@pagopa/io-wallet-oid4vp 1.5.4 → 1.5.5

package/dist/index.d.mts

@@ -107,8 +107,8 @@ declare const zOpenid4vpAuthorizationRequestHeaderV1_0: z.ZodObject<{
 type Openid4vpAuthorizationRequestHeaderV1_0 = z.infer<typeof zOpenid4vpAuthorizationRequestHeaderV1_0>;
 declare const zOpenid4vpAuthorizationRequestHeaderV1_3: z.ZodObject<{
     alg: z.ZodString;
-    kid: z.ZodString;
     typ: z.ZodLiteral<"oauth-authz-req+jwt">;
+    kid: z.ZodOptional<z.ZodString>;
     trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
     x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$loose>;

package/dist/index.d.ts

@@ -107,8 +107,8 @@ declare const zOpenid4vpAuthorizationRequestHeaderV1_0: z.ZodObject<{
 type Openid4vpAuthorizationRequestHeaderV1_0 = z.infer<typeof zOpenid4vpAuthorizationRequestHeaderV1_0>;
 declare const zOpenid4vpAuthorizationRequestHeaderV1_3: z.ZodObject<{
     alg: z.ZodString;
-    kid: z.ZodString;
     typ: z.ZodLiteral<"oauth-authz-req+jwt">;
+    kid: z.ZodOptional<z.ZodString>;
     trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
     x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$loose>;

package/dist/index.js

@@ -226,6 +226,8 @@ var zOpenid4vpAuthorizationRequestHeaderV1_0 = zOpenid4vpAuthorizationRequestHea
   trust_chain: import_io_wallet_oauth2.zTrustChain
 }).loose();
 var zOpenid4vpAuthorizationRequestHeaderV1_3 = zOpenid4vpAuthorizationRequestHeaderBase.extend({
+  // kid is only mandatory for openid_federation/legacy; x509_hash RPs use x5c instead (see getPublicKeyForVerification).
+  kid: import_zod.z.string().optional(),
   trust_chain: import_io_wallet_oauth2.zTrustChain.optional(),
   x5c: import_io_wallet_oauth2.zCertificateChain.optional()
 }).loose();

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/authorization-request/create-authorization-request.ts","../src/errors.ts","../src/authorization-request/client-id-prefix.ts","../src/authorization-request/z-authorization-request.ts","../src/authorization-request/fetch-authorization-request.ts","../src/authorization-request/validate-authorization-request.ts","../src/authorization-request/validate-certificate-endpoints.ts","../src/authorization-request/z-authorization-request-url.ts","../src/authorization-request/parse-authorization-request.ts","../src/authorization-response/create-authorization-response.ts","../src/authorization-response/build-jarm-response.ts","../src/jarm/jarm-extract-jwks.ts","../src/authorization-response/v1.3/create-authorization-response.ts","../src/authorization-response/v1.4/create-authorization-response.ts","../src/authorization-response/fetch-authorization-response.ts","../src/authorization-response/z-authorization-response.ts","../src/vp-token/z-vp-token.ts","../src/authorization-response/parse-authorization-response.ts","../src/jarm/parse-jarm-authorization-response.ts","../src/vp-token/parse-vp-token.ts","../src/authorization-response/validate-authorization-response.ts","../src/jarm/verify-jarm-authorization-response.ts","../src/jarm/z-jarm.ts"],"sourcesContent":["export * from \"./authorization-request/create-authorization-request\";\nexport * from \"./authorization-request/fetch-authorization-request\";\nexport * from \"./authorization-request/parse-authorization-request\";\nexport * from \"./authorization-request/validate-authorization-request\";\nexport * from \"./authorization-request/validate-certificate-endpoints\";\nexport * from \"./authorization-request/z-authorization-request\";\nexport * from \"./authorization-request/z-authorization-request-url\";\nexport * from \"./authorization-response/create-authorization-response\";\nexport * from \"./authorization-response/fetch-authorization-response\";\nexport * from \"./authorization-response/parse-authorization-response\";\nexport * from \"./authorization-response/validate-authorization-response\";\nexport * from \"./authorization-response/z-authorization-response\";\nexport * from \"./errors\";\nexport * from \"./jarm/jarm-extract-jwks\";\nexport * from \"./jarm/parse-jarm-authorization-response\";\nexport * from \"./jarm/verify-jarm-authorization-response\";\nexport * from \"./jarm/z-jarm\";\nexport * from \"./vp-token/parse-vp-token\";\nexport * from \"./vp-token/z-vp-token\";\n\nexport {\n  type CreateOpenid4vpAuthorizationResponseOptions,\n  type CreateOpenid4vpAuthorizationResponseResult,\n  type VpToken,\n  createOpenid4vpAuthorizationResponse,\n} from \"@openid4vc/openid4vp\";\n","import {\n  type CallbackContext,\n  type CreateJarRequestOptions,\n  CreateJarRequestResult,\n  JarAuthorizationRequest,\n  JwtSignerFederation,\n  JwtSignerX5c,\n  createJarRequest,\n  jwtHeaderFromJwtSigner,\n  signedAuthorizationRequestJwtHeaderTyp,\n} from \"@pagopa/io-wallet-oauth2\";\nimport {\n  IoWalletSdkConfig,\n  ItWalletSpecsVersion,\n  ValidationError,\n  createVersionDispatcher,\n  objectToQueryParams,\n  parseWithErrorHandling,\n} from \"@pagopa/io-wallet-utils\";\n\nimport { Oid4vpError } from \"../errors\";\nimport {\n  ClientIdPrefix,\n  extractClientIdPrefix,\n  validateAuthorizationRequestClientBinding,\n} from \"./client-id-prefix\";\nimport {\n  Openid4vpAuthorizationRequestPayload,\n  zOpenid4vpAuthorizationRequestHeaderV1_0,\n  zOpenid4vpAuthorizationRequestHeaderV1_3,\n  zOpenid4vpAuthorizationRequestPayload,\n} from \"./z-authorization-request\";\n\ntype BaseJarOptions<TSigner extends JwtSignerFederation | JwtSignerX5c> = {\n  jwtSigner: TSigner;\n} & Pick<\n  CreateJarRequestOptions,\n  \"additionalJwtPayload\" | \"expiresInSeconds\" | \"now\" | \"requestUri\"\n>;\n\nexport type JarOptionsV1_0 = BaseJarOptions<JwtSignerFederation>;\n\nexport type JarOptionsV1_3 = BaseJarOptions<JwtSignerFederation | JwtSignerX5c>;\n\nexport type JarOptionsV1_4 = JarOptionsV1_3;\n\ntype JarOptions = JarOptionsV1_0 | JarOptionsV1_3 | JarOptionsV1_4;\n\ninterface BaseCreateAuthorizationRequestOptions<\n  V extends ItWalletSpecsVersion,\n  TJar extends JarOptions,\n> {\n  /**\n   * Authorization request payload to be validated and serialized.\n   */\n  authorizationRequestPayload: Openid4vpAuthorizationRequestPayload;\n\n  /**\n   * Required callbacks used to create a signed/encrypted Request Object.\n   */\n  callbacks: Partial<Pick<CallbackContext, \"encryptJwe\">> &\n    Partial<Pick<CallbackContext, \"hash\">> &\n    Pick<CallbackContext, \"signJwt\">;\n\n  config: IoWalletSdkConfig<V>;\n\n  /**\n   * The request is generated as a JAR authorization request.\n   * When `additionalJwtPayload.aud` is missing, it is set to `requestUri`.\n   */\n  jar: TJar;\n\n  /**\n   * Authorization request URL scheme.\n   * @default \"openid4vp://\"\n   */\n  scheme?: string;\n}\n\n/**\n * Options for creating an OpenID4VP authorization request URL.\n */\nexport type CreateAuthorizationRequestOptionsV1_0 =\n  BaseCreateAuthorizationRequestOptions<\n    ItWalletSpecsVersion.V1_0,\n    JarOptionsV1_0\n  >;\n\nexport type CreateAuthorizationRequestOptionsV1_3 =\n  BaseCreateAuthorizationRequestOptions<\n    ItWalletSpecsVersion.V1_3,\n    JarOptionsV1_3\n  >;\n\nexport type CreateAuthorizationRequestOptionsV1_4 =\n  BaseCreateAuthorizationRequestOptions<\n    ItWalletSpecsVersion.V1_4,\n    JarOptionsV1_4\n  >;\n\nexport type CreateAuthorizationRequestOptions =\n  | CreateAuthorizationRequestOptionsV1_0\n  | CreateAuthorizationRequestOptionsV1_3\n  | CreateAuthorizationRequestOptionsV1_4;\n\ninterface BaseCreateAuthorizationRequestResult<TJar extends JarOptions> {\n  authorizationRequest: string;\n  authorizationRequestObject: JarAuthorizationRequest;\n  authorizationRequestPayload: Openid4vpAuthorizationRequestPayload;\n  jar: CreateJarRequestResult & TJar;\n}\n\nexport type CreateAuthorizationRequestResultV1_0 =\n  BaseCreateAuthorizationRequestResult<JarOptionsV1_0>;\n\nexport type CreateAuthorizationRequestResultV1_3 =\n  BaseCreateAuthorizationRequestResult<JarOptionsV1_3>;\n\nexport type CreateAuthorizationRequestResultV1_4 =\n  BaseCreateAuthorizationRequestResult<JarOptionsV1_4>;\n\nexport type CreateAuthorizationRequestResult =\n  | CreateAuthorizationRequestResultV1_0\n  | CreateAuthorizationRequestResultV1_3\n  | CreateAuthorizationRequestResultV1_4;\n\n/**\n * Creates an OpenID4VP authorization request URL.\n *\n * This function creates a JAR request object through\n * `createJarRequest` and serializes it into the URL query parameters.\n *\n * @param options {@link CreateAuthorizationRequestOptions}\n * @returns Authorization request URL plus request object details used to build it\n * @throws When authorization request payload validation fails\n * @throws When JAR creation fails\n */\nconst dispatchCreateAuthorizationRequest = createVersionDispatcher<\n  CreateAuthorizationRequestOptions,\n  Promise<CreateAuthorizationRequestResult>\n>({\n  [ItWalletSpecsVersion.V1_0]: async (o) =>\n    createAuthorizationRequestWithHeader(\n      o as CreateAuthorizationRequestOptionsV1_0,\n      zOpenid4vpAuthorizationRequestHeaderV1_0,\n    ),\n  [ItWalletSpecsVersion.V1_3]: async (o) =>\n    createAuthorizationRequestWithHeader(\n      o as CreateAuthorizationRequestOptionsV1_3,\n      zOpenid4vpAuthorizationRequestHeaderV1_3,\n    ),\n  // V1_4 reuses the V1_3 JAR header schema; the conditional x5c rule is a normative 1.4.4 LTS backport.\n  [ItWalletSpecsVersion.V1_4]: async (o) =>\n    createAuthorizationRequestWithHeader(\n      o as CreateAuthorizationRequestOptionsV1_4,\n      zOpenid4vpAuthorizationRequestHeaderV1_3,\n    ),\n});\n\n/**\n * Creates an OpenID4VP authorization request URL for the configured IT-Wallet version.\n *\n * This function creates a JAR request object through `createJarRequest` and\n * serializes it into authorization request URL query parameters.\n *\n * @param options - Version-specific authorization request creation options.\n * @returns Authorization request URL plus request object details used to build it.\n * @throws {Oid4vpError} If authorization request payload validation fails.\n */\nexport async function createAuthorizationRequest(\n  options: CreateAuthorizationRequestOptionsV1_0,\n): Promise<CreateAuthorizationRequestResultV1_0>;\n\nexport async function createAuthorizationRequest(\n  options: CreateAuthorizationRequestOptionsV1_3,\n): Promise<CreateAuthorizationRequestResultV1_3>;\n\nexport async function createAuthorizationRequest(\n  options: CreateAuthorizationRequestOptionsV1_4,\n): Promise<CreateAuthorizationRequestResultV1_4>;\n\nexport async function createAuthorizationRequest(\n  options: CreateAuthorizationRequestOptions,\n): Promise<CreateAuthorizationRequestResult> {\n  try {\n    return await dispatchCreateAuthorizationRequest(options);\n  } catch (error) {\n    if (error instanceof ValidationError) {\n      throw new Oid4vpError(`Invalid authorization request: ${error.message}`);\n    }\n    throw error;\n  }\n}\n\nasync function createAuthorizationRequestWithHeader<TJar extends JarOptions>(\n  options: BaseCreateAuthorizationRequestOptions<ItWalletSpecsVersion, TJar>,\n  headerSchema:\n    | typeof zOpenid4vpAuthorizationRequestHeaderV1_0\n    | typeof zOpenid4vpAuthorizationRequestHeaderV1_3,\n): Promise<BaseCreateAuthorizationRequestResult<TJar>> {\n  const { callbacks, jar, scheme = \"openid4vp://\" } = options;\n\n  const authorizationRequestHeader = parseWithErrorHandling(headerSchema, {\n    ...jwtHeaderFromJwtSigner(jar.jwtSigner),\n    typ: signedAuthorizationRequestJwtHeaderTyp,\n  });\n\n  const authorizationRequestPayload = parseWithErrorHandling(\n    zOpenid4vpAuthorizationRequestPayload,\n    options.authorizationRequestPayload,\n  );\n\n  validateJarSignerForAuthorizationRequest(\n    options.config.itWalletSpecsVersion,\n    jar.jwtSigner,\n    authorizationRequestPayload,\n  );\n\n  validateAuthorizationRequestClientBinding({\n    hash: options.callbacks.hash,\n    header: authorizationRequestHeader,\n    payload: authorizationRequestPayload,\n  });\n\n  const additionalJwtPayload = !jar.additionalJwtPayload?.aud\n    ? { ...jar.additionalJwtPayload, aud: jar.requestUri }\n    : jar.additionalJwtPayload;\n\n  const jarResult = await createJarRequest({\n    ...jar,\n    additionalJwtPayload,\n    authorizationRequestHeader,\n    authorizationRequestPayload,\n    callbacks,\n  });\n\n  return {\n    authorizationRequest: createAuthorizationRequestUrl(\n      scheme,\n      jarResult.jarAuthorizationRequest,\n    ),\n    authorizationRequestObject: jarResult.jarAuthorizationRequest,\n    authorizationRequestPayload,\n    jar: { ...jar, ...jarResult },\n  };\n}\n\nfunction createAuthorizationRequestUrl(\n  scheme: string,\n  request: JarAuthorizationRequest,\n) {\n  const url = new URL(scheme);\n\n  const searchParams = new URLSearchParams([\n    ...url.searchParams.entries(),\n    ...objectToQueryParams(request).entries(),\n  ]);\n\n  url.search = searchParams.toString();\n\n  return url.toString();\n}\n\nfunction validateJarSignerForAuthorizationRequest(\n  specsVersion: ItWalletSpecsVersion,\n  jwtSigner: JwtSignerFederation | JwtSignerX5c,\n  payload: Openid4vpAuthorizationRequestPayload,\n) {\n  if (specsVersion === ItWalletSpecsVersion.V1_0) {\n    return;\n  }\n\n  const { prefix } = extractClientIdPrefix(payload.client_id);\n\n  if (prefix === ClientIdPrefix.X509_HASH && jwtSigner.method !== \"x5c\") {\n    throw new Oid4vpError(\n      \"x509_hash client_id requires a JAR signer with method x5c\",\n    );\n  }\n\n  if (\n    prefix !== ClientIdPrefix.X509_HASH &&\n    jwtSigner.method !== \"federation\"\n  ) {\n    throw new Oid4vpError(\n      \"openid_federation and legacy client_id values require a JAR signer with method federation\",\n    );\n  }\n}\n","/**\n * Generic error thrown during Oid4vp operations\n */\nexport class Oid4vpError extends Error {\n  readonly statusCode?: number;\n  constructor(\n    message: string,\n    options?: { statusCode?: number } & ErrorOptions,\n  ) {\n    super(message, options);\n    this.name = \"Oid4vpError\";\n    this.statusCode = options?.statusCode;\n  }\n}\n\n/**\n * Error thrown by {@link parseAuthorizeRequest} when the passed\n * request object has an invalid signature or unexpected errors\n * are thrown\n */\nexport class ParseAuthorizeRequestError extends Oid4vpError {\n  readonly statusCode?: number;\n  constructor(\n    message: string,\n    options?: { statusCode?: number } & ErrorOptions,\n  ) {\n    super(message, options);\n    this.name = \"ParseAuthorizeRequestError\";\n    this.statusCode = options?.statusCode;\n  }\n}\n\n/**\n * Error thrown by {@link fetchAuthorizationResponse}\n */\nexport class FetchAuthorizationResponseError extends Oid4vpError {\n  readonly statusCode?: number;\n  constructor(\n    message: string,\n    options?: { statusCode?: number } & ErrorOptions,\n  ) {\n    super(message, options);\n    this.name = \"FetchAuthorizationResponseError\";\n    this.statusCode = options?.statusCode;\n  }\n}\n\n/**\n * Error thrown by {@link createAuthorizationResponse} in case there\n * are unexpected errors.\n */\nexport class CreateAuthorizationResponseError extends Oid4vpError {\n  readonly statusCode?: number;\n  constructor(\n    message: string,\n    options?: { statusCode?: number } & ErrorOptions,\n  ) {\n    super(message, options);\n    this.name = \"CreateAuthorizationResponseError\";\n    this.statusCode = options?.statusCode;\n  }\n}\n\n/**\n * Error thrown when request_uri_method parameter has an invalid value.\n * Valid values are \"get\" or \"post\" (case-insensitive).\n */\nexport class InvalidRequestUriMethodError extends Oid4vpError {\n  constructor(message: string, options?: ErrorOptions) {\n    super(message, options);\n    this.name = \"InvalidRequestUriMethodError\";\n  }\n}\n","import {\n  HashAlgorithm,\n  type HashCallback,\n  decodeBase64,\n  encodeToBase64Url,\n} from \"@pagopa/io-wallet-utils\";\n\nimport { Oid4vpError, ParseAuthorizeRequestError } from \"../errors\";\nimport {\n  Openid4vpAuthorizationRequestHeaderV1_3,\n  Openid4vpAuthorizationRequestPayload,\n} from \"./z-authorization-request\";\n\nexport enum ClientIdPrefix {\n  NONE = \"none\",\n  OPENID_FEDERATION = \"openid_federation\",\n  X509_HASH = \"x509_hash\",\n}\n\nexport interface ClientIdParts {\n  clientId: string;\n  prefix: ClientIdPrefix;\n}\n\nexport interface CreateX509HashClientIdOptions {\n  certificateChain: string[];\n  hash: HashCallback;\n}\n\nexport function extractClientIdPrefix(clientId: string): ClientIdParts {\n  const colonIndex = clientId.indexOf(\":\");\n\n  if (colonIndex === -1) {\n    return { clientId, prefix: ClientIdPrefix.NONE };\n  }\n\n  if (clientId.startsWith(\"https://\") || clientId.startsWith(\"http://\")) {\n    return { clientId, prefix: ClientIdPrefix.NONE };\n  }\n\n  const rawPrefix = clientId.slice(0, colonIndex);\n  const rest = clientId.slice(colonIndex + 1);\n\n  if (rawPrefix === ClientIdPrefix.X509_HASH) {\n    return { clientId: rest, prefix: ClientIdPrefix.X509_HASH };\n  }\n  if (rawPrefix === ClientIdPrefix.OPENID_FEDERATION) {\n    return { clientId: rest, prefix: ClientIdPrefix.OPENID_FEDERATION };\n  }\n\n  throw new Oid4vpError(\n    `Unsupported client_id prefix \"${rawPrefix}\": only \"openid_federation\" and \"x509_hash\" are allowed by the IT-Wallet profile`,\n  );\n}\n\nexport async function createX509HashClientId(\n  options: CreateX509HashClientIdOptions,\n): Promise<string> {\n  return `${ClientIdPrefix.X509_HASH}:${await calculateX509CertificateHash(options)}`;\n}\n\nasync function calculateX509CertificateHash(\n  options: CreateX509HashClientIdOptions,\n) {\n  const leafCertificate = getLeafCertificate(options.certificateChain);\n\n  return encodeToBase64Url(\n    await options.hash(decodeBase64(leafCertificate), HashAlgorithm.Sha256),\n  );\n}\n\nexport async function validateAuthorizationRequestClientBinding(options: {\n  hash?: HashCallback;\n  header: Openid4vpAuthorizationRequestHeaderV1_3;\n  payload: Openid4vpAuthorizationRequestPayload;\n}): Promise<ClientIdParts> {\n  const clientIdParts = extractClientIdPrefix(options.payload.client_id);\n\n  if (clientIdParts.prefix !== ClientIdPrefix.X509_HASH) {\n    return clientIdParts;\n  }\n\n  const { x5c } = options.header;\n  if (!Array.isArray(x5c) || x5c.length === 0) {\n    throw new ParseAuthorizeRequestError(\n      \"x5c is required in JWT header for x509_hash client_id\",\n    );\n  }\n\n  if (!options.hash) {\n    return clientIdParts;\n  }\n\n  const expectedCertificateHash = await calculateX509CertificateHash({\n    certificateChain: x5c,\n    hash: options.hash,\n  });\n\n  if (expectedCertificateHash !== clientIdParts.clientId) {\n    throw new ParseAuthorizeRequestError(\n      \"x509_hash client_id does not match the JWT header leaf certificate\",\n    );\n  }\n\n  return clientIdParts;\n}\n\nfunction getLeafCertificate(certificateChain: string[]) {\n  const leafCertificate = certificateChain[0];\n\n  if (!leafCertificate) {\n    throw new ParseAuthorizeRequestError(\n      \"Certificate chain is empty, cannot validate x509_hash\",\n    );\n  }\n\n  return leafCertificate;\n}\n","import {\n  zAlgValueNotNone,\n  zCertificateChain,\n  zJwtPayload,\n  zSignedAuthorizationRequestJwtHeaderTyp,\n  zTrustChain,\n} from \"@pagopa/io-wallet-oauth2\";\nimport { itWalletCredentialVerifierMetadataV1_3 } from \"@pagopa/io-wallet-oid-federation\";\nimport { z } from \"zod\";\n\n/**\n * This schema is a less strict version of {@link itWalletCredentialVerifierMetadataV1_3} because\n * only a subset of the Credential Verifier metadata fields are required in the Request Object.\n * @see https://italia.github.io/eid-wallet-it-docs/releases/1.3.3/en/remote-flow.html#request-object\n */\nconst zOpenid4vpCredentialVerifierMetadata =\n  itWalletCredentialVerifierMetadataV1_3.partial({\n    application_type: true,\n    client_id: true,\n    client_name: true,\n    logo_uri: true,\n    request_uris: true,\n    response_uris: true,\n  });\n\n/**\n * Zod parser that describes a JWT payload\n * containing an OID4VP Request Object\n */\nexport const zOpenid4vpAuthorizationRequestPayload = z\n  .looseObject({\n    client_id: z.string(),\n    client_metadata: zOpenid4vpCredentialVerifierMetadata.optional(),\n    dcql_query: z.record(z.string(), z.any()),\n    nonce: z.string(),\n    request_uri: z.url().optional(),\n    request_uri_method: z.optional(z.string()),\n    response_mode: z.literal(\"direct_post.jwt\"),\n    response_type: z.literal(\"vp_token\"),\n    response_uri: z.url(),\n    scope: z.string().optional(),\n    state: z.string().optional(),\n    transaction_data: z.array(z.string()).nonempty().optional(),\n    transaction_data_hashes_alg: z.array(z.string()).optional(),\n    wallet_nonce: z.string().optional(),\n  })\n  .and(\n    z.object({\n      ...zJwtPayload.shape,\n    }),\n  );\n\nexport type Openid4vpAuthorizationRequestPayload = z.infer<\n  typeof zOpenid4vpAuthorizationRequestPayload\n>;\n\nconst zOpenid4vpAuthorizationRequestHeaderBase = z.object({\n  alg: zAlgValueNotNone,\n  kid: z.string(),\n  typ: zSignedAuthorizationRequestJwtHeaderTyp,\n});\n\nexport const zOpenid4vpAuthorizationRequestHeaderV1_0 =\n  zOpenid4vpAuthorizationRequestHeaderBase\n    .extend({\n      trust_chain: zTrustChain,\n    })\n    .loose();\n\nexport type Openid4vpAuthorizationRequestHeaderV1_0 = z.infer<\n  typeof zOpenid4vpAuthorizationRequestHeaderV1_0\n>;\n\nexport const zOpenid4vpAuthorizationRequestHeaderV1_3 =\n  zOpenid4vpAuthorizationRequestHeaderBase\n    .extend({\n      trust_chain: zTrustChain.optional(),\n      x5c: zCertificateChain.optional(),\n    })\n    .loose();\n\nexport type Openid4vpAuthorizationRequestHeaderV1_3 = z.infer<\n  typeof zOpenid4vpAuthorizationRequestHeaderV1_3\n>;\n\nexport type Openid4vpAuthorizationRequestHeader =\n  | Openid4vpAuthorizationRequestHeaderV1_0\n  | Openid4vpAuthorizationRequestHeaderV1_3;\n","import { type CallbackContext, Oauth2JwtParseError } from \"@openid4vc/oauth2\";\nimport {\n  UnexpectedStatusCodeError,\n  ValidationError,\n  createFetcher,\n  hasStatusOrThrow,\n} from \"@pagopa/io-wallet-utils\";\n\nimport { Oid4vpError } from \"../errors\";\nimport { validateAuthorizationRequestParams } from \"./validate-authorization-request\";\nimport {\n  X509CertificateBinding,\n  validateCertificateEndpoints,\n} from \"./validate-certificate-endpoints\";\nimport { zAuthorizationRequestUrlParams } from \"./z-authorization-request-url\";\n\nexport interface FetchAuthorizationRequestOptions {\n  /**\n   * The authorization URL from the QR code\n   * Should contain `client_id` and either `request` or `request_uri` query parameters\n   */\n  authorizeRequestUrl: string;\n\n  /**\n   * Callback functions for making HTTP requests\n   * Allows for custom fetch implementation\n   */\n  callbacks: Pick<CallbackContext, \"fetch\">;\n\n  /**\n   * Optional wallet metadata to send when request_uri_method=post.\n   * If not provided and POST is required, sends an empty body (basic implementation).\n   *\n   * Specification: IT-Wallet v1.3.3 recommends (SHOULD) sending wallet capabilities\n   * in application/x-www-form-urlencoded format when using POST.\n   */\n  walletMetadata?: {\n    authorization_endpoint?: string;\n    client_id_prefixes_supported?: string[];\n    request_object_signing_alg_values_supported?: string[];\n    response_modes_supported?: string[];\n    response_types_supported?: string[];\n    vp_formats_supported?: Record<string, unknown>;\n  };\n\n  /**\n   * Optional wallet nonce for replay attack prevention (RECOMMENDED per spec)\n   */\n  walletNonce?: string;\n\n  /**\n   * Optional RP certificate context used to bind `request_uri` to the certificate SAN entries.\n   */\n  x509Certificate?: {\n    binding: X509CertificateBinding;\n    leafCertificate: string;\n  };\n}\n\nexport interface ParsedQrCode {\n  /**\n   * The `client_id` from the authorization URL\n   */\n  clientId: string;\n\n  /**\n   * It contains the base64url-encoded and signed Request Object. For the content of the Request Object, see {@link Openid4vpAuthorizationRequestPayload}.\n   */\n  request?: string;\n  /**\n   * The `request_uri` from the authorization URL\n   */\n  requestUri?: string;\n  /**\n   * The `request_uri_method` from the authorization URL (get or post)\n   */\n  requestUriMethod?: \"get\" | \"post\";\n}\n\nexport interface FetchAuthorizationRequestResult {\n  /**\n   * The parsed QR code data\n   * Includes `clientId`, `requestUri` and `requestUriMethod`\n   */\n  parsedQrCode: ParsedQrCode;\n\n  /**\n   * The original Request Object JWT, either fetched from `request_uri` or extracted from `request` parameter.\n   */\n  requestObjectJwt: string;\n\n  /**\n   * Transmission mode indicator\n   * - \"value\": Request Object JWT passed inline via `request` parameter\n   * - \"reference\": Request Object JWT fetched from `request_uri`\n   */\n  sendBy: \"reference\" | \"value\";\n}\n\n/**\n * Parses an authorization request URL and builds a {@link ParsedQrCode} object.\n *\n * @param authorizeRequestUrl - The authorization URL extracted from the QR code\n * @returns The parsed QR code data including `clientId`, `requestUri`, and `requestUriMethod`\n * @throws {ValidationError} If URL parameters fail schema validation or business logic checks\n */\nexport function createParsedQrCode(authorizeRequestUrl: string): ParsedQrCode {\n  const url = new URL(authorizeRequestUrl);\n\n  const rawParams = {\n    client_id: url.searchParams.get(\"client_id\") ?? undefined,\n    request: url.searchParams.get(\"request\") ?? undefined,\n    request_uri: url.searchParams.get(\"request_uri\") ?? undefined,\n    request_uri_method: url.searchParams.get(\"request_uri_method\") ?? undefined,\n    state: url.searchParams.get(\"state\") ?? undefined,\n  };\n\n  const parsedParams = zAuthorizationRequestUrlParams.parse(rawParams);\n  const validatedParams = validateAuthorizationRequestParams(parsedParams);\n  const sendBy = validatedParams.request ? \"value\" : \"reference\";\n\n  return {\n    clientId: validatedParams.client_id,\n    request: validatedParams.request,\n    requestUri: validatedParams.request_uri,\n    requestUriMethod:\n      sendBy === \"reference\"\n        ? (validatedParams.request_uri_method ?? \"get\")\n        : undefined,\n  };\n}\n\n/**\n * Helper function to fetch Request Object JWT from request_uri.\n * Supports GET and POST methods, with optional wallet metadata for POST.\n *\n * @param requestUri - URI to fetch Request Object from\n * @param options - Fetch options including method and wallet metadata\n * @returns The Request Object JWT as a string\n * @throws {UnexpectedStatusCodeError} If the server returns a non-200 status code\n * @throws {Error} If the underlying fetch/createFetcher call fails (for example, due to network errors)\n */\nexport async function fetchRequestObjectJwt(\n  requestUri: string,\n  options: {\n    fetch: CallbackContext[\"fetch\"];\n    method: \"get\" | \"post\";\n    walletMetadata?: FetchAuthorizationRequestOptions[\"walletMetadata\"];\n    walletNonce?: string;\n  },\n): Promise<string> {\n  const fetch = createFetcher(options.fetch);\n\n  // Prepare request configuration\n  const requestInit: RequestInit = {\n    method: options.method.toUpperCase(),\n  };\n\n  // Add body for POST requests per IT-Wallet spec (SHOULD include metadata)\n  if (options.method === \"post\") {\n    const formData = new URLSearchParams();\n\n    // Add wallet_metadata if provided (spec: OPTIONAL)\n    if (options.walletMetadata) {\n      formData.append(\n        \"wallet_metadata\",\n        JSON.stringify(options.walletMetadata),\n      );\n    }\n\n    // Add wallet_nonce if provided (spec: RECOMMENDED)\n    if (options.walletNonce) {\n      formData.append(\"wallet_nonce\", options.walletNonce);\n    }\n\n    requestInit.headers = {\n      \"Content-Type\": \"application/x-www-form-urlencoded\",\n    };\n    requestInit.body = formData.toString();\n  }\n\n  const response = await fetch(requestUri, requestInit);\n\n  await hasStatusOrThrow(200, UnexpectedStatusCodeError)(response);\n\n  return await response.text();\n}\n\n/**\n * Fetches an OpenID4VP authorization request JWT from a QR code URL.\n *\n * Supports two transmission modes:\n * - **By Value**: Request Object JWT passed inline via `request` parameter\n * - **By Reference**: Request Object JWT fetched from `request_uri`\n *\n * The function:\n * 1. Parses the authorization URL to extract parameters\n * 2. Validates that exactly one of `request` or `request_uri` is present\n * 3. Either uses inline JWT or fetches from URI (GET/POST based on request_uri_method)\n * 4. Returns the Request Object JWT along with transmission mode metadata\n *\n * Note: This function does NOT parse or verify the JWT. Use {@link parseAuthorizeRequest}\n * separately to decode and optionally verify the signature.\n *\n * @param options {@link FetchAuthorizationRequestOptions}\n * @returns Promise that resolves to {@link FetchAuthorizationRequestResult}\n * @throws {Oid4vpError} When required query parameters are missing, the URL is invalid, or an unexpected error occurs during fetch or parsing\n * @throws {UnexpectedStatusCodeError} When the server returns a non-200 status code during fetch\n * @throws {ValidationError} When URL parameters fail schema validation\n *\n * @example By Value mode\n * ```typescript\n * const url = \"[https://wallet.example.org/authorize](https://wallet.example.org/authorize)?\" +\n *   \"client_id=openid_federation%23https%3A%2F%2Frp.example.org\" +\n *   \"&request=eyJhbGciOiJFUzI1NiIs...\";\n *\n * const result = await fetchAuthorizationRequest({\n *   authorizeRequestUrl: url,\n *   callbacks: { fetch },\n * });\n * // result.sendBy === \"value\"\n * // result.requestObjectJwt === \"eyJhbGciOiJFUzI1NiIs...\"\n * ```\n *\n * @example By Reference mode with POST\n * ```typescript\n * const url = \"[https://wallet.example.org/authorize](https://wallet.example.org/authorize)?\" +\n *   \"client_id=openid_federation%23https%3A%2F%2Frp.example.org\" +\n *   \"&request_uri=https%3A%2F%2Frp.example.org%2Frequest\" +\n *   \"&request_uri_method=post\";\n *\n * const result = await fetchAuthorizationRequest({\n *   authorizeRequestUrl: url,\n *   callbacks: { fetch },\n *   walletMetadata: {\n *     authorization_endpoint: \"[https://wallet.example.org/authorize](https://wallet.example.org/authorize)\",\n *     response_types_supported: [\"vp_token\"],\n *   },\n *   walletNonce: \"random-nonce\",\n * });\n * // result.sendBy === \"reference\"\n * // result.requestObjectJwt === fetched JWT from request_uri\n * ```\n */\nexport async function fetchAuthorizationRequest(\n  options: FetchAuthorizationRequestOptions,\n): Promise<FetchAuthorizationRequestResult> {\n  try {\n    const parsedQrCode = createParsedQrCode(options.authorizeRequestUrl);\n\n    // Get JWT: either inline or fetch from URI\n    let requestObjectJwt: string;\n    if (parsedQrCode.request) {\n      requestObjectJwt = parsedQrCode.request;\n    } else {\n      if (options.x509Certificate) {\n        await validateCertificateEndpoints({\n          callbacks: options.x509Certificate.binding,\n          certificate: options.x509Certificate.leafCertificate,\n          endpoints: [\n            {\n              name: \"request_uri\",\n              uri: parsedQrCode.requestUri,\n            },\n          ],\n        });\n      }\n\n      // Type system guarantees request_uri is defined here due to validation\n      requestObjectJwt = await fetchRequestObjectJwt(\n        parsedQrCode.requestUri as string,\n        {\n          fetch: options.callbacks.fetch,\n          method: parsedQrCode.requestUriMethod ?? \"get\",\n          walletMetadata: options.walletMetadata,\n          walletNonce: options.walletNonce,\n        },\n      );\n    }\n\n    return {\n      parsedQrCode,\n      requestObjectJwt,\n      sendBy: parsedQrCode.request ? \"value\" : \"reference\",\n    };\n  } catch (error) {\n    if (\n      error instanceof ValidationError ||\n      error instanceof Oauth2JwtParseError ||\n      error instanceof Oid4vpError ||\n      error instanceof UnexpectedStatusCodeError\n    ) {\n      throw error;\n    }\n\n    throw new Oid4vpError(\n      `Unexpected error during fetch authorization request: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n}\n","import { InvalidRequestUriMethodError, Oid4vpError } from \"../errors\";\nimport { AuthorizationRequestUrlParams } from \"./z-authorization-request-url\";\n\n/**\n * Validates authorization request URL parameters according to IT-Wallet and OpenID4VP specifications.\n *\n * Validation rules:\n * 1. Exactly one of `request` or `request_uri` must be present (mutual exclusivity)\n * 2. `request_uri_method` must be \"get\" or \"post\" (case-insensitive) if present\n * 3. `request_uri_method` can only be used with `request_uri` parameter\n *\n * @param params - Parsed authorization request URL parameters\n * @returns Type-narrowed params ensuring mutual exclusivity\n * @throws {Oid4vpError} When both or neither request/request_uri are present\n * @throws {InvalidRequestUriMethodError} When request_uri_method is not \"get\" or \"post\"\n * @throws {Oid4vpError} When request_uri_method is used without request_uri\n */\nexport function validateAuthorizationRequestParams(\n  params: AuthorizationRequestUrlParams,\n) {\n  // Mutual exclusivity check\n  if (params.request && params.request_uri) {\n    throw new Oid4vpError(\n      \"request and request_uri cannot both be present in an authorization request\",\n    );\n  }\n\n  // At least one must be present\n  if (!params.request && !params.request_uri) {\n    throw new Oid4vpError(\n      \"Either request or request_uri parameter must be present\",\n    );\n  }\n\n  // Validate request_uri_method if present\n  if (params.request_uri_method) {\n    const normalizedMethod = params.request_uri_method.toLowerCase();\n    if (normalizedMethod !== \"get\" && normalizedMethod !== \"post\") {\n      throw new InvalidRequestUriMethodError(\n        `Invalid request_uri_method: '${params.request_uri_method}'. Must be 'get' or 'post'`,\n      );\n    }\n  }\n\n  // request_uri_method only allowed with request_uri\n  if (params.request_uri_method && !params.request_uri) {\n    throw new Oid4vpError(\n      \"request_uri_method can only be used with request_uri parameter\",\n    );\n  }\n\n  // Normalize request_uri_method to lowercase if present\n  const normalizedMethod = params.request_uri_method\n    ? (params.request_uri_method.toLowerCase() as \"get\" | \"post\")\n    : undefined;\n\n  return {\n    ...params,\n    request_uri_method: normalizedMethod,\n  } as (\n    | {\n        request?: never;\n        request_uri: string;\n        request_uri_method?: \"get\" | \"post\";\n      }\n    | { request: string; request_uri?: never; request_uri_method?: never }\n  ) &\n    typeof params;\n}\n","import { Oid4vpError } from \"../errors\";\n\nexport interface X509CertificateMetadata {\n  sanDnsNames?: string[];\n  sanUriNames?: string[];\n}\n\nexport type GetX509CertificateMetadataCallback = (\n  certificate: string,\n) => Promise<X509CertificateMetadata> | X509CertificateMetadata;\n\nexport interface X509CertificateBinding {\n  getX509CertificateMetadata: GetX509CertificateMetadataCallback;\n}\n\nexport interface CertificateEndpoint {\n  name: string;\n  uri?: string;\n}\n\nexport interface ValidateCertificateEndpointsOptions {\n  callbacks: X509CertificateBinding;\n  certificate: string;\n  endpoints: CertificateEndpoint[];\n}\n\nexport async function validateCertificateEndpoints(\n  options: ValidateCertificateEndpointsOptions,\n): Promise<void> {\n  const metadata = await options.callbacks.getX509CertificateMetadata(\n    options.certificate,\n  );\n\n  for (const endpoint of options.endpoints) {\n    if (!endpoint.uri) {\n      continue;\n    }\n\n    validateEndpointAgainstMetadata(\n      { name: endpoint.name, uri: endpoint.uri },\n      metadata,\n    );\n  }\n}\n\nfunction validateEndpointAgainstMetadata(\n  endpoint: { name: string; uri: string },\n  metadata: X509CertificateMetadata,\n) {\n  const endpointUrl = parseEndpointUrl(endpoint);\n  const sanUriNames = metadata.sanUriNames ?? [];\n  const matchesUriSan = sanUriNames.some(\n    (sanUriName) => normalizeUriForComparison(sanUriName) === endpointUrl.href,\n  );\n  const sanDnsNames = metadata.sanDnsNames ?? [];\n  const matchesDnsSan = sanDnsNames.some((sanDnsName) =>\n    matchesDnsSanHostname(sanDnsName, endpointUrl.hostname),\n  );\n\n  if (matchesUriSan || matchesDnsSan) {\n    return;\n  }\n\n  throw new Oid4vpError(\n    `${endpoint.name} is not covered by the Relying Party certificate SAN entries`,\n  );\n}\n\nfunction normalizeUriForComparison(uri: string) {\n  try {\n    return new URL(uri).href;\n  } catch (error) {\n    throw new Oid4vpError(`Certificate URI SAN is not a valid URL: ${uri}`, {\n      cause: error,\n    });\n  }\n}\n\nfunction matchesDnsSanHostname(sanDnsName: string, hostname: string) {\n  const normalizedSanDnsName = sanDnsName.toLowerCase();\n  const normalizedHostname = hostname.toLowerCase();\n\n  if (normalizedSanDnsName === normalizedHostname) {\n    return true;\n  }\n\n  if (!normalizedSanDnsName.includes(\"*\")) {\n    return false;\n  }\n\n  const wildcardCount = [...normalizedSanDnsName].filter(\n    (character) => character === \"*\",\n  ).length;\n  const sanLabels = normalizedSanDnsName.split(\".\");\n  const hostnameLabels = normalizedHostname.split(\".\");\n\n  return (\n    wildcardCount === 1 &&\n    sanLabels[0] === \"*\" &&\n    sanLabels.length === hostnameLabels.length &&\n    sanLabels\n      .slice(1)\n      .every((label, index) => label === hostnameLabels[index + 1])\n  );\n}\n\nfunction parseEndpointUrl(endpoint: { name: string; uri: string }) {\n  try {\n    return new URL(endpoint.uri);\n  } catch (error) {\n    throw new Oid4vpError(\n      `${endpoint.name} is not a valid URL: ${endpoint.uri}`,\n      { cause: error },\n    );\n  }\n}\n","import z from \"zod\";\n\n/**\n * Schema for authorization request URL query parameters.\n * Note: `request` contains the signed Request Object JWT, it is NOT a claim inside the Request Object.\n */\nexport const zAuthorizationRequestUrlParams = z.looseObject({\n  client_id: z.string(),\n  request: z.string().optional(), // JWT containing Request Object (by value)\n  request_uri: z.url().optional(), // URI to fetch Request Object (by reference)\n  request_uri_method: z.string().optional(), // HTTP method for request_uri (validated in business logic)\n  state: z.string().optional(), // Optional state parameter\n});\n\nexport type AuthorizationRequestUrlParams = z.infer<\n  typeof zAuthorizationRequestUrlParams\n>;\n","import {\n  CallbackContext,\n  JwtSigner,\n  Oauth2JwtParseError,\n  verifyJwt,\n} from \"@openid4vc/oauth2\";\nimport { decodeJwt } from \"@pagopa/io-wallet-oauth2\";\nimport {\n  IoWalletSdkConfig,\n  ItWalletSpecsVersion,\n  ItWalletSpecsVersionError,\n  ValidationError,\n  dispatchByVersion,\n} from \"@pagopa/io-wallet-utils\";\n\nimport { Oid4vpError, ParseAuthorizeRequestError } from \"../errors\";\nimport {\n  ClientIdPrefix,\n  extractClientIdPrefix,\n  validateAuthorizationRequestClientBinding,\n} from \"./client-id-prefix\";\nimport {\n  X509CertificateBinding,\n  validateCertificateEndpoints,\n} from \"./validate-certificate-endpoints\";\nimport {\n  Openid4vpAuthorizationRequestHeader,\n  Openid4vpAuthorizationRequestHeaderV1_3,\n  Openid4vpAuthorizationRequestPayload,\n  zOpenid4vpAuthorizationRequestHeaderV1_0,\n  zOpenid4vpAuthorizationRequestHeaderV1_3,\n  zOpenid4vpAuthorizationRequestPayload,\n} from \"./z-authorization-request\";\n\nexport {\n  type ClientIdParts,\n  ClientIdPrefix,\n  createX509HashClientId,\n  extractClientIdPrefix,\n} from \"./client-id-prefix\";\n\n/**\n * Retrieves the public key for verifying the Request Object JWT signature\n * according to IT Wallet specifications.\n *\n * Prefix routing:\n * 1. If client_id uses x509_hash: use x5c certificate chain from header.\n * 2. If client_id uses openid_federation or no prefix: return a federation signer;\n *    if trust_chain is present it is forwarded, otherwise the verifyJwt callback is\n *    responsible for reconstructing the chain from client_id.\n *\n * @param options - Parse options containing decoded JWT\n * @returns The JWK to use for signature verification\n * @throws {ParseAuthorizeRequestError} When no valid public key can be found\n */\nfunction getPublicKeyForVerification(options: {\n  header: Openid4vpAuthorizationRequestHeader;\n  payload: Openid4vpAuthorizationRequestPayload;\n}): JwtSigner {\n  const { header, payload } = options;\n\n  const { prefix: clientIdPrefix } = extractClientIdPrefix(payload.client_id);\n\n  if (\n    clientIdPrefix === ClientIdPrefix.OPENID_FEDERATION ||\n    clientIdPrefix === ClientIdPrefix.NONE\n  ) {\n    if (!header.kid) {\n      throw new ParseAuthorizeRequestError(\n        \"kid is required in JWT header for openid_federation client_id or no prefix\",\n      );\n    }\n\n    return {\n      alg: header.alg,\n      kid: header.kid,\n      method: \"federation\" as const,\n      ...(header.trust_chain && { trustChain: header.trust_chain }),\n    };\n  }\n\n  if (clientIdPrefix === ClientIdPrefix.X509_HASH) {\n    if (!Array.isArray(header.x5c) || header.x5c.length === 0) {\n      throw new ParseAuthorizeRequestError(\n        \"x5c is required in JWT header for x509_hash client_id\",\n      );\n    }\n\n    return {\n      alg: header.alg,\n      kid: header.kid,\n      method: \"x5c\" as const,\n      ...(header.trust_chain && { trustChain: header.trust_chain }),\n      x5c: header.x5c,\n    };\n  }\n\n  throw new ParseAuthorizeRequestError(\n    \"Unable to determine public key for Request Object verification with client_id prefix: \" +\n      clientIdPrefix,\n  );\n}\n\nexport interface ParseAuthorizeRequestOptions {\n  /**\n   * Optional callback context for JWT signature verification and hashing x509 client_id for digest comparison.\n   * If not provided, signature verification is skipped or hash skips the x509_hash digest comparison.\n   */\n  callbacks?: Partial<Pick<CallbackContext, \"hash\" | \"verifyJwt\">> &\n    Partial<X509CertificateBinding>;\n\n  config: IoWalletSdkConfig;\n\n  /**\n   * The Authorization Request Object JWT.\n   */\n  requestObjectJwt: string;\n}\n\nexport interface ParsedAuthorizeRequestResult {\n  /**\n   * The JWT header of the authorization request object.\n   */\n  header: Openid4vpAuthorizationRequestHeader;\n  /**\n   * The parsed authorization request object.\n   */\n  payload: Openid4vpAuthorizationRequestPayload;\n\n  /**\n   * X.509 context extracted from the Request Object header when `x5c` is present.\n   */\n  x509Certificate?: {\n    leafCertificate: string;\n    x5c: [string, ...string[]];\n  };\n}\n\n/**\n * Parses and optionally verifies a JWT containing an OpenID4VP Request Object.\n *\n * This method decodes the Request Object JWT and validates its structure. If the `verifyJwt`\n * callback is provided, it also verifies the JWT signature using the public key obtained\n * according to IT Wallet specifications:\n * 1. If client_id uses x509_hash: pass an x5c signer to the callback.\n * 2. If client_id uses openid_federation or a legacy HTTPS identifier, pass a federation signer;\n *    trust_chain is forwarded when present, otherwise the callback must reconstruct the chain from client_id.\n *\n * For x509_hash client identifiers, x5c is always required. When `callbacks.hash` is provided,\n * this method also checks the SHA-256 base64url certificate digest embedded in client_id.\n *\n * Security: If `verifyJwt` callback is not provided in options, JWT signature verification is skipped.\n *\n * @param options {@link ParseAuthorizeRequestOptions}\n * @returns A {@link ParsedAuthorizeRequestResult} containing the RP required credentials payload and the {@link Openid4vpAuthorizationRequestHeader} JWT header\n * @throws {ValidationError} in case there are errors validating the Request Object structure\n * @throws {Oauth2JwtParseError} in case the request object jwt is malformed (e.g missing header, bad encoding)\n * @throws {@link ParseAuthorizeRequestError} in case the JWT signature is invalid (when verifyJwt is provided) or there are unexpected errors\n */\nexport async function parseAuthorizeRequest(\n  options: ParseAuthorizeRequestOptions,\n): Promise<ParsedAuthorizeRequestResult> {\n  try {\n    const headerSchema = dispatchByVersion<\n      | typeof zOpenid4vpAuthorizationRequestHeaderV1_0\n      | typeof zOpenid4vpAuthorizationRequestHeaderV1_3\n    >(options.config.itWalletSpecsVersion, {\n      [ItWalletSpecsVersion.V1_0]: () =>\n        zOpenid4vpAuthorizationRequestHeaderV1_0,\n      [ItWalletSpecsVersion.V1_3]: () =>\n        zOpenid4vpAuthorizationRequestHeaderV1_3,\n      [ItWalletSpecsVersion.V1_4]: () =>\n        zOpenid4vpAuthorizationRequestHeaderV1_3,\n    });\n\n    const decoded = decodeJwt({\n      errorMessagePrefix: \"Error decoding authorization request JWT:\",\n      headerSchema,\n      jwt: options.requestObjectJwt,\n      payloadSchema: zOpenid4vpAuthorizationRequestPayload,\n    });\n\n    if (options.config.itWalletSpecsVersion !== ItWalletSpecsVersion.V1_0) {\n      await validateAuthorizationRequestClientBinding({\n        hash: options.callbacks?.hash,\n        header: decoded.header as Openid4vpAuthorizationRequestHeaderV1_3,\n        payload: decoded.payload,\n      });\n    }\n\n    const x5c =\n      \"x5c\" in decoded.header &&\n      Array.isArray(decoded.header.x5c) &&\n      decoded.header.x5c.length > 0\n        ? (decoded.header.x5c as [string, ...string[]])\n        : undefined;\n\n    if (x5c && options.callbacks?.getX509CertificateMetadata) {\n      await validateCertificateEndpoints({\n        callbacks: {\n          getX509CertificateMetadata:\n            options.callbacks.getX509CertificateMetadata,\n        },\n        certificate: x5c[0],\n        endpoints: [\n          { name: \"request_uri\", uri: decoded.payload.request_uri },\n          { name: \"response_uri\", uri: decoded.payload.response_uri },\n        ],\n      });\n    }\n\n    if (options.callbacks?.verifyJwt) {\n      const signer = getPublicKeyForVerification({\n        header: decoded.header,\n        payload: decoded.payload,\n      });\n\n      await verifyJwt({\n        compact: options.requestObjectJwt,\n        errorMessage: \"Error verifying Request Object signature\",\n        header: decoded.header,\n        payload: decoded.payload,\n        signer,\n        verifyJwtCallback: options.callbacks.verifyJwt,\n      });\n    }\n\n    return {\n      header: decoded.header,\n      payload: decoded.payload,\n      ...(x5c && {\n        x509Certificate: {\n          leafCertificate: x5c[0],\n          x5c,\n        },\n      }),\n    };\n  } catch (error) {\n    if (\n      error instanceof ItWalletSpecsVersionError ||\n      error instanceof ValidationError ||\n      error instanceof Oauth2JwtParseError ||\n      error instanceof Oid4vpError\n    )\n      throw error;\n    throw new ParseAuthorizeRequestError(\n      `Unexpected error during Request Object parsing: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n}\n","import {\n  ItWalletSpecsVersion,\n  createVersionDispatcher,\n} from \"@pagopa/io-wallet-utils\";\n\nimport type {\n  CreateAuthorizationResponseOptionsV1_3,\n  CreateAuthorizationResponseOptionsV1_4,\n  CreateAuthorizationResponseResult,\n  CreateAuthorizationResponseVersionedOptions,\n} from \"./types\";\n\nimport * as V1_3 from \"./v1.3/create-authorization-response\";\nimport * as V1_4 from \"./v1.4/create-authorization-response\";\n\nexport type {\n  CreateAuthorizationResponseOptionsV1_0,\n  CreateAuthorizationResponseOptionsV1_3,\n  CreateAuthorizationResponseOptionsV1_4,\n  CreateAuthorizationResponseResult,\n  CreateAuthorizationResponseVersionedOptions,\n} from \"./types\";\n\nconst dispatchCreateAuthorizationResponse = createVersionDispatcher<\n  CreateAuthorizationResponseVersionedOptions,\n  Promise<CreateAuthorizationResponseResult>\n>({\n  [ItWalletSpecsVersion.V1_0]: (o) =>\n    // V1_0 shares the v1.3 response logic — JWKS / enc resolution is identical.\n    V1_3.createAuthorizationResponse(\n      o as CreateAuthorizationResponseOptionsV1_3,\n    ),\n  [ItWalletSpecsVersion.V1_3]: (o) =>\n    V1_3.createAuthorizationResponse(\n      o as CreateAuthorizationResponseOptionsV1_3,\n    ),\n  [ItWalletSpecsVersion.V1_4]: (o) =>\n    V1_4.createAuthorizationResponse(\n      o as CreateAuthorizationResponseOptionsV1_4,\n    ),\n});\n\n/**\n * Creates an encrypted JARM authorization response for OpenID4VP presentation.\n *\n * Routes to the version-specific implementation based on `config.itWalletSpecsVersion`.\n *\n * **Version differences:**\n * - v1.0 / v1.3: When `openid_federation` client_id prefix is used, `client_metadata`\n *   is ignored and `rpJwks` is used for JWKS resolution.\n * - v1.4: `client_metadata.jwks` is used directly when present, regardless of\n *   the `client_id` prefix, falling back to `rpJwks.jwks`.\n *\n * @throws {CreateAuthorizationResponseError} If response generation or encryption fails\n * @throws {ItWalletSpecsVersionError} If `config.itWalletSpecsVersion` is not a recognised version at runtime\n */\nexport async function createAuthorizationResponse(\n  options: CreateAuthorizationResponseVersionedOptions,\n): Promise<CreateAuthorizationResponseResult> {\n  return dispatchCreateAuthorizationResponse(options);\n}\n","import type { JwkSet } from \"@pagopa/io-wallet-oauth2\";\n\nimport { CallbackContext, JweEncryptor } from \"@pagopa/io-wallet-oauth2\";\nimport { encodeToBase64Url } from \"@pagopa/io-wallet-utils\";\n\nimport type { CreateAuthorizationResponseResult } from \"./types\";\n\nimport { Openid4vpAuthorizationRequestPayload } from \"../authorization-request/z-authorization-request\";\nimport { CreateAuthorizationResponseError } from \"../errors\";\nimport { extractEncryptionJwkFromJwks } from \"../jarm/jarm-extract-jwks\";\nimport { VpToken } from \"../vp-token/z-vp-token\";\n\nexport interface BuildJarmResponseOptions {\n  authorization_encrypted_response_alg?: string;\n  authorization_encrypted_response_enc?: string;\n  callbacks: Pick<CallbackContext, \"encryptJwe\" | \"generateRandom\">;\n  encValuesSupported: string[] | undefined;\n  encryptionJwks: JwkSet;\n  requestObject: Pick<Openid4vpAuthorizationRequestPayload, \"nonce\" | \"state\">;\n  vp_token: VpToken;\n}\n\nfunction resolveEncValue(\n  supported: string[] | undefined,\n  requested: string | undefined,\n  fallback: string,\n): string {\n  if (!supported) return requested ?? fallback;\n  return (\n    supported.find((e) => e === requested) ??\n    supported[0] ??\n    requested ??\n    fallback\n  );\n}\n\n/**\n * Shared core: resolves enc/alg, encrypts the VP token into a JARM JWE, and returns the result.\n * Callers are responsible for resolving `encryptionJwks` and `encValuesSupported`\n * according to their version-specific metadata rules before invoking this function.\n */\nexport async function buildJarmResponse(\n  options: BuildJarmResponseOptions,\n): Promise<CreateAuthorizationResponseResult> {\n  try {\n    const encryptionAlg =\n      options.authorization_encrypted_response_alg ?? \"ECDH-ES\";\n    const encryptionEnc =\n      options.authorization_encrypted_response_enc ?? \"A256GCM\";\n\n    const authorizationResponsePayload = {\n      state: options.requestObject.state,\n      vp_token: options.vp_token,\n    };\n\n    const encryptionJwk = extractEncryptionJwkFromJwks(options.encryptionJwks, {\n      supportedAlgValues: [encryptionAlg],\n    });\n    if (!encryptionJwk) {\n      throw new CreateAuthorizationResponseError(\n        \"No encryption JWK found in metadata\",\n      );\n    }\n\n    if (!encryptionJwk.kid) {\n      throw new CreateAuthorizationResponseError(\n        \"Encryption JWK must have a 'kid' parameter\",\n      );\n    }\n\n    const enc = resolveEncValue(\n      options.encValuesSupported,\n      options.authorization_encrypted_response_enc,\n      encryptionEnc,\n    );\n\n    const alg = encryptionAlg;\n\n    const nonceBytes = await options.callbacks.generateRandom(32);\n\n    const jweEncryptor: JweEncryptor = {\n      alg,\n      apu: encodeToBase64Url(nonceBytes),\n      apv: encodeToBase64Url(options.requestObject.nonce),\n      enc,\n      kid: encryptionJwk.kid,\n      method: \"jwk\",\n      publicJwk: encryptionJwk,\n    };\n\n    const { encryptionJwk: usedJwk, jwe } = await options.callbacks.encryptJwe(\n      jweEncryptor,\n      JSON.stringify(authorizationResponsePayload),\n    );\n\n    return {\n      authorizationResponsePayload,\n      jarm: {\n        encryptionJwk: usedJwk,\n        responseJwe: jwe,\n      },\n    };\n  } catch (error) {\n    if (error instanceof CreateAuthorizationResponseError) {\n      throw error;\n    }\n    throw new CreateAuthorizationResponseError(\n      `Unexpected error during authorization response creation: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n}\n","import type { JwkSet } from \"@pagopa/io-wallet-oauth2\";\n\n/**\n * Selects an encryption JWK from a JWKS.\n *\n * Selection prefers an explicit `kid`, then keys whose `alg` is supported, then\n * keys marked for encryption or not explicitly marked for signatures.\n *\n * @param jwks - JSON Web Key Set to search.\n * @param options - Optional selection constraints.\n * @param options.kid - Key ID to select directly.\n * @param options.supportedAlgValues - Encryption algorithms accepted by the caller.\n * @returns Matching encryption JWK, or the first available key when no better match exists.\n */\nexport function extractEncryptionJwkFromJwks(\n  jwks: JwkSet,\n  {\n    kid,\n    supportedAlgValues,\n  }: {\n    kid?: string;\n    supportedAlgValues?: string[];\n  },\n) {\n  if (kid) {\n    return jwks.keys.find((jwk) => jwk.kid === kid);\n  }\n\n  let algFiltered = jwks.keys.filter(\n    (key) => key.alg && supportedAlgValues?.includes(key.alg),\n  );\n  if (algFiltered.length === 0) algFiltered = jwks.keys;\n\n  let encFiltered = algFiltered.filter((key) => key.use === \"enc\");\n  if (encFiltered.length === 0) {\n    encFiltered = algFiltered.filter((key) => key.use !== \"sig\");\n  }\n\n  return encFiltered.length > 0 ? encFiltered[0] : jwks.keys[0];\n}\n","import type {\n  CreateAuthorizationResponseOptionsV1_3,\n  CreateAuthorizationResponseResult,\n} from \"../types\";\n\nimport {\n  ClientIdPrefix,\n  extractClientIdPrefix,\n} from \"../../authorization-request/parse-authorization-request\";\nimport { CreateAuthorizationResponseError } from \"../../errors\";\nimport { buildJarmResponse } from \"../build-jarm-response\";\n\n/**\n * Creates an encrypted JARM authorization response for OpenID4VP presentation — v1.0 / v1.3 variant.\n *\n * When the `openid_federation` client_id prefix is used, `client_metadata` is ignored\n * and `rpJwks` is used for JWKS resolution, as required by the Italian specification.\n */\nexport async function createAuthorizationResponse(\n  options: CreateAuthorizationResponseOptionsV1_3,\n): Promise<CreateAuthorizationResponseResult> {\n  const { requestObject } = options;\n  const clientMetadata = requestObject.client_metadata;\n  const { prefix: clientIdPrefix } = extractClientIdPrefix(\n    requestObject.client_id,\n  );\n\n  if (clientIdPrefix === ClientIdPrefix.X509_HASH && !clientMetadata) {\n    throw new CreateAuthorizationResponseError(\n      \"clientMetadata is required when client_id uses x509_hash prefix\",\n    );\n  }\n\n  // When using OpenID Federation, client_metadata may be present in the request\n  // but per the Italian specification most of its content should be ignored —\n  // use rpJwks for encryption parameters instead.\n  const effectiveClientMetadata =\n    clientIdPrefix === ClientIdPrefix.OPENID_FEDERATION\n      ? undefined\n      : clientMetadata;\n\n  const encryptionJwks = effectiveClientMetadata\n    ? effectiveClientMetadata.jwks\n    : options.rpJwks.jwks;\n\n  const encValuesSupported =\n    effectiveClientMetadata?.encrypted_response_enc_values_supported ??\n    options.rpJwks.encrypted_response_enc_values_supported;\n\n  return buildJarmResponse({\n    authorization_encrypted_response_alg:\n      options.authorization_encrypted_response_alg,\n    authorization_encrypted_response_enc:\n      options.authorization_encrypted_response_enc,\n    callbacks: options.callbacks,\n    encValuesSupported,\n    encryptionJwks,\n    requestObject: options.requestObject,\n    vp_token: options.vp_token,\n  });\n}\n","import type {\n  CreateAuthorizationResponseOptionsV1_4,\n  CreateAuthorizationResponseResult,\n} from \"../types\";\n\nimport {\n  ClientIdPrefix,\n  extractClientIdPrefix,\n} from \"../../authorization-request/parse-authorization-request\";\nimport { CreateAuthorizationResponseError } from \"../../errors\";\nimport { buildJarmResponse } from \"../build-jarm-response\";\n\n/**\n * Creates an encrypted JARM authorization response for OpenID4VP presentation — v1.4 variant.\n *\n * **v1.4 behavior:** both `encryptionJwks` and `encValuesSupported`\n * are resolved directly from `requestObject.client_metadata`, falling back to `rpJwks`, regardless\n * of the `client_id` prefix. The IT-Wallet spec (RPR-113) permits `client_metadata.jwks` and\n * `encrypted_response_enc_values_supported` to carry request-specific ephemeral encryption keys\n * even when the `openid_federation` prefix is active.\n */\nexport async function createAuthorizationResponse(\n  options: CreateAuthorizationResponseOptionsV1_4,\n): Promise<CreateAuthorizationResponseResult> {\n  const { requestObject } = options;\n  const clientMetadata = requestObject.client_metadata;\n  const { prefix: clientIdPrefix } = extractClientIdPrefix(\n    requestObject.client_id,\n  );\n\n  if (clientIdPrefix === ClientIdPrefix.X509_HASH && !clientMetadata) {\n    throw new CreateAuthorizationResponseError(\n      \"clientMetadata is required when client_id uses x509_hash prefix\",\n    );\n  }\n\n  const encryptionJwks = clientMetadata?.jwks ?? options.rpJwks.jwks;\n\n  const encValuesSupported =\n    clientMetadata?.encrypted_response_enc_values_supported ??\n    options.rpJwks.encrypted_response_enc_values_supported;\n\n  return buildJarmResponse({\n    authorization_encrypted_response_alg:\n      options.authorization_encrypted_response_alg,\n    authorization_encrypted_response_enc:\n      options.authorization_encrypted_response_enc,\n    callbacks: options.callbacks,\n    encValuesSupported,\n    encryptionJwks,\n    requestObject: options.requestObject,\n    vp_token: options.vp_token,\n  });\n}\n","import { CallbackContext } from \"@openid4vc/oauth2\";\nimport {\n  CONTENT_TYPES,\n  HEADERS,\n  UnexpectedStatusCodeError,\n  ValidationError,\n  createFetcher,\n  hasStatusOrThrow,\n  parseWithErrorHandling,\n} from \"@pagopa/io-wallet-utils\";\n\nimport {\n  X509CertificateBinding,\n  validateCertificateEndpoints,\n} from \"../authorization-request/validate-certificate-endpoints\";\nimport { FetchAuthorizationResponseError } from \"../errors\";\nimport {\n  Openid4vpAuthorizationResponseResult,\n  zOpenid4vpAuthorizationResponseResult,\n} from \"./z-authorization-response\";\n\n/**\n * Configuration options for fetching OID4VP Presentation Result\n */\nexport interface FetchAuthorizationResponseOptions {\n  /**\n   * The signed and encrypted {@link Openid4vpAuthorizationResponse} in base64 format\n   */\n  authorizationResponseJarm: string;\n\n  /**\n   * Callback functions for making HTTP requests\n   * Allows for custom fetch implementations\n   */\n  callbacks: Pick<CallbackContext, \"fetch\">;\n\n  /**\n   * The response_uri field contained in the {@link Openid4vpAuthorizationRequestPayload}\n   */\n  presentationResponseUri: string;\n\n  /**\n   * Optional RP certificate context from the parsed Request Object.\n   * When provided, `presentationResponseUri` and the returned `redirect_uri`\n   * are checked against the certificate SAN entries through the supplied callback.\n   */\n  x509Certificate?: {\n    binding: X509CertificateBinding;\n    leafCertificate: string;\n  };\n}\n\n/**\n * Sends the {@link Openid4vpAuthorizationResponse} to the response uri provided by the session's\n * {@link Openid4vpAuthorizationRequestPayload} and returns the {@link Openid4vpAuthorizationResponseResult} object\n * containing the redirect_uri at which to continue the presentation\n *\n * @param options {@link FetchAuthorizationResponseOptions}\n * @returns Promise that resolves to the parsed {@link Openid4vpAuthorizationResponseResult}\n * @throws {UnexpectedStatusCodeError} When the server returns a non-200 status code\n * @throws {ValidationError} When the response cannot be parsed or is invalid\n */\nexport async function fetchAuthorizationResponse(\n  options: FetchAuthorizationResponseOptions,\n): Promise<Openid4vpAuthorizationResponseResult> {\n  try {\n    if (options.x509Certificate) {\n      await validateCertificateEndpoints({\n        callbacks: options.x509Certificate.binding,\n        certificate: options.x509Certificate.leafCertificate,\n        endpoints: [\n          { name: \"response_uri\", uri: options.presentationResponseUri },\n        ],\n      });\n    }\n\n    const fetch = createFetcher(options.callbacks.fetch);\n    const authorizationResponseResult = await fetch(\n      options.presentationResponseUri,\n      {\n        body: new URLSearchParams({\n          response: options.authorizationResponseJarm,\n        }),\n        headers: {\n          [HEADERS.CONTENT_TYPE]: CONTENT_TYPES.FORM_URLENCODED,\n        },\n        method: \"POST\",\n      },\n    );\n\n    await hasStatusOrThrow(\n      200,\n      UnexpectedStatusCodeError,\n    )(authorizationResponseResult);\n\n    const authorizationResponseResultJson =\n      await authorizationResponseResult.json();\n\n    //Response could be anything, so it's returned as is for further processing\n    const parsedAuthorizationResponseResult = parseWithErrorHandling(\n      zOpenid4vpAuthorizationResponseResult,\n      authorizationResponseResultJson,\n    );\n\n    if (options.x509Certificate) {\n      await validateCertificateEndpoints({\n        callbacks: options.x509Certificate.binding,\n        certificate: options.x509Certificate.leafCertificate,\n        endpoints: [\n          {\n            name: \"redirect_uri\",\n            uri: parsedAuthorizationResponseResult.redirect_uri,\n          },\n        ],\n      });\n    }\n\n    return parsedAuthorizationResponseResult;\n  } catch (error) {\n    if (\n      error instanceof UnexpectedStatusCodeError ||\n      error instanceof ValidationError ||\n      error instanceof FetchAuthorizationResponseError\n    ) {\n      throw error;\n    }\n    throw new FetchAuthorizationResponseError(\n      `Unexpected error sending authorization response: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n}\n","import z from \"zod\";\n\nimport { zVpToken } from \"../vp-token/z-vp-token\";\n\nexport const zOpenid4vpAuthorizationResponse = z.object({\n  state: z.string().optional(),\n  vp_token: zVpToken,\n});\n\nexport type Openid4vpAuthorizationResponse = z.infer<\n  typeof zOpenid4vpAuthorizationResponse\n>;\n\nexport const zOpenid4vpAuthorizationResponseResult = z.object({\n  redirect_uri: z.url().optional(),\n});\n\nexport type Openid4vpAuthorizationResponseResult = z.infer<\n  typeof zOpenid4vpAuthorizationResponseResult\n>;\n","import { z } from \"zod\";\n\nexport const zVpToken = z.record(\n  z.string(),\n  z.string().or(z.array(z.string()).nonempty()),\n  {\n    message:\n      \"vp_token must be an object where each key is a string and each value is a non-empty array of strings (v1.3) or a string (v1.0)\",\n  },\n);\n\nexport type VpToken = z.infer<typeof zVpToken>;\n","import { CallbackContext } from \"@pagopa/io-wallet-oauth2\";\nimport { parseWithErrorHandling } from \"@pagopa/io-wallet-utils\";\n\nimport { Openid4vpAuthorizationRequestPayload } from \"../authorization-request/z-authorization-request\";\nimport { Oid4vpError } from \"../errors\";\nimport { parseJarmAuthorizationResponse } from \"../jarm/parse-jarm-authorization-response\";\nimport { VerifyJarmAuthorizationResponseResult } from \"../jarm/verify-jarm-authorization-response\";\nimport { JarmHeader } from \"../jarm/z-jarm\";\nimport {\n  ValidateOpenid4vpAuthorizationResponseResult,\n  validateOpenid4vpAuthorizationResponsePayload,\n} from \"./validate-authorization-response\";\nimport {\n  Openid4vpAuthorizationResponse,\n  zOpenid4vpAuthorizationResponse,\n} from \"./z-authorization-response\";\n\nexport interface ParseAuthorizationResponseOptions {\n  /**\n   * Parsed authorization request payload used to validate response parameters.\n   */\n  authorizationRequestPayload: Openid4vpAuthorizationRequestPayload;\n  /**\n   * Authorization response received from the verifier endpoint or redirect URI.\n   */\n  authorizationResponse: Record<string, unknown>;\n  /**\n   * Callbacks required when the response is returned in JARM format.\n   */\n  callbacks: Pick<CallbackContext, \"decryptJwe\" | \"verifyJwt\">;\n}\n\n/**\n * Parsed and validated authorization response.\n */\nexport type ParseAuthorizationResponseResult = {\n  authorizationResponsePayload: Openid4vpAuthorizationResponse;\n  expectedNonce: string;\n  jarm?: {\n    jarmHeader: JarmHeader;\n  } & VerifyJarmAuthorizationResponseResult;\n} & ValidateOpenid4vpAuthorizationResponseResult;\n\n/**\n * Parses an OpenID4VP authorization response and validates it against the request.\n *\n * If the response includes a `response` parameter, the JARM flow is used.\n * Otherwise, the plain authorization response payload is parsed and validated.\n *\n * @param options {@link ParseAuthorizationResponseOptions}\n * @returns A parsed and validated authorization response.\n */\nexport async function parseAuthorizationResponse(\n  options: ParseAuthorizationResponseOptions,\n): Promise<ParseAuthorizationResponseResult> {\n  const { authorizationRequestPayload, authorizationResponse, callbacks } =\n    options;\n\n  if (authorizationResponse.response) {\n    if (typeof authorizationResponse.response !== \"string\") {\n      throw new Oid4vpError(\n        \"Invalid jarm authorization response: 'response' parameter must be a jwt string.\",\n      );\n    }\n\n    return parseJarmAuthorizationResponse({\n      authorizationRequestPayload,\n      callbacks,\n      jarmResponseJwt: authorizationResponse.response,\n    });\n  }\n\n  const authorizationResponsePayload = parseWithErrorHandling(\n    zOpenid4vpAuthorizationResponse,\n    authorizationResponse,\n    \"Failed to parse openid4vp authorization response.\",\n  );\n\n  const validatedOpenId4vpResponse =\n    validateOpenid4vpAuthorizationResponsePayload({\n      authorizationRequestPayload: authorizationRequestPayload,\n      authorizationResponsePayload: authorizationResponsePayload,\n    });\n\n  return {\n    ...validatedOpenId4vpResponse,\n    authorizationResponsePayload,\n    expectedNonce: authorizationRequestPayload.nonce,\n  };\n}\n","import {\n  type CallbackContext,\n  decodeJwtHeader,\n  zCompactJwe,\n  zCompactJwt,\n} from \"@pagopa/io-wallet-oauth2\";\nimport { parseWithErrorHandling } from \"@pagopa/io-wallet-utils\";\nimport z from \"zod\";\n\nimport { Openid4vpAuthorizationRequestPayload } from \"../authorization-request/z-authorization-request\";\nimport { ParseAuthorizationResponseResult } from \"../authorization-response/parse-authorization-response\";\nimport { validateOpenid4vpAuthorizationResponsePayload } from \"../authorization-response/validate-authorization-response\";\nimport { zOpenid4vpAuthorizationResponse } from \"../authorization-response/z-authorization-response\";\nimport { verifyJarmAuthorizationResponse } from \"./verify-jarm-authorization-response\";\nimport { zJarmHeader } from \"./z-jarm\";\n\nexport interface ParseJarmAuthorizationResponseOptions {\n  /**\n   * Parsed authorization request payload used to validate JARM claims.\n   */\n  authorizationRequestPayload: Openid4vpAuthorizationRequestPayload;\n  /**\n   * Callbacks used to decrypt and verify JARM JWT/JWE responses.\n   */\n  callbacks: Pick<CallbackContext, \"decryptJwe\" | \"verifyJwt\">;\n  /**\n   * Compact JARM authorization response (`response` parameter value).\n   */\n  jarmResponseJwt: string;\n  /**\n   * Current time used for temporal claim validation (`exp`, `nbf`).\n   * Defaults to current date-time when omitted.\n   */\n  now?: Date;\n}\n\n/**\n * Parses and validates a JARM authorization response for OpenID4VP.\n *\n * This function validates compact format, decrypts and/or verifies the JARM token,\n * parses the resulting OpenID4VP authorization response, and validates it against\n * the originating authorization request.\n *\n * @param options {@link ParseJarmAuthorizationResponseOptions}\n * @returns Parsed authorization response enriched with JARM metadata.\n */\nexport async function parseJarmAuthorizationResponse(\n  options: ParseJarmAuthorizationResponseOptions,\n): Promise<ParseAuthorizationResponseResult> {\n  const { authorizationRequestPayload, callbacks, jarmResponseJwt, now } =\n    options;\n\n  const jarmAuthorizationResponseJwt = parseWithErrorHandling(\n    z.union([zCompactJwt, zCompactJwe]),\n    jarmResponseJwt,\n    \"Invalid jarm authorization response jwt.\",\n  );\n\n  const verifiedJarmResponse = await verifyJarmAuthorizationResponse({\n    authorizationRequestPayload,\n    callbacks,\n    jarmAuthorizationResponseJwt,\n    now,\n  });\n\n  const { header: jarmHeader } = decodeJwtHeader({\n    headerSchema: zJarmHeader,\n    jwt: jarmAuthorizationResponseJwt,\n  });\n\n  const authorizationResponsePayload = parseWithErrorHandling(\n    zOpenid4vpAuthorizationResponse,\n    verifiedJarmResponse.jarmAuthorizationResponse,\n    \"Failed to parse openid4vp authorization response.\",\n  );\n\n  const validateOpenId4vpResponse =\n    validateOpenid4vpAuthorizationResponsePayload({\n      authorizationRequestPayload: authorizationRequestPayload,\n      authorizationResponsePayload: authorizationResponsePayload,\n    });\n\n  return {\n    ...validateOpenId4vpResponse,\n    authorizationResponsePayload,\n    expectedNonce: authorizationRequestPayload.nonce,\n    jarm: { ...verifiedJarmResponse, jarmHeader },\n  };\n}\n","import { parseIfJson, parseWithErrorHandling } from \"@pagopa/io-wallet-utils\";\n\nimport { zVpToken } from \"./z-vp-token\";\n\n/**\n * Parses a DCQL VP token into the SDK VP token shape.\n *\n * @param vpToken - Raw VP token object or JSON string.\n * @returns Parsed VP token.\n * @throws {ValidationError} If the token is not an object of encoded presentations.\n */\nexport function parseVpToken(vpToken: unknown) {\n  return parseWithErrorHandling(\n    zVpToken,\n    parseIfJson(vpToken),\n    \"Could not parse dcql vp_token. Expected an object where the values are encoded presentations\",\n  );\n}\n","import { Openid4vpAuthorizationRequestPayload } from \"../authorization-request/z-authorization-request\";\nimport { Oid4vpError } from \"../errors\";\nimport { parseVpToken } from \"../vp-token/parse-vp-token\";\nimport { Openid4vpAuthorizationResponse } from \"./z-authorization-response\";\n\nexport interface ValidateOpenid4vpAuthorizationResponseOptions {\n  /**\n   * Parsed request payload used as validation source.\n   */\n  authorizationRequestPayload: Openid4vpAuthorizationRequestPayload;\n  /**\n   * Parsed authorization response payload to validate.\n   */\n  authorizationResponsePayload: Openid4vpAuthorizationResponse;\n}\n\n/**\n * Result of authorization response validation.\n */\nexport interface ValidateOpenid4vpAuthorizationResponseResult {\n  presentations: ReturnType<typeof parseVpToken>;\n  query: Openid4vpAuthorizationRequestPayload[\"dcql_query\"];\n}\n\n/**\n * Validates the OpenID4VP authorization response payload against the request payload.\n *\n * @param options {@link ValidateOpenid4vpAuthorizationResponseOptions}\n * @returns Presentations and query extracted from the validated flow.\n * @throws {Oid4vpError} If `state` is present in the request and does not match the response.\n */\nexport function validateOpenid4vpAuthorizationResponsePayload(\n  options: ValidateOpenid4vpAuthorizationResponseOptions,\n): ValidateOpenid4vpAuthorizationResponseResult {\n  const { authorizationRequestPayload, authorizationResponsePayload } = options;\n\n  if (\n    authorizationRequestPayload.state !== authorizationResponsePayload.state\n  ) {\n    throw new Oid4vpError(\"OpenId4Vp Authorization Response state mismatch.\");\n  }\n\n  const presentations = parseVpToken(authorizationResponsePayload.vp_token);\n\n  return {\n    presentations,\n    query: authorizationRequestPayload.dcql_query,\n  };\n}\n","import { jwtSignerFromJwt } from \"@openid4vc/oauth2\";\nimport {\n  type CallbackContext,\n  type Jwk,\n  Oauth2Error,\n  decodeJwt,\n  decodeJwtHeader,\n  zCompactJwe,\n  zCompactJwt,\n  zJwtHeader,\n} from \"@pagopa/io-wallet-oauth2\";\nimport { stringToJsonWithErrorHandling } from \"@pagopa/io-wallet-utils\";\nimport z from \"zod\";\n\nimport { Openid4vpAuthorizationRequestPayload } from \"../authorization-request/z-authorization-request\";\nimport { extractEncryptionJwkFromJwks } from \"./jarm-extract-jwks\";\nimport {\n  JarmAuthorizationResponse,\n  JarmAuthorizationResponseEncryptedOnly,\n  zEncryptedJarmHeader,\n  zJarmAuthorizationResponse,\n  zJarmAuthorizationResponseEncryptedOnly,\n} from \"./z-jarm\";\n\n/**\n * Supported JARM serialization/processing modes.\n */\nexport enum JarmMode {\n  Encrypted = \"Encrypted\",\n  Signed = \"Signed\",\n  SignedEncrypted = \"SignedEncrypted\",\n}\n\nconst decryptJarmAuthorizationResponseJwt = async (options: {\n  authorizationRequestPayload: Openid4vpAuthorizationRequestPayload;\n  callbacks: Pick<CallbackContext, \"decryptJwe\">;\n  jarmAuthorizationResponseJwt: string;\n}) => {\n  const {\n    authorizationRequestPayload,\n    callbacks,\n    jarmAuthorizationResponseJwt,\n  } = options;\n\n  let encryptionJwk: Jwk | undefined;\n  const { header } = decodeJwtHeader({\n    headerSchema: zEncryptedJarmHeader,\n    jwt: jarmAuthorizationResponseJwt,\n  });\n\n  const jwks = authorizationRequestPayload.client_metadata?.jwks;\n\n  if (jwks) {\n    encryptionJwk = extractEncryptionJwkFromJwks(jwks, { kid: header.kid });\n  }\n\n  const result = await callbacks.decryptJwe(jarmAuthorizationResponseJwt, {\n    jwk: encryptionJwk,\n  });\n\n  if (!result.decrypted) {\n    throw new Oauth2Error(\"Failed to decrypt jarm auth response.\");\n  }\n\n  return {\n    decryptionJwk: result.decryptionJwk,\n    payload: result.payload,\n  };\n};\n\nexport interface VerifyJarmAuthorizationResponseOptions {\n  /**\n   * Parsed authorization request payload used to resolve metadata and key material.\n   */\n  authorizationRequestPayload: Openid4vpAuthorizationRequestPayload;\n  /**\n   * Callbacks required for JWE decryption and JWT signature verification.\n   */\n  callbacks: Pick<CallbackContext, \"decryptJwe\" | \"verifyJwt\">;\n  /**\n   * Compact serialized JARM response received from the verifier.\n   */\n  jarmAuthorizationResponseJwt: string;\n  /**\n   * Current time used for temporal claim validation (`exp`, `nbf`).\n   * Defaults to current date-time when omitted.\n   */\n  now?: Date;\n}\n\n/**\n * Verified JARM authorization response data returned by {@link verifyJarmAuthorizationResponse}.\n */\nexport interface VerifyJarmAuthorizationResponseResult {\n  /**\n   * JWK used for decryption when the response is encrypted, or `undefined` if the response was not encrypted.\n   */\n  decryptionJwk: Jwk | undefined;\n  /**\n   * The `iss` claim from the JARM response, representing the issuer of the response.\n   */\n  issuer: string | undefined;\n  /**\n   * The parsed JARM authorization response body, containing claims like `iss`, `aud`, `exp`, etc.\n   */\n  jarmAuthorizationResponse:\n    | JarmAuthorizationResponse\n    | JarmAuthorizationResponseEncryptedOnly;\n  /**\n   * Detected JARM processing mode indicating whether the response was signed, encrypted, or both.\n   */\n  type: JarmMode;\n}\n\n/**\n * Verifies a JARM authorization response in signed, encrypted, or signed+encrypted mode.\n *\n * The function detects the response mode, performs decryption when needed, verifies\n * JWS signatures for signed payloads, and returns the parsed JARM body with metadata.\n *\n * @param options {@link VerifyJarmAuthorizationResponseOptions}\n * @returns Decryption and verification artifacts with parsed JARM payload.\n * @throws {Oauth2Error} If the response mode is invalid, decryption fails, or signature verification fails.\n */\nexport async function verifyJarmAuthorizationResponse(\n  options: VerifyJarmAuthorizationResponseOptions,\n) {\n  const {\n    authorizationRequestPayload,\n    callbacks,\n    jarmAuthorizationResponseJwt,\n  } = options;\n\n  const requestDataIsEncrypted = zCompactJwe.safeParse(\n    jarmAuthorizationResponseJwt,\n  ).success;\n  const decryptedRequestData = requestDataIsEncrypted\n    ? await decryptJarmAuthorizationResponseJwt({\n        authorizationRequestPayload,\n        callbacks,\n        jarmAuthorizationResponseJwt,\n      })\n    : { decryptionJwk: undefined, payload: jarmAuthorizationResponseJwt };\n\n  const responseIsSigned = zCompactJwt.safeParse(\n    decryptedRequestData.payload,\n  ).success;\n\n  if (!requestDataIsEncrypted && !responseIsSigned) {\n    throw new Oauth2Error(\n      \"Jarm Auth Response must be either encrypted, signed, or signed and encrypted.\",\n    );\n  }\n\n  let jarmAuthorizationResponse:\n    | JarmAuthorizationResponse\n    | JarmAuthorizationResponseEncryptedOnly;\n\n  if (responseIsSigned) {\n    const { header: jwsProtectedHeader, payload: jwsPayload } = decodeJwt({\n      errorMessagePrefix: \"Error decoding JARM authorization response JWT:\",\n      headerSchema: z.object({ ...zJwtHeader.shape, kid: z.string() }),\n      jwt: decryptedRequestData.payload,\n    });\n\n    const response = zJarmAuthorizationResponse.parse(jwsPayload);\n    const jwtSigner = jwtSignerFromJwt({\n      header: jwsProtectedHeader,\n      payload: jwsPayload,\n    });\n\n    const verificationResult = await options.callbacks.verifyJwt(jwtSigner, {\n      compact: decryptedRequestData.payload,\n      header: jwsProtectedHeader,\n      payload: jwsPayload,\n    });\n\n    if (!verificationResult.verified) {\n      throw new Oauth2Error(\"Jarm Auth Response is not valid.\");\n    }\n\n    const expectedAudience = authorizationRequestPayload.client_id;\n    const expectedIssuer = authorizationRequestPayload.iss;\n    if (response.aud !== expectedAudience) {\n      throw new Oauth2Error(\n        `Jarm Auth Response contains 'aud' value '${response.aud}', but expected '${expectedAudience}'.`,\n      );\n    }\n\n    if (expectedIssuer && response.iss !== expectedIssuer) {\n      throw new Oauth2Error(\n        `Jarm Auth Response contains 'iss' value '${response.iss}', but expected '${expectedIssuer}'.`,\n      );\n    }\n\n    const now = options.now ?? new Date();\n    const nowSeconds = Math.floor(now.getTime() / 1000);\n    if (response.exp < nowSeconds) {\n      throw new Oauth2Error(\"Jarm Auth Response has expired.\");\n    }\n\n    if (response.nbf !== undefined && response.nbf > nowSeconds) {\n      throw new Oauth2Error(\"Jarm Auth Response is not active yet.\");\n    }\n\n    jarmAuthorizationResponse = response;\n  } else {\n    const jsonRequestData = stringToJsonWithErrorHandling(\n      decryptedRequestData.payload,\n      \"Unable to parse decrypted JARM JWE body to JSON\",\n    );\n    jarmAuthorizationResponse =\n      zJarmAuthorizationResponseEncryptedOnly.parse(jsonRequestData);\n  }\n\n  const type: JarmMode =\n    requestDataIsEncrypted && responseIsSigned\n      ? JarmMode.SignedEncrypted\n      : requestDataIsEncrypted\n        ? JarmMode.Encrypted\n        : JarmMode.Signed;\n\n  const issuer = jarmAuthorizationResponse.iss;\n\n  return {\n    decryptionJwk: decryptedRequestData.decryptionJwk,\n    issuer,\n    jarmAuthorizationResponse,\n    type,\n  };\n}\n","import { zJwtHeader, zJwtPayload } from \"@pagopa/io-wallet-oauth2\";\nimport { z } from \"zod\";\n\nexport const zJarmHeader = z.object({\n  ...zJwtHeader.shape,\n  apu: z.string().optional(),\n  apv: z.string().optional(),\n  kid: z.string(),\n});\n\nexport type JarmHeader = z.infer<typeof zJarmHeader>;\n\nexport const zEncryptedJarmHeader = z.object({\n  ...zJwtHeader.shape,\n  apu: z.string().optional(),\n  apv: z.string().optional(),\n  enc: z.string().optional(),\n  kid: z.string(),\n});\n\nexport type EncryptedJarmHeader = z.infer<typeof zEncryptedJarmHeader>;\n\nexport const zJarmAuthorizationResponse = z.looseObject({\n  /**\n   * iss: The issuer URL of the authorization server that created the response\n   * aud: The client_id of the client the response is intended for\n   * exp: The expiration time of the JWT. A maximum JWT lifetime of 10 minutes is RECOMMENDED.\n   */\n  ...zJwtPayload.shape,\n  ...zJwtPayload.pick({ aud: true, exp: true, iss: true }).required().shape,\n  state: z.optional(z.string()),\n});\n\nexport type JarmAuthorizationResponse = z.infer<\n  typeof zJarmAuthorizationResponse\n>;\n\nexport const zJarmAuthorizationResponseEncryptedOnly = z.looseObject({\n  ...zJwtPayload.shape,\n  state: z.optional(z.string()),\n});\n\nexport type JarmAuthorizationResponseEncryptedOnly = z.infer<\n  typeof zJarmAuthorizationResponseEncryptedOnly\n>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qCAAAA;AAAA,EAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,IAAAC,2BAUO;AACP,IAAAC,0BAOO;;;ACfA,IAAM,cAAN,cAA0B,MAAM;AAAA,EAC5B;AAAA,EACT,YACE,SACA,SACA;AACA,UAAM,SAAS,OAAO;AACtB,SAAK,OAAO;AACZ,SAAK,aAAa,SAAS;AAAA,EAC7B;AACF;AAOO,IAAM,6BAAN,cAAyC,YAAY;AAAA,EACjD;AAAA,EACT,YACE,SACA,SACA;AACA,UAAM,SAAS,OAAO;AACtB,SAAK,OAAO;AACZ,SAAK,aAAa,SAAS;AAAA,EAC7B;AACF;AAKO,IAAM,kCAAN,cAA8C,YAAY;AAAA,EACtD;AAAA,EACT,YACE,SACA,SACA;AACA,UAAM,SAAS,OAAO;AACtB,SAAK,OAAO;AACZ,SAAK,aAAa,SAAS;AAAA,EAC7B;AACF;AAMO,IAAM,mCAAN,cAA+C,YAAY;AAAA,EACvD;AAAA,EACT,YACE,SACA,SACA;AACA,UAAM,SAAS,OAAO;AACtB,SAAK,OAAO;AACZ,SAAK,aAAa,SAAS;AAAA,EAC7B;AACF;AAMO,IAAM,+BAAN,cAA2C,YAAY;AAAA,EAC5D,YAAY,SAAiB,SAAwB;AACnD,UAAM,SAAS,OAAO;AACtB,SAAK,OAAO;AAAA,EACd;AACF;;;ACxEA,6BAKO;AAQA,IAAK,iBAAL,kBAAKC,oBAAL;AACL,EAAAA,gBAAA,UAAO;AACP,EAAAA,gBAAA,uBAAoB;AACpB,EAAAA,gBAAA,eAAY;AAHF,SAAAA;AAAA,GAAA;AAgBL,SAAS,sBAAsB,UAAiC;AACrE,QAAM,aAAa,SAAS,QAAQ,GAAG;AAEvC,MAAI,eAAe,IAAI;AACrB,WAAO,EAAE,UAAU,QAAQ,kBAAoB;AAAA,EACjD;AAEA,MAAI,SAAS,WAAW,UAAU,KAAK,SAAS,WAAW,SAAS,GAAG;AACrE,WAAO,EAAE,UAAU,QAAQ,kBAAoB;AAAA,EACjD;AAEA,QAAM,YAAY,SAAS,MAAM,GAAG,UAAU;AAC9C,QAAM,OAAO,SAAS,MAAM,aAAa,CAAC;AAE1C,MAAI,cAAc,6BAA0B;AAC1C,WAAO,EAAE,UAAU,MAAM,QAAQ,4BAAyB;AAAA,EAC5D;AACA,MAAI,cAAc,6CAAkC;AAClD,WAAO,EAAE,UAAU,MAAM,QAAQ,4CAAiC;AAAA,EACpE;AAEA,QAAM,IAAI;AAAA,IACR,iCAAiC,SAAS;AAAA,EAC5C;AACF;AAEA,eAAsB,uBACpB,SACiB;AACjB,SAAO,GAAG,2BAAwB,IAAI,MAAM,6BAA6B,OAAO,CAAC;AACnF;AAEA,eAAe,6BACb,SACA;AACA,QAAM,kBAAkB,mBAAmB,QAAQ,gBAAgB;AAEnE,aAAO;AAAA,IACL,MAAM,QAAQ,SAAK,qCAAa,eAAe,GAAG,qCAAc,MAAM;AAAA,EACxE;AACF;AAEA,eAAsB,0CAA0C,SAIrC;AACzB,QAAM,gBAAgB,sBAAsB,QAAQ,QAAQ,SAAS;AAErE,MAAI,cAAc,WAAW,6BAA0B;AACrD,WAAO;AAAA,EACT;AAEA,QAAM,EAAE,IAAI,IAAI,QAAQ;AACxB,MAAI,CAAC,MAAM,QAAQ,GAAG,KAAK,IAAI,WAAW,GAAG;AAC3C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,QAAQ,MAAM;AACjB,WAAO;AAAA,EACT;AAEA,QAAM,0BAA0B,MAAM,6BAA6B;AAAA,IACjE,kBAAkB;AAAA,IAClB,MAAM,QAAQ;AAAA,EAChB,CAAC;AAED,MAAI,4BAA4B,cAAc,UAAU;AACtD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,mBAAmB,kBAA4B;AACtD,QAAM,kBAAkB,iBAAiB,CAAC;AAE1C,MAAI,CAAC,iBAAiB;AACpB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;;;ACrHA,8BAMO;AACP,sCAAuD;AACvD,iBAAkB;AAOlB,IAAM,uCACJ,uEAAuC,QAAQ;AAAA,EAC7C,kBAAkB;AAAA,EAClB,WAAW;AAAA,EACX,aAAa;AAAA,EACb,UAAU;AAAA,EACV,cAAc;AAAA,EACd,eAAe;AACjB,CAAC;AAMI,IAAM,wCAAwC,aAClD,YAAY;AAAA,EACX,WAAW,aAAE,OAAO;AAAA,EACpB,iBAAiB,qCAAqC,SAAS;AAAA,EAC/D,YAAY,aAAE,OAAO,aAAE,OAAO,GAAG,aAAE,IAAI,CAAC;AAAA,EACxC,OAAO,aAAE,OAAO;AAAA,EAChB,aAAa,aAAE,IAAI,EAAE,SAAS;AAAA,EAC9B,oBAAoB,aAAE,SAAS,aAAE,OAAO,CAAC;AAAA,EACzC,eAAe,aAAE,QAAQ,iBAAiB;AAAA,EAC1C,eAAe,aAAE,QAAQ,UAAU;AAAA,EACnC,cAAc,aAAE,IAAI;AAAA,EACpB,OAAO,aAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,OAAO,aAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,kBAAkB,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1D,6BAA6B,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EAC1D,cAAc,aAAE,OAAO,EAAE,SAAS;AACpC,CAAC,EACA;AAAA,EACC,aAAE,OAAO;AAAA,IACP,GAAG,oCAAY;AAAA,EACjB,CAAC;AACH;AAMF,IAAM,2CAA2C,aAAE,OAAO;AAAA,EACxD,KAAK;AAAA,EACL,KAAK,aAAE,OAAO;AAAA,EACd,KAAK;AACP,CAAC;AAEM,IAAM,2CACX,yCACG,OAAO;AAAA,EACN,aAAa;AACf,CAAC,EACA,MAAM;AAMJ,IAAM,2CACX,yCACG,OAAO;AAAA,EACN,aAAa,oCAAY,SAAS;AAAA,EAClC,KAAK,0CAAkB,SAAS;AAClC,CAAC,EACA,MAAM;;;AH0DX,IAAM,yCAAqC,iDAGzC;AAAA,EACA,CAAC,6CAAqB,IAAI,GAAG,OAAO,MAClC;AAAA,IACE;AAAA,IACA;AAAA,EACF;AAAA,EACF,CAAC,6CAAqB,IAAI,GAAG,OAAO,MAClC;AAAA,IACE;AAAA,IACA;AAAA,EACF;AAAA;AAAA,EAEF,CAAC,6CAAqB,IAAI,GAAG,OAAO,MAClC;AAAA,IACE;AAAA,IACA;AAAA,EACF;AACJ,CAAC;AAwBD,eAAsB,2BACpB,SAC2C;AAC3C,MAAI;AACF,WAAO,MAAM,mCAAmC,OAAO;AAAA,EACzD,SAAS,OAAO;AACd,QAAI,iBAAiB,yCAAiB;AACpC,YAAM,IAAI,YAAY,kCAAkC,MAAM,OAAO,EAAE;AAAA,IACzE;AACA,UAAM;AAAA,EACR;AACF;AAEA,eAAe,qCACb,SACA,cAGqD;AACrD,QAAM,EAAE,WAAW,KAAK,SAAS,eAAe,IAAI;AAEpD,QAAM,iCAA6B,gDAAuB,cAAc;AAAA,IACtE,OAAG,iDAAuB,IAAI,SAAS;AAAA,IACvC,KAAK;AAAA,EACP,CAAC;AAED,QAAM,kCAA8B;AAAA,IAClC;AAAA,IACA,QAAQ;AAAA,EACV;AAEA;AAAA,IACE,QAAQ,OAAO;AAAA,IACf,IAAI;AAAA,IACJ;AAAA,EACF;AAEA,4CAA0C;AAAA,IACxC,MAAM,QAAQ,UAAU;AAAA,IACxB,QAAQ;AAAA,IACR,SAAS;AAAA,EACX,CAAC;AAED,QAAM,uBAAuB,CAAC,IAAI,sBAAsB,MACpD,EAAE,GAAG,IAAI,sBAAsB,KAAK,IAAI,WAAW,IACnD,IAAI;AAER,QAAM,YAAY,UAAM,2CAAiB;AAAA,IACvC,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,SAAO;AAAA,IACL,sBAAsB;AAAA,MACpB;AAAA,MACA,UAAU;AAAA,IACZ;AAAA,IACA,4BAA4B,UAAU;AAAA,IACtC;AAAA,IACA,KAAK,EAAE,GAAG,KAAK,GAAG,UAAU;AAAA,EAC9B;AACF;AAEA,SAAS,8BACP,QACA,SACA;AACA,QAAM,MAAM,IAAI,IAAI,MAAM;AAE1B,QAAM,eAAe,IAAI,gBAAgB;AAAA,IACvC,GAAG,IAAI,aAAa,QAAQ;AAAA,IAC5B,OAAG,6CAAoB,OAAO,EAAE,QAAQ;AAAA,EAC1C,CAAC;AAED,MAAI,SAAS,aAAa,SAAS;AAEnC,SAAO,IAAI,SAAS;AACtB;AAEA,SAAS,yCACP,cACA,WACA,SACA;AACA,MAAI,iBAAiB,6CAAqB,MAAM;AAC9C;AAAA,EACF;AAEA,QAAM,EAAE,OAAO,IAAI,sBAAsB,QAAQ,SAAS;AAE1D,MAAI,0CAAuC,UAAU,WAAW,OAAO;AACrE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,MACE,0CACA,UAAU,WAAW,cACrB;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;;;AIhSA,oBAA0D;AAC1D,IAAAC,0BAKO;;;ACWA,SAAS,mCACd,QACA;AAEA,MAAI,OAAO,WAAW,OAAO,aAAa;AACxC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAGA,MAAI,CAAC,OAAO,WAAW,CAAC,OAAO,aAAa;AAC1C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAGA,MAAI,OAAO,oBAAoB;AAC7B,UAAMC,oBAAmB,OAAO,mBAAmB,YAAY;AAC/D,QAAIA,sBAAqB,SAASA,sBAAqB,QAAQ;AAC7D,YAAM,IAAI;AAAA,QACR,gCAAgC,OAAO,kBAAkB;AAAA,MAC3D;AAAA,IACF;AAAA,EACF;AAGA,MAAI,OAAO,sBAAsB,CAAC,OAAO,aAAa;AACpD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAGA,QAAM,mBAAmB,OAAO,qBAC3B,OAAO,mBAAmB,YAAY,IACvC;AAEJ,SAAO;AAAA,IACL,GAAG;AAAA,IACH,oBAAoB;AAAA,EACtB;AASF;;;AC1CA,eAAsB,6BACpB,SACe;AACf,QAAM,WAAW,MAAM,QAAQ,UAAU;AAAA,IACvC,QAAQ;AAAA,EACV;AAEA,aAAW,YAAY,QAAQ,WAAW;AACxC,QAAI,CAAC,SAAS,KAAK;AACjB;AAAA,IACF;AAEA;AAAA,MACE,EAAE,MAAM,SAAS,MAAM,KAAK,SAAS,IAAI;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,gCACP,UACA,UACA;AACA,QAAM,cAAc,iBAAiB,QAAQ;AAC7C,QAAM,cAAc,SAAS,eAAe,CAAC;AAC7C,QAAM,gBAAgB,YAAY;AAAA,IAChC,CAAC,eAAe,0BAA0B,UAAU,MAAM,YAAY;AAAA,EACxE;AACA,QAAM,cAAc,SAAS,eAAe,CAAC;AAC7C,QAAM,gBAAgB,YAAY;AAAA,IAAK,CAAC,eACtC,sBAAsB,YAAY,YAAY,QAAQ;AAAA,EACxD;AAEA,MAAI,iBAAiB,eAAe;AAClC;AAAA,EACF;AAEA,QAAM,IAAI;AAAA,IACR,GAAG,SAAS,IAAI;AAAA,EAClB;AACF;AAEA,SAAS,0BAA0B,KAAa;AAC9C,MAAI;AACF,WAAO,IAAI,IAAI,GAAG,EAAE;AAAA,EACtB,SAAS,OAAO;AACd,UAAM,IAAI,YAAY,2CAA2C,GAAG,IAAI;AAAA,MACtE,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACF;AAEA,SAAS,sBAAsB,YAAoB,UAAkB;AACnE,QAAM,uBAAuB,WAAW,YAAY;AACpD,QAAM,qBAAqB,SAAS,YAAY;AAEhD,MAAI,yBAAyB,oBAAoB;AAC/C,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,qBAAqB,SAAS,GAAG,GAAG;AACvC,WAAO;AAAA,EACT;AAEA,QAAM,gBAAgB,CAAC,GAAG,oBAAoB,EAAE;AAAA,IAC9C,CAAC,cAAc,cAAc;AAAA,EAC/B,EAAE;AACF,QAAM,YAAY,qBAAqB,MAAM,GAAG;AAChD,QAAM,iBAAiB,mBAAmB,MAAM,GAAG;AAEnD,SACE,kBAAkB,KAClB,UAAU,CAAC,MAAM,OACjB,UAAU,WAAW,eAAe,UACpC,UACG,MAAM,CAAC,EACP,MAAM,CAAC,OAAO,UAAU,UAAU,eAAe,QAAQ,CAAC,CAAC;AAElE;AAEA,SAAS,iBAAiB,UAAyC;AACjE,MAAI;AACF,WAAO,IAAI,IAAI,SAAS,GAAG;AAAA,EAC7B,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR,GAAG,SAAS,IAAI,wBAAwB,SAAS,GAAG;AAAA,MACpD,EAAE,OAAO,MAAM;AAAA,IACjB;AAAA,EACF;AACF;;;ACnHA,IAAAC,cAAc;AAMP,IAAM,iCAAiC,YAAAC,QAAE,YAAY;AAAA,EAC1D,WAAW,YAAAA,QAAE,OAAO;AAAA,EACpB,SAAS,YAAAA,QAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAC7B,aAAa,YAAAA,QAAE,IAAI,EAAE,SAAS;AAAA;AAAA,EAC9B,oBAAoB,YAAAA,QAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EACxC,OAAO,YAAAA,QAAE,OAAO,EAAE,SAAS;AAAA;AAC7B,CAAC;;;AH8FM,SAAS,mBAAmB,qBAA2C;AAC5E,QAAM,MAAM,IAAI,IAAI,mBAAmB;AAEvC,QAAM,YAAY;AAAA,IAChB,WAAW,IAAI,aAAa,IAAI,WAAW,KAAK;AAAA,IAChD,SAAS,IAAI,aAAa,IAAI,SAAS,KAAK;AAAA,IAC5C,aAAa,IAAI,aAAa,IAAI,aAAa,KAAK;AAAA,IACpD,oBAAoB,IAAI,aAAa,IAAI,oBAAoB,KAAK;AAAA,IAClE,OAAO,IAAI,aAAa,IAAI,OAAO,KAAK;AAAA,EAC1C;AAEA,QAAM,eAAe,+BAA+B,MAAM,SAAS;AACnE,QAAM,kBAAkB,mCAAmC,YAAY;AACvE,QAAM,SAAS,gBAAgB,UAAU,UAAU;AAEnD,SAAO;AAAA,IACL,UAAU,gBAAgB;AAAA,IAC1B,SAAS,gBAAgB;AAAA,IACzB,YAAY,gBAAgB;AAAA,IAC5B,kBACE,WAAW,cACN,gBAAgB,sBAAsB,QACvC;AAAA,EACR;AACF;AAYA,eAAsB,sBACpB,YACA,SAMiB;AACjB,QAAM,YAAQ,uCAAc,QAAQ,KAAK;AAGzC,QAAM,cAA2B;AAAA,IAC/B,QAAQ,QAAQ,OAAO,YAAY;AAAA,EACrC;AAGA,MAAI,QAAQ,WAAW,QAAQ;AAC7B,UAAM,WAAW,IAAI,gBAAgB;AAGrC,QAAI,QAAQ,gBAAgB;AAC1B,eAAS;AAAA,QACP;AAAA,QACA,KAAK,UAAU,QAAQ,cAAc;AAAA,MACvC;AAAA,IACF;AAGA,QAAI,QAAQ,aAAa;AACvB,eAAS,OAAO,gBAAgB,QAAQ,WAAW;AAAA,IACrD;AAEA,gBAAY,UAAU;AAAA,MACpB,gBAAgB;AAAA,IAClB;AACA,gBAAY,OAAO,SAAS,SAAS;AAAA,EACvC;AAEA,QAAM,WAAW,MAAM,MAAM,YAAY,WAAW;AAEpD,YAAM,0CAAiB,KAAK,iDAAyB,EAAE,QAAQ;AAE/D,SAAO,MAAM,SAAS,KAAK;AAC7B;AA0DA,eAAsB,0BACpB,SAC0C;AAC1C,MAAI;AACF,UAAM,eAAe,mBAAmB,QAAQ,mBAAmB;AAGnE,QAAI;AACJ,QAAI,aAAa,SAAS;AACxB,yBAAmB,aAAa;AAAA,IAClC,OAAO;AACL,UAAI,QAAQ,iBAAiB;AAC3B,cAAM,6BAA6B;AAAA,UACjC,WAAW,QAAQ,gBAAgB;AAAA,UACnC,aAAa,QAAQ,gBAAgB;AAAA,UACrC,WAAW;AAAA,YACT;AAAA,cACE,MAAM;AAAA,cACN,KAAK,aAAa;AAAA,YACpB;AAAA,UACF;AAAA,QACF,CAAC;AAAA,MACH;AAGA,yBAAmB,MAAM;AAAA,QACvB,aAAa;AAAA,QACb;AAAA,UACE,OAAO,QAAQ,UAAU;AAAA,UACzB,QAAQ,aAAa,oBAAoB;AAAA,UACzC,gBAAgB,QAAQ;AAAA,UACxB,aAAa,QAAQ;AAAA,QACvB;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,QAAQ,aAAa,UAAU,UAAU;AAAA,IAC3C;AAAA,EACF,SAAS,OAAO;AACd,QACE,iBAAiB,2CACjB,iBAAiB,qCACjB,iBAAiB,eACjB,iBAAiB,mDACjB;AACA,YAAM;AAAA,IACR;AAEA,UAAM,IAAI;AAAA,MACR,wDAAwD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IAChH;AAAA,EACF;AACF;;;AI3SA,IAAAC,iBAKO;AACP,IAAAC,2BAA0B;AAC1B,IAAAC,0BAMO;AA0CP,SAAS,4BAA4B,SAGvB;AACZ,QAAM,EAAE,QAAQ,QAAQ,IAAI;AAE5B,QAAM,EAAE,QAAQ,eAAe,IAAI,sBAAsB,QAAQ,SAAS;AAE1E,MACE,kEACA,sCACA;AACA,QAAI,CAAC,OAAO,KAAK;AACf,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL,KAAK,OAAO;AAAA,MACZ,KAAK,OAAO;AAAA,MACZ,QAAQ;AAAA,MACR,GAAI,OAAO,eAAe,EAAE,YAAY,OAAO,YAAY;AAAA,IAC7D;AAAA,EACF;AAEA,MAAI,gDAA6C;AAC/C,QAAI,CAAC,MAAM,QAAQ,OAAO,GAAG,KAAK,OAAO,IAAI,WAAW,GAAG;AACzD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL,KAAK,OAAO;AAAA,MACZ,KAAK,OAAO;AAAA,MACZ,QAAQ;AAAA,MACR,GAAI,OAAO,eAAe,EAAE,YAAY,OAAO,YAAY;AAAA,MAC3D,KAAK,OAAO;AAAA,IACd;AAAA,EACF;AAEA,QAAM,IAAI;AAAA,IACR,2FACE;AAAA,EACJ;AACF;AA0DA,eAAsB,sBACpB,SACuC;AACvC,MAAI;AACF,UAAM,mBAAe,2CAGnB,QAAQ,OAAO,sBAAsB;AAAA,MACrC,CAAC,6CAAqB,IAAI,GAAG,MAC3B;AAAA,MACF,CAAC,6CAAqB,IAAI,GAAG,MAC3B;AAAA,MACF,CAAC,6CAAqB,IAAI,GAAG,MAC3B;AAAA,IACJ,CAAC;AAED,UAAM,cAAU,oCAAU;AAAA,MACxB,oBAAoB;AAAA,MACpB;AAAA,MACA,KAAK,QAAQ;AAAA,MACb,eAAe;AAAA,IACjB,CAAC;AAED,QAAI,QAAQ,OAAO,yBAAyB,6CAAqB,MAAM;AACrE,YAAM,0CAA0C;AAAA,QAC9C,MAAM,QAAQ,WAAW;AAAA,QACzB,QAAQ,QAAQ;AAAA,QAChB,SAAS,QAAQ;AAAA,MACnB,CAAC;AAAA,IACH;AAEA,UAAM,MACJ,SAAS,QAAQ,UACjB,MAAM,QAAQ,QAAQ,OAAO,GAAG,KAChC,QAAQ,OAAO,IAAI,SAAS,IACvB,QAAQ,OAAO,MAChB;AAEN,QAAI,OAAO,QAAQ,WAAW,4BAA4B;AACxD,YAAM,6BAA6B;AAAA,QACjC,WAAW;AAAA,UACT,4BACE,QAAQ,UAAU;AAAA,QACtB;AAAA,QACA,aAAa,IAAI,CAAC;AAAA,QAClB,WAAW;AAAA,UACT,EAAE,MAAM,eAAe,KAAK,QAAQ,QAAQ,YAAY;AAAA,UACxD,EAAE,MAAM,gBAAgB,KAAK,QAAQ,QAAQ,aAAa;AAAA,QAC5D;AAAA,MACF,CAAC;AAAA,IACH;AAEA,QAAI,QAAQ,WAAW,WAAW;AAChC,YAAM,SAAS,4BAA4B;AAAA,QACzC,QAAQ,QAAQ;AAAA,QAChB,SAAS,QAAQ;AAAA,MACnB,CAAC;AAED,gBAAM,0BAAU;AAAA,QACd,SAAS,QAAQ;AAAA,QACjB,cAAc;AAAA,QACd,QAAQ,QAAQ;AAAA,QAChB,SAAS,QAAQ;AAAA,QACjB;AAAA,QACA,mBAAmB,QAAQ,UAAU;AAAA,MACvC,CAAC;AAAA,IACH;AAEA,WAAO;AAAA,MACL,QAAQ,QAAQ;AAAA,MAChB,SAAS,QAAQ;AAAA,MACjB,GAAI,OAAO;AAAA,QACT,iBAAiB;AAAA,UACf,iBAAiB,IAAI,CAAC;AAAA,UACtB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,QACE,iBAAiB,qDACjB,iBAAiB,2CACjB,iBAAiB,sCACjB,iBAAiB;AAEjB,YAAM;AACR,UAAM,IAAI;AAAA,MACR,mDAAmD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IAC3G;AAAA,EACF;AACF;;;ACzPA,IAAAC,0BAGO;;;ACAP,IAAAC,0BAAkC;;;ACW3B,SAAS,6BACd,MACA;AAAA,EACE;AAAA,EACA;AACF,GAIA;AACA,MAAI,KAAK;AACP,WAAO,KAAK,KAAK,KAAK,CAAC,QAAQ,IAAI,QAAQ,GAAG;AAAA,EAChD;AAEA,MAAI,cAAc,KAAK,KAAK;AAAA,IAC1B,CAAC,QAAQ,IAAI,OAAO,oBAAoB,SAAS,IAAI,GAAG;AAAA,EAC1D;AACA,MAAI,YAAY,WAAW,EAAG,eAAc,KAAK;AAEjD,MAAI,cAAc,YAAY,OAAO,CAAC,QAAQ,IAAI,QAAQ,KAAK;AAC/D,MAAI,YAAY,WAAW,GAAG;AAC5B,kBAAc,YAAY,OAAO,CAAC,QAAQ,IAAI,QAAQ,KAAK;AAAA,EAC7D;AAEA,SAAO,YAAY,SAAS,IAAI,YAAY,CAAC,IAAI,KAAK,KAAK,CAAC;AAC9D;;;ADjBA,SAAS,gBACP,WACA,WACA,UACQ;AACR,MAAI,CAAC,UAAW,QAAO,aAAa;AACpC,SACE,UAAU,KAAK,CAAC,MAAM,MAAM,SAAS,KACrC,UAAU,CAAC,KACX,aACA;AAEJ;AAOA,eAAsB,kBACpB,SAC4C;AAC5C,MAAI;AACF,UAAM,gBACJ,QAAQ,wCAAwC;AAClD,UAAM,gBACJ,QAAQ,wCAAwC;AAElD,UAAM,+BAA+B;AAAA,MACnC,OAAO,QAAQ,cAAc;AAAA,MAC7B,UAAU,QAAQ;AAAA,IACpB;AAEA,UAAM,gBAAgB,6BAA6B,QAAQ,gBAAgB;AAAA,MACzE,oBAAoB,CAAC,aAAa;AAAA,IACpC,CAAC;AACD,QAAI,CAAC,eAAe;AAClB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,cAAc,KAAK;AACtB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,MAAM;AAAA,MACV,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,IACF;AAEA,UAAM,MAAM;AAEZ,UAAM,aAAa,MAAM,QAAQ,UAAU,eAAe,EAAE;AAE5D,UAAM,eAA6B;AAAA,MACjC;AAAA,MACA,SAAK,2CAAkB,UAAU;AAAA,MACjC,SAAK,2CAAkB,QAAQ,cAAc,KAAK;AAAA,MAClD;AAAA,MACA,KAAK,cAAc;AAAA,MACnB,QAAQ;AAAA,MACR,WAAW;AAAA,IACb;AAEA,UAAM,EAAE,eAAe,SAAS,IAAI,IAAI,MAAM,QAAQ,UAAU;AAAA,MAC9D;AAAA,MACA,KAAK,UAAU,4BAA4B;AAAA,IAC7C;AAEA,WAAO;AAAA,MACL;AAAA,MACA,MAAM;AAAA,QACJ,eAAe;AAAA,QACf,aAAa;AAAA,MACf;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,QAAI,iBAAiB,kCAAkC;AACrD,YAAM;AAAA,IACR;AACA,UAAM,IAAI;AAAA,MACR,4DAA4D,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IACpH;AAAA,EACF;AACF;;;AE5FA,eAAsB,4BACpB,SAC4C;AAC5C,QAAM,EAAE,cAAc,IAAI;AAC1B,QAAM,iBAAiB,cAAc;AACrC,QAAM,EAAE,QAAQ,eAAe,IAAI;AAAA,IACjC,cAAc;AAAA,EAChB;AAEA,MAAI,kDAA+C,CAAC,gBAAgB;AAClE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAKA,QAAM,0BACJ,iEACI,SACA;AAEN,QAAM,iBAAiB,0BACnB,wBAAwB,OACxB,QAAQ,OAAO;AAEnB,QAAM,qBACJ,yBAAyB,2CACzB,QAAQ,OAAO;AAEjB,SAAO,kBAAkB;AAAA,IACvB,sCACE,QAAQ;AAAA,IACV,sCACE,QAAQ;AAAA,IACV,WAAW,QAAQ;AAAA,IACnB;AAAA,IACA;AAAA,IACA,eAAe,QAAQ;AAAA,IACvB,UAAU,QAAQ;AAAA,EACpB,CAAC;AACH;;;ACvCA,eAAsBC,6BACpB,SAC4C;AAC5C,QAAM,EAAE,cAAc,IAAI;AAC1B,QAAM,iBAAiB,cAAc;AACrC,QAAM,EAAE,QAAQ,eAAe,IAAI;AAAA,IACjC,cAAc;AAAA,EAChB;AAEA,MAAI,kDAA+C,CAAC,gBAAgB;AAClE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,iBAAiB,gBAAgB,QAAQ,QAAQ,OAAO;AAE9D,QAAM,qBACJ,gBAAgB,2CAChB,QAAQ,OAAO;AAEjB,SAAO,kBAAkB;AAAA,IACvB,sCACE,QAAQ;AAAA,IACV,sCACE,QAAQ;AAAA,IACV,WAAW,QAAQ;AAAA,IACnB;AAAA,IACA;AAAA,IACA,eAAe,QAAQ;AAAA,IACvB,UAAU,QAAQ;AAAA,EACpB,CAAC;AACH;;;AJ9BA,IAAM,0CAAsC,iDAG1C;AAAA,EACA,CAAC,6CAAqB,IAAI,GAAG,CAAC;AAAA;AAAA,IAEvB;AAAA,MACH;AAAA,IACF;AAAA;AAAA,EACF,CAAC,6CAAqB,IAAI,GAAG,CAAC,MACvB;AAAA,IACH;AAAA,EACF;AAAA,EACF,CAAC,6CAAqB,IAAI,GAAG,CAAC,MACvBC;AAAA,IACH;AAAA,EACF;AACJ,CAAC;AAgBD,eAAsBA,6BACpB,SAC4C;AAC5C,SAAO,oCAAoC,OAAO;AACpD;;;AK3DA,IAAAC,0BAQO;;;ACTP,IAAAC,cAAc;;;ACAd,IAAAC,cAAkB;AAEX,IAAM,WAAW,cAAE;AAAA,EACxB,cAAE,OAAO;AAAA,EACT,cAAE,OAAO,EAAE,GAAG,cAAE,MAAM,cAAE,OAAO,CAAC,EAAE,SAAS,CAAC;AAAA,EAC5C;AAAA,IACE,SACE;AAAA,EACJ;AACF;;;ADLO,IAAM,kCAAkC,YAAAC,QAAE,OAAO;AAAA,EACtD,OAAO,YAAAA,QAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,UAAU;AACZ,CAAC;AAMM,IAAM,wCAAwC,YAAAA,QAAE,OAAO;AAAA,EAC5D,cAAc,YAAAA,QAAE,IAAI,EAAE,SAAS;AACjC,CAAC;;;AD+CD,eAAsB,2BACpB,SAC+C;AAC/C,MAAI;AACF,QAAI,QAAQ,iBAAiB;AAC3B,YAAM,6BAA6B;AAAA,QACjC,WAAW,QAAQ,gBAAgB;AAAA,QACnC,aAAa,QAAQ,gBAAgB;AAAA,QACrC,WAAW;AAAA,UACT,EAAE,MAAM,gBAAgB,KAAK,QAAQ,wBAAwB;AAAA,QAC/D;AAAA,MACF,CAAC;AAAA,IACH;AAEA,UAAM,YAAQ,uCAAc,QAAQ,UAAU,KAAK;AACnD,UAAM,8BAA8B,MAAM;AAAA,MACxC,QAAQ;AAAA,MACR;AAAA,QACE,MAAM,IAAI,gBAAgB;AAAA,UACxB,UAAU,QAAQ;AAAA,QACpB,CAAC;AAAA,QACD,SAAS;AAAA,UACP,CAAC,gCAAQ,YAAY,GAAG,sCAAc;AAAA,QACxC;AAAA,QACA,QAAQ;AAAA,MACV;AAAA,IACF;AAEA,cAAM;AAAA,MACJ;AAAA,MACA;AAAA,IACF,EAAE,2BAA2B;AAE7B,UAAM,kCACJ,MAAM,4BAA4B,KAAK;AAGzC,UAAM,wCAAoC;AAAA,MACxC;AAAA,MACA;AAAA,IACF;AAEA,QAAI,QAAQ,iBAAiB;AAC3B,YAAM,6BAA6B;AAAA,QACjC,WAAW,QAAQ,gBAAgB;AAAA,QACnC,aAAa,QAAQ,gBAAgB;AAAA,QACrC,WAAW;AAAA,UACT;AAAA,YACE,MAAM;AAAA,YACN,KAAK,kCAAkC;AAAA,UACzC;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAEA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QACE,iBAAiB,qDACjB,iBAAiB,2CACjB,iBAAiB,iCACjB;AACA,YAAM;AAAA,IACR;AACA,UAAM,IAAI;AAAA,MACR,oDAAoD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IAC5G;AAAA,EACF;AACF;;;AGjIA,IAAAC,2BAAuC;;;ACDvC,IAAAC,2BAKO;AACP,IAAAC,2BAAuC;AACvC,IAAAC,cAAc;;;ACPd,IAAAC,0BAAoD;AAW7C,SAAS,aAAa,SAAkB;AAC7C,aAAO;AAAA,IACL;AAAA,QACA,qCAAY,OAAO;AAAA,IACnB;AAAA,EACF;AACF;;;ACcO,SAAS,8CACd,SAC8C;AAC9C,QAAM,EAAE,6BAA6B,6BAA6B,IAAI;AAEtE,MACE,4BAA4B,UAAU,6BAA6B,OACnE;AACA,UAAM,IAAI,YAAY,kDAAkD;AAAA,EAC1E;AAEA,QAAM,gBAAgB,aAAa,6BAA6B,QAAQ;AAExE,SAAO;AAAA,IACL;AAAA,IACA,OAAO,4BAA4B;AAAA,EACrC;AACF;;;AChDA,IAAAC,iBAAiC;AACjC,IAAAC,2BASO;AACP,IAAAC,0BAA8C;AAC9C,IAAAC,cAAc;;;ACZd,IAAAC,2BAAwC;AACxC,IAAAC,cAAkB;AAEX,IAAM,cAAc,cAAE,OAAO;AAAA,EAClC,GAAG,oCAAW;AAAA,EACd,KAAK,cAAE,OAAO,EAAE,SAAS;AAAA,EACzB,KAAK,cAAE,OAAO,EAAE,SAAS;AAAA,EACzB,KAAK,cAAE,OAAO;AAChB,CAAC;AAIM,IAAM,uBAAuB,cAAE,OAAO;AAAA,EAC3C,GAAG,oCAAW;AAAA,EACd,KAAK,cAAE,OAAO,EAAE,SAAS;AAAA,EACzB,KAAK,cAAE,OAAO,EAAE,SAAS;AAAA,EACzB,KAAK,cAAE,OAAO,EAAE,SAAS;AAAA,EACzB,KAAK,cAAE,OAAO;AAChB,CAAC;AAIM,IAAM,6BAA6B,cAAE,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtD,GAAG,qCAAY;AAAA,EACf,GAAG,qCAAY,KAAK,EAAE,KAAK,MAAM,KAAK,MAAM,KAAK,KAAK,CAAC,EAAE,SAAS,EAAE;AAAA,EACpE,OAAO,cAAE,SAAS,cAAE,OAAO,CAAC;AAC9B,CAAC;AAMM,IAAM,0CAA0C,cAAE,YAAY;AAAA,EACnE,GAAG,qCAAY;AAAA,EACf,OAAO,cAAE,SAAS,cAAE,OAAO,CAAC;AAC9B,CAAC;;;ADbM,IAAK,WAAL,kBAAKC,cAAL;AACL,EAAAA,UAAA,eAAY;AACZ,EAAAA,UAAA,YAAS;AACT,EAAAA,UAAA,qBAAkB;AAHR,SAAAA;AAAA,GAAA;AAMZ,IAAM,sCAAsC,OAAO,YAI7C;AACJ,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AAEJ,MAAI;AACJ,QAAM,EAAE,OAAO,QAAI,0CAAgB;AAAA,IACjC,cAAc;AAAA,IACd,KAAK;AAAA,EACP,CAAC;AAED,QAAM,OAAO,4BAA4B,iBAAiB;AAE1D,MAAI,MAAM;AACR,oBAAgB,6BAA6B,MAAM,EAAE,KAAK,OAAO,IAAI,CAAC;AAAA,EACxE;AAEA,QAAM,SAAS,MAAM,UAAU,WAAW,8BAA8B;AAAA,IACtE,KAAK;AAAA,EACP,CAAC;AAED,MAAI,CAAC,OAAO,WAAW;AACrB,UAAM,IAAI,qCAAY,uCAAuC;AAAA,EAC/D;AAEA,SAAO;AAAA,IACL,eAAe,OAAO;AAAA,IACtB,SAAS,OAAO;AAAA,EAClB;AACF;AAwDA,eAAsB,gCACpB,SACA;AACA,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AAEJ,QAAM,yBAAyB,qCAAY;AAAA,IACzC;AAAA,EACF,EAAE;AACF,QAAM,uBAAuB,yBACzB,MAAM,oCAAoC;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,IACD,EAAE,eAAe,QAAW,SAAS,6BAA6B;AAEtE,QAAM,mBAAmB,qCAAY;AAAA,IACnC,qBAAqB;AAAA,EACvB,EAAE;AAEF,MAAI,CAAC,0BAA0B,CAAC,kBAAkB;AAChD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AAIJ,MAAI,kBAAkB;AACpB,UAAM,EAAE,QAAQ,oBAAoB,SAAS,WAAW,QAAI,oCAAU;AAAA,MACpE,oBAAoB;AAAA,MACpB,cAAc,YAAAC,QAAE,OAAO,EAAE,GAAG,oCAAW,OAAO,KAAK,YAAAA,QAAE,OAAO,EAAE,CAAC;AAAA,MAC/D,KAAK,qBAAqB;AAAA,IAC5B,CAAC;AAED,UAAM,WAAW,2BAA2B,MAAM,UAAU;AAC5D,UAAM,gBAAY,iCAAiB;AAAA,MACjC,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,UAAM,qBAAqB,MAAM,QAAQ,UAAU,UAAU,WAAW;AAAA,MACtE,SAAS,qBAAqB;AAAA,MAC9B,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,QAAI,CAAC,mBAAmB,UAAU;AAChC,YAAM,IAAI,qCAAY,kCAAkC;AAAA,IAC1D;AAEA,UAAM,mBAAmB,4BAA4B;AACrD,UAAM,iBAAiB,4BAA4B;AACnD,QAAI,SAAS,QAAQ,kBAAkB;AACrC,YAAM,IAAI;AAAA,QACR,4CAA4C,SAAS,GAAG,oBAAoB,gBAAgB;AAAA,MAC9F;AAAA,IACF;AAEA,QAAI,kBAAkB,SAAS,QAAQ,gBAAgB;AACrD,YAAM,IAAI;AAAA,QACR,4CAA4C,SAAS,GAAG,oBAAoB,cAAc;AAAA,MAC5F;AAAA,IACF;AAEA,UAAM,MAAM,QAAQ,OAAO,oBAAI,KAAK;AACpC,UAAM,aAAa,KAAK,MAAM,IAAI,QAAQ,IAAI,GAAI;AAClD,QAAI,SAAS,MAAM,YAAY;AAC7B,YAAM,IAAI,qCAAY,iCAAiC;AAAA,IACzD;AAEA,QAAI,SAAS,QAAQ,UAAa,SAAS,MAAM,YAAY;AAC3D,YAAM,IAAI,qCAAY,uCAAuC;AAAA,IAC/D;AAEA,gCAA4B;AAAA,EAC9B,OAAO;AACL,UAAM,sBAAkB;AAAA,MACtB,qBAAqB;AAAA,MACrB;AAAA,IACF;AACA,gCACE,wCAAwC,MAAM,eAAe;AAAA,EACjE;AAEA,QAAM,OACJ,0BAA0B,mBACtB,0CACA,yBACE,8BACA;AAER,QAAM,SAAS,0BAA0B;AAEzC,SAAO;AAAA,IACL,eAAe,qBAAqB;AAAA,IACpC;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;;;AHxLA,eAAsB,+BACpB,SAC2C;AAC3C,QAAM,EAAE,6BAA6B,WAAW,iBAAiB,IAAI,IACnE;AAEF,QAAM,mCAA+B;AAAA,IACnC,YAAAC,QAAE,MAAM,CAAC,sCAAa,oCAAW,CAAC;AAAA,IAClC;AAAA,IACA;AAAA,EACF;AAEA,QAAM,uBAAuB,MAAM,gCAAgC;AAAA,IACjE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,EAAE,QAAQ,WAAW,QAAI,0CAAgB;AAAA,IAC7C,cAAc;AAAA,IACd,KAAK;AAAA,EACP,CAAC;AAED,QAAM,mCAA+B;AAAA,IACnC;AAAA,IACA,qBAAqB;AAAA,IACrB;AAAA,EACF;AAEA,QAAM,4BACJ,8CAA8C;AAAA,IAC5C;AAAA,IACA;AAAA,EACF,CAAC;AAEH,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,eAAe,4BAA4B;AAAA,IAC3C,MAAM,EAAE,GAAG,sBAAsB,WAAW;AAAA,EAC9C;AACF;;;ADpCA,eAAsB,2BACpB,SAC2C;AAC3C,QAAM,EAAE,6BAA6B,uBAAuB,UAAU,IACpE;AAEF,MAAI,sBAAsB,UAAU;AAClC,QAAI,OAAO,sBAAsB,aAAa,UAAU;AACtD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,WAAO,+BAA+B;AAAA,MACpC;AAAA,MACA;AAAA,MACA,iBAAiB,sBAAsB;AAAA,IACzC,CAAC;AAAA,EACH;AAEA,QAAM,mCAA+B;AAAA,IACnC;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,QAAM,6BACJ,8CAA8C;AAAA,IAC5C;AAAA,IACA;AAAA,EACF,CAAC;AAEH,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,eAAe,4BAA4B;AAAA,EAC7C;AACF;;;AlBrEA,uBAKO;","names":["createAuthorizationResponse","import_io_wallet_oauth2","import_io_wallet_utils","ClientIdPrefix","import_io_wallet_utils","normalizedMethod","import_zod","z","import_oauth2","import_io_wallet_oauth2","import_io_wallet_utils","import_io_wallet_utils","import_io_wallet_utils","createAuthorizationResponse","createAuthorizationResponse","import_io_wallet_utils","import_zod","import_zod","z","import_io_wallet_utils","import_io_wallet_oauth2","import_io_wallet_utils","import_zod","import_io_wallet_utils","import_oauth2","import_io_wallet_oauth2","import_io_wallet_utils","import_zod","import_io_wallet_oauth2","import_zod","JarmMode","z","z"]}
+{"version":3,"sources":["../src/index.ts","../src/authorization-request/create-authorization-request.ts","../src/errors.ts","../src/authorization-request/client-id-prefix.ts","../src/authorization-request/z-authorization-request.ts","../src/authorization-request/fetch-authorization-request.ts","../src/authorization-request/validate-authorization-request.ts","../src/authorization-request/validate-certificate-endpoints.ts","../src/authorization-request/z-authorization-request-url.ts","../src/authorization-request/parse-authorization-request.ts","../src/authorization-response/create-authorization-response.ts","../src/authorization-response/build-jarm-response.ts","../src/jarm/jarm-extract-jwks.ts","../src/authorization-response/v1.3/create-authorization-response.ts","../src/authorization-response/v1.4/create-authorization-response.ts","../src/authorization-response/fetch-authorization-response.ts","../src/authorization-response/z-authorization-response.ts","../src/vp-token/z-vp-token.ts","../src/authorization-response/parse-authorization-response.ts","../src/jarm/parse-jarm-authorization-response.ts","../src/vp-token/parse-vp-token.ts","../src/authorization-response/validate-authorization-response.ts","../src/jarm/verify-jarm-authorization-response.ts","../src/jarm/z-jarm.ts"],"sourcesContent":["export * from \"./authorization-request/create-authorization-request\";\nexport * from \"./authorization-request/fetch-authorization-request\";\nexport * from \"./authorization-request/parse-authorization-request\";\nexport * from \"./authorization-request/validate-authorization-request\";\nexport * from \"./authorization-request/validate-certificate-endpoints\";\nexport * from \"./authorization-request/z-authorization-request\";\nexport * from \"./authorization-request/z-authorization-request-url\";\nexport * from \"./authorization-response/create-authorization-response\";\nexport * from \"./authorization-response/fetch-authorization-response\";\nexport * from \"./authorization-response/parse-authorization-response\";\nexport * from \"./authorization-response/validate-authorization-response\";\nexport * from \"./authorization-response/z-authorization-response\";\nexport * from \"./errors\";\nexport * from \"./jarm/jarm-extract-jwks\";\nexport * from \"./jarm/parse-jarm-authorization-response\";\nexport * from \"./jarm/verify-jarm-authorization-response\";\nexport * from \"./jarm/z-jarm\";\nexport * from \"./vp-token/parse-vp-token\";\nexport * from \"./vp-token/z-vp-token\";\n\nexport {\n  type CreateOpenid4vpAuthorizationResponseOptions,\n  type CreateOpenid4vpAuthorizationResponseResult,\n  type VpToken,\n  createOpenid4vpAuthorizationResponse,\n} from \"@openid4vc/openid4vp\";\n","import {\n  type CallbackContext,\n  type CreateJarRequestOptions,\n  CreateJarRequestResult,\n  JarAuthorizationRequest,\n  JwtSignerFederation,\n  JwtSignerX5c,\n  createJarRequest,\n  jwtHeaderFromJwtSigner,\n  signedAuthorizationRequestJwtHeaderTyp,\n} from \"@pagopa/io-wallet-oauth2\";\nimport {\n  IoWalletSdkConfig,\n  ItWalletSpecsVersion,\n  ValidationError,\n  createVersionDispatcher,\n  objectToQueryParams,\n  parseWithErrorHandling,\n} from \"@pagopa/io-wallet-utils\";\n\nimport { Oid4vpError } from \"../errors\";\nimport {\n  ClientIdPrefix,\n  extractClientIdPrefix,\n  validateAuthorizationRequestClientBinding,\n} from \"./client-id-prefix\";\nimport {\n  Openid4vpAuthorizationRequestPayload,\n  zOpenid4vpAuthorizationRequestHeaderV1_0,\n  zOpenid4vpAuthorizationRequestHeaderV1_3,\n  zOpenid4vpAuthorizationRequestPayload,\n} from \"./z-authorization-request\";\n\ntype BaseJarOptions<TSigner extends JwtSignerFederation | JwtSignerX5c> = {\n  jwtSigner: TSigner;\n} & Pick<\n  CreateJarRequestOptions,\n  \"additionalJwtPayload\" | \"expiresInSeconds\" | \"now\" | \"requestUri\"\n>;\n\nexport type JarOptionsV1_0 = BaseJarOptions<JwtSignerFederation>;\n\nexport type JarOptionsV1_3 = BaseJarOptions<JwtSignerFederation | JwtSignerX5c>;\n\nexport type JarOptionsV1_4 = JarOptionsV1_3;\n\ntype JarOptions = JarOptionsV1_0 | JarOptionsV1_3 | JarOptionsV1_4;\n\ninterface BaseCreateAuthorizationRequestOptions<\n  V extends ItWalletSpecsVersion,\n  TJar extends JarOptions,\n> {\n  /**\n   * Authorization request payload to be validated and serialized.\n   */\n  authorizationRequestPayload: Openid4vpAuthorizationRequestPayload;\n\n  /**\n   * Required callbacks used to create a signed/encrypted Request Object.\n   */\n  callbacks: Partial<Pick<CallbackContext, \"encryptJwe\">> &\n    Partial<Pick<CallbackContext, \"hash\">> &\n    Pick<CallbackContext, \"signJwt\">;\n\n  config: IoWalletSdkConfig<V>;\n\n  /**\n   * The request is generated as a JAR authorization request.\n   * When `additionalJwtPayload.aud` is missing, it is set to `requestUri`.\n   */\n  jar: TJar;\n\n  /**\n   * Authorization request URL scheme.\n   * @default \"openid4vp://\"\n   */\n  scheme?: string;\n}\n\n/**\n * Options for creating an OpenID4VP authorization request URL.\n */\nexport type CreateAuthorizationRequestOptionsV1_0 =\n  BaseCreateAuthorizationRequestOptions<\n    ItWalletSpecsVersion.V1_0,\n    JarOptionsV1_0\n  >;\n\nexport type CreateAuthorizationRequestOptionsV1_3 =\n  BaseCreateAuthorizationRequestOptions<\n    ItWalletSpecsVersion.V1_3,\n    JarOptionsV1_3\n  >;\n\nexport type CreateAuthorizationRequestOptionsV1_4 =\n  BaseCreateAuthorizationRequestOptions<\n    ItWalletSpecsVersion.V1_4,\n    JarOptionsV1_4\n  >;\n\nexport type CreateAuthorizationRequestOptions =\n  | CreateAuthorizationRequestOptionsV1_0\n  | CreateAuthorizationRequestOptionsV1_3\n  | CreateAuthorizationRequestOptionsV1_4;\n\ninterface BaseCreateAuthorizationRequestResult<TJar extends JarOptions> {\n  authorizationRequest: string;\n  authorizationRequestObject: JarAuthorizationRequest;\n  authorizationRequestPayload: Openid4vpAuthorizationRequestPayload;\n  jar: CreateJarRequestResult & TJar;\n}\n\nexport type CreateAuthorizationRequestResultV1_0 =\n  BaseCreateAuthorizationRequestResult<JarOptionsV1_0>;\n\nexport type CreateAuthorizationRequestResultV1_3 =\n  BaseCreateAuthorizationRequestResult<JarOptionsV1_3>;\n\nexport type CreateAuthorizationRequestResultV1_4 =\n  BaseCreateAuthorizationRequestResult<JarOptionsV1_4>;\n\nexport type CreateAuthorizationRequestResult =\n  | CreateAuthorizationRequestResultV1_0\n  | CreateAuthorizationRequestResultV1_3\n  | CreateAuthorizationRequestResultV1_4;\n\n/**\n * Creates an OpenID4VP authorization request URL.\n *\n * This function creates a JAR request object through\n * `createJarRequest` and serializes it into the URL query parameters.\n *\n * @param options {@link CreateAuthorizationRequestOptions}\n * @returns Authorization request URL plus request object details used to build it\n * @throws When authorization request payload validation fails\n * @throws When JAR creation fails\n */\nconst dispatchCreateAuthorizationRequest = createVersionDispatcher<\n  CreateAuthorizationRequestOptions,\n  Promise<CreateAuthorizationRequestResult>\n>({\n  [ItWalletSpecsVersion.V1_0]: async (o) =>\n    createAuthorizationRequestWithHeader(\n      o as CreateAuthorizationRequestOptionsV1_0,\n      zOpenid4vpAuthorizationRequestHeaderV1_0,\n    ),\n  [ItWalletSpecsVersion.V1_3]: async (o) =>\n    createAuthorizationRequestWithHeader(\n      o as CreateAuthorizationRequestOptionsV1_3,\n      zOpenid4vpAuthorizationRequestHeaderV1_3,\n    ),\n  // V1_4 reuses the V1_3 JAR header schema; the conditional x5c rule is a normative 1.4.4 LTS backport.\n  [ItWalletSpecsVersion.V1_4]: async (o) =>\n    createAuthorizationRequestWithHeader(\n      o as CreateAuthorizationRequestOptionsV1_4,\n      zOpenid4vpAuthorizationRequestHeaderV1_3,\n    ),\n});\n\n/**\n * Creates an OpenID4VP authorization request URL for the configured IT-Wallet version.\n *\n * This function creates a JAR request object through `createJarRequest` and\n * serializes it into authorization request URL query parameters.\n *\n * @param options - Version-specific authorization request creation options.\n * @returns Authorization request URL plus request object details used to build it.\n * @throws {Oid4vpError} If authorization request payload validation fails.\n */\nexport async function createAuthorizationRequest(\n  options: CreateAuthorizationRequestOptionsV1_0,\n): Promise<CreateAuthorizationRequestResultV1_0>;\n\nexport async function createAuthorizationRequest(\n  options: CreateAuthorizationRequestOptionsV1_3,\n): Promise<CreateAuthorizationRequestResultV1_3>;\n\nexport async function createAuthorizationRequest(\n  options: CreateAuthorizationRequestOptionsV1_4,\n): Promise<CreateAuthorizationRequestResultV1_4>;\n\nexport async function createAuthorizationRequest(\n  options: CreateAuthorizationRequestOptions,\n): Promise<CreateAuthorizationRequestResult> {\n  try {\n    return await dispatchCreateAuthorizationRequest(options);\n  } catch (error) {\n    if (error instanceof ValidationError) {\n      throw new Oid4vpError(`Invalid authorization request: ${error.message}`);\n    }\n    throw error;\n  }\n}\n\nasync function createAuthorizationRequestWithHeader<TJar extends JarOptions>(\n  options: BaseCreateAuthorizationRequestOptions<ItWalletSpecsVersion, TJar>,\n  headerSchema:\n    | typeof zOpenid4vpAuthorizationRequestHeaderV1_0\n    | typeof zOpenid4vpAuthorizationRequestHeaderV1_3,\n): Promise<BaseCreateAuthorizationRequestResult<TJar>> {\n  const { callbacks, jar, scheme = \"openid4vp://\" } = options;\n\n  const authorizationRequestHeader = parseWithErrorHandling(headerSchema, {\n    ...jwtHeaderFromJwtSigner(jar.jwtSigner),\n    typ: signedAuthorizationRequestJwtHeaderTyp,\n  });\n\n  const authorizationRequestPayload = parseWithErrorHandling(\n    zOpenid4vpAuthorizationRequestPayload,\n    options.authorizationRequestPayload,\n  );\n\n  validateJarSignerForAuthorizationRequest(\n    options.config.itWalletSpecsVersion,\n    jar.jwtSigner,\n    authorizationRequestPayload,\n  );\n\n  validateAuthorizationRequestClientBinding({\n    hash: options.callbacks.hash,\n    header: authorizationRequestHeader,\n    payload: authorizationRequestPayload,\n  });\n\n  const additionalJwtPayload = !jar.additionalJwtPayload?.aud\n    ? { ...jar.additionalJwtPayload, aud: jar.requestUri }\n    : jar.additionalJwtPayload;\n\n  const jarResult = await createJarRequest({\n    ...jar,\n    additionalJwtPayload,\n    authorizationRequestHeader,\n    authorizationRequestPayload,\n    callbacks,\n  });\n\n  return {\n    authorizationRequest: createAuthorizationRequestUrl(\n      scheme,\n      jarResult.jarAuthorizationRequest,\n    ),\n    authorizationRequestObject: jarResult.jarAuthorizationRequest,\n    authorizationRequestPayload,\n    jar: { ...jar, ...jarResult },\n  };\n}\n\nfunction createAuthorizationRequestUrl(\n  scheme: string,\n  request: JarAuthorizationRequest,\n) {\n  const url = new URL(scheme);\n\n  const searchParams = new URLSearchParams([\n    ...url.searchParams.entries(),\n    ...objectToQueryParams(request).entries(),\n  ]);\n\n  url.search = searchParams.toString();\n\n  return url.toString();\n}\n\nfunction validateJarSignerForAuthorizationRequest(\n  specsVersion: ItWalletSpecsVersion,\n  jwtSigner: JwtSignerFederation | JwtSignerX5c,\n  payload: Openid4vpAuthorizationRequestPayload,\n) {\n  if (specsVersion === ItWalletSpecsVersion.V1_0) {\n    return;\n  }\n\n  const { prefix } = extractClientIdPrefix(payload.client_id);\n\n  if (prefix === ClientIdPrefix.X509_HASH && jwtSigner.method !== \"x5c\") {\n    throw new Oid4vpError(\n      \"x509_hash client_id requires a JAR signer with method x5c\",\n    );\n  }\n\n  if (\n    prefix !== ClientIdPrefix.X509_HASH &&\n    jwtSigner.method !== \"federation\"\n  ) {\n    throw new Oid4vpError(\n      \"openid_federation and legacy client_id values require a JAR signer with method federation\",\n    );\n  }\n}\n","/**\n * Generic error thrown during Oid4vp operations\n */\nexport class Oid4vpError extends Error {\n  readonly statusCode?: number;\n  constructor(\n    message: string,\n    options?: { statusCode?: number } & ErrorOptions,\n  ) {\n    super(message, options);\n    this.name = \"Oid4vpError\";\n    this.statusCode = options?.statusCode;\n  }\n}\n\n/**\n * Error thrown by {@link parseAuthorizeRequest} when the passed\n * request object has an invalid signature or unexpected errors\n * are thrown\n */\nexport class ParseAuthorizeRequestError extends Oid4vpError {\n  readonly statusCode?: number;\n  constructor(\n    message: string,\n    options?: { statusCode?: number } & ErrorOptions,\n  ) {\n    super(message, options);\n    this.name = \"ParseAuthorizeRequestError\";\n    this.statusCode = options?.statusCode;\n  }\n}\n\n/**\n * Error thrown by {@link fetchAuthorizationResponse}\n */\nexport class FetchAuthorizationResponseError extends Oid4vpError {\n  readonly statusCode?: number;\n  constructor(\n    message: string,\n    options?: { statusCode?: number } & ErrorOptions,\n  ) {\n    super(message, options);\n    this.name = \"FetchAuthorizationResponseError\";\n    this.statusCode = options?.statusCode;\n  }\n}\n\n/**\n * Error thrown by {@link createAuthorizationResponse} in case there\n * are unexpected errors.\n */\nexport class CreateAuthorizationResponseError extends Oid4vpError {\n  readonly statusCode?: number;\n  constructor(\n    message: string,\n    options?: { statusCode?: number } & ErrorOptions,\n  ) {\n    super(message, options);\n    this.name = \"CreateAuthorizationResponseError\";\n    this.statusCode = options?.statusCode;\n  }\n}\n\n/**\n * Error thrown when request_uri_method parameter has an invalid value.\n * Valid values are \"get\" or \"post\" (case-insensitive).\n */\nexport class InvalidRequestUriMethodError extends Oid4vpError {\n  constructor(message: string, options?: ErrorOptions) {\n    super(message, options);\n    this.name = \"InvalidRequestUriMethodError\";\n  }\n}\n","import {\n  HashAlgorithm,\n  type HashCallback,\n  decodeBase64,\n  encodeToBase64Url,\n} from \"@pagopa/io-wallet-utils\";\n\nimport { Oid4vpError, ParseAuthorizeRequestError } from \"../errors\";\nimport {\n  Openid4vpAuthorizationRequestHeaderV1_3,\n  Openid4vpAuthorizationRequestPayload,\n} from \"./z-authorization-request\";\n\nexport enum ClientIdPrefix {\n  NONE = \"none\",\n  OPENID_FEDERATION = \"openid_federation\",\n  X509_HASH = \"x509_hash\",\n}\n\nexport interface ClientIdParts {\n  clientId: string;\n  prefix: ClientIdPrefix;\n}\n\nexport interface CreateX509HashClientIdOptions {\n  certificateChain: string[];\n  hash: HashCallback;\n}\n\nexport function extractClientIdPrefix(clientId: string): ClientIdParts {\n  const colonIndex = clientId.indexOf(\":\");\n\n  if (colonIndex === -1) {\n    return { clientId, prefix: ClientIdPrefix.NONE };\n  }\n\n  if (clientId.startsWith(\"https://\") || clientId.startsWith(\"http://\")) {\n    return { clientId, prefix: ClientIdPrefix.NONE };\n  }\n\n  const rawPrefix = clientId.slice(0, colonIndex);\n  const rest = clientId.slice(colonIndex + 1);\n\n  if (rawPrefix === ClientIdPrefix.X509_HASH) {\n    return { clientId: rest, prefix: ClientIdPrefix.X509_HASH };\n  }\n  if (rawPrefix === ClientIdPrefix.OPENID_FEDERATION) {\n    return { clientId: rest, prefix: ClientIdPrefix.OPENID_FEDERATION };\n  }\n\n  throw new Oid4vpError(\n    `Unsupported client_id prefix \"${rawPrefix}\": only \"openid_federation\" and \"x509_hash\" are allowed by the IT-Wallet profile`,\n  );\n}\n\nexport async function createX509HashClientId(\n  options: CreateX509HashClientIdOptions,\n): Promise<string> {\n  return `${ClientIdPrefix.X509_HASH}:${await calculateX509CertificateHash(options)}`;\n}\n\nasync function calculateX509CertificateHash(\n  options: CreateX509HashClientIdOptions,\n) {\n  const leafCertificate = getLeafCertificate(options.certificateChain);\n\n  return encodeToBase64Url(\n    await options.hash(decodeBase64(leafCertificate), HashAlgorithm.Sha256),\n  );\n}\n\nexport async function validateAuthorizationRequestClientBinding(options: {\n  hash?: HashCallback;\n  header: Openid4vpAuthorizationRequestHeaderV1_3;\n  payload: Openid4vpAuthorizationRequestPayload;\n}): Promise<ClientIdParts> {\n  const clientIdParts = extractClientIdPrefix(options.payload.client_id);\n\n  if (clientIdParts.prefix !== ClientIdPrefix.X509_HASH) {\n    return clientIdParts;\n  }\n\n  const { x5c } = options.header;\n  if (!Array.isArray(x5c) || x5c.length === 0) {\n    throw new ParseAuthorizeRequestError(\n      \"x5c is required in JWT header for x509_hash client_id\",\n    );\n  }\n\n  if (!options.hash) {\n    return clientIdParts;\n  }\n\n  const expectedCertificateHash = await calculateX509CertificateHash({\n    certificateChain: x5c,\n    hash: options.hash,\n  });\n\n  if (expectedCertificateHash !== clientIdParts.clientId) {\n    throw new ParseAuthorizeRequestError(\n      \"x509_hash client_id does not match the JWT header leaf certificate\",\n    );\n  }\n\n  return clientIdParts;\n}\n\nfunction getLeafCertificate(certificateChain: string[]) {\n  const leafCertificate = certificateChain[0];\n\n  if (!leafCertificate) {\n    throw new ParseAuthorizeRequestError(\n      \"Certificate chain is empty, cannot validate x509_hash\",\n    );\n  }\n\n  return leafCertificate;\n}\n","import {\n  zAlgValueNotNone,\n  zCertificateChain,\n  zJwtPayload,\n  zSignedAuthorizationRequestJwtHeaderTyp,\n  zTrustChain,\n} from \"@pagopa/io-wallet-oauth2\";\nimport { itWalletCredentialVerifierMetadataV1_3 } from \"@pagopa/io-wallet-oid-federation\";\nimport { z } from \"zod\";\n\n/**\n * This schema is a less strict version of {@link itWalletCredentialVerifierMetadataV1_3} because\n * only a subset of the Credential Verifier metadata fields are required in the Request Object.\n * @see https://italia.github.io/eid-wallet-it-docs/releases/1.3.3/en/remote-flow.html#request-object\n */\nconst zOpenid4vpCredentialVerifierMetadata =\n  itWalletCredentialVerifierMetadataV1_3.partial({\n    application_type: true,\n    client_id: true,\n    client_name: true,\n    logo_uri: true,\n    request_uris: true,\n    response_uris: true,\n  });\n\n/**\n * Zod parser that describes a JWT payload\n * containing an OID4VP Request Object\n */\nexport const zOpenid4vpAuthorizationRequestPayload = z\n  .looseObject({\n    client_id: z.string(),\n    client_metadata: zOpenid4vpCredentialVerifierMetadata.optional(),\n    dcql_query: z.record(z.string(), z.any()),\n    nonce: z.string(),\n    request_uri: z.url().optional(),\n    request_uri_method: z.optional(z.string()),\n    response_mode: z.literal(\"direct_post.jwt\"),\n    response_type: z.literal(\"vp_token\"),\n    response_uri: z.url(),\n    scope: z.string().optional(),\n    state: z.string().optional(),\n    transaction_data: z.array(z.string()).nonempty().optional(),\n    transaction_data_hashes_alg: z.array(z.string()).optional(),\n    wallet_nonce: z.string().optional(),\n  })\n  .and(\n    z.object({\n      ...zJwtPayload.shape,\n    }),\n  );\n\nexport type Openid4vpAuthorizationRequestPayload = z.infer<\n  typeof zOpenid4vpAuthorizationRequestPayload\n>;\n\nconst zOpenid4vpAuthorizationRequestHeaderBase = z.object({\n  alg: zAlgValueNotNone,\n  kid: z.string(),\n  typ: zSignedAuthorizationRequestJwtHeaderTyp,\n});\n\nexport const zOpenid4vpAuthorizationRequestHeaderV1_0 =\n  zOpenid4vpAuthorizationRequestHeaderBase\n    .extend({\n      trust_chain: zTrustChain,\n    })\n    .loose();\n\nexport type Openid4vpAuthorizationRequestHeaderV1_0 = z.infer<\n  typeof zOpenid4vpAuthorizationRequestHeaderV1_0\n>;\n\nexport const zOpenid4vpAuthorizationRequestHeaderV1_3 =\n  zOpenid4vpAuthorizationRequestHeaderBase\n    .extend({\n      // kid is only mandatory for openid_federation/legacy; x509_hash RPs use x5c instead (see getPublicKeyForVerification).\n      kid: z.string().optional(),\n      trust_chain: zTrustChain.optional(),\n      x5c: zCertificateChain.optional(),\n    })\n    .loose();\n\nexport type Openid4vpAuthorizationRequestHeaderV1_3 = z.infer<\n  typeof zOpenid4vpAuthorizationRequestHeaderV1_3\n>;\n\nexport type Openid4vpAuthorizationRequestHeader =\n  | Openid4vpAuthorizationRequestHeaderV1_0\n  | Openid4vpAuthorizationRequestHeaderV1_3;\n","import { type CallbackContext, Oauth2JwtParseError } from \"@openid4vc/oauth2\";\nimport {\n  UnexpectedStatusCodeError,\n  ValidationError,\n  createFetcher,\n  hasStatusOrThrow,\n} from \"@pagopa/io-wallet-utils\";\n\nimport { Oid4vpError } from \"../errors\";\nimport { validateAuthorizationRequestParams } from \"./validate-authorization-request\";\nimport {\n  X509CertificateBinding,\n  validateCertificateEndpoints,\n} from \"./validate-certificate-endpoints\";\nimport { zAuthorizationRequestUrlParams } from \"./z-authorization-request-url\";\n\nexport interface FetchAuthorizationRequestOptions {\n  /**\n   * The authorization URL from the QR code\n   * Should contain `client_id` and either `request` or `request_uri` query parameters\n   */\n  authorizeRequestUrl: string;\n\n  /**\n   * Callback functions for making HTTP requests\n   * Allows for custom fetch implementation\n   */\n  callbacks: Pick<CallbackContext, \"fetch\">;\n\n  /**\n   * Optional wallet metadata to send when request_uri_method=post.\n   * If not provided and POST is required, sends an empty body (basic implementation).\n   *\n   * Specification: IT-Wallet v1.3.3 recommends (SHOULD) sending wallet capabilities\n   * in application/x-www-form-urlencoded format when using POST.\n   */\n  walletMetadata?: {\n    authorization_endpoint?: string;\n    client_id_prefixes_supported?: string[];\n    request_object_signing_alg_values_supported?: string[];\n    response_modes_supported?: string[];\n    response_types_supported?: string[];\n    vp_formats_supported?: Record<string, unknown>;\n  };\n\n  /**\n   * Optional wallet nonce for replay attack prevention (RECOMMENDED per spec)\n   */\n  walletNonce?: string;\n\n  /**\n   * Optional RP certificate context used to bind `request_uri` to the certificate SAN entries.\n   */\n  x509Certificate?: {\n    binding: X509CertificateBinding;\n    leafCertificate: string;\n  };\n}\n\nexport interface ParsedQrCode {\n  /**\n   * The `client_id` from the authorization URL\n   */\n  clientId: string;\n\n  /**\n   * It contains the base64url-encoded and signed Request Object. For the content of the Request Object, see {@link Openid4vpAuthorizationRequestPayload}.\n   */\n  request?: string;\n  /**\n   * The `request_uri` from the authorization URL\n   */\n  requestUri?: string;\n  /**\n   * The `request_uri_method` from the authorization URL (get or post)\n   */\n  requestUriMethod?: \"get\" | \"post\";\n}\n\nexport interface FetchAuthorizationRequestResult {\n  /**\n   * The parsed QR code data\n   * Includes `clientId`, `requestUri` and `requestUriMethod`\n   */\n  parsedQrCode: ParsedQrCode;\n\n  /**\n   * The original Request Object JWT, either fetched from `request_uri` or extracted from `request` parameter.\n   */\n  requestObjectJwt: string;\n\n  /**\n   * Transmission mode indicator\n   * - \"value\": Request Object JWT passed inline via `request` parameter\n   * - \"reference\": Request Object JWT fetched from `request_uri`\n   */\n  sendBy: \"reference\" | \"value\";\n}\n\n/**\n * Parses an authorization request URL and builds a {@link ParsedQrCode} object.\n *\n * @param authorizeRequestUrl - The authorization URL extracted from the QR code\n * @returns The parsed QR code data including `clientId`, `requestUri`, and `requestUriMethod`\n * @throws {ValidationError} If URL parameters fail schema validation or business logic checks\n */\nexport function createParsedQrCode(authorizeRequestUrl: string): ParsedQrCode {\n  const url = new URL(authorizeRequestUrl);\n\n  const rawParams = {\n    client_id: url.searchParams.get(\"client_id\") ?? undefined,\n    request: url.searchParams.get(\"request\") ?? undefined,\n    request_uri: url.searchParams.get(\"request_uri\") ?? undefined,\n    request_uri_method: url.searchParams.get(\"request_uri_method\") ?? undefined,\n    state: url.searchParams.get(\"state\") ?? undefined,\n  };\n\n  const parsedParams = zAuthorizationRequestUrlParams.parse(rawParams);\n  const validatedParams = validateAuthorizationRequestParams(parsedParams);\n  const sendBy = validatedParams.request ? \"value\" : \"reference\";\n\n  return {\n    clientId: validatedParams.client_id,\n    request: validatedParams.request,\n    requestUri: validatedParams.request_uri,\n    requestUriMethod:\n      sendBy === \"reference\"\n        ? (validatedParams.request_uri_method ?? \"get\")\n        : undefined,\n  };\n}\n\n/**\n * Helper function to fetch Request Object JWT from request_uri.\n * Supports GET and POST methods, with optional wallet metadata for POST.\n *\n * @param requestUri - URI to fetch Request Object from\n * @param options - Fetch options including method and wallet metadata\n * @returns The Request Object JWT as a string\n * @throws {UnexpectedStatusCodeError} If the server returns a non-200 status code\n * @throws {Error} If the underlying fetch/createFetcher call fails (for example, due to network errors)\n */\nexport async function fetchRequestObjectJwt(\n  requestUri: string,\n  options: {\n    fetch: CallbackContext[\"fetch\"];\n    method: \"get\" | \"post\";\n    walletMetadata?: FetchAuthorizationRequestOptions[\"walletMetadata\"];\n    walletNonce?: string;\n  },\n): Promise<string> {\n  const fetch = createFetcher(options.fetch);\n\n  // Prepare request configuration\n  const requestInit: RequestInit = {\n    method: options.method.toUpperCase(),\n  };\n\n  // Add body for POST requests per IT-Wallet spec (SHOULD include metadata)\n  if (options.method === \"post\") {\n    const formData = new URLSearchParams();\n\n    // Add wallet_metadata if provided (spec: OPTIONAL)\n    if (options.walletMetadata) {\n      formData.append(\n        \"wallet_metadata\",\n        JSON.stringify(options.walletMetadata),\n      );\n    }\n\n    // Add wallet_nonce if provided (spec: RECOMMENDED)\n    if (options.walletNonce) {\n      formData.append(\"wallet_nonce\", options.walletNonce);\n    }\n\n    requestInit.headers = {\n      \"Content-Type\": \"application/x-www-form-urlencoded\",\n    };\n    requestInit.body = formData.toString();\n  }\n\n  const response = await fetch(requestUri, requestInit);\n\n  await hasStatusOrThrow(200, UnexpectedStatusCodeError)(response);\n\n  return await response.text();\n}\n\n/**\n * Fetches an OpenID4VP authorization request JWT from a QR code URL.\n *\n * Supports two transmission modes:\n * - **By Value**: Request Object JWT passed inline via `request` parameter\n * - **By Reference**: Request Object JWT fetched from `request_uri`\n *\n * The function:\n * 1. Parses the authorization URL to extract parameters\n * 2. Validates that exactly one of `request` or `request_uri` is present\n * 3. Either uses inline JWT or fetches from URI (GET/POST based on request_uri_method)\n * 4. Returns the Request Object JWT along with transmission mode metadata\n *\n * Note: This function does NOT parse or verify the JWT. Use {@link parseAuthorizeRequest}\n * separately to decode and optionally verify the signature.\n *\n * @param options {@link FetchAuthorizationRequestOptions}\n * @returns Promise that resolves to {@link FetchAuthorizationRequestResult}\n * @throws {Oid4vpError} When required query parameters are missing, the URL is invalid, or an unexpected error occurs during fetch or parsing\n * @throws {UnexpectedStatusCodeError} When the server returns a non-200 status code during fetch\n * @throws {ValidationError} When URL parameters fail schema validation\n *\n * @example By Value mode\n * ```typescript\n * const url = \"[https://wallet.example.org/authorize](https://wallet.example.org/authorize)?\" +\n *   \"client_id=openid_federation%23https%3A%2F%2Frp.example.org\" +\n *   \"&request=eyJhbGciOiJFUzI1NiIs...\";\n *\n * const result = await fetchAuthorizationRequest({\n *   authorizeRequestUrl: url,\n *   callbacks: { fetch },\n * });\n * // result.sendBy === \"value\"\n * // result.requestObjectJwt === \"eyJhbGciOiJFUzI1NiIs...\"\n * ```\n *\n * @example By Reference mode with POST\n * ```typescript\n * const url = \"[https://wallet.example.org/authorize](https://wallet.example.org/authorize)?\" +\n *   \"client_id=openid_federation%23https%3A%2F%2Frp.example.org\" +\n *   \"&request_uri=https%3A%2F%2Frp.example.org%2Frequest\" +\n *   \"&request_uri_method=post\";\n *\n * const result = await fetchAuthorizationRequest({\n *   authorizeRequestUrl: url,\n *   callbacks: { fetch },\n *   walletMetadata: {\n *     authorization_endpoint: \"[https://wallet.example.org/authorize](https://wallet.example.org/authorize)\",\n *     response_types_supported: [\"vp_token\"],\n *   },\n *   walletNonce: \"random-nonce\",\n * });\n * // result.sendBy === \"reference\"\n * // result.requestObjectJwt === fetched JWT from request_uri\n * ```\n */\nexport async function fetchAuthorizationRequest(\n  options: FetchAuthorizationRequestOptions,\n): Promise<FetchAuthorizationRequestResult> {\n  try {\n    const parsedQrCode = createParsedQrCode(options.authorizeRequestUrl);\n\n    // Get JWT: either inline or fetch from URI\n    let requestObjectJwt: string;\n    if (parsedQrCode.request) {\n      requestObjectJwt = parsedQrCode.request;\n    } else {\n      if (options.x509Certificate) {\n        await validateCertificateEndpoints({\n          callbacks: options.x509Certificate.binding,\n          certificate: options.x509Certificate.leafCertificate,\n          endpoints: [\n            {\n              name: \"request_uri\",\n              uri: parsedQrCode.requestUri,\n            },\n          ],\n        });\n      }\n\n      // Type system guarantees request_uri is defined here due to validation\n      requestObjectJwt = await fetchRequestObjectJwt(\n        parsedQrCode.requestUri as string,\n        {\n          fetch: options.callbacks.fetch,\n          method: parsedQrCode.requestUriMethod ?? \"get\",\n          walletMetadata: options.walletMetadata,\n          walletNonce: options.walletNonce,\n        },\n      );\n    }\n\n    return {\n      parsedQrCode,\n      requestObjectJwt,\n      sendBy: parsedQrCode.request ? \"value\" : \"reference\",\n    };\n  } catch (error) {\n    if (\n      error instanceof ValidationError ||\n      error instanceof Oauth2JwtParseError ||\n      error instanceof Oid4vpError ||\n      error instanceof UnexpectedStatusCodeError\n    ) {\n      throw error;\n    }\n\n    throw new Oid4vpError(\n      `Unexpected error during fetch authorization request: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n}\n","import { InvalidRequestUriMethodError, Oid4vpError } from \"../errors\";\nimport { AuthorizationRequestUrlParams } from \"./z-authorization-request-url\";\n\n/**\n * Validates authorization request URL parameters according to IT-Wallet and OpenID4VP specifications.\n *\n * Validation rules:\n * 1. Exactly one of `request` or `request_uri` must be present (mutual exclusivity)\n * 2. `request_uri_method` must be \"get\" or \"post\" (case-insensitive) if present\n * 3. `request_uri_method` can only be used with `request_uri` parameter\n *\n * @param params - Parsed authorization request URL parameters\n * @returns Type-narrowed params ensuring mutual exclusivity\n * @throws {Oid4vpError} When both or neither request/request_uri are present\n * @throws {InvalidRequestUriMethodError} When request_uri_method is not \"get\" or \"post\"\n * @throws {Oid4vpError} When request_uri_method is used without request_uri\n */\nexport function validateAuthorizationRequestParams(\n  params: AuthorizationRequestUrlParams,\n) {\n  // Mutual exclusivity check\n  if (params.request && params.request_uri) {\n    throw new Oid4vpError(\n      \"request and request_uri cannot both be present in an authorization request\",\n    );\n  }\n\n  // At least one must be present\n  if (!params.request && !params.request_uri) {\n    throw new Oid4vpError(\n      \"Either request or request_uri parameter must be present\",\n    );\n  }\n\n  // Validate request_uri_method if present\n  if (params.request_uri_method) {\n    const normalizedMethod = params.request_uri_method.toLowerCase();\n    if (normalizedMethod !== \"get\" && normalizedMethod !== \"post\") {\n      throw new InvalidRequestUriMethodError(\n        `Invalid request_uri_method: '${params.request_uri_method}'. Must be 'get' or 'post'`,\n      );\n    }\n  }\n\n  // request_uri_method only allowed with request_uri\n  if (params.request_uri_method && !params.request_uri) {\n    throw new Oid4vpError(\n      \"request_uri_method can only be used with request_uri parameter\",\n    );\n  }\n\n  // Normalize request_uri_method to lowercase if present\n  const normalizedMethod = params.request_uri_method\n    ? (params.request_uri_method.toLowerCase() as \"get\" | \"post\")\n    : undefined;\n\n  return {\n    ...params,\n    request_uri_method: normalizedMethod,\n  } as (\n    | {\n        request?: never;\n        request_uri: string;\n        request_uri_method?: \"get\" | \"post\";\n      }\n    | { request: string; request_uri?: never; request_uri_method?: never }\n  ) &\n    typeof params;\n}\n","import { Oid4vpError } from \"../errors\";\n\nexport interface X509CertificateMetadata {\n  sanDnsNames?: string[];\n  sanUriNames?: string[];\n}\n\nexport type GetX509CertificateMetadataCallback = (\n  certificate: string,\n) => Promise<X509CertificateMetadata> | X509CertificateMetadata;\n\nexport interface X509CertificateBinding {\n  getX509CertificateMetadata: GetX509CertificateMetadataCallback;\n}\n\nexport interface CertificateEndpoint {\n  name: string;\n  uri?: string;\n}\n\nexport interface ValidateCertificateEndpointsOptions {\n  callbacks: X509CertificateBinding;\n  certificate: string;\n  endpoints: CertificateEndpoint[];\n}\n\nexport async function validateCertificateEndpoints(\n  options: ValidateCertificateEndpointsOptions,\n): Promise<void> {\n  const metadata = await options.callbacks.getX509CertificateMetadata(\n    options.certificate,\n  );\n\n  for (const endpoint of options.endpoints) {\n    if (!endpoint.uri) {\n      continue;\n    }\n\n    validateEndpointAgainstMetadata(\n      { name: endpoint.name, uri: endpoint.uri },\n      metadata,\n    );\n  }\n}\n\nfunction validateEndpointAgainstMetadata(\n  endpoint: { name: string; uri: string },\n  metadata: X509CertificateMetadata,\n) {\n  const endpointUrl = parseEndpointUrl(endpoint);\n  const sanUriNames = metadata.sanUriNames ?? [];\n  const matchesUriSan = sanUriNames.some(\n    (sanUriName) => normalizeUriForComparison(sanUriName) === endpointUrl.href,\n  );\n  const sanDnsNames = metadata.sanDnsNames ?? [];\n  const matchesDnsSan = sanDnsNames.some((sanDnsName) =>\n    matchesDnsSanHostname(sanDnsName, endpointUrl.hostname),\n  );\n\n  if (matchesUriSan || matchesDnsSan) {\n    return;\n  }\n\n  throw new Oid4vpError(\n    `${endpoint.name} is not covered by the Relying Party certificate SAN entries`,\n  );\n}\n\nfunction normalizeUriForComparison(uri: string) {\n  try {\n    return new URL(uri).href;\n  } catch (error) {\n    throw new Oid4vpError(`Certificate URI SAN is not a valid URL: ${uri}`, {\n      cause: error,\n    });\n  }\n}\n\nfunction matchesDnsSanHostname(sanDnsName: string, hostname: string) {\n  const normalizedSanDnsName = sanDnsName.toLowerCase();\n  const normalizedHostname = hostname.toLowerCase();\n\n  if (normalizedSanDnsName === normalizedHostname) {\n    return true;\n  }\n\n  if (!normalizedSanDnsName.includes(\"*\")) {\n    return false;\n  }\n\n  const wildcardCount = [...normalizedSanDnsName].filter(\n    (character) => character === \"*\",\n  ).length;\n  const sanLabels = normalizedSanDnsName.split(\".\");\n  const hostnameLabels = normalizedHostname.split(\".\");\n\n  return (\n    wildcardCount === 1 &&\n    sanLabels[0] === \"*\" &&\n    sanLabels.length === hostnameLabels.length &&\n    sanLabels\n      .slice(1)\n      .every((label, index) => label === hostnameLabels[index + 1])\n  );\n}\n\nfunction parseEndpointUrl(endpoint: { name: string; uri: string }) {\n  try {\n    return new URL(endpoint.uri);\n  } catch (error) {\n    throw new Oid4vpError(\n      `${endpoint.name} is not a valid URL: ${endpoint.uri}`,\n      { cause: error },\n    );\n  }\n}\n","import z from \"zod\";\n\n/**\n * Schema for authorization request URL query parameters.\n * Note: `request` contains the signed Request Object JWT, it is NOT a claim inside the Request Object.\n */\nexport const zAuthorizationRequestUrlParams = z.looseObject({\n  client_id: z.string(),\n  request: z.string().optional(), // JWT containing Request Object (by value)\n  request_uri: z.url().optional(), // URI to fetch Request Object (by reference)\n  request_uri_method: z.string().optional(), // HTTP method for request_uri (validated in business logic)\n  state: z.string().optional(), // Optional state parameter\n});\n\nexport type AuthorizationRequestUrlParams = z.infer<\n  typeof zAuthorizationRequestUrlParams\n>;\n","import {\n  CallbackContext,\n  JwtSigner,\n  Oauth2JwtParseError,\n  verifyJwt,\n} from \"@openid4vc/oauth2\";\nimport { decodeJwt } from \"@pagopa/io-wallet-oauth2\";\nimport {\n  IoWalletSdkConfig,\n  ItWalletSpecsVersion,\n  ItWalletSpecsVersionError,\n  ValidationError,\n  dispatchByVersion,\n} from \"@pagopa/io-wallet-utils\";\n\nimport { Oid4vpError, ParseAuthorizeRequestError } from \"../errors\";\nimport {\n  ClientIdPrefix,\n  extractClientIdPrefix,\n  validateAuthorizationRequestClientBinding,\n} from \"./client-id-prefix\";\nimport {\n  X509CertificateBinding,\n  validateCertificateEndpoints,\n} from \"./validate-certificate-endpoints\";\nimport {\n  Openid4vpAuthorizationRequestHeader,\n  Openid4vpAuthorizationRequestHeaderV1_3,\n  Openid4vpAuthorizationRequestPayload,\n  zOpenid4vpAuthorizationRequestHeaderV1_0,\n  zOpenid4vpAuthorizationRequestHeaderV1_3,\n  zOpenid4vpAuthorizationRequestPayload,\n} from \"./z-authorization-request\";\n\nexport {\n  type ClientIdParts,\n  ClientIdPrefix,\n  createX509HashClientId,\n  extractClientIdPrefix,\n} from \"./client-id-prefix\";\n\n/**\n * Retrieves the public key for verifying the Request Object JWT signature\n * according to IT Wallet specifications.\n *\n * Prefix routing:\n * 1. If client_id uses x509_hash: use x5c certificate chain from header.\n * 2. If client_id uses openid_federation or no prefix: return a federation signer;\n *    if trust_chain is present it is forwarded, otherwise the verifyJwt callback is\n *    responsible for reconstructing the chain from client_id.\n *\n * @param options - Parse options containing decoded JWT\n * @returns The JWK to use for signature verification\n * @throws {ParseAuthorizeRequestError} When no valid public key can be found\n */\nfunction getPublicKeyForVerification(options: {\n  header: Openid4vpAuthorizationRequestHeader;\n  payload: Openid4vpAuthorizationRequestPayload;\n}): JwtSigner {\n  const { header, payload } = options;\n\n  const { prefix: clientIdPrefix } = extractClientIdPrefix(payload.client_id);\n\n  if (\n    clientIdPrefix === ClientIdPrefix.OPENID_FEDERATION ||\n    clientIdPrefix === ClientIdPrefix.NONE\n  ) {\n    if (!header.kid) {\n      throw new ParseAuthorizeRequestError(\n        \"kid is required in JWT header for openid_federation client_id or no prefix\",\n      );\n    }\n\n    return {\n      alg: header.alg,\n      kid: header.kid,\n      method: \"federation\" as const,\n      ...(header.trust_chain && { trustChain: header.trust_chain }),\n    };\n  }\n\n  if (clientIdPrefix === ClientIdPrefix.X509_HASH) {\n    if (!Array.isArray(header.x5c) || header.x5c.length === 0) {\n      throw new ParseAuthorizeRequestError(\n        \"x5c is required in JWT header for x509_hash client_id\",\n      );\n    }\n\n    return {\n      alg: header.alg,\n      kid: header.kid,\n      method: \"x5c\" as const,\n      ...(header.trust_chain && { trustChain: header.trust_chain }),\n      x5c: header.x5c,\n    };\n  }\n\n  throw new ParseAuthorizeRequestError(\n    \"Unable to determine public key for Request Object verification with client_id prefix: \" +\n      clientIdPrefix,\n  );\n}\n\nexport interface ParseAuthorizeRequestOptions {\n  /**\n   * Optional callback context for JWT signature verification and hashing x509 client_id for digest comparison.\n   * If not provided, signature verification is skipped or hash skips the x509_hash digest comparison.\n   */\n  callbacks?: Partial<Pick<CallbackContext, \"hash\" | \"verifyJwt\">> &\n    Partial<X509CertificateBinding>;\n\n  config: IoWalletSdkConfig;\n\n  /**\n   * The Authorization Request Object JWT.\n   */\n  requestObjectJwt: string;\n}\n\nexport interface ParsedAuthorizeRequestResult {\n  /**\n   * The JWT header of the authorization request object.\n   */\n  header: Openid4vpAuthorizationRequestHeader;\n  /**\n   * The parsed authorization request object.\n   */\n  payload: Openid4vpAuthorizationRequestPayload;\n\n  /**\n   * X.509 context extracted from the Request Object header when `x5c` is present.\n   */\n  x509Certificate?: {\n    leafCertificate: string;\n    x5c: [string, ...string[]];\n  };\n}\n\n/**\n * Parses and optionally verifies a JWT containing an OpenID4VP Request Object.\n *\n * This method decodes the Request Object JWT and validates its structure. If the `verifyJwt`\n * callback is provided, it also verifies the JWT signature using the public key obtained\n * according to IT Wallet specifications:\n * 1. If client_id uses x509_hash: pass an x5c signer to the callback.\n * 2. If client_id uses openid_federation or a legacy HTTPS identifier, pass a federation signer;\n *    trust_chain is forwarded when present, otherwise the callback must reconstruct the chain from client_id.\n *\n * For x509_hash client identifiers, x5c is always required. When `callbacks.hash` is provided,\n * this method also checks the SHA-256 base64url certificate digest embedded in client_id.\n *\n * Security: If `verifyJwt` callback is not provided in options, JWT signature verification is skipped.\n *\n * @param options {@link ParseAuthorizeRequestOptions}\n * @returns A {@link ParsedAuthorizeRequestResult} containing the RP required credentials payload and the {@link Openid4vpAuthorizationRequestHeader} JWT header\n * @throws {ValidationError} in case there are errors validating the Request Object structure\n * @throws {Oauth2JwtParseError} in case the request object jwt is malformed (e.g missing header, bad encoding)\n * @throws {@link ParseAuthorizeRequestError} in case the JWT signature is invalid (when verifyJwt is provided) or there are unexpected errors\n */\nexport async function parseAuthorizeRequest(\n  options: ParseAuthorizeRequestOptions,\n): Promise<ParsedAuthorizeRequestResult> {\n  try {\n    const headerSchema = dispatchByVersion<\n      | typeof zOpenid4vpAuthorizationRequestHeaderV1_0\n      | typeof zOpenid4vpAuthorizationRequestHeaderV1_3\n    >(options.config.itWalletSpecsVersion, {\n      [ItWalletSpecsVersion.V1_0]: () =>\n        zOpenid4vpAuthorizationRequestHeaderV1_0,\n      [ItWalletSpecsVersion.V1_3]: () =>\n        zOpenid4vpAuthorizationRequestHeaderV1_3,\n      [ItWalletSpecsVersion.V1_4]: () =>\n        zOpenid4vpAuthorizationRequestHeaderV1_3,\n    });\n\n    const decoded = decodeJwt({\n      errorMessagePrefix: \"Error decoding authorization request JWT:\",\n      headerSchema,\n      jwt: options.requestObjectJwt,\n      payloadSchema: zOpenid4vpAuthorizationRequestPayload,\n    });\n\n    if (options.config.itWalletSpecsVersion !== ItWalletSpecsVersion.V1_0) {\n      await validateAuthorizationRequestClientBinding({\n        hash: options.callbacks?.hash,\n        header: decoded.header as Openid4vpAuthorizationRequestHeaderV1_3,\n        payload: decoded.payload,\n      });\n    }\n\n    const x5c =\n      \"x5c\" in decoded.header &&\n      Array.isArray(decoded.header.x5c) &&\n      decoded.header.x5c.length > 0\n        ? (decoded.header.x5c as [string, ...string[]])\n        : undefined;\n\n    if (x5c && options.callbacks?.getX509CertificateMetadata) {\n      await validateCertificateEndpoints({\n        callbacks: {\n          getX509CertificateMetadata:\n            options.callbacks.getX509CertificateMetadata,\n        },\n        certificate: x5c[0],\n        endpoints: [\n          { name: \"request_uri\", uri: decoded.payload.request_uri },\n          { name: \"response_uri\", uri: decoded.payload.response_uri },\n        ],\n      });\n    }\n\n    if (options.callbacks?.verifyJwt) {\n      const signer = getPublicKeyForVerification({\n        header: decoded.header,\n        payload: decoded.payload,\n      });\n\n      await verifyJwt({\n        compact: options.requestObjectJwt,\n        errorMessage: \"Error verifying Request Object signature\",\n        header: decoded.header,\n        payload: decoded.payload,\n        signer,\n        verifyJwtCallback: options.callbacks.verifyJwt,\n      });\n    }\n\n    return {\n      header: decoded.header,\n      payload: decoded.payload,\n      ...(x5c && {\n        x509Certificate: {\n          leafCertificate: x5c[0],\n          x5c,\n        },\n      }),\n    };\n  } catch (error) {\n    if (\n      error instanceof ItWalletSpecsVersionError ||\n      error instanceof ValidationError ||\n      error instanceof Oauth2JwtParseError ||\n      error instanceof Oid4vpError\n    )\n      throw error;\n    throw new ParseAuthorizeRequestError(\n      `Unexpected error during Request Object parsing: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n}\n","import {\n  ItWalletSpecsVersion,\n  createVersionDispatcher,\n} from \"@pagopa/io-wallet-utils\";\n\nimport type {\n  CreateAuthorizationResponseOptionsV1_3,\n  CreateAuthorizationResponseOptionsV1_4,\n  CreateAuthorizationResponseResult,\n  CreateAuthorizationResponseVersionedOptions,\n} from \"./types\";\n\nimport * as V1_3 from \"./v1.3/create-authorization-response\";\nimport * as V1_4 from \"./v1.4/create-authorization-response\";\n\nexport type {\n  CreateAuthorizationResponseOptionsV1_0,\n  CreateAuthorizationResponseOptionsV1_3,\n  CreateAuthorizationResponseOptionsV1_4,\n  CreateAuthorizationResponseResult,\n  CreateAuthorizationResponseVersionedOptions,\n} from \"./types\";\n\nconst dispatchCreateAuthorizationResponse = createVersionDispatcher<\n  CreateAuthorizationResponseVersionedOptions,\n  Promise<CreateAuthorizationResponseResult>\n>({\n  [ItWalletSpecsVersion.V1_0]: (o) =>\n    // V1_0 shares the v1.3 response logic — JWKS / enc resolution is identical.\n    V1_3.createAuthorizationResponse(\n      o as CreateAuthorizationResponseOptionsV1_3,\n    ),\n  [ItWalletSpecsVersion.V1_3]: (o) =>\n    V1_3.createAuthorizationResponse(\n      o as CreateAuthorizationResponseOptionsV1_3,\n    ),\n  [ItWalletSpecsVersion.V1_4]: (o) =>\n    V1_4.createAuthorizationResponse(\n      o as CreateAuthorizationResponseOptionsV1_4,\n    ),\n});\n\n/**\n * Creates an encrypted JARM authorization response for OpenID4VP presentation.\n *\n * Routes to the version-specific implementation based on `config.itWalletSpecsVersion`.\n *\n * **Version differences:**\n * - v1.0 / v1.3: When `openid_federation` client_id prefix is used, `client_metadata`\n *   is ignored and `rpJwks` is used for JWKS resolution.\n * - v1.4: `client_metadata.jwks` is used directly when present, regardless of\n *   the `client_id` prefix, falling back to `rpJwks.jwks`.\n *\n * @throws {CreateAuthorizationResponseError} If response generation or encryption fails\n * @throws {ItWalletSpecsVersionError} If `config.itWalletSpecsVersion` is not a recognised version at runtime\n */\nexport async function createAuthorizationResponse(\n  options: CreateAuthorizationResponseVersionedOptions,\n): Promise<CreateAuthorizationResponseResult> {\n  return dispatchCreateAuthorizationResponse(options);\n}\n","import type { JwkSet } from \"@pagopa/io-wallet-oauth2\";\n\nimport { CallbackContext, JweEncryptor } from \"@pagopa/io-wallet-oauth2\";\nimport { encodeToBase64Url } from \"@pagopa/io-wallet-utils\";\n\nimport type { CreateAuthorizationResponseResult } from \"./types\";\n\nimport { Openid4vpAuthorizationRequestPayload } from \"../authorization-request/z-authorization-request\";\nimport { CreateAuthorizationResponseError } from \"../errors\";\nimport { extractEncryptionJwkFromJwks } from \"../jarm/jarm-extract-jwks\";\nimport { VpToken } from \"../vp-token/z-vp-token\";\n\nexport interface BuildJarmResponseOptions {\n  authorization_encrypted_response_alg?: string;\n  authorization_encrypted_response_enc?: string;\n  callbacks: Pick<CallbackContext, \"encryptJwe\" | \"generateRandom\">;\n  encValuesSupported: string[] | undefined;\n  encryptionJwks: JwkSet;\n  requestObject: Pick<Openid4vpAuthorizationRequestPayload, \"nonce\" | \"state\">;\n  vp_token: VpToken;\n}\n\nfunction resolveEncValue(\n  supported: string[] | undefined,\n  requested: string | undefined,\n  fallback: string,\n): string {\n  if (!supported) return requested ?? fallback;\n  return (\n    supported.find((e) => e === requested) ??\n    supported[0] ??\n    requested ??\n    fallback\n  );\n}\n\n/**\n * Shared core: resolves enc/alg, encrypts the VP token into a JARM JWE, and returns the result.\n * Callers are responsible for resolving `encryptionJwks` and `encValuesSupported`\n * according to their version-specific metadata rules before invoking this function.\n */\nexport async function buildJarmResponse(\n  options: BuildJarmResponseOptions,\n): Promise<CreateAuthorizationResponseResult> {\n  try {\n    const encryptionAlg =\n      options.authorization_encrypted_response_alg ?? \"ECDH-ES\";\n    const encryptionEnc =\n      options.authorization_encrypted_response_enc ?? \"A256GCM\";\n\n    const authorizationResponsePayload = {\n      state: options.requestObject.state,\n      vp_token: options.vp_token,\n    };\n\n    const encryptionJwk = extractEncryptionJwkFromJwks(options.encryptionJwks, {\n      supportedAlgValues: [encryptionAlg],\n    });\n    if (!encryptionJwk) {\n      throw new CreateAuthorizationResponseError(\n        \"No encryption JWK found in metadata\",\n      );\n    }\n\n    if (!encryptionJwk.kid) {\n      throw new CreateAuthorizationResponseError(\n        \"Encryption JWK must have a 'kid' parameter\",\n      );\n    }\n\n    const enc = resolveEncValue(\n      options.encValuesSupported,\n      options.authorization_encrypted_response_enc,\n      encryptionEnc,\n    );\n\n    const alg = encryptionAlg;\n\n    const nonceBytes = await options.callbacks.generateRandom(32);\n\n    const jweEncryptor: JweEncryptor = {\n      alg,\n      apu: encodeToBase64Url(nonceBytes),\n      apv: encodeToBase64Url(options.requestObject.nonce),\n      enc,\n      kid: encryptionJwk.kid,\n      method: \"jwk\",\n      publicJwk: encryptionJwk,\n    };\n\n    const { encryptionJwk: usedJwk, jwe } = await options.callbacks.encryptJwe(\n      jweEncryptor,\n      JSON.stringify(authorizationResponsePayload),\n    );\n\n    return {\n      authorizationResponsePayload,\n      jarm: {\n        encryptionJwk: usedJwk,\n        responseJwe: jwe,\n      },\n    };\n  } catch (error) {\n    if (error instanceof CreateAuthorizationResponseError) {\n      throw error;\n    }\n    throw new CreateAuthorizationResponseError(\n      `Unexpected error during authorization response creation: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n}\n","import type { JwkSet } from \"@pagopa/io-wallet-oauth2\";\n\n/**\n * Selects an encryption JWK from a JWKS.\n *\n * Selection prefers an explicit `kid`, then keys whose `alg` is supported, then\n * keys marked for encryption or not explicitly marked for signatures.\n *\n * @param jwks - JSON Web Key Set to search.\n * @param options - Optional selection constraints.\n * @param options.kid - Key ID to select directly.\n * @param options.supportedAlgValues - Encryption algorithms accepted by the caller.\n * @returns Matching encryption JWK, or the first available key when no better match exists.\n */\nexport function extractEncryptionJwkFromJwks(\n  jwks: JwkSet,\n  {\n    kid,\n    supportedAlgValues,\n  }: {\n    kid?: string;\n    supportedAlgValues?: string[];\n  },\n) {\n  if (kid) {\n    return jwks.keys.find((jwk) => jwk.kid === kid);\n  }\n\n  let algFiltered = jwks.keys.filter(\n    (key) => key.alg && supportedAlgValues?.includes(key.alg),\n  );\n  if (algFiltered.length === 0) algFiltered = jwks.keys;\n\n  let encFiltered = algFiltered.filter((key) => key.use === \"enc\");\n  if (encFiltered.length === 0) {\n    encFiltered = algFiltered.filter((key) => key.use !== \"sig\");\n  }\n\n  return encFiltered.length > 0 ? encFiltered[0] : jwks.keys[0];\n}\n","import type {\n  CreateAuthorizationResponseOptionsV1_3,\n  CreateAuthorizationResponseResult,\n} from \"../types\";\n\nimport {\n  ClientIdPrefix,\n  extractClientIdPrefix,\n} from \"../../authorization-request/parse-authorization-request\";\nimport { CreateAuthorizationResponseError } from \"../../errors\";\nimport { buildJarmResponse } from \"../build-jarm-response\";\n\n/**\n * Creates an encrypted JARM authorization response for OpenID4VP presentation — v1.0 / v1.3 variant.\n *\n * When the `openid_federation` client_id prefix is used, `client_metadata` is ignored\n * and `rpJwks` is used for JWKS resolution, as required by the Italian specification.\n */\nexport async function createAuthorizationResponse(\n  options: CreateAuthorizationResponseOptionsV1_3,\n): Promise<CreateAuthorizationResponseResult> {\n  const { requestObject } = options;\n  const clientMetadata = requestObject.client_metadata;\n  const { prefix: clientIdPrefix } = extractClientIdPrefix(\n    requestObject.client_id,\n  );\n\n  if (clientIdPrefix === ClientIdPrefix.X509_HASH && !clientMetadata) {\n    throw new CreateAuthorizationResponseError(\n      \"clientMetadata is required when client_id uses x509_hash prefix\",\n    );\n  }\n\n  // When using OpenID Federation, client_metadata may be present in the request\n  // but per the Italian specification most of its content should be ignored —\n  // use rpJwks for encryption parameters instead.\n  const effectiveClientMetadata =\n    clientIdPrefix === ClientIdPrefix.OPENID_FEDERATION\n      ? undefined\n      : clientMetadata;\n\n  const encryptionJwks = effectiveClientMetadata\n    ? effectiveClientMetadata.jwks\n    : options.rpJwks.jwks;\n\n  const encValuesSupported =\n    effectiveClientMetadata?.encrypted_response_enc_values_supported ??\n    options.rpJwks.encrypted_response_enc_values_supported;\n\n  return buildJarmResponse({\n    authorization_encrypted_response_alg:\n      options.authorization_encrypted_response_alg,\n    authorization_encrypted_response_enc:\n      options.authorization_encrypted_response_enc,\n    callbacks: options.callbacks,\n    encValuesSupported,\n    encryptionJwks,\n    requestObject: options.requestObject,\n    vp_token: options.vp_token,\n  });\n}\n","import type {\n  CreateAuthorizationResponseOptionsV1_4,\n  CreateAuthorizationResponseResult,\n} from \"../types\";\n\nimport {\n  ClientIdPrefix,\n  extractClientIdPrefix,\n} from \"../../authorization-request/parse-authorization-request\";\nimport { CreateAuthorizationResponseError } from \"../../errors\";\nimport { buildJarmResponse } from \"../build-jarm-response\";\n\n/**\n * Creates an encrypted JARM authorization response for OpenID4VP presentation — v1.4 variant.\n *\n * **v1.4 behavior:** both `encryptionJwks` and `encValuesSupported`\n * are resolved directly from `requestObject.client_metadata`, falling back to `rpJwks`, regardless\n * of the `client_id` prefix. The IT-Wallet spec (RPR-113) permits `client_metadata.jwks` and\n * `encrypted_response_enc_values_supported` to carry request-specific ephemeral encryption keys\n * even when the `openid_federation` prefix is active.\n */\nexport async function createAuthorizationResponse(\n  options: CreateAuthorizationResponseOptionsV1_4,\n): Promise<CreateAuthorizationResponseResult> {\n  const { requestObject } = options;\n  const clientMetadata = requestObject.client_metadata;\n  const { prefix: clientIdPrefix } = extractClientIdPrefix(\n    requestObject.client_id,\n  );\n\n  if (clientIdPrefix === ClientIdPrefix.X509_HASH && !clientMetadata) {\n    throw new CreateAuthorizationResponseError(\n      \"clientMetadata is required when client_id uses x509_hash prefix\",\n    );\n  }\n\n  const encryptionJwks = clientMetadata?.jwks ?? options.rpJwks.jwks;\n\n  const encValuesSupported =\n    clientMetadata?.encrypted_response_enc_values_supported ??\n    options.rpJwks.encrypted_response_enc_values_supported;\n\n  return buildJarmResponse({\n    authorization_encrypted_response_alg:\n      options.authorization_encrypted_response_alg,\n    authorization_encrypted_response_enc:\n      options.authorization_encrypted_response_enc,\n    callbacks: options.callbacks,\n    encValuesSupported,\n    encryptionJwks,\n    requestObject: options.requestObject,\n    vp_token: options.vp_token,\n  });\n}\n","import { CallbackContext } from \"@openid4vc/oauth2\";\nimport {\n  CONTENT_TYPES,\n  HEADERS,\n  UnexpectedStatusCodeError,\n  ValidationError,\n  createFetcher,\n  hasStatusOrThrow,\n  parseWithErrorHandling,\n} from \"@pagopa/io-wallet-utils\";\n\nimport {\n  X509CertificateBinding,\n  validateCertificateEndpoints,\n} from \"../authorization-request/validate-certificate-endpoints\";\nimport { FetchAuthorizationResponseError } from \"../errors\";\nimport {\n  Openid4vpAuthorizationResponseResult,\n  zOpenid4vpAuthorizationResponseResult,\n} from \"./z-authorization-response\";\n\n/**\n * Configuration options for fetching OID4VP Presentation Result\n */\nexport interface FetchAuthorizationResponseOptions {\n  /**\n   * The signed and encrypted {@link Openid4vpAuthorizationResponse} in base64 format\n   */\n  authorizationResponseJarm: string;\n\n  /**\n   * Callback functions for making HTTP requests\n   * Allows for custom fetch implementations\n   */\n  callbacks: Pick<CallbackContext, \"fetch\">;\n\n  /**\n   * The response_uri field contained in the {@link Openid4vpAuthorizationRequestPayload}\n   */\n  presentationResponseUri: string;\n\n  /**\n   * Optional RP certificate context from the parsed Request Object.\n   * When provided, `presentationResponseUri` and the returned `redirect_uri`\n   * are checked against the certificate SAN entries through the supplied callback.\n   */\n  x509Certificate?: {\n    binding: X509CertificateBinding;\n    leafCertificate: string;\n  };\n}\n\n/**\n * Sends the {@link Openid4vpAuthorizationResponse} to the response uri provided by the session's\n * {@link Openid4vpAuthorizationRequestPayload} and returns the {@link Openid4vpAuthorizationResponseResult} object\n * containing the redirect_uri at which to continue the presentation\n *\n * @param options {@link FetchAuthorizationResponseOptions}\n * @returns Promise that resolves to the parsed {@link Openid4vpAuthorizationResponseResult}\n * @throws {UnexpectedStatusCodeError} When the server returns a non-200 status code\n * @throws {ValidationError} When the response cannot be parsed or is invalid\n */\nexport async function fetchAuthorizationResponse(\n  options: FetchAuthorizationResponseOptions,\n): Promise<Openid4vpAuthorizationResponseResult> {\n  try {\n    if (options.x509Certificate) {\n      await validateCertificateEndpoints({\n        callbacks: options.x509Certificate.binding,\n        certificate: options.x509Certificate.leafCertificate,\n        endpoints: [\n          { name: \"response_uri\", uri: options.presentationResponseUri },\n        ],\n      });\n    }\n\n    const fetch = createFetcher(options.callbacks.fetch);\n    const authorizationResponseResult = await fetch(\n      options.presentationResponseUri,\n      {\n        body: new URLSearchParams({\n          response: options.authorizationResponseJarm,\n        }),\n        headers: {\n          [HEADERS.CONTENT_TYPE]: CONTENT_TYPES.FORM_URLENCODED,\n        },\n        method: \"POST\",\n      },\n    );\n\n    await hasStatusOrThrow(\n      200,\n      UnexpectedStatusCodeError,\n    )(authorizationResponseResult);\n\n    const authorizationResponseResultJson =\n      await authorizationResponseResult.json();\n\n    //Response could be anything, so it's returned as is for further processing\n    const parsedAuthorizationResponseResult = parseWithErrorHandling(\n      zOpenid4vpAuthorizationResponseResult,\n      authorizationResponseResultJson,\n    );\n\n    if (options.x509Certificate) {\n      await validateCertificateEndpoints({\n        callbacks: options.x509Certificate.binding,\n        certificate: options.x509Certificate.leafCertificate,\n        endpoints: [\n          {\n            name: \"redirect_uri\",\n            uri: parsedAuthorizationResponseResult.redirect_uri,\n          },\n        ],\n      });\n    }\n\n    return parsedAuthorizationResponseResult;\n  } catch (error) {\n    if (\n      error instanceof UnexpectedStatusCodeError ||\n      error instanceof ValidationError ||\n      error instanceof FetchAuthorizationResponseError\n    ) {\n      throw error;\n    }\n    throw new FetchAuthorizationResponseError(\n      `Unexpected error sending authorization response: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n}\n","import z from \"zod\";\n\nimport { zVpToken } from \"../vp-token/z-vp-token\";\n\nexport const zOpenid4vpAuthorizationResponse = z.object({\n  state: z.string().optional(),\n  vp_token: zVpToken,\n});\n\nexport type Openid4vpAuthorizationResponse = z.infer<\n  typeof zOpenid4vpAuthorizationResponse\n>;\n\nexport const zOpenid4vpAuthorizationResponseResult = z.object({\n  redirect_uri: z.url().optional(),\n});\n\nexport type Openid4vpAuthorizationResponseResult = z.infer<\n  typeof zOpenid4vpAuthorizationResponseResult\n>;\n","import { z } from \"zod\";\n\nexport const zVpToken = z.record(\n  z.string(),\n  z.string().or(z.array(z.string()).nonempty()),\n  {\n    message:\n      \"vp_token must be an object where each key is a string and each value is a non-empty array of strings (v1.3) or a string (v1.0)\",\n  },\n);\n\nexport type VpToken = z.infer<typeof zVpToken>;\n","import { CallbackContext } from \"@pagopa/io-wallet-oauth2\";\nimport { parseWithErrorHandling } from \"@pagopa/io-wallet-utils\";\n\nimport { Openid4vpAuthorizationRequestPayload } from \"../authorization-request/z-authorization-request\";\nimport { Oid4vpError } from \"../errors\";\nimport { parseJarmAuthorizationResponse } from \"../jarm/parse-jarm-authorization-response\";\nimport { VerifyJarmAuthorizationResponseResult } from \"../jarm/verify-jarm-authorization-response\";\nimport { JarmHeader } from \"../jarm/z-jarm\";\nimport {\n  ValidateOpenid4vpAuthorizationResponseResult,\n  validateOpenid4vpAuthorizationResponsePayload,\n} from \"./validate-authorization-response\";\nimport {\n  Openid4vpAuthorizationResponse,\n  zOpenid4vpAuthorizationResponse,\n} from \"./z-authorization-response\";\n\nexport interface ParseAuthorizationResponseOptions {\n  /**\n   * Parsed authorization request payload used to validate response parameters.\n   */\n  authorizationRequestPayload: Openid4vpAuthorizationRequestPayload;\n  /**\n   * Authorization response received from the verifier endpoint or redirect URI.\n   */\n  authorizationResponse: Record<string, unknown>;\n  /**\n   * Callbacks required when the response is returned in JARM format.\n   */\n  callbacks: Pick<CallbackContext, \"decryptJwe\" | \"verifyJwt\">;\n}\n\n/**\n * Parsed and validated authorization response.\n */\nexport type ParseAuthorizationResponseResult = {\n  authorizationResponsePayload: Openid4vpAuthorizationResponse;\n  expectedNonce: string;\n  jarm?: {\n    jarmHeader: JarmHeader;\n  } & VerifyJarmAuthorizationResponseResult;\n} & ValidateOpenid4vpAuthorizationResponseResult;\n\n/**\n * Parses an OpenID4VP authorization response and validates it against the request.\n *\n * If the response includes a `response` parameter, the JARM flow is used.\n * Otherwise, the plain authorization response payload is parsed and validated.\n *\n * @param options {@link ParseAuthorizationResponseOptions}\n * @returns A parsed and validated authorization response.\n */\nexport async function parseAuthorizationResponse(\n  options: ParseAuthorizationResponseOptions,\n): Promise<ParseAuthorizationResponseResult> {\n  const { authorizationRequestPayload, authorizationResponse, callbacks } =\n    options;\n\n  if (authorizationResponse.response) {\n    if (typeof authorizationResponse.response !== \"string\") {\n      throw new Oid4vpError(\n        \"Invalid jarm authorization response: 'response' parameter must be a jwt string.\",\n      );\n    }\n\n    return parseJarmAuthorizationResponse({\n      authorizationRequestPayload,\n      callbacks,\n      jarmResponseJwt: authorizationResponse.response,\n    });\n  }\n\n  const authorizationResponsePayload = parseWithErrorHandling(\n    zOpenid4vpAuthorizationResponse,\n    authorizationResponse,\n    \"Failed to parse openid4vp authorization response.\",\n  );\n\n  const validatedOpenId4vpResponse =\n    validateOpenid4vpAuthorizationResponsePayload({\n      authorizationRequestPayload: authorizationRequestPayload,\n      authorizationResponsePayload: authorizationResponsePayload,\n    });\n\n  return {\n    ...validatedOpenId4vpResponse,\n    authorizationResponsePayload,\n    expectedNonce: authorizationRequestPayload.nonce,\n  };\n}\n","import {\n  type CallbackContext,\n  decodeJwtHeader,\n  zCompactJwe,\n  zCompactJwt,\n} from \"@pagopa/io-wallet-oauth2\";\nimport { parseWithErrorHandling } from \"@pagopa/io-wallet-utils\";\nimport z from \"zod\";\n\nimport { Openid4vpAuthorizationRequestPayload } from \"../authorization-request/z-authorization-request\";\nimport { ParseAuthorizationResponseResult } from \"../authorization-response/parse-authorization-response\";\nimport { validateOpenid4vpAuthorizationResponsePayload } from \"../authorization-response/validate-authorization-response\";\nimport { zOpenid4vpAuthorizationResponse } from \"../authorization-response/z-authorization-response\";\nimport { verifyJarmAuthorizationResponse } from \"./verify-jarm-authorization-response\";\nimport { zJarmHeader } from \"./z-jarm\";\n\nexport interface ParseJarmAuthorizationResponseOptions {\n  /**\n   * Parsed authorization request payload used to validate JARM claims.\n   */\n  authorizationRequestPayload: Openid4vpAuthorizationRequestPayload;\n  /**\n   * Callbacks used to decrypt and verify JARM JWT/JWE responses.\n   */\n  callbacks: Pick<CallbackContext, \"decryptJwe\" | \"verifyJwt\">;\n  /**\n   * Compact JARM authorization response (`response` parameter value).\n   */\n  jarmResponseJwt: string;\n  /**\n   * Current time used for temporal claim validation (`exp`, `nbf`).\n   * Defaults to current date-time when omitted.\n   */\n  now?: Date;\n}\n\n/**\n * Parses and validates a JARM authorization response for OpenID4VP.\n *\n * This function validates compact format, decrypts and/or verifies the JARM token,\n * parses the resulting OpenID4VP authorization response, and validates it against\n * the originating authorization request.\n *\n * @param options {@link ParseJarmAuthorizationResponseOptions}\n * @returns Parsed authorization response enriched with JARM metadata.\n */\nexport async function parseJarmAuthorizationResponse(\n  options: ParseJarmAuthorizationResponseOptions,\n): Promise<ParseAuthorizationResponseResult> {\n  const { authorizationRequestPayload, callbacks, jarmResponseJwt, now } =\n    options;\n\n  const jarmAuthorizationResponseJwt = parseWithErrorHandling(\n    z.union([zCompactJwt, zCompactJwe]),\n    jarmResponseJwt,\n    \"Invalid jarm authorization response jwt.\",\n  );\n\n  const verifiedJarmResponse = await verifyJarmAuthorizationResponse({\n    authorizationRequestPayload,\n    callbacks,\n    jarmAuthorizationResponseJwt,\n    now,\n  });\n\n  const { header: jarmHeader } = decodeJwtHeader({\n    headerSchema: zJarmHeader,\n    jwt: jarmAuthorizationResponseJwt,\n  });\n\n  const authorizationResponsePayload = parseWithErrorHandling(\n    zOpenid4vpAuthorizationResponse,\n    verifiedJarmResponse.jarmAuthorizationResponse,\n    \"Failed to parse openid4vp authorization response.\",\n  );\n\n  const validateOpenId4vpResponse =\n    validateOpenid4vpAuthorizationResponsePayload({\n      authorizationRequestPayload: authorizationRequestPayload,\n      authorizationResponsePayload: authorizationResponsePayload,\n    });\n\n  return {\n    ...validateOpenId4vpResponse,\n    authorizationResponsePayload,\n    expectedNonce: authorizationRequestPayload.nonce,\n    jarm: { ...verifiedJarmResponse, jarmHeader },\n  };\n}\n","import { parseIfJson, parseWithErrorHandling } from \"@pagopa/io-wallet-utils\";\n\nimport { zVpToken } from \"./z-vp-token\";\n\n/**\n * Parses a DCQL VP token into the SDK VP token shape.\n *\n * @param vpToken - Raw VP token object or JSON string.\n * @returns Parsed VP token.\n * @throws {ValidationError} If the token is not an object of encoded presentations.\n */\nexport function parseVpToken(vpToken: unknown) {\n  return parseWithErrorHandling(\n    zVpToken,\n    parseIfJson(vpToken),\n    \"Could not parse dcql vp_token. Expected an object where the values are encoded presentations\",\n  );\n}\n","import { Openid4vpAuthorizationRequestPayload } from \"../authorization-request/z-authorization-request\";\nimport { Oid4vpError } from \"../errors\";\nimport { parseVpToken } from \"../vp-token/parse-vp-token\";\nimport { Openid4vpAuthorizationResponse } from \"./z-authorization-response\";\n\nexport interface ValidateOpenid4vpAuthorizationResponseOptions {\n  /**\n   * Parsed request payload used as validation source.\n   */\n  authorizationRequestPayload: Openid4vpAuthorizationRequestPayload;\n  /**\n   * Parsed authorization response payload to validate.\n   */\n  authorizationResponsePayload: Openid4vpAuthorizationResponse;\n}\n\n/**\n * Result of authorization response validation.\n */\nexport interface ValidateOpenid4vpAuthorizationResponseResult {\n  presentations: ReturnType<typeof parseVpToken>;\n  query: Openid4vpAuthorizationRequestPayload[\"dcql_query\"];\n}\n\n/**\n * Validates the OpenID4VP authorization response payload against the request payload.\n *\n * @param options {@link ValidateOpenid4vpAuthorizationResponseOptions}\n * @returns Presentations and query extracted from the validated flow.\n * @throws {Oid4vpError} If `state` is present in the request and does not match the response.\n */\nexport function validateOpenid4vpAuthorizationResponsePayload(\n  options: ValidateOpenid4vpAuthorizationResponseOptions,\n): ValidateOpenid4vpAuthorizationResponseResult {\n  const { authorizationRequestPayload, authorizationResponsePayload } = options;\n\n  if (\n    authorizationRequestPayload.state !== authorizationResponsePayload.state\n  ) {\n    throw new Oid4vpError(\"OpenId4Vp Authorization Response state mismatch.\");\n  }\n\n  const presentations = parseVpToken(authorizationResponsePayload.vp_token);\n\n  return {\n    presentations,\n    query: authorizationRequestPayload.dcql_query,\n  };\n}\n","import { jwtSignerFromJwt } from \"@openid4vc/oauth2\";\nimport {\n  type CallbackContext,\n  type Jwk,\n  Oauth2Error,\n  decodeJwt,\n  decodeJwtHeader,\n  zCompactJwe,\n  zCompactJwt,\n  zJwtHeader,\n} from \"@pagopa/io-wallet-oauth2\";\nimport { stringToJsonWithErrorHandling } from \"@pagopa/io-wallet-utils\";\nimport z from \"zod\";\n\nimport { Openid4vpAuthorizationRequestPayload } from \"../authorization-request/z-authorization-request\";\nimport { extractEncryptionJwkFromJwks } from \"./jarm-extract-jwks\";\nimport {\n  JarmAuthorizationResponse,\n  JarmAuthorizationResponseEncryptedOnly,\n  zEncryptedJarmHeader,\n  zJarmAuthorizationResponse,\n  zJarmAuthorizationResponseEncryptedOnly,\n} from \"./z-jarm\";\n\n/**\n * Supported JARM serialization/processing modes.\n */\nexport enum JarmMode {\n  Encrypted = \"Encrypted\",\n  Signed = \"Signed\",\n  SignedEncrypted = \"SignedEncrypted\",\n}\n\nconst decryptJarmAuthorizationResponseJwt = async (options: {\n  authorizationRequestPayload: Openid4vpAuthorizationRequestPayload;\n  callbacks: Pick<CallbackContext, \"decryptJwe\">;\n  jarmAuthorizationResponseJwt: string;\n}) => {\n  const {\n    authorizationRequestPayload,\n    callbacks,\n    jarmAuthorizationResponseJwt,\n  } = options;\n\n  let encryptionJwk: Jwk | undefined;\n  const { header } = decodeJwtHeader({\n    headerSchema: zEncryptedJarmHeader,\n    jwt: jarmAuthorizationResponseJwt,\n  });\n\n  const jwks = authorizationRequestPayload.client_metadata?.jwks;\n\n  if (jwks) {\n    encryptionJwk = extractEncryptionJwkFromJwks(jwks, { kid: header.kid });\n  }\n\n  const result = await callbacks.decryptJwe(jarmAuthorizationResponseJwt, {\n    jwk: encryptionJwk,\n  });\n\n  if (!result.decrypted) {\n    throw new Oauth2Error(\"Failed to decrypt jarm auth response.\");\n  }\n\n  return {\n    decryptionJwk: result.decryptionJwk,\n    payload: result.payload,\n  };\n};\n\nexport interface VerifyJarmAuthorizationResponseOptions {\n  /**\n   * Parsed authorization request payload used to resolve metadata and key material.\n   */\n  authorizationRequestPayload: Openid4vpAuthorizationRequestPayload;\n  /**\n   * Callbacks required for JWE decryption and JWT signature verification.\n   */\n  callbacks: Pick<CallbackContext, \"decryptJwe\" | \"verifyJwt\">;\n  /**\n   * Compact serialized JARM response received from the verifier.\n   */\n  jarmAuthorizationResponseJwt: string;\n  /**\n   * Current time used for temporal claim validation (`exp`, `nbf`).\n   * Defaults to current date-time when omitted.\n   */\n  now?: Date;\n}\n\n/**\n * Verified JARM authorization response data returned by {@link verifyJarmAuthorizationResponse}.\n */\nexport interface VerifyJarmAuthorizationResponseResult {\n  /**\n   * JWK used for decryption when the response is encrypted, or `undefined` if the response was not encrypted.\n   */\n  decryptionJwk: Jwk | undefined;\n  /**\n   * The `iss` claim from the JARM response, representing the issuer of the response.\n   */\n  issuer: string | undefined;\n  /**\n   * The parsed JARM authorization response body, containing claims like `iss`, `aud`, `exp`, etc.\n   */\n  jarmAuthorizationResponse:\n    | JarmAuthorizationResponse\n    | JarmAuthorizationResponseEncryptedOnly;\n  /**\n   * Detected JARM processing mode indicating whether the response was signed, encrypted, or both.\n   */\n  type: JarmMode;\n}\n\n/**\n * Verifies a JARM authorization response in signed, encrypted, or signed+encrypted mode.\n *\n * The function detects the response mode, performs decryption when needed, verifies\n * JWS signatures for signed payloads, and returns the parsed JARM body with metadata.\n *\n * @param options {@link VerifyJarmAuthorizationResponseOptions}\n * @returns Decryption and verification artifacts with parsed JARM payload.\n * @throws {Oauth2Error} If the response mode is invalid, decryption fails, or signature verification fails.\n */\nexport async function verifyJarmAuthorizationResponse(\n  options: VerifyJarmAuthorizationResponseOptions,\n) {\n  const {\n    authorizationRequestPayload,\n    callbacks,\n    jarmAuthorizationResponseJwt,\n  } = options;\n\n  const requestDataIsEncrypted = zCompactJwe.safeParse(\n    jarmAuthorizationResponseJwt,\n  ).success;\n  const decryptedRequestData = requestDataIsEncrypted\n    ? await decryptJarmAuthorizationResponseJwt({\n        authorizationRequestPayload,\n        callbacks,\n        jarmAuthorizationResponseJwt,\n      })\n    : { decryptionJwk: undefined, payload: jarmAuthorizationResponseJwt };\n\n  const responseIsSigned = zCompactJwt.safeParse(\n    decryptedRequestData.payload,\n  ).success;\n\n  if (!requestDataIsEncrypted && !responseIsSigned) {\n    throw new Oauth2Error(\n      \"Jarm Auth Response must be either encrypted, signed, or signed and encrypted.\",\n    );\n  }\n\n  let jarmAuthorizationResponse:\n    | JarmAuthorizationResponse\n    | JarmAuthorizationResponseEncryptedOnly;\n\n  if (responseIsSigned) {\n    const { header: jwsProtectedHeader, payload: jwsPayload } = decodeJwt({\n      errorMessagePrefix: \"Error decoding JARM authorization response JWT:\",\n      headerSchema: z.object({ ...zJwtHeader.shape, kid: z.string() }),\n      jwt: decryptedRequestData.payload,\n    });\n\n    const response = zJarmAuthorizationResponse.parse(jwsPayload);\n    const jwtSigner = jwtSignerFromJwt({\n      header: jwsProtectedHeader,\n      payload: jwsPayload,\n    });\n\n    const verificationResult = await options.callbacks.verifyJwt(jwtSigner, {\n      compact: decryptedRequestData.payload,\n      header: jwsProtectedHeader,\n      payload: jwsPayload,\n    });\n\n    if (!verificationResult.verified) {\n      throw new Oauth2Error(\"Jarm Auth Response is not valid.\");\n    }\n\n    const expectedAudience = authorizationRequestPayload.client_id;\n    const expectedIssuer = authorizationRequestPayload.iss;\n    if (response.aud !== expectedAudience) {\n      throw new Oauth2Error(\n        `Jarm Auth Response contains 'aud' value '${response.aud}', but expected '${expectedAudience}'.`,\n      );\n    }\n\n    if (expectedIssuer && response.iss !== expectedIssuer) {\n      throw new Oauth2Error(\n        `Jarm Auth Response contains 'iss' value '${response.iss}', but expected '${expectedIssuer}'.`,\n      );\n    }\n\n    const now = options.now ?? new Date();\n    const nowSeconds = Math.floor(now.getTime() / 1000);\n    if (response.exp < nowSeconds) {\n      throw new Oauth2Error(\"Jarm Auth Response has expired.\");\n    }\n\n    if (response.nbf !== undefined && response.nbf > nowSeconds) {\n      throw new Oauth2Error(\"Jarm Auth Response is not active yet.\");\n    }\n\n    jarmAuthorizationResponse = response;\n  } else {\n    const jsonRequestData = stringToJsonWithErrorHandling(\n      decryptedRequestData.payload,\n      \"Unable to parse decrypted JARM JWE body to JSON\",\n    );\n    jarmAuthorizationResponse =\n      zJarmAuthorizationResponseEncryptedOnly.parse(jsonRequestData);\n  }\n\n  const type: JarmMode =\n    requestDataIsEncrypted && responseIsSigned\n      ? JarmMode.SignedEncrypted\n      : requestDataIsEncrypted\n        ? JarmMode.Encrypted\n        : JarmMode.Signed;\n\n  const issuer = jarmAuthorizationResponse.iss;\n\n  return {\n    decryptionJwk: decryptedRequestData.decryptionJwk,\n    issuer,\n    jarmAuthorizationResponse,\n    type,\n  };\n}\n","import { zJwtHeader, zJwtPayload } from \"@pagopa/io-wallet-oauth2\";\nimport { z } from \"zod\";\n\nexport const zJarmHeader = z.object({\n  ...zJwtHeader.shape,\n  apu: z.string().optional(),\n  apv: z.string().optional(),\n  kid: z.string(),\n});\n\nexport type JarmHeader = z.infer<typeof zJarmHeader>;\n\nexport const zEncryptedJarmHeader = z.object({\n  ...zJwtHeader.shape,\n  apu: z.string().optional(),\n  apv: z.string().optional(),\n  enc: z.string().optional(),\n  kid: z.string(),\n});\n\nexport type EncryptedJarmHeader = z.infer<typeof zEncryptedJarmHeader>;\n\nexport const zJarmAuthorizationResponse = z.looseObject({\n  /**\n   * iss: The issuer URL of the authorization server that created the response\n   * aud: The client_id of the client the response is intended for\n   * exp: The expiration time of the JWT. A maximum JWT lifetime of 10 minutes is RECOMMENDED.\n   */\n  ...zJwtPayload.shape,\n  ...zJwtPayload.pick({ aud: true, exp: true, iss: true }).required().shape,\n  state: z.optional(z.string()),\n});\n\nexport type JarmAuthorizationResponse = z.infer<\n  typeof zJarmAuthorizationResponse\n>;\n\nexport const zJarmAuthorizationResponseEncryptedOnly = z.looseObject({\n  ...zJwtPayload.shape,\n  state: z.optional(z.string()),\n});\n\nexport type JarmAuthorizationResponseEncryptedOnly = z.infer<\n  typeof zJarmAuthorizationResponseEncryptedOnly\n>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qCAAAA;AAAA,EAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,IAAAC,2BAUO;AACP,IAAAC,0BAOO;;;ACfA,IAAM,cAAN,cAA0B,MAAM;AAAA,EAC5B;AAAA,EACT,YACE,SACA,SACA;AACA,UAAM,SAAS,OAAO;AACtB,SAAK,OAAO;AACZ,SAAK,aAAa,SAAS;AAAA,EAC7B;AACF;AAOO,IAAM,6BAAN,cAAyC,YAAY;AAAA,EACjD;AAAA,EACT,YACE,SACA,SACA;AACA,UAAM,SAAS,OAAO;AACtB,SAAK,OAAO;AACZ,SAAK,aAAa,SAAS;AAAA,EAC7B;AACF;AAKO,IAAM,kCAAN,cAA8C,YAAY;AAAA,EACtD;AAAA,EACT,YACE,SACA,SACA;AACA,UAAM,SAAS,OAAO;AACtB,SAAK,OAAO;AACZ,SAAK,aAAa,SAAS;AAAA,EAC7B;AACF;AAMO,IAAM,mCAAN,cAA+C,YAAY;AAAA,EACvD;AAAA,EACT,YACE,SACA,SACA;AACA,UAAM,SAAS,OAAO;AACtB,SAAK,OAAO;AACZ,SAAK,aAAa,SAAS;AAAA,EAC7B;AACF;AAMO,IAAM,+BAAN,cAA2C,YAAY;AAAA,EAC5D,YAAY,SAAiB,SAAwB;AACnD,UAAM,SAAS,OAAO;AACtB,SAAK,OAAO;AAAA,EACd;AACF;;;ACxEA,6BAKO;AAQA,IAAK,iBAAL,kBAAKC,oBAAL;AACL,EAAAA,gBAAA,UAAO;AACP,EAAAA,gBAAA,uBAAoB;AACpB,EAAAA,gBAAA,eAAY;AAHF,SAAAA;AAAA,GAAA;AAgBL,SAAS,sBAAsB,UAAiC;AACrE,QAAM,aAAa,SAAS,QAAQ,GAAG;AAEvC,MAAI,eAAe,IAAI;AACrB,WAAO,EAAE,UAAU,QAAQ,kBAAoB;AAAA,EACjD;AAEA,MAAI,SAAS,WAAW,UAAU,KAAK,SAAS,WAAW,SAAS,GAAG;AACrE,WAAO,EAAE,UAAU,QAAQ,kBAAoB;AAAA,EACjD;AAEA,QAAM,YAAY,SAAS,MAAM,GAAG,UAAU;AAC9C,QAAM,OAAO,SAAS,MAAM,aAAa,CAAC;AAE1C,MAAI,cAAc,6BAA0B;AAC1C,WAAO,EAAE,UAAU,MAAM,QAAQ,4BAAyB;AAAA,EAC5D;AACA,MAAI,cAAc,6CAAkC;AAClD,WAAO,EAAE,UAAU,MAAM,QAAQ,4CAAiC;AAAA,EACpE;AAEA,QAAM,IAAI;AAAA,IACR,iCAAiC,SAAS;AAAA,EAC5C;AACF;AAEA,eAAsB,uBACpB,SACiB;AACjB,SAAO,GAAG,2BAAwB,IAAI,MAAM,6BAA6B,OAAO,CAAC;AACnF;AAEA,eAAe,6BACb,SACA;AACA,QAAM,kBAAkB,mBAAmB,QAAQ,gBAAgB;AAEnE,aAAO;AAAA,IACL,MAAM,QAAQ,SAAK,qCAAa,eAAe,GAAG,qCAAc,MAAM;AAAA,EACxE;AACF;AAEA,eAAsB,0CAA0C,SAIrC;AACzB,QAAM,gBAAgB,sBAAsB,QAAQ,QAAQ,SAAS;AAErE,MAAI,cAAc,WAAW,6BAA0B;AACrD,WAAO;AAAA,EACT;AAEA,QAAM,EAAE,IAAI,IAAI,QAAQ;AACxB,MAAI,CAAC,MAAM,QAAQ,GAAG,KAAK,IAAI,WAAW,GAAG;AAC3C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,QAAQ,MAAM;AACjB,WAAO;AAAA,EACT;AAEA,QAAM,0BAA0B,MAAM,6BAA6B;AAAA,IACjE,kBAAkB;AAAA,IAClB,MAAM,QAAQ;AAAA,EAChB,CAAC;AAED,MAAI,4BAA4B,cAAc,UAAU;AACtD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,mBAAmB,kBAA4B;AACtD,QAAM,kBAAkB,iBAAiB,CAAC;AAE1C,MAAI,CAAC,iBAAiB;AACpB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;;;ACrHA,8BAMO;AACP,sCAAuD;AACvD,iBAAkB;AAOlB,IAAM,uCACJ,uEAAuC,QAAQ;AAAA,EAC7C,kBAAkB;AAAA,EAClB,WAAW;AAAA,EACX,aAAa;AAAA,EACb,UAAU;AAAA,EACV,cAAc;AAAA,EACd,eAAe;AACjB,CAAC;AAMI,IAAM,wCAAwC,aAClD,YAAY;AAAA,EACX,WAAW,aAAE,OAAO;AAAA,EACpB,iBAAiB,qCAAqC,SAAS;AAAA,EAC/D,YAAY,aAAE,OAAO,aAAE,OAAO,GAAG,aAAE,IAAI,CAAC;AAAA,EACxC,OAAO,aAAE,OAAO;AAAA,EAChB,aAAa,aAAE,IAAI,EAAE,SAAS;AAAA,EAC9B,oBAAoB,aAAE,SAAS,aAAE,OAAO,CAAC;AAAA,EACzC,eAAe,aAAE,QAAQ,iBAAiB;AAAA,EAC1C,eAAe,aAAE,QAAQ,UAAU;AAAA,EACnC,cAAc,aAAE,IAAI;AAAA,EACpB,OAAO,aAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,OAAO,aAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,kBAAkB,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1D,6BAA6B,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EAC1D,cAAc,aAAE,OAAO,EAAE,SAAS;AACpC,CAAC,EACA;AAAA,EACC,aAAE,OAAO;AAAA,IACP,GAAG,oCAAY;AAAA,EACjB,CAAC;AACH;AAMF,IAAM,2CAA2C,aAAE,OAAO;AAAA,EACxD,KAAK;AAAA,EACL,KAAK,aAAE,OAAO;AAAA,EACd,KAAK;AACP,CAAC;AAEM,IAAM,2CACX,yCACG,OAAO;AAAA,EACN,aAAa;AACf,CAAC,EACA,MAAM;AAMJ,IAAM,2CACX,yCACG,OAAO;AAAA;AAAA,EAEN,KAAK,aAAE,OAAO,EAAE,SAAS;AAAA,EACzB,aAAa,oCAAY,SAAS;AAAA,EAClC,KAAK,0CAAkB,SAAS;AAClC,CAAC,EACA,MAAM;;;AHwDX,IAAM,yCAAqC,iDAGzC;AAAA,EACA,CAAC,6CAAqB,IAAI,GAAG,OAAO,MAClC;AAAA,IACE;AAAA,IACA;AAAA,EACF;AAAA,EACF,CAAC,6CAAqB,IAAI,GAAG,OAAO,MAClC;AAAA,IACE;AAAA,IACA;AAAA,EACF;AAAA;AAAA,EAEF,CAAC,6CAAqB,IAAI,GAAG,OAAO,MAClC;AAAA,IACE;AAAA,IACA;AAAA,EACF;AACJ,CAAC;AAwBD,eAAsB,2BACpB,SAC2C;AAC3C,MAAI;AACF,WAAO,MAAM,mCAAmC,OAAO;AAAA,EACzD,SAAS,OAAO;AACd,QAAI,iBAAiB,yCAAiB;AACpC,YAAM,IAAI,YAAY,kCAAkC,MAAM,OAAO,EAAE;AAAA,IACzE;AACA,UAAM;AAAA,EACR;AACF;AAEA,eAAe,qCACb,SACA,cAGqD;AACrD,QAAM,EAAE,WAAW,KAAK,SAAS,eAAe,IAAI;AAEpD,QAAM,iCAA6B,gDAAuB,cAAc;AAAA,IACtE,OAAG,iDAAuB,IAAI,SAAS;AAAA,IACvC,KAAK;AAAA,EACP,CAAC;AAED,QAAM,kCAA8B;AAAA,IAClC;AAAA,IACA,QAAQ;AAAA,EACV;AAEA;AAAA,IACE,QAAQ,OAAO;AAAA,IACf,IAAI;AAAA,IACJ;AAAA,EACF;AAEA,4CAA0C;AAAA,IACxC,MAAM,QAAQ,UAAU;AAAA,IACxB,QAAQ;AAAA,IACR,SAAS;AAAA,EACX,CAAC;AAED,QAAM,uBAAuB,CAAC,IAAI,sBAAsB,MACpD,EAAE,GAAG,IAAI,sBAAsB,KAAK,IAAI,WAAW,IACnD,IAAI;AAER,QAAM,YAAY,UAAM,2CAAiB;AAAA,IACvC,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,SAAO;AAAA,IACL,sBAAsB;AAAA,MACpB;AAAA,MACA,UAAU;AAAA,IACZ;AAAA,IACA,4BAA4B,UAAU;AAAA,IACtC;AAAA,IACA,KAAK,EAAE,GAAG,KAAK,GAAG,UAAU;AAAA,EAC9B;AACF;AAEA,SAAS,8BACP,QACA,SACA;AACA,QAAM,MAAM,IAAI,IAAI,MAAM;AAE1B,QAAM,eAAe,IAAI,gBAAgB;AAAA,IACvC,GAAG,IAAI,aAAa,QAAQ;AAAA,IAC5B,OAAG,6CAAoB,OAAO,EAAE,QAAQ;AAAA,EAC1C,CAAC;AAED,MAAI,SAAS,aAAa,SAAS;AAEnC,SAAO,IAAI,SAAS;AACtB;AAEA,SAAS,yCACP,cACA,WACA,SACA;AACA,MAAI,iBAAiB,6CAAqB,MAAM;AAC9C;AAAA,EACF;AAEA,QAAM,EAAE,OAAO,IAAI,sBAAsB,QAAQ,SAAS;AAE1D,MAAI,0CAAuC,UAAU,WAAW,OAAO;AACrE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,MACE,0CACA,UAAU,WAAW,cACrB;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;;;AIhSA,oBAA0D;AAC1D,IAAAC,0BAKO;;;ACWA,SAAS,mCACd,QACA;AAEA,MAAI,OAAO,WAAW,OAAO,aAAa;AACxC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAGA,MAAI,CAAC,OAAO,WAAW,CAAC,OAAO,aAAa;AAC1C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAGA,MAAI,OAAO,oBAAoB;AAC7B,UAAMC,oBAAmB,OAAO,mBAAmB,YAAY;AAC/D,QAAIA,sBAAqB,SAASA,sBAAqB,QAAQ;AAC7D,YAAM,IAAI;AAAA,QACR,gCAAgC,OAAO,kBAAkB;AAAA,MAC3D;AAAA,IACF;AAAA,EACF;AAGA,MAAI,OAAO,sBAAsB,CAAC,OAAO,aAAa;AACpD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAGA,QAAM,mBAAmB,OAAO,qBAC3B,OAAO,mBAAmB,YAAY,IACvC;AAEJ,SAAO;AAAA,IACL,GAAG;AAAA,IACH,oBAAoB;AAAA,EACtB;AASF;;;AC1CA,eAAsB,6BACpB,SACe;AACf,QAAM,WAAW,MAAM,QAAQ,UAAU;AAAA,IACvC,QAAQ;AAAA,EACV;AAEA,aAAW,YAAY,QAAQ,WAAW;AACxC,QAAI,CAAC,SAAS,KAAK;AACjB;AAAA,IACF;AAEA;AAAA,MACE,EAAE,MAAM,SAAS,MAAM,KAAK,SAAS,IAAI;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,gCACP,UACA,UACA;AACA,QAAM,cAAc,iBAAiB,QAAQ;AAC7C,QAAM,cAAc,SAAS,eAAe,CAAC;AAC7C,QAAM,gBAAgB,YAAY;AAAA,IAChC,CAAC,eAAe,0BAA0B,UAAU,MAAM,YAAY;AAAA,EACxE;AACA,QAAM,cAAc,SAAS,eAAe,CAAC;AAC7C,QAAM,gBAAgB,YAAY;AAAA,IAAK,CAAC,eACtC,sBAAsB,YAAY,YAAY,QAAQ;AAAA,EACxD;AAEA,MAAI,iBAAiB,eAAe;AAClC;AAAA,EACF;AAEA,QAAM,IAAI;AAAA,IACR,GAAG,SAAS,IAAI;AAAA,EAClB;AACF;AAEA,SAAS,0BAA0B,KAAa;AAC9C,MAAI;AACF,WAAO,IAAI,IAAI,GAAG,EAAE;AAAA,EACtB,SAAS,OAAO;AACd,UAAM,IAAI,YAAY,2CAA2C,GAAG,IAAI;AAAA,MACtE,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACF;AAEA,SAAS,sBAAsB,YAAoB,UAAkB;AACnE,QAAM,uBAAuB,WAAW,YAAY;AACpD,QAAM,qBAAqB,SAAS,YAAY;AAEhD,MAAI,yBAAyB,oBAAoB;AAC/C,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,qBAAqB,SAAS,GAAG,GAAG;AACvC,WAAO;AAAA,EACT;AAEA,QAAM,gBAAgB,CAAC,GAAG,oBAAoB,EAAE;AAAA,IAC9C,CAAC,cAAc,cAAc;AAAA,EAC/B,EAAE;AACF,QAAM,YAAY,qBAAqB,MAAM,GAAG;AAChD,QAAM,iBAAiB,mBAAmB,MAAM,GAAG;AAEnD,SACE,kBAAkB,KAClB,UAAU,CAAC,MAAM,OACjB,UAAU,WAAW,eAAe,UACpC,UACG,MAAM,CAAC,EACP,MAAM,CAAC,OAAO,UAAU,UAAU,eAAe,QAAQ,CAAC,CAAC;AAElE;AAEA,SAAS,iBAAiB,UAAyC;AACjE,MAAI;AACF,WAAO,IAAI,IAAI,SAAS,GAAG;AAAA,EAC7B,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR,GAAG,SAAS,IAAI,wBAAwB,SAAS,GAAG;AAAA,MACpD,EAAE,OAAO,MAAM;AAAA,IACjB;AAAA,EACF;AACF;;;ACnHA,IAAAC,cAAc;AAMP,IAAM,iCAAiC,YAAAC,QAAE,YAAY;AAAA,EAC1D,WAAW,YAAAA,QAAE,OAAO;AAAA,EACpB,SAAS,YAAAA,QAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAC7B,aAAa,YAAAA,QAAE,IAAI,EAAE,SAAS;AAAA;AAAA,EAC9B,oBAAoB,YAAAA,QAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EACxC,OAAO,YAAAA,QAAE,OAAO,EAAE,SAAS;AAAA;AAC7B,CAAC;;;AH8FM,SAAS,mBAAmB,qBAA2C;AAC5E,QAAM,MAAM,IAAI,IAAI,mBAAmB;AAEvC,QAAM,YAAY;AAAA,IAChB,WAAW,IAAI,aAAa,IAAI,WAAW,KAAK;AAAA,IAChD,SAAS,IAAI,aAAa,IAAI,SAAS,KAAK;AAAA,IAC5C,aAAa,IAAI,aAAa,IAAI,aAAa,KAAK;AAAA,IACpD,oBAAoB,IAAI,aAAa,IAAI,oBAAoB,KAAK;AAAA,IAClE,OAAO,IAAI,aAAa,IAAI,OAAO,KAAK;AAAA,EAC1C;AAEA,QAAM,eAAe,+BAA+B,MAAM,SAAS;AACnE,QAAM,kBAAkB,mCAAmC,YAAY;AACvE,QAAM,SAAS,gBAAgB,UAAU,UAAU;AAEnD,SAAO;AAAA,IACL,UAAU,gBAAgB;AAAA,IAC1B,SAAS,gBAAgB;AAAA,IACzB,YAAY,gBAAgB;AAAA,IAC5B,kBACE,WAAW,cACN,gBAAgB,sBAAsB,QACvC;AAAA,EACR;AACF;AAYA,eAAsB,sBACpB,YACA,SAMiB;AACjB,QAAM,YAAQ,uCAAc,QAAQ,KAAK;AAGzC,QAAM,cAA2B;AAAA,IAC/B,QAAQ,QAAQ,OAAO,YAAY;AAAA,EACrC;AAGA,MAAI,QAAQ,WAAW,QAAQ;AAC7B,UAAM,WAAW,IAAI,gBAAgB;AAGrC,QAAI,QAAQ,gBAAgB;AAC1B,eAAS;AAAA,QACP;AAAA,QACA,KAAK,UAAU,QAAQ,cAAc;AAAA,MACvC;AAAA,IACF;AAGA,QAAI,QAAQ,aAAa;AACvB,eAAS,OAAO,gBAAgB,QAAQ,WAAW;AAAA,IACrD;AAEA,gBAAY,UAAU;AAAA,MACpB,gBAAgB;AAAA,IAClB;AACA,gBAAY,OAAO,SAAS,SAAS;AAAA,EACvC;AAEA,QAAM,WAAW,MAAM,MAAM,YAAY,WAAW;AAEpD,YAAM,0CAAiB,KAAK,iDAAyB,EAAE,QAAQ;AAE/D,SAAO,MAAM,SAAS,KAAK;AAC7B;AA0DA,eAAsB,0BACpB,SAC0C;AAC1C,MAAI;AACF,UAAM,eAAe,mBAAmB,QAAQ,mBAAmB;AAGnE,QAAI;AACJ,QAAI,aAAa,SAAS;AACxB,yBAAmB,aAAa;AAAA,IAClC,OAAO;AACL,UAAI,QAAQ,iBAAiB;AAC3B,cAAM,6BAA6B;AAAA,UACjC,WAAW,QAAQ,gBAAgB;AAAA,UACnC,aAAa,QAAQ,gBAAgB;AAAA,UACrC,WAAW;AAAA,YACT;AAAA,cACE,MAAM;AAAA,cACN,KAAK,aAAa;AAAA,YACpB;AAAA,UACF;AAAA,QACF,CAAC;AAAA,MACH;AAGA,yBAAmB,MAAM;AAAA,QACvB,aAAa;AAAA,QACb;AAAA,UACE,OAAO,QAAQ,UAAU;AAAA,UACzB,QAAQ,aAAa,oBAAoB;AAAA,UACzC,gBAAgB,QAAQ;AAAA,UACxB,aAAa,QAAQ;AAAA,QACvB;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,QAAQ,aAAa,UAAU,UAAU;AAAA,IAC3C;AAAA,EACF,SAAS,OAAO;AACd,QACE,iBAAiB,2CACjB,iBAAiB,qCACjB,iBAAiB,eACjB,iBAAiB,mDACjB;AACA,YAAM;AAAA,IACR;AAEA,UAAM,IAAI;AAAA,MACR,wDAAwD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IAChH;AAAA,EACF;AACF;;;AI3SA,IAAAC,iBAKO;AACP,IAAAC,2BAA0B;AAC1B,IAAAC,0BAMO;AA0CP,SAAS,4BAA4B,SAGvB;AACZ,QAAM,EAAE,QAAQ,QAAQ,IAAI;AAE5B,QAAM,EAAE,QAAQ,eAAe,IAAI,sBAAsB,QAAQ,SAAS;AAE1E,MACE,kEACA,sCACA;AACA,QAAI,CAAC,OAAO,KAAK;AACf,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL,KAAK,OAAO;AAAA,MACZ,KAAK,OAAO;AAAA,MACZ,QAAQ;AAAA,MACR,GAAI,OAAO,eAAe,EAAE,YAAY,OAAO,YAAY;AAAA,IAC7D;AAAA,EACF;AAEA,MAAI,gDAA6C;AAC/C,QAAI,CAAC,MAAM,QAAQ,OAAO,GAAG,KAAK,OAAO,IAAI,WAAW,GAAG;AACzD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL,KAAK,OAAO;AAAA,MACZ,KAAK,OAAO;AAAA,MACZ,QAAQ;AAAA,MACR,GAAI,OAAO,eAAe,EAAE,YAAY,OAAO,YAAY;AAAA,MAC3D,KAAK,OAAO;AAAA,IACd;AAAA,EACF;AAEA,QAAM,IAAI;AAAA,IACR,2FACE;AAAA,EACJ;AACF;AA0DA,eAAsB,sBACpB,SACuC;AACvC,MAAI;AACF,UAAM,mBAAe,2CAGnB,QAAQ,OAAO,sBAAsB;AAAA,MACrC,CAAC,6CAAqB,IAAI,GAAG,MAC3B;AAAA,MACF,CAAC,6CAAqB,IAAI,GAAG,MAC3B;AAAA,MACF,CAAC,6CAAqB,IAAI,GAAG,MAC3B;AAAA,IACJ,CAAC;AAED,UAAM,cAAU,oCAAU;AAAA,MACxB,oBAAoB;AAAA,MACpB;AAAA,MACA,KAAK,QAAQ;AAAA,MACb,eAAe;AAAA,IACjB,CAAC;AAED,QAAI,QAAQ,OAAO,yBAAyB,6CAAqB,MAAM;AACrE,YAAM,0CAA0C;AAAA,QAC9C,MAAM,QAAQ,WAAW;AAAA,QACzB,QAAQ,QAAQ;AAAA,QAChB,SAAS,QAAQ;AAAA,MACnB,CAAC;AAAA,IACH;AAEA,UAAM,MACJ,SAAS,QAAQ,UACjB,MAAM,QAAQ,QAAQ,OAAO,GAAG,KAChC,QAAQ,OAAO,IAAI,SAAS,IACvB,QAAQ,OAAO,MAChB;AAEN,QAAI,OAAO,QAAQ,WAAW,4BAA4B;AACxD,YAAM,6BAA6B;AAAA,QACjC,WAAW;AAAA,UACT,4BACE,QAAQ,UAAU;AAAA,QACtB;AAAA,QACA,aAAa,IAAI,CAAC;AAAA,QAClB,WAAW;AAAA,UACT,EAAE,MAAM,eAAe,KAAK,QAAQ,QAAQ,YAAY;AAAA,UACxD,EAAE,MAAM,gBAAgB,KAAK,QAAQ,QAAQ,aAAa;AAAA,QAC5D;AAAA,MACF,CAAC;AAAA,IACH;AAEA,QAAI,QAAQ,WAAW,WAAW;AAChC,YAAM,SAAS,4BAA4B;AAAA,QACzC,QAAQ,QAAQ;AAAA,QAChB,SAAS,QAAQ;AAAA,MACnB,CAAC;AAED,gBAAM,0BAAU;AAAA,QACd,SAAS,QAAQ;AAAA,QACjB,cAAc;AAAA,QACd,QAAQ,QAAQ;AAAA,QAChB,SAAS,QAAQ;AAAA,QACjB;AAAA,QACA,mBAAmB,QAAQ,UAAU;AAAA,MACvC,CAAC;AAAA,IACH;AAEA,WAAO;AAAA,MACL,QAAQ,QAAQ;AAAA,MAChB,SAAS,QAAQ;AAAA,MACjB,GAAI,OAAO;AAAA,QACT,iBAAiB;AAAA,UACf,iBAAiB,IAAI,CAAC;AAAA,UACtB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,QACE,iBAAiB,qDACjB,iBAAiB,2CACjB,iBAAiB,sCACjB,iBAAiB;AAEjB,YAAM;AACR,UAAM,IAAI;AAAA,MACR,mDAAmD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IAC3G;AAAA,EACF;AACF;;;ACzPA,IAAAC,0BAGO;;;ACAP,IAAAC,0BAAkC;;;ACW3B,SAAS,6BACd,MACA;AAAA,EACE;AAAA,EACA;AACF,GAIA;AACA,MAAI,KAAK;AACP,WAAO,KAAK,KAAK,KAAK,CAAC,QAAQ,IAAI,QAAQ,GAAG;AAAA,EAChD;AAEA,MAAI,cAAc,KAAK,KAAK;AAAA,IAC1B,CAAC,QAAQ,IAAI,OAAO,oBAAoB,SAAS,IAAI,GAAG;AAAA,EAC1D;AACA,MAAI,YAAY,WAAW,EAAG,eAAc,KAAK;AAEjD,MAAI,cAAc,YAAY,OAAO,CAAC,QAAQ,IAAI,QAAQ,KAAK;AAC/D,MAAI,YAAY,WAAW,GAAG;AAC5B,kBAAc,YAAY,OAAO,CAAC,QAAQ,IAAI,QAAQ,KAAK;AAAA,EAC7D;AAEA,SAAO,YAAY,SAAS,IAAI,YAAY,CAAC,IAAI,KAAK,KAAK,CAAC;AAC9D;;;ADjBA,SAAS,gBACP,WACA,WACA,UACQ;AACR,MAAI,CAAC,UAAW,QAAO,aAAa;AACpC,SACE,UAAU,KAAK,CAAC,MAAM,MAAM,SAAS,KACrC,UAAU,CAAC,KACX,aACA;AAEJ;AAOA,eAAsB,kBACpB,SAC4C;AAC5C,MAAI;AACF,UAAM,gBACJ,QAAQ,wCAAwC;AAClD,UAAM,gBACJ,QAAQ,wCAAwC;AAElD,UAAM,+BAA+B;AAAA,MACnC,OAAO,QAAQ,cAAc;AAAA,MAC7B,UAAU,QAAQ;AAAA,IACpB;AAEA,UAAM,gBAAgB,6BAA6B,QAAQ,gBAAgB;AAAA,MACzE,oBAAoB,CAAC,aAAa;AAAA,IACpC,CAAC;AACD,QAAI,CAAC,eAAe;AAClB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,cAAc,KAAK;AACtB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,MAAM;AAAA,MACV,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,IACF;AAEA,UAAM,MAAM;AAEZ,UAAM,aAAa,MAAM,QAAQ,UAAU,eAAe,EAAE;AAE5D,UAAM,eAA6B;AAAA,MACjC;AAAA,MACA,SAAK,2CAAkB,UAAU;AAAA,MACjC,SAAK,2CAAkB,QAAQ,cAAc,KAAK;AAAA,MAClD;AAAA,MACA,KAAK,cAAc;AAAA,MACnB,QAAQ;AAAA,MACR,WAAW;AAAA,IACb;AAEA,UAAM,EAAE,eAAe,SAAS,IAAI,IAAI,MAAM,QAAQ,UAAU;AAAA,MAC9D;AAAA,MACA,KAAK,UAAU,4BAA4B;AAAA,IAC7C;AAEA,WAAO;AAAA,MACL;AAAA,MACA,MAAM;AAAA,QACJ,eAAe;AAAA,QACf,aAAa;AAAA,MACf;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,QAAI,iBAAiB,kCAAkC;AACrD,YAAM;AAAA,IACR;AACA,UAAM,IAAI;AAAA,MACR,4DAA4D,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IACpH;AAAA,EACF;AACF;;;AE5FA,eAAsB,4BACpB,SAC4C;AAC5C,QAAM,EAAE,cAAc,IAAI;AAC1B,QAAM,iBAAiB,cAAc;AACrC,QAAM,EAAE,QAAQ,eAAe,IAAI;AAAA,IACjC,cAAc;AAAA,EAChB;AAEA,MAAI,kDAA+C,CAAC,gBAAgB;AAClE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAKA,QAAM,0BACJ,iEACI,SACA;AAEN,QAAM,iBAAiB,0BACnB,wBAAwB,OACxB,QAAQ,OAAO;AAEnB,QAAM,qBACJ,yBAAyB,2CACzB,QAAQ,OAAO;AAEjB,SAAO,kBAAkB;AAAA,IACvB,sCACE,QAAQ;AAAA,IACV,sCACE,QAAQ;AAAA,IACV,WAAW,QAAQ;AAAA,IACnB;AAAA,IACA;AAAA,IACA,eAAe,QAAQ;AAAA,IACvB,UAAU,QAAQ;AAAA,EACpB,CAAC;AACH;;;ACvCA,eAAsBC,6BACpB,SAC4C;AAC5C,QAAM,EAAE,cAAc,IAAI;AAC1B,QAAM,iBAAiB,cAAc;AACrC,QAAM,EAAE,QAAQ,eAAe,IAAI;AAAA,IACjC,cAAc;AAAA,EAChB;AAEA,MAAI,kDAA+C,CAAC,gBAAgB;AAClE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,iBAAiB,gBAAgB,QAAQ,QAAQ,OAAO;AAE9D,QAAM,qBACJ,gBAAgB,2CAChB,QAAQ,OAAO;AAEjB,SAAO,kBAAkB;AAAA,IACvB,sCACE,QAAQ;AAAA,IACV,sCACE,QAAQ;AAAA,IACV,WAAW,QAAQ;AAAA,IACnB;AAAA,IACA;AAAA,IACA,eAAe,QAAQ;AAAA,IACvB,UAAU,QAAQ;AAAA,EACpB,CAAC;AACH;;;AJ9BA,IAAM,0CAAsC,iDAG1C;AAAA,EACA,CAAC,6CAAqB,IAAI,GAAG,CAAC;AAAA;AAAA,IAEvB;AAAA,MACH;AAAA,IACF;AAAA;AAAA,EACF,CAAC,6CAAqB,IAAI,GAAG,CAAC,MACvB;AAAA,IACH;AAAA,EACF;AAAA,EACF,CAAC,6CAAqB,IAAI,GAAG,CAAC,MACvBC;AAAA,IACH;AAAA,EACF;AACJ,CAAC;AAgBD,eAAsBA,6BACpB,SAC4C;AAC5C,SAAO,oCAAoC,OAAO;AACpD;;;AK3DA,IAAAC,0BAQO;;;ACTP,IAAAC,cAAc;;;ACAd,IAAAC,cAAkB;AAEX,IAAM,WAAW,cAAE;AAAA,EACxB,cAAE,OAAO;AAAA,EACT,cAAE,OAAO,EAAE,GAAG,cAAE,MAAM,cAAE,OAAO,CAAC,EAAE,SAAS,CAAC;AAAA,EAC5C;AAAA,IACE,SACE;AAAA,EACJ;AACF;;;ADLO,IAAM,kCAAkC,YAAAC,QAAE,OAAO;AAAA,EACtD,OAAO,YAAAA,QAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,UAAU;AACZ,CAAC;AAMM,IAAM,wCAAwC,YAAAA,QAAE,OAAO;AAAA,EAC5D,cAAc,YAAAA,QAAE,IAAI,EAAE,SAAS;AACjC,CAAC;;;AD+CD,eAAsB,2BACpB,SAC+C;AAC/C,MAAI;AACF,QAAI,QAAQ,iBAAiB;AAC3B,YAAM,6BAA6B;AAAA,QACjC,WAAW,QAAQ,gBAAgB;AAAA,QACnC,aAAa,QAAQ,gBAAgB;AAAA,QACrC,WAAW;AAAA,UACT,EAAE,MAAM,gBAAgB,KAAK,QAAQ,wBAAwB;AAAA,QAC/D;AAAA,MACF,CAAC;AAAA,IACH;AAEA,UAAM,YAAQ,uCAAc,QAAQ,UAAU,KAAK;AACnD,UAAM,8BAA8B,MAAM;AAAA,MACxC,QAAQ;AAAA,MACR;AAAA,QACE,MAAM,IAAI,gBAAgB;AAAA,UACxB,UAAU,QAAQ;AAAA,QACpB,CAAC;AAAA,QACD,SAAS;AAAA,UACP,CAAC,gCAAQ,YAAY,GAAG,sCAAc;AAAA,QACxC;AAAA,QACA,QAAQ;AAAA,MACV;AAAA,IACF;AAEA,cAAM;AAAA,MACJ;AAAA,MACA;AAAA,IACF,EAAE,2BAA2B;AAE7B,UAAM,kCACJ,MAAM,4BAA4B,KAAK;AAGzC,UAAM,wCAAoC;AAAA,MACxC;AAAA,MACA;AAAA,IACF;AAEA,QAAI,QAAQ,iBAAiB;AAC3B,YAAM,6BAA6B;AAAA,QACjC,WAAW,QAAQ,gBAAgB;AAAA,QACnC,aAAa,QAAQ,gBAAgB;AAAA,QACrC,WAAW;AAAA,UACT;AAAA,YACE,MAAM;AAAA,YACN,KAAK,kCAAkC;AAAA,UACzC;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAEA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QACE,iBAAiB,qDACjB,iBAAiB,2CACjB,iBAAiB,iCACjB;AACA,YAAM;AAAA,IACR;AACA,UAAM,IAAI;AAAA,MACR,oDAAoD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IAC5G;AAAA,EACF;AACF;;;AGjIA,IAAAC,2BAAuC;;;ACDvC,IAAAC,2BAKO;AACP,IAAAC,2BAAuC;AACvC,IAAAC,cAAc;;;ACPd,IAAAC,0BAAoD;AAW7C,SAAS,aAAa,SAAkB;AAC7C,aAAO;AAAA,IACL;AAAA,QACA,qCAAY,OAAO;AAAA,IACnB;AAAA,EACF;AACF;;;ACcO,SAAS,8CACd,SAC8C;AAC9C,QAAM,EAAE,6BAA6B,6BAA6B,IAAI;AAEtE,MACE,4BAA4B,UAAU,6BAA6B,OACnE;AACA,UAAM,IAAI,YAAY,kDAAkD;AAAA,EAC1E;AAEA,QAAM,gBAAgB,aAAa,6BAA6B,QAAQ;AAExE,SAAO;AAAA,IACL;AAAA,IACA,OAAO,4BAA4B;AAAA,EACrC;AACF;;;AChDA,IAAAC,iBAAiC;AACjC,IAAAC,2BASO;AACP,IAAAC,0BAA8C;AAC9C,IAAAC,cAAc;;;ACZd,IAAAC,2BAAwC;AACxC,IAAAC,cAAkB;AAEX,IAAM,cAAc,cAAE,OAAO;AAAA,EAClC,GAAG,oCAAW;AAAA,EACd,KAAK,cAAE,OAAO,EAAE,SAAS;AAAA,EACzB,KAAK,cAAE,OAAO,EAAE,SAAS;AAAA,EACzB,KAAK,cAAE,OAAO;AAChB,CAAC;AAIM,IAAM,uBAAuB,cAAE,OAAO;AAAA,EAC3C,GAAG,oCAAW;AAAA,EACd,KAAK,cAAE,OAAO,EAAE,SAAS;AAAA,EACzB,KAAK,cAAE,OAAO,EAAE,SAAS;AAAA,EACzB,KAAK,cAAE,OAAO,EAAE,SAAS;AAAA,EACzB,KAAK,cAAE,OAAO;AAChB,CAAC;AAIM,IAAM,6BAA6B,cAAE,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtD,GAAG,qCAAY;AAAA,EACf,GAAG,qCAAY,KAAK,EAAE,KAAK,MAAM,KAAK,MAAM,KAAK,KAAK,CAAC,EAAE,SAAS,EAAE;AAAA,EACpE,OAAO,cAAE,SAAS,cAAE,OAAO,CAAC;AAC9B,CAAC;AAMM,IAAM,0CAA0C,cAAE,YAAY;AAAA,EACnE,GAAG,qCAAY;AAAA,EACf,OAAO,cAAE,SAAS,cAAE,OAAO,CAAC;AAC9B,CAAC;;;ADbM,IAAK,WAAL,kBAAKC,cAAL;AACL,EAAAA,UAAA,eAAY;AACZ,EAAAA,UAAA,YAAS;AACT,EAAAA,UAAA,qBAAkB;AAHR,SAAAA;AAAA,GAAA;AAMZ,IAAM,sCAAsC,OAAO,YAI7C;AACJ,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AAEJ,MAAI;AACJ,QAAM,EAAE,OAAO,QAAI,0CAAgB;AAAA,IACjC,cAAc;AAAA,IACd,KAAK;AAAA,EACP,CAAC;AAED,QAAM,OAAO,4BAA4B,iBAAiB;AAE1D,MAAI,MAAM;AACR,oBAAgB,6BAA6B,MAAM,EAAE,KAAK,OAAO,IAAI,CAAC;AAAA,EACxE;AAEA,QAAM,SAAS,MAAM,UAAU,WAAW,8BAA8B;AAAA,IACtE,KAAK;AAAA,EACP,CAAC;AAED,MAAI,CAAC,OAAO,WAAW;AACrB,UAAM,IAAI,qCAAY,uCAAuC;AAAA,EAC/D;AAEA,SAAO;AAAA,IACL,eAAe,OAAO;AAAA,IACtB,SAAS,OAAO;AAAA,EAClB;AACF;AAwDA,eAAsB,gCACpB,SACA;AACA,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AAEJ,QAAM,yBAAyB,qCAAY;AAAA,IACzC;AAAA,EACF,EAAE;AACF,QAAM,uBAAuB,yBACzB,MAAM,oCAAoC;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,IACD,EAAE,eAAe,QAAW,SAAS,6BAA6B;AAEtE,QAAM,mBAAmB,qCAAY;AAAA,IACnC,qBAAqB;AAAA,EACvB,EAAE;AAEF,MAAI,CAAC,0BAA0B,CAAC,kBAAkB;AAChD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AAIJ,MAAI,kBAAkB;AACpB,UAAM,EAAE,QAAQ,oBAAoB,SAAS,WAAW,QAAI,oCAAU;AAAA,MACpE,oBAAoB;AAAA,MACpB,cAAc,YAAAC,QAAE,OAAO,EAAE,GAAG,oCAAW,OAAO,KAAK,YAAAA,QAAE,OAAO,EAAE,CAAC;AAAA,MAC/D,KAAK,qBAAqB;AAAA,IAC5B,CAAC;AAED,UAAM,WAAW,2BAA2B,MAAM,UAAU;AAC5D,UAAM,gBAAY,iCAAiB;AAAA,MACjC,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,UAAM,qBAAqB,MAAM,QAAQ,UAAU,UAAU,WAAW;AAAA,MACtE,SAAS,qBAAqB;AAAA,MAC9B,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,QAAI,CAAC,mBAAmB,UAAU;AAChC,YAAM,IAAI,qCAAY,kCAAkC;AAAA,IAC1D;AAEA,UAAM,mBAAmB,4BAA4B;AACrD,UAAM,iBAAiB,4BAA4B;AACnD,QAAI,SAAS,QAAQ,kBAAkB;AACrC,YAAM,IAAI;AAAA,QACR,4CAA4C,SAAS,GAAG,oBAAoB,gBAAgB;AAAA,MAC9F;AAAA,IACF;AAEA,QAAI,kBAAkB,SAAS,QAAQ,gBAAgB;AACrD,YAAM,IAAI;AAAA,QACR,4CAA4C,SAAS,GAAG,oBAAoB,cAAc;AAAA,MAC5F;AAAA,IACF;AAEA,UAAM,MAAM,QAAQ,OAAO,oBAAI,KAAK;AACpC,UAAM,aAAa,KAAK,MAAM,IAAI,QAAQ,IAAI,GAAI;AAClD,QAAI,SAAS,MAAM,YAAY;AAC7B,YAAM,IAAI,qCAAY,iCAAiC;AAAA,IACzD;AAEA,QAAI,SAAS,QAAQ,UAAa,SAAS,MAAM,YAAY;AAC3D,YAAM,IAAI,qCAAY,uCAAuC;AAAA,IAC/D;AAEA,gCAA4B;AAAA,EAC9B,OAAO;AACL,UAAM,sBAAkB;AAAA,MACtB,qBAAqB;AAAA,MACrB;AAAA,IACF;AACA,gCACE,wCAAwC,MAAM,eAAe;AAAA,EACjE;AAEA,QAAM,OACJ,0BAA0B,mBACtB,0CACA,yBACE,8BACA;AAER,QAAM,SAAS,0BAA0B;AAEzC,SAAO;AAAA,IACL,eAAe,qBAAqB;AAAA,IACpC;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;;;AHxLA,eAAsB,+BACpB,SAC2C;AAC3C,QAAM,EAAE,6BAA6B,WAAW,iBAAiB,IAAI,IACnE;AAEF,QAAM,mCAA+B;AAAA,IACnC,YAAAC,QAAE,MAAM,CAAC,sCAAa,oCAAW,CAAC;AAAA,IAClC;AAAA,IACA;AAAA,EACF;AAEA,QAAM,uBAAuB,MAAM,gCAAgC;AAAA,IACjE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,EAAE,QAAQ,WAAW,QAAI,0CAAgB;AAAA,IAC7C,cAAc;AAAA,IACd,KAAK;AAAA,EACP,CAAC;AAED,QAAM,mCAA+B;AAAA,IACnC;AAAA,IACA,qBAAqB;AAAA,IACrB;AAAA,EACF;AAEA,QAAM,4BACJ,8CAA8C;AAAA,IAC5C;AAAA,IACA;AAAA,EACF,CAAC;AAEH,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,eAAe,4BAA4B;AAAA,IAC3C,MAAM,EAAE,GAAG,sBAAsB,WAAW;AAAA,EAC9C;AACF;;;ADpCA,eAAsB,2BACpB,SAC2C;AAC3C,QAAM,EAAE,6BAA6B,uBAAuB,UAAU,IACpE;AAEF,MAAI,sBAAsB,UAAU;AAClC,QAAI,OAAO,sBAAsB,aAAa,UAAU;AACtD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,WAAO,+BAA+B;AAAA,MACpC;AAAA,MACA;AAAA,MACA,iBAAiB,sBAAsB;AAAA,IACzC,CAAC;AAAA,EACH;AAEA,QAAM,mCAA+B;AAAA,IACnC;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,QAAM,6BACJ,8CAA8C;AAAA,IAC5C;AAAA,IACA;AAAA,EACF,CAAC;AAEH,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,eAAe,4BAA4B;AAAA,EAC7C;AACF;;;AlBrEA,uBAKO;","names":["createAuthorizationResponse","import_io_wallet_oauth2","import_io_wallet_utils","ClientIdPrefix","import_io_wallet_utils","normalizedMethod","import_zod","z","import_oauth2","import_io_wallet_oauth2","import_io_wallet_utils","import_io_wallet_utils","import_io_wallet_utils","createAuthorizationResponse","createAuthorizationResponse","import_io_wallet_utils","import_zod","import_zod","z","import_io_wallet_utils","import_io_wallet_oauth2","import_io_wallet_utils","import_zod","import_io_wallet_utils","import_oauth2","import_io_wallet_oauth2","import_io_wallet_utils","import_zod","import_io_wallet_oauth2","import_zod","JarmMode","z","z"]}

package/dist/index.mjs

@@ -175,6 +175,8 @@ var zOpenid4vpAuthorizationRequestHeaderV1_0 = zOpenid4vpAuthorizationRequestHea
   trust_chain: zTrustChain
 }).loose();
 var zOpenid4vpAuthorizationRequestHeaderV1_3 = zOpenid4vpAuthorizationRequestHeaderBase.extend({
+  // kid is only mandatory for openid_federation/legacy; x509_hash RPs use x5c instead (see getPublicKeyForVerification).
+  kid: z.string().optional(),
   trust_chain: zTrustChain.optional(),
   x5c: zCertificateChain.optional()
 }).loose();

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/authorization-request/create-authorization-request.ts","../src/errors.ts","../src/authorization-request/client-id-prefix.ts","../src/authorization-request/z-authorization-request.ts","../src/authorization-request/fetch-authorization-request.ts","../src/authorization-request/validate-authorization-request.ts","../src/authorization-request/validate-certificate-endpoints.ts","../src/authorization-request/z-authorization-request-url.ts","../src/authorization-request/parse-authorization-request.ts","../src/authorization-response/create-authorization-response.ts","../src/authorization-response/build-jarm-response.ts","../src/jarm/jarm-extract-jwks.ts","../src/authorization-response/v1.3/create-authorization-response.ts","../src/authorization-response/v1.4/create-authorization-response.ts","../src/authorization-response/fetch-authorization-response.ts","../src/authorization-response/z-authorization-response.ts","../src/vp-token/z-vp-token.ts","../src/authorization-response/parse-authorization-response.ts","../src/jarm/parse-jarm-authorization-response.ts","../src/vp-token/parse-vp-token.ts","../src/authorization-response/validate-authorization-response.ts","../src/jarm/verify-jarm-authorization-response.ts","../src/jarm/z-jarm.ts","../src/index.ts"],"sourcesContent":["import {\n  type CallbackContext,\n  type CreateJarRequestOptions,\n  CreateJarRequestResult,\n  JarAuthorizationRequest,\n  JwtSignerFederation,\n  JwtSignerX5c,\n  createJarRequest,\n  jwtHeaderFromJwtSigner,\n  signedAuthorizationRequestJwtHeaderTyp,\n} from \"@pagopa/io-wallet-oauth2\";\nimport {\n  IoWalletSdkConfig,\n  ItWalletSpecsVersion,\n  ValidationError,\n  createVersionDispatcher,\n  objectToQueryParams,\n  parseWithErrorHandling,\n} from \"@pagopa/io-wallet-utils\";\n\nimport { Oid4vpError } from \"../errors\";\nimport {\n  ClientIdPrefix,\n  extractClientIdPrefix,\n  validateAuthorizationRequestClientBinding,\n} from \"./client-id-prefix\";\nimport {\n  Openid4vpAuthorizationRequestPayload,\n  zOpenid4vpAuthorizationRequestHeaderV1_0,\n  zOpenid4vpAuthorizationRequestHeaderV1_3,\n  zOpenid4vpAuthorizationRequestPayload,\n} from \"./z-authorization-request\";\n\ntype BaseJarOptions<TSigner extends JwtSignerFederation | JwtSignerX5c> = {\n  jwtSigner: TSigner;\n} & Pick<\n  CreateJarRequestOptions,\n  \"additionalJwtPayload\" | \"expiresInSeconds\" | \"now\" | \"requestUri\"\n>;\n\nexport type JarOptionsV1_0 = BaseJarOptions<JwtSignerFederation>;\n\nexport type JarOptionsV1_3 = BaseJarOptions<JwtSignerFederation | JwtSignerX5c>;\n\nexport type JarOptionsV1_4 = JarOptionsV1_3;\n\ntype JarOptions = JarOptionsV1_0 | JarOptionsV1_3 | JarOptionsV1_4;\n\ninterface BaseCreateAuthorizationRequestOptions<\n  V extends ItWalletSpecsVersion,\n  TJar extends JarOptions,\n> {\n  /**\n   * Authorization request payload to be validated and serialized.\n   */\n  authorizationRequestPayload: Openid4vpAuthorizationRequestPayload;\n\n  /**\n   * Required callbacks used to create a signed/encrypted Request Object.\n   */\n  callbacks: Partial<Pick<CallbackContext, \"encryptJwe\">> &\n    Partial<Pick<CallbackContext, \"hash\">> &\n    Pick<CallbackContext, \"signJwt\">;\n\n  config: IoWalletSdkConfig<V>;\n\n  /**\n   * The request is generated as a JAR authorization request.\n   * When `additionalJwtPayload.aud` is missing, it is set to `requestUri`.\n   */\n  jar: TJar;\n\n  /**\n   * Authorization request URL scheme.\n   * @default \"openid4vp://\"\n   */\n  scheme?: string;\n}\n\n/**\n * Options for creating an OpenID4VP authorization request URL.\n */\nexport type CreateAuthorizationRequestOptionsV1_0 =\n  BaseCreateAuthorizationRequestOptions<\n    ItWalletSpecsVersion.V1_0,\n    JarOptionsV1_0\n  >;\n\nexport type CreateAuthorizationRequestOptionsV1_3 =\n  BaseCreateAuthorizationRequestOptions<\n    ItWalletSpecsVersion.V1_3,\n    JarOptionsV1_3\n  >;\n\nexport type CreateAuthorizationRequestOptionsV1_4 =\n  BaseCreateAuthorizationRequestOptions<\n    ItWalletSpecsVersion.V1_4,\n    JarOptionsV1_4\n  >;\n\nexport type CreateAuthorizationRequestOptions =\n  | CreateAuthorizationRequestOptionsV1_0\n  | CreateAuthorizationRequestOptionsV1_3\n  | CreateAuthorizationRequestOptionsV1_4;\n\ninterface BaseCreateAuthorizationRequestResult<TJar extends JarOptions> {\n  authorizationRequest: string;\n  authorizationRequestObject: JarAuthorizationRequest;\n  authorizationRequestPayload: Openid4vpAuthorizationRequestPayload;\n  jar: CreateJarRequestResult & TJar;\n}\n\nexport type CreateAuthorizationRequestResultV1_0 =\n  BaseCreateAuthorizationRequestResult<JarOptionsV1_0>;\n\nexport type CreateAuthorizationRequestResultV1_3 =\n  BaseCreateAuthorizationRequestResult<JarOptionsV1_3>;\n\nexport type CreateAuthorizationRequestResultV1_4 =\n  BaseCreateAuthorizationRequestResult<JarOptionsV1_4>;\n\nexport type CreateAuthorizationRequestResult =\n  | CreateAuthorizationRequestResultV1_0\n  | CreateAuthorizationRequestResultV1_3\n  | CreateAuthorizationRequestResultV1_4;\n\n/**\n * Creates an OpenID4VP authorization request URL.\n *\n * This function creates a JAR request object through\n * `createJarRequest` and serializes it into the URL query parameters.\n *\n * @param options {@link CreateAuthorizationRequestOptions}\n * @returns Authorization request URL plus request object details used to build it\n * @throws When authorization request payload validation fails\n * @throws When JAR creation fails\n */\nconst dispatchCreateAuthorizationRequest = createVersionDispatcher<\n  CreateAuthorizationRequestOptions,\n  Promise<CreateAuthorizationRequestResult>\n>({\n  [ItWalletSpecsVersion.V1_0]: async (o) =>\n    createAuthorizationRequestWithHeader(\n      o as CreateAuthorizationRequestOptionsV1_0,\n      zOpenid4vpAuthorizationRequestHeaderV1_0,\n    ),\n  [ItWalletSpecsVersion.V1_3]: async (o) =>\n    createAuthorizationRequestWithHeader(\n      o as CreateAuthorizationRequestOptionsV1_3,\n      zOpenid4vpAuthorizationRequestHeaderV1_3,\n    ),\n  // V1_4 reuses the V1_3 JAR header schema; the conditional x5c rule is a normative 1.4.4 LTS backport.\n  [ItWalletSpecsVersion.V1_4]: async (o) =>\n    createAuthorizationRequestWithHeader(\n      o as CreateAuthorizationRequestOptionsV1_4,\n      zOpenid4vpAuthorizationRequestHeaderV1_3,\n    ),\n});\n\n/**\n * Creates an OpenID4VP authorization request URL for the configured IT-Wallet version.\n *\n * This function creates a JAR request object through `createJarRequest` and\n * serializes it into authorization request URL query parameters.\n *\n * @param options - Version-specific authorization request creation options.\n * @returns Authorization request URL plus request object details used to build it.\n * @throws {Oid4vpError} If authorization request payload validation fails.\n */\nexport async function createAuthorizationRequest(\n  options: CreateAuthorizationRequestOptionsV1_0,\n): Promise<CreateAuthorizationRequestResultV1_0>;\n\nexport async function createAuthorizationRequest(\n  options: CreateAuthorizationRequestOptionsV1_3,\n): Promise<CreateAuthorizationRequestResultV1_3>;\n\nexport async function createAuthorizationRequest(\n  options: CreateAuthorizationRequestOptionsV1_4,\n): Promise<CreateAuthorizationRequestResultV1_4>;\n\nexport async function createAuthorizationRequest(\n  options: CreateAuthorizationRequestOptions,\n): Promise<CreateAuthorizationRequestResult> {\n  try {\n    return await dispatchCreateAuthorizationRequest(options);\n  } catch (error) {\n    if (error instanceof ValidationError) {\n      throw new Oid4vpError(`Invalid authorization request: ${error.message}`);\n    }\n    throw error;\n  }\n}\n\nasync function createAuthorizationRequestWithHeader<TJar extends JarOptions>(\n  options: BaseCreateAuthorizationRequestOptions<ItWalletSpecsVersion, TJar>,\n  headerSchema:\n    | typeof zOpenid4vpAuthorizationRequestHeaderV1_0\n    | typeof zOpenid4vpAuthorizationRequestHeaderV1_3,\n): Promise<BaseCreateAuthorizationRequestResult<TJar>> {\n  const { callbacks, jar, scheme = \"openid4vp://\" } = options;\n\n  const authorizationRequestHeader = parseWithErrorHandling(headerSchema, {\n    ...jwtHeaderFromJwtSigner(jar.jwtSigner),\n    typ: signedAuthorizationRequestJwtHeaderTyp,\n  });\n\n  const authorizationRequestPayload = parseWithErrorHandling(\n    zOpenid4vpAuthorizationRequestPayload,\n    options.authorizationRequestPayload,\n  );\n\n  validateJarSignerForAuthorizationRequest(\n    options.config.itWalletSpecsVersion,\n    jar.jwtSigner,\n    authorizationRequestPayload,\n  );\n\n  validateAuthorizationRequestClientBinding({\n    hash: options.callbacks.hash,\n    header: authorizationRequestHeader,\n    payload: authorizationRequestPayload,\n  });\n\n  const additionalJwtPayload = !jar.additionalJwtPayload?.aud\n    ? { ...jar.additionalJwtPayload, aud: jar.requestUri }\n    : jar.additionalJwtPayload;\n\n  const jarResult = await createJarRequest({\n    ...jar,\n    additionalJwtPayload,\n    authorizationRequestHeader,\n    authorizationRequestPayload,\n    callbacks,\n  });\n\n  return {\n    authorizationRequest: createAuthorizationRequestUrl(\n      scheme,\n      jarResult.jarAuthorizationRequest,\n    ),\n    authorizationRequestObject: jarResult.jarAuthorizationRequest,\n    authorizationRequestPayload,\n    jar: { ...jar, ...jarResult },\n  };\n}\n\nfunction createAuthorizationRequestUrl(\n  scheme: string,\n  request: JarAuthorizationRequest,\n) {\n  const url = new URL(scheme);\n\n  const searchParams = new URLSearchParams([\n    ...url.searchParams.entries(),\n    ...objectToQueryParams(request).entries(),\n  ]);\n\n  url.search = searchParams.toString();\n\n  return url.toString();\n}\n\nfunction validateJarSignerForAuthorizationRequest(\n  specsVersion: ItWalletSpecsVersion,\n  jwtSigner: JwtSignerFederation | JwtSignerX5c,\n  payload: Openid4vpAuthorizationRequestPayload,\n) {\n  if (specsVersion === ItWalletSpecsVersion.V1_0) {\n    return;\n  }\n\n  const { prefix } = extractClientIdPrefix(payload.client_id);\n\n  if (prefix === ClientIdPrefix.X509_HASH && jwtSigner.method !== \"x5c\") {\n    throw new Oid4vpError(\n      \"x509_hash client_id requires a JAR signer with method x5c\",\n    );\n  }\n\n  if (\n    prefix !== ClientIdPrefix.X509_HASH &&\n    jwtSigner.method !== \"federation\"\n  ) {\n    throw new Oid4vpError(\n      \"openid_federation and legacy client_id values require a JAR signer with method federation\",\n    );\n  }\n}\n","/**\n * Generic error thrown during Oid4vp operations\n */\nexport class Oid4vpError extends Error {\n  readonly statusCode?: number;\n  constructor(\n    message: string,\n    options?: { statusCode?: number } & ErrorOptions,\n  ) {\n    super(message, options);\n    this.name = \"Oid4vpError\";\n    this.statusCode = options?.statusCode;\n  }\n}\n\n/**\n * Error thrown by {@link parseAuthorizeRequest} when the passed\n * request object has an invalid signature or unexpected errors\n * are thrown\n */\nexport class ParseAuthorizeRequestError extends Oid4vpError {\n  readonly statusCode?: number;\n  constructor(\n    message: string,\n    options?: { statusCode?: number } & ErrorOptions,\n  ) {\n    super(message, options);\n    this.name = \"ParseAuthorizeRequestError\";\n    this.statusCode = options?.statusCode;\n  }\n}\n\n/**\n * Error thrown by {@link fetchAuthorizationResponse}\n */\nexport class FetchAuthorizationResponseError extends Oid4vpError {\n  readonly statusCode?: number;\n  constructor(\n    message: string,\n    options?: { statusCode?: number } & ErrorOptions,\n  ) {\n    super(message, options);\n    this.name = \"FetchAuthorizationResponseError\";\n    this.statusCode = options?.statusCode;\n  }\n}\n\n/**\n * Error thrown by {@link createAuthorizationResponse} in case there\n * are unexpected errors.\n */\nexport class CreateAuthorizationResponseError extends Oid4vpError {\n  readonly statusCode?: number;\n  constructor(\n    message: string,\n    options?: { statusCode?: number } & ErrorOptions,\n  ) {\n    super(message, options);\n    this.name = \"CreateAuthorizationResponseError\";\n    this.statusCode = options?.statusCode;\n  }\n}\n\n/**\n * Error thrown when request_uri_method parameter has an invalid value.\n * Valid values are \"get\" or \"post\" (case-insensitive).\n */\nexport class InvalidRequestUriMethodError extends Oid4vpError {\n  constructor(message: string, options?: ErrorOptions) {\n    super(message, options);\n    this.name = \"InvalidRequestUriMethodError\";\n  }\n}\n","import {\n  HashAlgorithm,\n  type HashCallback,\n  decodeBase64,\n  encodeToBase64Url,\n} from \"@pagopa/io-wallet-utils\";\n\nimport { Oid4vpError, ParseAuthorizeRequestError } from \"../errors\";\nimport {\n  Openid4vpAuthorizationRequestHeaderV1_3,\n  Openid4vpAuthorizationRequestPayload,\n} from \"./z-authorization-request\";\n\nexport enum ClientIdPrefix {\n  NONE = \"none\",\n  OPENID_FEDERATION = \"openid_federation\",\n  X509_HASH = \"x509_hash\",\n}\n\nexport interface ClientIdParts {\n  clientId: string;\n  prefix: ClientIdPrefix;\n}\n\nexport interface CreateX509HashClientIdOptions {\n  certificateChain: string[];\n  hash: HashCallback;\n}\n\nexport function extractClientIdPrefix(clientId: string): ClientIdParts {\n  const colonIndex = clientId.indexOf(\":\");\n\n  if (colonIndex === -1) {\n    return { clientId, prefix: ClientIdPrefix.NONE };\n  }\n\n  if (clientId.startsWith(\"https://\") || clientId.startsWith(\"http://\")) {\n    return { clientId, prefix: ClientIdPrefix.NONE };\n  }\n\n  const rawPrefix = clientId.slice(0, colonIndex);\n  const rest = clientId.slice(colonIndex + 1);\n\n  if (rawPrefix === ClientIdPrefix.X509_HASH) {\n    return { clientId: rest, prefix: ClientIdPrefix.X509_HASH };\n  }\n  if (rawPrefix === ClientIdPrefix.OPENID_FEDERATION) {\n    return { clientId: rest, prefix: ClientIdPrefix.OPENID_FEDERATION };\n  }\n\n  throw new Oid4vpError(\n    `Unsupported client_id prefix \"${rawPrefix}\": only \"openid_federation\" and \"x509_hash\" are allowed by the IT-Wallet profile`,\n  );\n}\n\nexport async function createX509HashClientId(\n  options: CreateX509HashClientIdOptions,\n): Promise<string> {\n  return `${ClientIdPrefix.X509_HASH}:${await calculateX509CertificateHash(options)}`;\n}\n\nasync function calculateX509CertificateHash(\n  options: CreateX509HashClientIdOptions,\n) {\n  const leafCertificate = getLeafCertificate(options.certificateChain);\n\n  return encodeToBase64Url(\n    await options.hash(decodeBase64(leafCertificate), HashAlgorithm.Sha256),\n  );\n}\n\nexport async function validateAuthorizationRequestClientBinding(options: {\n  hash?: HashCallback;\n  header: Openid4vpAuthorizationRequestHeaderV1_3;\n  payload: Openid4vpAuthorizationRequestPayload;\n}): Promise<ClientIdParts> {\n  const clientIdParts = extractClientIdPrefix(options.payload.client_id);\n\n  if (clientIdParts.prefix !== ClientIdPrefix.X509_HASH) {\n    return clientIdParts;\n  }\n\n  const { x5c } = options.header;\n  if (!Array.isArray(x5c) || x5c.length === 0) {\n    throw new ParseAuthorizeRequestError(\n      \"x5c is required in JWT header for x509_hash client_id\",\n    );\n  }\n\n  if (!options.hash) {\n    return clientIdParts;\n  }\n\n  const expectedCertificateHash = await calculateX509CertificateHash({\n    certificateChain: x5c,\n    hash: options.hash,\n  });\n\n  if (expectedCertificateHash !== clientIdParts.clientId) {\n    throw new ParseAuthorizeRequestError(\n      \"x509_hash client_id does not match the JWT header leaf certificate\",\n    );\n  }\n\n  return clientIdParts;\n}\n\nfunction getLeafCertificate(certificateChain: string[]) {\n  const leafCertificate = certificateChain[0];\n\n  if (!leafCertificate) {\n    throw new ParseAuthorizeRequestError(\n      \"Certificate chain is empty, cannot validate x509_hash\",\n    );\n  }\n\n  return leafCertificate;\n}\n","import {\n  zAlgValueNotNone,\n  zCertificateChain,\n  zJwtPayload,\n  zSignedAuthorizationRequestJwtHeaderTyp,\n  zTrustChain,\n} from \"@pagopa/io-wallet-oauth2\";\nimport { itWalletCredentialVerifierMetadataV1_3 } from \"@pagopa/io-wallet-oid-federation\";\nimport { z } from \"zod\";\n\n/**\n * This schema is a less strict version of {@link itWalletCredentialVerifierMetadataV1_3} because\n * only a subset of the Credential Verifier metadata fields are required in the Request Object.\n * @see https://italia.github.io/eid-wallet-it-docs/releases/1.3.3/en/remote-flow.html#request-object\n */\nconst zOpenid4vpCredentialVerifierMetadata =\n  itWalletCredentialVerifierMetadataV1_3.partial({\n    application_type: true,\n    client_id: true,\n    client_name: true,\n    logo_uri: true,\n    request_uris: true,\n    response_uris: true,\n  });\n\n/**\n * Zod parser that describes a JWT payload\n * containing an OID4VP Request Object\n */\nexport const zOpenid4vpAuthorizationRequestPayload = z\n  .looseObject({\n    client_id: z.string(),\n    client_metadata: zOpenid4vpCredentialVerifierMetadata.optional(),\n    dcql_query: z.record(z.string(), z.any()),\n    nonce: z.string(),\n    request_uri: z.url().optional(),\n    request_uri_method: z.optional(z.string()),\n    response_mode: z.literal(\"direct_post.jwt\"),\n    response_type: z.literal(\"vp_token\"),\n    response_uri: z.url(),\n    scope: z.string().optional(),\n    state: z.string().optional(),\n    transaction_data: z.array(z.string()).nonempty().optional(),\n    transaction_data_hashes_alg: z.array(z.string()).optional(),\n    wallet_nonce: z.string().optional(),\n  })\n  .and(\n    z.object({\n      ...zJwtPayload.shape,\n    }),\n  );\n\nexport type Openid4vpAuthorizationRequestPayload = z.infer<\n  typeof zOpenid4vpAuthorizationRequestPayload\n>;\n\nconst zOpenid4vpAuthorizationRequestHeaderBase = z.object({\n  alg: zAlgValueNotNone,\n  kid: z.string(),\n  typ: zSignedAuthorizationRequestJwtHeaderTyp,\n});\n\nexport const zOpenid4vpAuthorizationRequestHeaderV1_0 =\n  zOpenid4vpAuthorizationRequestHeaderBase\n    .extend({\n      trust_chain: zTrustChain,\n    })\n    .loose();\n\nexport type Openid4vpAuthorizationRequestHeaderV1_0 = z.infer<\n  typeof zOpenid4vpAuthorizationRequestHeaderV1_0\n>;\n\nexport const zOpenid4vpAuthorizationRequestHeaderV1_3 =\n  zOpenid4vpAuthorizationRequestHeaderBase\n    .extend({\n      trust_chain: zTrustChain.optional(),\n      x5c: zCertificateChain.optional(),\n    })\n    .loose();\n\nexport type Openid4vpAuthorizationRequestHeaderV1_3 = z.infer<\n  typeof zOpenid4vpAuthorizationRequestHeaderV1_3\n>;\n\nexport type Openid4vpAuthorizationRequestHeader =\n  | Openid4vpAuthorizationRequestHeaderV1_0\n  | Openid4vpAuthorizationRequestHeaderV1_3;\n","import { type CallbackContext, Oauth2JwtParseError } from \"@openid4vc/oauth2\";\nimport {\n  UnexpectedStatusCodeError,\n  ValidationError,\n  createFetcher,\n  hasStatusOrThrow,\n} from \"@pagopa/io-wallet-utils\";\n\nimport { Oid4vpError } from \"../errors\";\nimport { validateAuthorizationRequestParams } from \"./validate-authorization-request\";\nimport {\n  X509CertificateBinding,\n  validateCertificateEndpoints,\n} from \"./validate-certificate-endpoints\";\nimport { zAuthorizationRequestUrlParams } from \"./z-authorization-request-url\";\n\nexport interface FetchAuthorizationRequestOptions {\n  /**\n   * The authorization URL from the QR code\n   * Should contain `client_id` and either `request` or `request_uri` query parameters\n   */\n  authorizeRequestUrl: string;\n\n  /**\n   * Callback functions for making HTTP requests\n   * Allows for custom fetch implementation\n   */\n  callbacks: Pick<CallbackContext, \"fetch\">;\n\n  /**\n   * Optional wallet metadata to send when request_uri_method=post.\n   * If not provided and POST is required, sends an empty body (basic implementation).\n   *\n   * Specification: IT-Wallet v1.3.3 recommends (SHOULD) sending wallet capabilities\n   * in application/x-www-form-urlencoded format when using POST.\n   */\n  walletMetadata?: {\n    authorization_endpoint?: string;\n    client_id_prefixes_supported?: string[];\n    request_object_signing_alg_values_supported?: string[];\n    response_modes_supported?: string[];\n    response_types_supported?: string[];\n    vp_formats_supported?: Record<string, unknown>;\n  };\n\n  /**\n   * Optional wallet nonce for replay attack prevention (RECOMMENDED per spec)\n   */\n  walletNonce?: string;\n\n  /**\n   * Optional RP certificate context used to bind `request_uri` to the certificate SAN entries.\n   */\n  x509Certificate?: {\n    binding: X509CertificateBinding;\n    leafCertificate: string;\n  };\n}\n\nexport interface ParsedQrCode {\n  /**\n   * The `client_id` from the authorization URL\n   */\n  clientId: string;\n\n  /**\n   * It contains the base64url-encoded and signed Request Object. For the content of the Request Object, see {@link Openid4vpAuthorizationRequestPayload}.\n   */\n  request?: string;\n  /**\n   * The `request_uri` from the authorization URL\n   */\n  requestUri?: string;\n  /**\n   * The `request_uri_method` from the authorization URL (get or post)\n   */\n  requestUriMethod?: \"get\" | \"post\";\n}\n\nexport interface FetchAuthorizationRequestResult {\n  /**\n   * The parsed QR code data\n   * Includes `clientId`, `requestUri` and `requestUriMethod`\n   */\n  parsedQrCode: ParsedQrCode;\n\n  /**\n   * The original Request Object JWT, either fetched from `request_uri` or extracted from `request` parameter.\n   */\n  requestObjectJwt: string;\n\n  /**\n   * Transmission mode indicator\n   * - \"value\": Request Object JWT passed inline via `request` parameter\n   * - \"reference\": Request Object JWT fetched from `request_uri`\n   */\n  sendBy: \"reference\" | \"value\";\n}\n\n/**\n * Parses an authorization request URL and builds a {@link ParsedQrCode} object.\n *\n * @param authorizeRequestUrl - The authorization URL extracted from the QR code\n * @returns The parsed QR code data including `clientId`, `requestUri`, and `requestUriMethod`\n * @throws {ValidationError} If URL parameters fail schema validation or business logic checks\n */\nexport function createParsedQrCode(authorizeRequestUrl: string): ParsedQrCode {\n  const url = new URL(authorizeRequestUrl);\n\n  const rawParams = {\n    client_id: url.searchParams.get(\"client_id\") ?? undefined,\n    request: url.searchParams.get(\"request\") ?? undefined,\n    request_uri: url.searchParams.get(\"request_uri\") ?? undefined,\n    request_uri_method: url.searchParams.get(\"request_uri_method\") ?? undefined,\n    state: url.searchParams.get(\"state\") ?? undefined,\n  };\n\n  const parsedParams = zAuthorizationRequestUrlParams.parse(rawParams);\n  const validatedParams = validateAuthorizationRequestParams(parsedParams);\n  const sendBy = validatedParams.request ? \"value\" : \"reference\";\n\n  return {\n    clientId: validatedParams.client_id,\n    request: validatedParams.request,\n    requestUri: validatedParams.request_uri,\n    requestUriMethod:\n      sendBy === \"reference\"\n        ? (validatedParams.request_uri_method ?? \"get\")\n        : undefined,\n  };\n}\n\n/**\n * Helper function to fetch Request Object JWT from request_uri.\n * Supports GET and POST methods, with optional wallet metadata for POST.\n *\n * @param requestUri - URI to fetch Request Object from\n * @param options - Fetch options including method and wallet metadata\n * @returns The Request Object JWT as a string\n * @throws {UnexpectedStatusCodeError} If the server returns a non-200 status code\n * @throws {Error} If the underlying fetch/createFetcher call fails (for example, due to network errors)\n */\nexport async function fetchRequestObjectJwt(\n  requestUri: string,\n  options: {\n    fetch: CallbackContext[\"fetch\"];\n    method: \"get\" | \"post\";\n    walletMetadata?: FetchAuthorizationRequestOptions[\"walletMetadata\"];\n    walletNonce?: string;\n  },\n): Promise<string> {\n  const fetch = createFetcher(options.fetch);\n\n  // Prepare request configuration\n  const requestInit: RequestInit = {\n    method: options.method.toUpperCase(),\n  };\n\n  // Add body for POST requests per IT-Wallet spec (SHOULD include metadata)\n  if (options.method === \"post\") {\n    const formData = new URLSearchParams();\n\n    // Add wallet_metadata if provided (spec: OPTIONAL)\n    if (options.walletMetadata) {\n      formData.append(\n        \"wallet_metadata\",\n        JSON.stringify(options.walletMetadata),\n      );\n    }\n\n    // Add wallet_nonce if provided (spec: RECOMMENDED)\n    if (options.walletNonce) {\n      formData.append(\"wallet_nonce\", options.walletNonce);\n    }\n\n    requestInit.headers = {\n      \"Content-Type\": \"application/x-www-form-urlencoded\",\n    };\n    requestInit.body = formData.toString();\n  }\n\n  const response = await fetch(requestUri, requestInit);\n\n  await hasStatusOrThrow(200, UnexpectedStatusCodeError)(response);\n\n  return await response.text();\n}\n\n/**\n * Fetches an OpenID4VP authorization request JWT from a QR code URL.\n *\n * Supports two transmission modes:\n * - **By Value**: Request Object JWT passed inline via `request` parameter\n * - **By Reference**: Request Object JWT fetched from `request_uri`\n *\n * The function:\n * 1. Parses the authorization URL to extract parameters\n * 2. Validates that exactly one of `request` or `request_uri` is present\n * 3. Either uses inline JWT or fetches from URI (GET/POST based on request_uri_method)\n * 4. Returns the Request Object JWT along with transmission mode metadata\n *\n * Note: This function does NOT parse or verify the JWT. Use {@link parseAuthorizeRequest}\n * separately to decode and optionally verify the signature.\n *\n * @param options {@link FetchAuthorizationRequestOptions}\n * @returns Promise that resolves to {@link FetchAuthorizationRequestResult}\n * @throws {Oid4vpError} When required query parameters are missing, the URL is invalid, or an unexpected error occurs during fetch or parsing\n * @throws {UnexpectedStatusCodeError} When the server returns a non-200 status code during fetch\n * @throws {ValidationError} When URL parameters fail schema validation\n *\n * @example By Value mode\n * ```typescript\n * const url = \"[https://wallet.example.org/authorize](https://wallet.example.org/authorize)?\" +\n *   \"client_id=openid_federation%23https%3A%2F%2Frp.example.org\" +\n *   \"&request=eyJhbGciOiJFUzI1NiIs...\";\n *\n * const result = await fetchAuthorizationRequest({\n *   authorizeRequestUrl: url,\n *   callbacks: { fetch },\n * });\n * // result.sendBy === \"value\"\n * // result.requestObjectJwt === \"eyJhbGciOiJFUzI1NiIs...\"\n * ```\n *\n * @example By Reference mode with POST\n * ```typescript\n * const url = \"[https://wallet.example.org/authorize](https://wallet.example.org/authorize)?\" +\n *   \"client_id=openid_federation%23https%3A%2F%2Frp.example.org\" +\n *   \"&request_uri=https%3A%2F%2Frp.example.org%2Frequest\" +\n *   \"&request_uri_method=post\";\n *\n * const result = await fetchAuthorizationRequest({\n *   authorizeRequestUrl: url,\n *   callbacks: { fetch },\n *   walletMetadata: {\n *     authorization_endpoint: \"[https://wallet.example.org/authorize](https://wallet.example.org/authorize)\",\n *     response_types_supported: [\"vp_token\"],\n *   },\n *   walletNonce: \"random-nonce\",\n * });\n * // result.sendBy === \"reference\"\n * // result.requestObjectJwt === fetched JWT from request_uri\n * ```\n */\nexport async function fetchAuthorizationRequest(\n  options: FetchAuthorizationRequestOptions,\n): Promise<FetchAuthorizationRequestResult> {\n  try {\n    const parsedQrCode = createParsedQrCode(options.authorizeRequestUrl);\n\n    // Get JWT: either inline or fetch from URI\n    let requestObjectJwt: string;\n    if (parsedQrCode.request) {\n      requestObjectJwt = parsedQrCode.request;\n    } else {\n      if (options.x509Certificate) {\n        await validateCertificateEndpoints({\n          callbacks: options.x509Certificate.binding,\n          certificate: options.x509Certificate.leafCertificate,\n          endpoints: [\n            {\n              name: \"request_uri\",\n              uri: parsedQrCode.requestUri,\n            },\n          ],\n        });\n      }\n\n      // Type system guarantees request_uri is defined here due to validation\n      requestObjectJwt = await fetchRequestObjectJwt(\n        parsedQrCode.requestUri as string,\n        {\n          fetch: options.callbacks.fetch,\n          method: parsedQrCode.requestUriMethod ?? \"get\",\n          walletMetadata: options.walletMetadata,\n          walletNonce: options.walletNonce,\n        },\n      );\n    }\n\n    return {\n      parsedQrCode,\n      requestObjectJwt,\n      sendBy: parsedQrCode.request ? \"value\" : \"reference\",\n    };\n  } catch (error) {\n    if (\n      error instanceof ValidationError ||\n      error instanceof Oauth2JwtParseError ||\n      error instanceof Oid4vpError ||\n      error instanceof UnexpectedStatusCodeError\n    ) {\n      throw error;\n    }\n\n    throw new Oid4vpError(\n      `Unexpected error during fetch authorization request: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n}\n","import { InvalidRequestUriMethodError, Oid4vpError } from \"../errors\";\nimport { AuthorizationRequestUrlParams } from \"./z-authorization-request-url\";\n\n/**\n * Validates authorization request URL parameters according to IT-Wallet and OpenID4VP specifications.\n *\n * Validation rules:\n * 1. Exactly one of `request` or `request_uri` must be present (mutual exclusivity)\n * 2. `request_uri_method` must be \"get\" or \"post\" (case-insensitive) if present\n * 3. `request_uri_method` can only be used with `request_uri` parameter\n *\n * @param params - Parsed authorization request URL parameters\n * @returns Type-narrowed params ensuring mutual exclusivity\n * @throws {Oid4vpError} When both or neither request/request_uri are present\n * @throws {InvalidRequestUriMethodError} When request_uri_method is not \"get\" or \"post\"\n * @throws {Oid4vpError} When request_uri_method is used without request_uri\n */\nexport function validateAuthorizationRequestParams(\n  params: AuthorizationRequestUrlParams,\n) {\n  // Mutual exclusivity check\n  if (params.request && params.request_uri) {\n    throw new Oid4vpError(\n      \"request and request_uri cannot both be present in an authorization request\",\n    );\n  }\n\n  // At least one must be present\n  if (!params.request && !params.request_uri) {\n    throw new Oid4vpError(\n      \"Either request or request_uri parameter must be present\",\n    );\n  }\n\n  // Validate request_uri_method if present\n  if (params.request_uri_method) {\n    const normalizedMethod = params.request_uri_method.toLowerCase();\n    if (normalizedMethod !== \"get\" && normalizedMethod !== \"post\") {\n      throw new InvalidRequestUriMethodError(\n        `Invalid request_uri_method: '${params.request_uri_method}'. Must be 'get' or 'post'`,\n      );\n    }\n  }\n\n  // request_uri_method only allowed with request_uri\n  if (params.request_uri_method && !params.request_uri) {\n    throw new Oid4vpError(\n      \"request_uri_method can only be used with request_uri parameter\",\n    );\n  }\n\n  // Normalize request_uri_method to lowercase if present\n  const normalizedMethod = params.request_uri_method\n    ? (params.request_uri_method.toLowerCase() as \"get\" | \"post\")\n    : undefined;\n\n  return {\n    ...params,\n    request_uri_method: normalizedMethod,\n  } as (\n    | {\n        request?: never;\n        request_uri: string;\n        request_uri_method?: \"get\" | \"post\";\n      }\n    | { request: string; request_uri?: never; request_uri_method?: never }\n  ) &\n    typeof params;\n}\n","import { Oid4vpError } from \"../errors\";\n\nexport interface X509CertificateMetadata {\n  sanDnsNames?: string[];\n  sanUriNames?: string[];\n}\n\nexport type GetX509CertificateMetadataCallback = (\n  certificate: string,\n) => Promise<X509CertificateMetadata> | X509CertificateMetadata;\n\nexport interface X509CertificateBinding {\n  getX509CertificateMetadata: GetX509CertificateMetadataCallback;\n}\n\nexport interface CertificateEndpoint {\n  name: string;\n  uri?: string;\n}\n\nexport interface ValidateCertificateEndpointsOptions {\n  callbacks: X509CertificateBinding;\n  certificate: string;\n  endpoints: CertificateEndpoint[];\n}\n\nexport async function validateCertificateEndpoints(\n  options: ValidateCertificateEndpointsOptions,\n): Promise<void> {\n  const metadata = await options.callbacks.getX509CertificateMetadata(\n    options.certificate,\n  );\n\n  for (const endpoint of options.endpoints) {\n    if (!endpoint.uri) {\n      continue;\n    }\n\n    validateEndpointAgainstMetadata(\n      { name: endpoint.name, uri: endpoint.uri },\n      metadata,\n    );\n  }\n}\n\nfunction validateEndpointAgainstMetadata(\n  endpoint: { name: string; uri: string },\n  metadata: X509CertificateMetadata,\n) {\n  const endpointUrl = parseEndpointUrl(endpoint);\n  const sanUriNames = metadata.sanUriNames ?? [];\n  const matchesUriSan = sanUriNames.some(\n    (sanUriName) => normalizeUriForComparison(sanUriName) === endpointUrl.href,\n  );\n  const sanDnsNames = metadata.sanDnsNames ?? [];\n  const matchesDnsSan = sanDnsNames.some((sanDnsName) =>\n    matchesDnsSanHostname(sanDnsName, endpointUrl.hostname),\n  );\n\n  if (matchesUriSan || matchesDnsSan) {\n    return;\n  }\n\n  throw new Oid4vpError(\n    `${endpoint.name} is not covered by the Relying Party certificate SAN entries`,\n  );\n}\n\nfunction normalizeUriForComparison(uri: string) {\n  try {\n    return new URL(uri).href;\n  } catch (error) {\n    throw new Oid4vpError(`Certificate URI SAN is not a valid URL: ${uri}`, {\n      cause: error,\n    });\n  }\n}\n\nfunction matchesDnsSanHostname(sanDnsName: string, hostname: string) {\n  const normalizedSanDnsName = sanDnsName.toLowerCase();\n  const normalizedHostname = hostname.toLowerCase();\n\n  if (normalizedSanDnsName === normalizedHostname) {\n    return true;\n  }\n\n  if (!normalizedSanDnsName.includes(\"*\")) {\n    return false;\n  }\n\n  const wildcardCount = [...normalizedSanDnsName].filter(\n    (character) => character === \"*\",\n  ).length;\n  const sanLabels = normalizedSanDnsName.split(\".\");\n  const hostnameLabels = normalizedHostname.split(\".\");\n\n  return (\n    wildcardCount === 1 &&\n    sanLabels[0] === \"*\" &&\n    sanLabels.length === hostnameLabels.length &&\n    sanLabels\n      .slice(1)\n      .every((label, index) => label === hostnameLabels[index + 1])\n  );\n}\n\nfunction parseEndpointUrl(endpoint: { name: string; uri: string }) {\n  try {\n    return new URL(endpoint.uri);\n  } catch (error) {\n    throw new Oid4vpError(\n      `${endpoint.name} is not a valid URL: ${endpoint.uri}`,\n      { cause: error },\n    );\n  }\n}\n","import z from \"zod\";\n\n/**\n * Schema for authorization request URL query parameters.\n * Note: `request` contains the signed Request Object JWT, it is NOT a claim inside the Request Object.\n */\nexport const zAuthorizationRequestUrlParams = z.looseObject({\n  client_id: z.string(),\n  request: z.string().optional(), // JWT containing Request Object (by value)\n  request_uri: z.url().optional(), // URI to fetch Request Object (by reference)\n  request_uri_method: z.string().optional(), // HTTP method for request_uri (validated in business logic)\n  state: z.string().optional(), // Optional state parameter\n});\n\nexport type AuthorizationRequestUrlParams = z.infer<\n  typeof zAuthorizationRequestUrlParams\n>;\n","import {\n  CallbackContext,\n  JwtSigner,\n  Oauth2JwtParseError,\n  verifyJwt,\n} from \"@openid4vc/oauth2\";\nimport { decodeJwt } from \"@pagopa/io-wallet-oauth2\";\nimport {\n  IoWalletSdkConfig,\n  ItWalletSpecsVersion,\n  ItWalletSpecsVersionError,\n  ValidationError,\n  dispatchByVersion,\n} from \"@pagopa/io-wallet-utils\";\n\nimport { Oid4vpError, ParseAuthorizeRequestError } from \"../errors\";\nimport {\n  ClientIdPrefix,\n  extractClientIdPrefix,\n  validateAuthorizationRequestClientBinding,\n} from \"./client-id-prefix\";\nimport {\n  X509CertificateBinding,\n  validateCertificateEndpoints,\n} from \"./validate-certificate-endpoints\";\nimport {\n  Openid4vpAuthorizationRequestHeader,\n  Openid4vpAuthorizationRequestHeaderV1_3,\n  Openid4vpAuthorizationRequestPayload,\n  zOpenid4vpAuthorizationRequestHeaderV1_0,\n  zOpenid4vpAuthorizationRequestHeaderV1_3,\n  zOpenid4vpAuthorizationRequestPayload,\n} from \"./z-authorization-request\";\n\nexport {\n  type ClientIdParts,\n  ClientIdPrefix,\n  createX509HashClientId,\n  extractClientIdPrefix,\n} from \"./client-id-prefix\";\n\n/**\n * Retrieves the public key for verifying the Request Object JWT signature\n * according to IT Wallet specifications.\n *\n * Prefix routing:\n * 1. If client_id uses x509_hash: use x5c certificate chain from header.\n * 2. If client_id uses openid_federation or no prefix: return a federation signer;\n *    if trust_chain is present it is forwarded, otherwise the verifyJwt callback is\n *    responsible for reconstructing the chain from client_id.\n *\n * @param options - Parse options containing decoded JWT\n * @returns The JWK to use for signature verification\n * @throws {ParseAuthorizeRequestError} When no valid public key can be found\n */\nfunction getPublicKeyForVerification(options: {\n  header: Openid4vpAuthorizationRequestHeader;\n  payload: Openid4vpAuthorizationRequestPayload;\n}): JwtSigner {\n  const { header, payload } = options;\n\n  const { prefix: clientIdPrefix } = extractClientIdPrefix(payload.client_id);\n\n  if (\n    clientIdPrefix === ClientIdPrefix.OPENID_FEDERATION ||\n    clientIdPrefix === ClientIdPrefix.NONE\n  ) {\n    if (!header.kid) {\n      throw new ParseAuthorizeRequestError(\n        \"kid is required in JWT header for openid_federation client_id or no prefix\",\n      );\n    }\n\n    return {\n      alg: header.alg,\n      kid: header.kid,\n      method: \"federation\" as const,\n      ...(header.trust_chain && { trustChain: header.trust_chain }),\n    };\n  }\n\n  if (clientIdPrefix === ClientIdPrefix.X509_HASH) {\n    if (!Array.isArray(header.x5c) || header.x5c.length === 0) {\n      throw new ParseAuthorizeRequestError(\n        \"x5c is required in JWT header for x509_hash client_id\",\n      );\n    }\n\n    return {\n      alg: header.alg,\n      kid: header.kid,\n      method: \"x5c\" as const,\n      ...(header.trust_chain && { trustChain: header.trust_chain }),\n      x5c: header.x5c,\n    };\n  }\n\n  throw new ParseAuthorizeRequestError(\n    \"Unable to determine public key for Request Object verification with client_id prefix: \" +\n      clientIdPrefix,\n  );\n}\n\nexport interface ParseAuthorizeRequestOptions {\n  /**\n   * Optional callback context for JWT signature verification and hashing x509 client_id for digest comparison.\n   * If not provided, signature verification is skipped or hash skips the x509_hash digest comparison.\n   */\n  callbacks?: Partial<Pick<CallbackContext, \"hash\" | \"verifyJwt\">> &\n    Partial<X509CertificateBinding>;\n\n  config: IoWalletSdkConfig;\n\n  /**\n   * The Authorization Request Object JWT.\n   */\n  requestObjectJwt: string;\n}\n\nexport interface ParsedAuthorizeRequestResult {\n  /**\n   * The JWT header of the authorization request object.\n   */\n  header: Openid4vpAuthorizationRequestHeader;\n  /**\n   * The parsed authorization request object.\n   */\n  payload: Openid4vpAuthorizationRequestPayload;\n\n  /**\n   * X.509 context extracted from the Request Object header when `x5c` is present.\n   */\n  x509Certificate?: {\n    leafCertificate: string;\n    x5c: [string, ...string[]];\n  };\n}\n\n/**\n * Parses and optionally verifies a JWT containing an OpenID4VP Request Object.\n *\n * This method decodes the Request Object JWT and validates its structure. If the `verifyJwt`\n * callback is provided, it also verifies the JWT signature using the public key obtained\n * according to IT Wallet specifications:\n * 1. If client_id uses x509_hash: pass an x5c signer to the callback.\n * 2. If client_id uses openid_federation or a legacy HTTPS identifier, pass a federation signer;\n *    trust_chain is forwarded when present, otherwise the callback must reconstruct the chain from client_id.\n *\n * For x509_hash client identifiers, x5c is always required. When `callbacks.hash` is provided,\n * this method also checks the SHA-256 base64url certificate digest embedded in client_id.\n *\n * Security: If `verifyJwt` callback is not provided in options, JWT signature verification is skipped.\n *\n * @param options {@link ParseAuthorizeRequestOptions}\n * @returns A {@link ParsedAuthorizeRequestResult} containing the RP required credentials payload and the {@link Openid4vpAuthorizationRequestHeader} JWT header\n * @throws {ValidationError} in case there are errors validating the Request Object structure\n * @throws {Oauth2JwtParseError} in case the request object jwt is malformed (e.g missing header, bad encoding)\n * @throws {@link ParseAuthorizeRequestError} in case the JWT signature is invalid (when verifyJwt is provided) or there are unexpected errors\n */\nexport async function parseAuthorizeRequest(\n  options: ParseAuthorizeRequestOptions,\n): Promise<ParsedAuthorizeRequestResult> {\n  try {\n    const headerSchema = dispatchByVersion<\n      | typeof zOpenid4vpAuthorizationRequestHeaderV1_0\n      | typeof zOpenid4vpAuthorizationRequestHeaderV1_3\n    >(options.config.itWalletSpecsVersion, {\n      [ItWalletSpecsVersion.V1_0]: () =>\n        zOpenid4vpAuthorizationRequestHeaderV1_0,\n      [ItWalletSpecsVersion.V1_3]: () =>\n        zOpenid4vpAuthorizationRequestHeaderV1_3,\n      [ItWalletSpecsVersion.V1_4]: () =>\n        zOpenid4vpAuthorizationRequestHeaderV1_3,\n    });\n\n    const decoded = decodeJwt({\n      errorMessagePrefix: \"Error decoding authorization request JWT:\",\n      headerSchema,\n      jwt: options.requestObjectJwt,\n      payloadSchema: zOpenid4vpAuthorizationRequestPayload,\n    });\n\n    if (options.config.itWalletSpecsVersion !== ItWalletSpecsVersion.V1_0) {\n      await validateAuthorizationRequestClientBinding({\n        hash: options.callbacks?.hash,\n        header: decoded.header as Openid4vpAuthorizationRequestHeaderV1_3,\n        payload: decoded.payload,\n      });\n    }\n\n    const x5c =\n      \"x5c\" in decoded.header &&\n      Array.isArray(decoded.header.x5c) &&\n      decoded.header.x5c.length > 0\n        ? (decoded.header.x5c as [string, ...string[]])\n        : undefined;\n\n    if (x5c && options.callbacks?.getX509CertificateMetadata) {\n      await validateCertificateEndpoints({\n        callbacks: {\n          getX509CertificateMetadata:\n            options.callbacks.getX509CertificateMetadata,\n        },\n        certificate: x5c[0],\n        endpoints: [\n          { name: \"request_uri\", uri: decoded.payload.request_uri },\n          { name: \"response_uri\", uri: decoded.payload.response_uri },\n        ],\n      });\n    }\n\n    if (options.callbacks?.verifyJwt) {\n      const signer = getPublicKeyForVerification({\n        header: decoded.header,\n        payload: decoded.payload,\n      });\n\n      await verifyJwt({\n        compact: options.requestObjectJwt,\n        errorMessage: \"Error verifying Request Object signature\",\n        header: decoded.header,\n        payload: decoded.payload,\n        signer,\n        verifyJwtCallback: options.callbacks.verifyJwt,\n      });\n    }\n\n    return {\n      header: decoded.header,\n      payload: decoded.payload,\n      ...(x5c && {\n        x509Certificate: {\n          leafCertificate: x5c[0],\n          x5c,\n        },\n      }),\n    };\n  } catch (error) {\n    if (\n      error instanceof ItWalletSpecsVersionError ||\n      error instanceof ValidationError ||\n      error instanceof Oauth2JwtParseError ||\n      error instanceof Oid4vpError\n    )\n      throw error;\n    throw new ParseAuthorizeRequestError(\n      `Unexpected error during Request Object parsing: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n}\n","import {\n  ItWalletSpecsVersion,\n  createVersionDispatcher,\n} from \"@pagopa/io-wallet-utils\";\n\nimport type {\n  CreateAuthorizationResponseOptionsV1_3,\n  CreateAuthorizationResponseOptionsV1_4,\n  CreateAuthorizationResponseResult,\n  CreateAuthorizationResponseVersionedOptions,\n} from \"./types\";\n\nimport * as V1_3 from \"./v1.3/create-authorization-response\";\nimport * as V1_4 from \"./v1.4/create-authorization-response\";\n\nexport type {\n  CreateAuthorizationResponseOptionsV1_0,\n  CreateAuthorizationResponseOptionsV1_3,\n  CreateAuthorizationResponseOptionsV1_4,\n  CreateAuthorizationResponseResult,\n  CreateAuthorizationResponseVersionedOptions,\n} from \"./types\";\n\nconst dispatchCreateAuthorizationResponse = createVersionDispatcher<\n  CreateAuthorizationResponseVersionedOptions,\n  Promise<CreateAuthorizationResponseResult>\n>({\n  [ItWalletSpecsVersion.V1_0]: (o) =>\n    // V1_0 shares the v1.3 response logic — JWKS / enc resolution is identical.\n    V1_3.createAuthorizationResponse(\n      o as CreateAuthorizationResponseOptionsV1_3,\n    ),\n  [ItWalletSpecsVersion.V1_3]: (o) =>\n    V1_3.createAuthorizationResponse(\n      o as CreateAuthorizationResponseOptionsV1_3,\n    ),\n  [ItWalletSpecsVersion.V1_4]: (o) =>\n    V1_4.createAuthorizationResponse(\n      o as CreateAuthorizationResponseOptionsV1_4,\n    ),\n});\n\n/**\n * Creates an encrypted JARM authorization response for OpenID4VP presentation.\n *\n * Routes to the version-specific implementation based on `config.itWalletSpecsVersion`.\n *\n * **Version differences:**\n * - v1.0 / v1.3: When `openid_federation` client_id prefix is used, `client_metadata`\n *   is ignored and `rpJwks` is used for JWKS resolution.\n * - v1.4: `client_metadata.jwks` is used directly when present, regardless of\n *   the `client_id` prefix, falling back to `rpJwks.jwks`.\n *\n * @throws {CreateAuthorizationResponseError} If response generation or encryption fails\n * @throws {ItWalletSpecsVersionError} If `config.itWalletSpecsVersion` is not a recognised version at runtime\n */\nexport async function createAuthorizationResponse(\n  options: CreateAuthorizationResponseVersionedOptions,\n): Promise<CreateAuthorizationResponseResult> {\n  return dispatchCreateAuthorizationResponse(options);\n}\n","import type { JwkSet } from \"@pagopa/io-wallet-oauth2\";\n\nimport { CallbackContext, JweEncryptor } from \"@pagopa/io-wallet-oauth2\";\nimport { encodeToBase64Url } from \"@pagopa/io-wallet-utils\";\n\nimport type { CreateAuthorizationResponseResult } from \"./types\";\n\nimport { Openid4vpAuthorizationRequestPayload } from \"../authorization-request/z-authorization-request\";\nimport { CreateAuthorizationResponseError } from \"../errors\";\nimport { extractEncryptionJwkFromJwks } from \"../jarm/jarm-extract-jwks\";\nimport { VpToken } from \"../vp-token/z-vp-token\";\n\nexport interface BuildJarmResponseOptions {\n  authorization_encrypted_response_alg?: string;\n  authorization_encrypted_response_enc?: string;\n  callbacks: Pick<CallbackContext, \"encryptJwe\" | \"generateRandom\">;\n  encValuesSupported: string[] | undefined;\n  encryptionJwks: JwkSet;\n  requestObject: Pick<Openid4vpAuthorizationRequestPayload, \"nonce\" | \"state\">;\n  vp_token: VpToken;\n}\n\nfunction resolveEncValue(\n  supported: string[] | undefined,\n  requested: string | undefined,\n  fallback: string,\n): string {\n  if (!supported) return requested ?? fallback;\n  return (\n    supported.find((e) => e === requested) ??\n    supported[0] ??\n    requested ??\n    fallback\n  );\n}\n\n/**\n * Shared core: resolves enc/alg, encrypts the VP token into a JARM JWE, and returns the result.\n * Callers are responsible for resolving `encryptionJwks` and `encValuesSupported`\n * according to their version-specific metadata rules before invoking this function.\n */\nexport async function buildJarmResponse(\n  options: BuildJarmResponseOptions,\n): Promise<CreateAuthorizationResponseResult> {\n  try {\n    const encryptionAlg =\n      options.authorization_encrypted_response_alg ?? \"ECDH-ES\";\n    const encryptionEnc =\n      options.authorization_encrypted_response_enc ?? \"A256GCM\";\n\n    const authorizationResponsePayload = {\n      state: options.requestObject.state,\n      vp_token: options.vp_token,\n    };\n\n    const encryptionJwk = extractEncryptionJwkFromJwks(options.encryptionJwks, {\n      supportedAlgValues: [encryptionAlg],\n    });\n    if (!encryptionJwk) {\n      throw new CreateAuthorizationResponseError(\n        \"No encryption JWK found in metadata\",\n      );\n    }\n\n    if (!encryptionJwk.kid) {\n      throw new CreateAuthorizationResponseError(\n        \"Encryption JWK must have a 'kid' parameter\",\n      );\n    }\n\n    const enc = resolveEncValue(\n      options.encValuesSupported,\n      options.authorization_encrypted_response_enc,\n      encryptionEnc,\n    );\n\n    const alg = encryptionAlg;\n\n    const nonceBytes = await options.callbacks.generateRandom(32);\n\n    const jweEncryptor: JweEncryptor = {\n      alg,\n      apu: encodeToBase64Url(nonceBytes),\n      apv: encodeToBase64Url(options.requestObject.nonce),\n      enc,\n      kid: encryptionJwk.kid,\n      method: \"jwk\",\n      publicJwk: encryptionJwk,\n    };\n\n    const { encryptionJwk: usedJwk, jwe } = await options.callbacks.encryptJwe(\n      jweEncryptor,\n      JSON.stringify(authorizationResponsePayload),\n    );\n\n    return {\n      authorizationResponsePayload,\n      jarm: {\n        encryptionJwk: usedJwk,\n        responseJwe: jwe,\n      },\n    };\n  } catch (error) {\n    if (error instanceof CreateAuthorizationResponseError) {\n      throw error;\n    }\n    throw new CreateAuthorizationResponseError(\n      `Unexpected error during authorization response creation: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n}\n","import type { JwkSet } from \"@pagopa/io-wallet-oauth2\";\n\n/**\n * Selects an encryption JWK from a JWKS.\n *\n * Selection prefers an explicit `kid`, then keys whose `alg` is supported, then\n * keys marked for encryption or not explicitly marked for signatures.\n *\n * @param jwks - JSON Web Key Set to search.\n * @param options - Optional selection constraints.\n * @param options.kid - Key ID to select directly.\n * @param options.supportedAlgValues - Encryption algorithms accepted by the caller.\n * @returns Matching encryption JWK, or the first available key when no better match exists.\n */\nexport function extractEncryptionJwkFromJwks(\n  jwks: JwkSet,\n  {\n    kid,\n    supportedAlgValues,\n  }: {\n    kid?: string;\n    supportedAlgValues?: string[];\n  },\n) {\n  if (kid) {\n    return jwks.keys.find((jwk) => jwk.kid === kid);\n  }\n\n  let algFiltered = jwks.keys.filter(\n    (key) => key.alg && supportedAlgValues?.includes(key.alg),\n  );\n  if (algFiltered.length === 0) algFiltered = jwks.keys;\n\n  let encFiltered = algFiltered.filter((key) => key.use === \"enc\");\n  if (encFiltered.length === 0) {\n    encFiltered = algFiltered.filter((key) => key.use !== \"sig\");\n  }\n\n  return encFiltered.length > 0 ? encFiltered[0] : jwks.keys[0];\n}\n","import type {\n  CreateAuthorizationResponseOptionsV1_3,\n  CreateAuthorizationResponseResult,\n} from \"../types\";\n\nimport {\n  ClientIdPrefix,\n  extractClientIdPrefix,\n} from \"../../authorization-request/parse-authorization-request\";\nimport { CreateAuthorizationResponseError } from \"../../errors\";\nimport { buildJarmResponse } from \"../build-jarm-response\";\n\n/**\n * Creates an encrypted JARM authorization response for OpenID4VP presentation — v1.0 / v1.3 variant.\n *\n * When the `openid_federation` client_id prefix is used, `client_metadata` is ignored\n * and `rpJwks` is used for JWKS resolution, as required by the Italian specification.\n */\nexport async function createAuthorizationResponse(\n  options: CreateAuthorizationResponseOptionsV1_3,\n): Promise<CreateAuthorizationResponseResult> {\n  const { requestObject } = options;\n  const clientMetadata = requestObject.client_metadata;\n  const { prefix: clientIdPrefix } = extractClientIdPrefix(\n    requestObject.client_id,\n  );\n\n  if (clientIdPrefix === ClientIdPrefix.X509_HASH && !clientMetadata) {\n    throw new CreateAuthorizationResponseError(\n      \"clientMetadata is required when client_id uses x509_hash prefix\",\n    );\n  }\n\n  // When using OpenID Federation, client_metadata may be present in the request\n  // but per the Italian specification most of its content should be ignored —\n  // use rpJwks for encryption parameters instead.\n  const effectiveClientMetadata =\n    clientIdPrefix === ClientIdPrefix.OPENID_FEDERATION\n      ? undefined\n      : clientMetadata;\n\n  const encryptionJwks = effectiveClientMetadata\n    ? effectiveClientMetadata.jwks\n    : options.rpJwks.jwks;\n\n  const encValuesSupported =\n    effectiveClientMetadata?.encrypted_response_enc_values_supported ??\n    options.rpJwks.encrypted_response_enc_values_supported;\n\n  return buildJarmResponse({\n    authorization_encrypted_response_alg:\n      options.authorization_encrypted_response_alg,\n    authorization_encrypted_response_enc:\n      options.authorization_encrypted_response_enc,\n    callbacks: options.callbacks,\n    encValuesSupported,\n    encryptionJwks,\n    requestObject: options.requestObject,\n    vp_token: options.vp_token,\n  });\n}\n","import type {\n  CreateAuthorizationResponseOptionsV1_4,\n  CreateAuthorizationResponseResult,\n} from \"../types\";\n\nimport {\n  ClientIdPrefix,\n  extractClientIdPrefix,\n} from \"../../authorization-request/parse-authorization-request\";\nimport { CreateAuthorizationResponseError } from \"../../errors\";\nimport { buildJarmResponse } from \"../build-jarm-response\";\n\n/**\n * Creates an encrypted JARM authorization response for OpenID4VP presentation — v1.4 variant.\n *\n * **v1.4 behavior:** both `encryptionJwks` and `encValuesSupported`\n * are resolved directly from `requestObject.client_metadata`, falling back to `rpJwks`, regardless\n * of the `client_id` prefix. The IT-Wallet spec (RPR-113) permits `client_metadata.jwks` and\n * `encrypted_response_enc_values_supported` to carry request-specific ephemeral encryption keys\n * even when the `openid_federation` prefix is active.\n */\nexport async function createAuthorizationResponse(\n  options: CreateAuthorizationResponseOptionsV1_4,\n): Promise<CreateAuthorizationResponseResult> {\n  const { requestObject } = options;\n  const clientMetadata = requestObject.client_metadata;\n  const { prefix: clientIdPrefix } = extractClientIdPrefix(\n    requestObject.client_id,\n  );\n\n  if (clientIdPrefix === ClientIdPrefix.X509_HASH && !clientMetadata) {\n    throw new CreateAuthorizationResponseError(\n      \"clientMetadata is required when client_id uses x509_hash prefix\",\n    );\n  }\n\n  const encryptionJwks = clientMetadata?.jwks ?? options.rpJwks.jwks;\n\n  const encValuesSupported =\n    clientMetadata?.encrypted_response_enc_values_supported ??\n    options.rpJwks.encrypted_response_enc_values_supported;\n\n  return buildJarmResponse({\n    authorization_encrypted_response_alg:\n      options.authorization_encrypted_response_alg,\n    authorization_encrypted_response_enc:\n      options.authorization_encrypted_response_enc,\n    callbacks: options.callbacks,\n    encValuesSupported,\n    encryptionJwks,\n    requestObject: options.requestObject,\n    vp_token: options.vp_token,\n  });\n}\n","import { CallbackContext } from \"@openid4vc/oauth2\";\nimport {\n  CONTENT_TYPES,\n  HEADERS,\n  UnexpectedStatusCodeError,\n  ValidationError,\n  createFetcher,\n  hasStatusOrThrow,\n  parseWithErrorHandling,\n} from \"@pagopa/io-wallet-utils\";\n\nimport {\n  X509CertificateBinding,\n  validateCertificateEndpoints,\n} from \"../authorization-request/validate-certificate-endpoints\";\nimport { FetchAuthorizationResponseError } from \"../errors\";\nimport {\n  Openid4vpAuthorizationResponseResult,\n  zOpenid4vpAuthorizationResponseResult,\n} from \"./z-authorization-response\";\n\n/**\n * Configuration options for fetching OID4VP Presentation Result\n */\nexport interface FetchAuthorizationResponseOptions {\n  /**\n   * The signed and encrypted {@link Openid4vpAuthorizationResponse} in base64 format\n   */\n  authorizationResponseJarm: string;\n\n  /**\n   * Callback functions for making HTTP requests\n   * Allows for custom fetch implementations\n   */\n  callbacks: Pick<CallbackContext, \"fetch\">;\n\n  /**\n   * The response_uri field contained in the {@link Openid4vpAuthorizationRequestPayload}\n   */\n  presentationResponseUri: string;\n\n  /**\n   * Optional RP certificate context from the parsed Request Object.\n   * When provided, `presentationResponseUri` and the returned `redirect_uri`\n   * are checked against the certificate SAN entries through the supplied callback.\n   */\n  x509Certificate?: {\n    binding: X509CertificateBinding;\n    leafCertificate: string;\n  };\n}\n\n/**\n * Sends the {@link Openid4vpAuthorizationResponse} to the response uri provided by the session's\n * {@link Openid4vpAuthorizationRequestPayload} and returns the {@link Openid4vpAuthorizationResponseResult} object\n * containing the redirect_uri at which to continue the presentation\n *\n * @param options {@link FetchAuthorizationResponseOptions}\n * @returns Promise that resolves to the parsed {@link Openid4vpAuthorizationResponseResult}\n * @throws {UnexpectedStatusCodeError} When the server returns a non-200 status code\n * @throws {ValidationError} When the response cannot be parsed or is invalid\n */\nexport async function fetchAuthorizationResponse(\n  options: FetchAuthorizationResponseOptions,\n): Promise<Openid4vpAuthorizationResponseResult> {\n  try {\n    if (options.x509Certificate) {\n      await validateCertificateEndpoints({\n        callbacks: options.x509Certificate.binding,\n        certificate: options.x509Certificate.leafCertificate,\n        endpoints: [\n          { name: \"response_uri\", uri: options.presentationResponseUri },\n        ],\n      });\n    }\n\n    const fetch = createFetcher(options.callbacks.fetch);\n    const authorizationResponseResult = await fetch(\n      options.presentationResponseUri,\n      {\n        body: new URLSearchParams({\n          response: options.authorizationResponseJarm,\n        }),\n        headers: {\n          [HEADERS.CONTENT_TYPE]: CONTENT_TYPES.FORM_URLENCODED,\n        },\n        method: \"POST\",\n      },\n    );\n\n    await hasStatusOrThrow(\n      200,\n      UnexpectedStatusCodeError,\n    )(authorizationResponseResult);\n\n    const authorizationResponseResultJson =\n      await authorizationResponseResult.json();\n\n    //Response could be anything, so it's returned as is for further processing\n    const parsedAuthorizationResponseResult = parseWithErrorHandling(\n      zOpenid4vpAuthorizationResponseResult,\n      authorizationResponseResultJson,\n    );\n\n    if (options.x509Certificate) {\n      await validateCertificateEndpoints({\n        callbacks: options.x509Certificate.binding,\n        certificate: options.x509Certificate.leafCertificate,\n        endpoints: [\n          {\n            name: \"redirect_uri\",\n            uri: parsedAuthorizationResponseResult.redirect_uri,\n          },\n        ],\n      });\n    }\n\n    return parsedAuthorizationResponseResult;\n  } catch (error) {\n    if (\n      error instanceof UnexpectedStatusCodeError ||\n      error instanceof ValidationError ||\n      error instanceof FetchAuthorizationResponseError\n    ) {\n      throw error;\n    }\n    throw new FetchAuthorizationResponseError(\n      `Unexpected error sending authorization response: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n}\n","import z from \"zod\";\n\nimport { zVpToken } from \"../vp-token/z-vp-token\";\n\nexport const zOpenid4vpAuthorizationResponse = z.object({\n  state: z.string().optional(),\n  vp_token: zVpToken,\n});\n\nexport type Openid4vpAuthorizationResponse = z.infer<\n  typeof zOpenid4vpAuthorizationResponse\n>;\n\nexport const zOpenid4vpAuthorizationResponseResult = z.object({\n  redirect_uri: z.url().optional(),\n});\n\nexport type Openid4vpAuthorizationResponseResult = z.infer<\n  typeof zOpenid4vpAuthorizationResponseResult\n>;\n","import { z } from \"zod\";\n\nexport const zVpToken = z.record(\n  z.string(),\n  z.string().or(z.array(z.string()).nonempty()),\n  {\n    message:\n      \"vp_token must be an object where each key is a string and each value is a non-empty array of strings (v1.3) or a string (v1.0)\",\n  },\n);\n\nexport type VpToken = z.infer<typeof zVpToken>;\n","import { CallbackContext } from \"@pagopa/io-wallet-oauth2\";\nimport { parseWithErrorHandling } from \"@pagopa/io-wallet-utils\";\n\nimport { Openid4vpAuthorizationRequestPayload } from \"../authorization-request/z-authorization-request\";\nimport { Oid4vpError } from \"../errors\";\nimport { parseJarmAuthorizationResponse } from \"../jarm/parse-jarm-authorization-response\";\nimport { VerifyJarmAuthorizationResponseResult } from \"../jarm/verify-jarm-authorization-response\";\nimport { JarmHeader } from \"../jarm/z-jarm\";\nimport {\n  ValidateOpenid4vpAuthorizationResponseResult,\n  validateOpenid4vpAuthorizationResponsePayload,\n} from \"./validate-authorization-response\";\nimport {\n  Openid4vpAuthorizationResponse,\n  zOpenid4vpAuthorizationResponse,\n} from \"./z-authorization-response\";\n\nexport interface ParseAuthorizationResponseOptions {\n  /**\n   * Parsed authorization request payload used to validate response parameters.\n   */\n  authorizationRequestPayload: Openid4vpAuthorizationRequestPayload;\n  /**\n   * Authorization response received from the verifier endpoint or redirect URI.\n   */\n  authorizationResponse: Record<string, unknown>;\n  /**\n   * Callbacks required when the response is returned in JARM format.\n   */\n  callbacks: Pick<CallbackContext, \"decryptJwe\" | \"verifyJwt\">;\n}\n\n/**\n * Parsed and validated authorization response.\n */\nexport type ParseAuthorizationResponseResult = {\n  authorizationResponsePayload: Openid4vpAuthorizationResponse;\n  expectedNonce: string;\n  jarm?: {\n    jarmHeader: JarmHeader;\n  } & VerifyJarmAuthorizationResponseResult;\n} & ValidateOpenid4vpAuthorizationResponseResult;\n\n/**\n * Parses an OpenID4VP authorization response and validates it against the request.\n *\n * If the response includes a `response` parameter, the JARM flow is used.\n * Otherwise, the plain authorization response payload is parsed and validated.\n *\n * @param options {@link ParseAuthorizationResponseOptions}\n * @returns A parsed and validated authorization response.\n */\nexport async function parseAuthorizationResponse(\n  options: ParseAuthorizationResponseOptions,\n): Promise<ParseAuthorizationResponseResult> {\n  const { authorizationRequestPayload, authorizationResponse, callbacks } =\n    options;\n\n  if (authorizationResponse.response) {\n    if (typeof authorizationResponse.response !== \"string\") {\n      throw new Oid4vpError(\n        \"Invalid jarm authorization response: 'response' parameter must be a jwt string.\",\n      );\n    }\n\n    return parseJarmAuthorizationResponse({\n      authorizationRequestPayload,\n      callbacks,\n      jarmResponseJwt: authorizationResponse.response,\n    });\n  }\n\n  const authorizationResponsePayload = parseWithErrorHandling(\n    zOpenid4vpAuthorizationResponse,\n    authorizationResponse,\n    \"Failed to parse openid4vp authorization response.\",\n  );\n\n  const validatedOpenId4vpResponse =\n    validateOpenid4vpAuthorizationResponsePayload({\n      authorizationRequestPayload: authorizationRequestPayload,\n      authorizationResponsePayload: authorizationResponsePayload,\n    });\n\n  return {\n    ...validatedOpenId4vpResponse,\n    authorizationResponsePayload,\n    expectedNonce: authorizationRequestPayload.nonce,\n  };\n}\n","import {\n  type CallbackContext,\n  decodeJwtHeader,\n  zCompactJwe,\n  zCompactJwt,\n} from \"@pagopa/io-wallet-oauth2\";\nimport { parseWithErrorHandling } from \"@pagopa/io-wallet-utils\";\nimport z from \"zod\";\n\nimport { Openid4vpAuthorizationRequestPayload } from \"../authorization-request/z-authorization-request\";\nimport { ParseAuthorizationResponseResult } from \"../authorization-response/parse-authorization-response\";\nimport { validateOpenid4vpAuthorizationResponsePayload } from \"../authorization-response/validate-authorization-response\";\nimport { zOpenid4vpAuthorizationResponse } from \"../authorization-response/z-authorization-response\";\nimport { verifyJarmAuthorizationResponse } from \"./verify-jarm-authorization-response\";\nimport { zJarmHeader } from \"./z-jarm\";\n\nexport interface ParseJarmAuthorizationResponseOptions {\n  /**\n   * Parsed authorization request payload used to validate JARM claims.\n   */\n  authorizationRequestPayload: Openid4vpAuthorizationRequestPayload;\n  /**\n   * Callbacks used to decrypt and verify JARM JWT/JWE responses.\n   */\n  callbacks: Pick<CallbackContext, \"decryptJwe\" | \"verifyJwt\">;\n  /**\n   * Compact JARM authorization response (`response` parameter value).\n   */\n  jarmResponseJwt: string;\n  /**\n   * Current time used for temporal claim validation (`exp`, `nbf`).\n   * Defaults to current date-time when omitted.\n   */\n  now?: Date;\n}\n\n/**\n * Parses and validates a JARM authorization response for OpenID4VP.\n *\n * This function validates compact format, decrypts and/or verifies the JARM token,\n * parses the resulting OpenID4VP authorization response, and validates it against\n * the originating authorization request.\n *\n * @param options {@link ParseJarmAuthorizationResponseOptions}\n * @returns Parsed authorization response enriched with JARM metadata.\n */\nexport async function parseJarmAuthorizationResponse(\n  options: ParseJarmAuthorizationResponseOptions,\n): Promise<ParseAuthorizationResponseResult> {\n  const { authorizationRequestPayload, callbacks, jarmResponseJwt, now } =\n    options;\n\n  const jarmAuthorizationResponseJwt = parseWithErrorHandling(\n    z.union([zCompactJwt, zCompactJwe]),\n    jarmResponseJwt,\n    \"Invalid jarm authorization response jwt.\",\n  );\n\n  const verifiedJarmResponse = await verifyJarmAuthorizationResponse({\n    authorizationRequestPayload,\n    callbacks,\n    jarmAuthorizationResponseJwt,\n    now,\n  });\n\n  const { header: jarmHeader } = decodeJwtHeader({\n    headerSchema: zJarmHeader,\n    jwt: jarmAuthorizationResponseJwt,\n  });\n\n  const authorizationResponsePayload = parseWithErrorHandling(\n    zOpenid4vpAuthorizationResponse,\n    verifiedJarmResponse.jarmAuthorizationResponse,\n    \"Failed to parse openid4vp authorization response.\",\n  );\n\n  const validateOpenId4vpResponse =\n    validateOpenid4vpAuthorizationResponsePayload({\n      authorizationRequestPayload: authorizationRequestPayload,\n      authorizationResponsePayload: authorizationResponsePayload,\n    });\n\n  return {\n    ...validateOpenId4vpResponse,\n    authorizationResponsePayload,\n    expectedNonce: authorizationRequestPayload.nonce,\n    jarm: { ...verifiedJarmResponse, jarmHeader },\n  };\n}\n","import { parseIfJson, parseWithErrorHandling } from \"@pagopa/io-wallet-utils\";\n\nimport { zVpToken } from \"./z-vp-token\";\n\n/**\n * Parses a DCQL VP token into the SDK VP token shape.\n *\n * @param vpToken - Raw VP token object or JSON string.\n * @returns Parsed VP token.\n * @throws {ValidationError} If the token is not an object of encoded presentations.\n */\nexport function parseVpToken(vpToken: unknown) {\n  return parseWithErrorHandling(\n    zVpToken,\n    parseIfJson(vpToken),\n    \"Could not parse dcql vp_token. Expected an object where the values are encoded presentations\",\n  );\n}\n","import { Openid4vpAuthorizationRequestPayload } from \"../authorization-request/z-authorization-request\";\nimport { Oid4vpError } from \"../errors\";\nimport { parseVpToken } from \"../vp-token/parse-vp-token\";\nimport { Openid4vpAuthorizationResponse } from \"./z-authorization-response\";\n\nexport interface ValidateOpenid4vpAuthorizationResponseOptions {\n  /**\n   * Parsed request payload used as validation source.\n   */\n  authorizationRequestPayload: Openid4vpAuthorizationRequestPayload;\n  /**\n   * Parsed authorization response payload to validate.\n   */\n  authorizationResponsePayload: Openid4vpAuthorizationResponse;\n}\n\n/**\n * Result of authorization response validation.\n */\nexport interface ValidateOpenid4vpAuthorizationResponseResult {\n  presentations: ReturnType<typeof parseVpToken>;\n  query: Openid4vpAuthorizationRequestPayload[\"dcql_query\"];\n}\n\n/**\n * Validates the OpenID4VP authorization response payload against the request payload.\n *\n * @param options {@link ValidateOpenid4vpAuthorizationResponseOptions}\n * @returns Presentations and query extracted from the validated flow.\n * @throws {Oid4vpError} If `state` is present in the request and does not match the response.\n */\nexport function validateOpenid4vpAuthorizationResponsePayload(\n  options: ValidateOpenid4vpAuthorizationResponseOptions,\n): ValidateOpenid4vpAuthorizationResponseResult {\n  const { authorizationRequestPayload, authorizationResponsePayload } = options;\n\n  if (\n    authorizationRequestPayload.state !== authorizationResponsePayload.state\n  ) {\n    throw new Oid4vpError(\"OpenId4Vp Authorization Response state mismatch.\");\n  }\n\n  const presentations = parseVpToken(authorizationResponsePayload.vp_token);\n\n  return {\n    presentations,\n    query: authorizationRequestPayload.dcql_query,\n  };\n}\n","import { jwtSignerFromJwt } from \"@openid4vc/oauth2\";\nimport {\n  type CallbackContext,\n  type Jwk,\n  Oauth2Error,\n  decodeJwt,\n  decodeJwtHeader,\n  zCompactJwe,\n  zCompactJwt,\n  zJwtHeader,\n} from \"@pagopa/io-wallet-oauth2\";\nimport { stringToJsonWithErrorHandling } from \"@pagopa/io-wallet-utils\";\nimport z from \"zod\";\n\nimport { Openid4vpAuthorizationRequestPayload } from \"../authorization-request/z-authorization-request\";\nimport { extractEncryptionJwkFromJwks } from \"./jarm-extract-jwks\";\nimport {\n  JarmAuthorizationResponse,\n  JarmAuthorizationResponseEncryptedOnly,\n  zEncryptedJarmHeader,\n  zJarmAuthorizationResponse,\n  zJarmAuthorizationResponseEncryptedOnly,\n} from \"./z-jarm\";\n\n/**\n * Supported JARM serialization/processing modes.\n */\nexport enum JarmMode {\n  Encrypted = \"Encrypted\",\n  Signed = \"Signed\",\n  SignedEncrypted = \"SignedEncrypted\",\n}\n\nconst decryptJarmAuthorizationResponseJwt = async (options: {\n  authorizationRequestPayload: Openid4vpAuthorizationRequestPayload;\n  callbacks: Pick<CallbackContext, \"decryptJwe\">;\n  jarmAuthorizationResponseJwt: string;\n}) => {\n  const {\n    authorizationRequestPayload,\n    callbacks,\n    jarmAuthorizationResponseJwt,\n  } = options;\n\n  let encryptionJwk: Jwk | undefined;\n  const { header } = decodeJwtHeader({\n    headerSchema: zEncryptedJarmHeader,\n    jwt: jarmAuthorizationResponseJwt,\n  });\n\n  const jwks = authorizationRequestPayload.client_metadata?.jwks;\n\n  if (jwks) {\n    encryptionJwk = extractEncryptionJwkFromJwks(jwks, { kid: header.kid });\n  }\n\n  const result = await callbacks.decryptJwe(jarmAuthorizationResponseJwt, {\n    jwk: encryptionJwk,\n  });\n\n  if (!result.decrypted) {\n    throw new Oauth2Error(\"Failed to decrypt jarm auth response.\");\n  }\n\n  return {\n    decryptionJwk: result.decryptionJwk,\n    payload: result.payload,\n  };\n};\n\nexport interface VerifyJarmAuthorizationResponseOptions {\n  /**\n   * Parsed authorization request payload used to resolve metadata and key material.\n   */\n  authorizationRequestPayload: Openid4vpAuthorizationRequestPayload;\n  /**\n   * Callbacks required for JWE decryption and JWT signature verification.\n   */\n  callbacks: Pick<CallbackContext, \"decryptJwe\" | \"verifyJwt\">;\n  /**\n   * Compact serialized JARM response received from the verifier.\n   */\n  jarmAuthorizationResponseJwt: string;\n  /**\n   * Current time used for temporal claim validation (`exp`, `nbf`).\n   * Defaults to current date-time when omitted.\n   */\n  now?: Date;\n}\n\n/**\n * Verified JARM authorization response data returned by {@link verifyJarmAuthorizationResponse}.\n */\nexport interface VerifyJarmAuthorizationResponseResult {\n  /**\n   * JWK used for decryption when the response is encrypted, or `undefined` if the response was not encrypted.\n   */\n  decryptionJwk: Jwk | undefined;\n  /**\n   * The `iss` claim from the JARM response, representing the issuer of the response.\n   */\n  issuer: string | undefined;\n  /**\n   * The parsed JARM authorization response body, containing claims like `iss`, `aud`, `exp`, etc.\n   */\n  jarmAuthorizationResponse:\n    | JarmAuthorizationResponse\n    | JarmAuthorizationResponseEncryptedOnly;\n  /**\n   * Detected JARM processing mode indicating whether the response was signed, encrypted, or both.\n   */\n  type: JarmMode;\n}\n\n/**\n * Verifies a JARM authorization response in signed, encrypted, or signed+encrypted mode.\n *\n * The function detects the response mode, performs decryption when needed, verifies\n * JWS signatures for signed payloads, and returns the parsed JARM body with metadata.\n *\n * @param options {@link VerifyJarmAuthorizationResponseOptions}\n * @returns Decryption and verification artifacts with parsed JARM payload.\n * @throws {Oauth2Error} If the response mode is invalid, decryption fails, or signature verification fails.\n */\nexport async function verifyJarmAuthorizationResponse(\n  options: VerifyJarmAuthorizationResponseOptions,\n) {\n  const {\n    authorizationRequestPayload,\n    callbacks,\n    jarmAuthorizationResponseJwt,\n  } = options;\n\n  const requestDataIsEncrypted = zCompactJwe.safeParse(\n    jarmAuthorizationResponseJwt,\n  ).success;\n  const decryptedRequestData = requestDataIsEncrypted\n    ? await decryptJarmAuthorizationResponseJwt({\n        authorizationRequestPayload,\n        callbacks,\n        jarmAuthorizationResponseJwt,\n      })\n    : { decryptionJwk: undefined, payload: jarmAuthorizationResponseJwt };\n\n  const responseIsSigned = zCompactJwt.safeParse(\n    decryptedRequestData.payload,\n  ).success;\n\n  if (!requestDataIsEncrypted && !responseIsSigned) {\n    throw new Oauth2Error(\n      \"Jarm Auth Response must be either encrypted, signed, or signed and encrypted.\",\n    );\n  }\n\n  let jarmAuthorizationResponse:\n    | JarmAuthorizationResponse\n    | JarmAuthorizationResponseEncryptedOnly;\n\n  if (responseIsSigned) {\n    const { header: jwsProtectedHeader, payload: jwsPayload } = decodeJwt({\n      errorMessagePrefix: \"Error decoding JARM authorization response JWT:\",\n      headerSchema: z.object({ ...zJwtHeader.shape, kid: z.string() }),\n      jwt: decryptedRequestData.payload,\n    });\n\n    const response = zJarmAuthorizationResponse.parse(jwsPayload);\n    const jwtSigner = jwtSignerFromJwt({\n      header: jwsProtectedHeader,\n      payload: jwsPayload,\n    });\n\n    const verificationResult = await options.callbacks.verifyJwt(jwtSigner, {\n      compact: decryptedRequestData.payload,\n      header: jwsProtectedHeader,\n      payload: jwsPayload,\n    });\n\n    if (!verificationResult.verified) {\n      throw new Oauth2Error(\"Jarm Auth Response is not valid.\");\n    }\n\n    const expectedAudience = authorizationRequestPayload.client_id;\n    const expectedIssuer = authorizationRequestPayload.iss;\n    if (response.aud !== expectedAudience) {\n      throw new Oauth2Error(\n        `Jarm Auth Response contains 'aud' value '${response.aud}', but expected '${expectedAudience}'.`,\n      );\n    }\n\n    if (expectedIssuer && response.iss !== expectedIssuer) {\n      throw new Oauth2Error(\n        `Jarm Auth Response contains 'iss' value '${response.iss}', but expected '${expectedIssuer}'.`,\n      );\n    }\n\n    const now = options.now ?? new Date();\n    const nowSeconds = Math.floor(now.getTime() / 1000);\n    if (response.exp < nowSeconds) {\n      throw new Oauth2Error(\"Jarm Auth Response has expired.\");\n    }\n\n    if (response.nbf !== undefined && response.nbf > nowSeconds) {\n      throw new Oauth2Error(\"Jarm Auth Response is not active yet.\");\n    }\n\n    jarmAuthorizationResponse = response;\n  } else {\n    const jsonRequestData = stringToJsonWithErrorHandling(\n      decryptedRequestData.payload,\n      \"Unable to parse decrypted JARM JWE body to JSON\",\n    );\n    jarmAuthorizationResponse =\n      zJarmAuthorizationResponseEncryptedOnly.parse(jsonRequestData);\n  }\n\n  const type: JarmMode =\n    requestDataIsEncrypted && responseIsSigned\n      ? JarmMode.SignedEncrypted\n      : requestDataIsEncrypted\n        ? JarmMode.Encrypted\n        : JarmMode.Signed;\n\n  const issuer = jarmAuthorizationResponse.iss;\n\n  return {\n    decryptionJwk: decryptedRequestData.decryptionJwk,\n    issuer,\n    jarmAuthorizationResponse,\n    type,\n  };\n}\n","import { zJwtHeader, zJwtPayload } from \"@pagopa/io-wallet-oauth2\";\nimport { z } from \"zod\";\n\nexport const zJarmHeader = z.object({\n  ...zJwtHeader.shape,\n  apu: z.string().optional(),\n  apv: z.string().optional(),\n  kid: z.string(),\n});\n\nexport type JarmHeader = z.infer<typeof zJarmHeader>;\n\nexport const zEncryptedJarmHeader = z.object({\n  ...zJwtHeader.shape,\n  apu: z.string().optional(),\n  apv: z.string().optional(),\n  enc: z.string().optional(),\n  kid: z.string(),\n});\n\nexport type EncryptedJarmHeader = z.infer<typeof zEncryptedJarmHeader>;\n\nexport const zJarmAuthorizationResponse = z.looseObject({\n  /**\n   * iss: The issuer URL of the authorization server that created the response\n   * aud: The client_id of the client the response is intended for\n   * exp: The expiration time of the JWT. A maximum JWT lifetime of 10 minutes is RECOMMENDED.\n   */\n  ...zJwtPayload.shape,\n  ...zJwtPayload.pick({ aud: true, exp: true, iss: true }).required().shape,\n  state: z.optional(z.string()),\n});\n\nexport type JarmAuthorizationResponse = z.infer<\n  typeof zJarmAuthorizationResponse\n>;\n\nexport const zJarmAuthorizationResponseEncryptedOnly = z.looseObject({\n  ...zJwtPayload.shape,\n  state: z.optional(z.string()),\n});\n\nexport type JarmAuthorizationResponseEncryptedOnly = z.infer<\n  typeof zJarmAuthorizationResponseEncryptedOnly\n>;\n","export * from \"./authorization-request/create-authorization-request\";\nexport * from \"./authorization-request/fetch-authorization-request\";\nexport * from \"./authorization-request/parse-authorization-request\";\nexport * from \"./authorization-request/validate-authorization-request\";\nexport * from \"./authorization-request/validate-certificate-endpoints\";\nexport * from \"./authorization-request/z-authorization-request\";\nexport * from \"./authorization-request/z-authorization-request-url\";\nexport * from \"./authorization-response/create-authorization-response\";\nexport * from \"./authorization-response/fetch-authorization-response\";\nexport * from \"./authorization-response/parse-authorization-response\";\nexport * from \"./authorization-response/validate-authorization-response\";\nexport * from \"./authorization-response/z-authorization-response\";\nexport * from \"./errors\";\nexport * from \"./jarm/jarm-extract-jwks\";\nexport * from \"./jarm/parse-jarm-authorization-response\";\nexport * from \"./jarm/verify-jarm-authorization-response\";\nexport * from \"./jarm/z-jarm\";\nexport * from \"./vp-token/parse-vp-token\";\nexport * from \"./vp-token/z-vp-token\";\n\nexport {\n  type CreateOpenid4vpAuthorizationResponseOptions,\n  type CreateOpenid4vpAuthorizationResponseResult,\n  type VpToken,\n  createOpenid4vpAuthorizationResponse,\n} from \"@openid4vc/openid4vp\";\n"],"mappings":";AAAA;AAAA,EAOE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;;;ACfA,IAAM,cAAN,cAA0B,MAAM;AAAA,EAC5B;AAAA,EACT,YACE,SACA,SACA;AACA,UAAM,SAAS,OAAO;AACtB,SAAK,OAAO;AACZ,SAAK,aAAa,SAAS;AAAA,EAC7B;AACF;AAOO,IAAM,6BAAN,cAAyC,YAAY;AAAA,EACjD;AAAA,EACT,YACE,SACA,SACA;AACA,UAAM,SAAS,OAAO;AACtB,SAAK,OAAO;AACZ,SAAK,aAAa,SAAS;AAAA,EAC7B;AACF;AAKO,IAAM,kCAAN,cAA8C,YAAY;AAAA,EACtD;AAAA,EACT,YACE,SACA,SACA;AACA,UAAM,SAAS,OAAO;AACtB,SAAK,OAAO;AACZ,SAAK,aAAa,SAAS;AAAA,EAC7B;AACF;AAMO,IAAM,mCAAN,cAA+C,YAAY;AAAA,EACvD;AAAA,EACT,YACE,SACA,SACA;AACA,UAAM,SAAS,OAAO;AACtB,SAAK,OAAO;AACZ,SAAK,aAAa,SAAS;AAAA,EAC7B;AACF;AAMO,IAAM,+BAAN,cAA2C,YAAY;AAAA,EAC5D,YAAY,SAAiB,SAAwB;AACnD,UAAM,SAAS,OAAO;AACtB,SAAK,OAAO;AAAA,EACd;AACF;;;ACxEA;AAAA,EACE;AAAA,EAEA;AAAA,EACA;AAAA,OACK;AAQA,IAAK,iBAAL,kBAAKA,oBAAL;AACL,EAAAA,gBAAA,UAAO;AACP,EAAAA,gBAAA,uBAAoB;AACpB,EAAAA,gBAAA,eAAY;AAHF,SAAAA;AAAA,GAAA;AAgBL,SAAS,sBAAsB,UAAiC;AACrE,QAAM,aAAa,SAAS,QAAQ,GAAG;AAEvC,MAAI,eAAe,IAAI;AACrB,WAAO,EAAE,UAAU,QAAQ,kBAAoB;AAAA,EACjD;AAEA,MAAI,SAAS,WAAW,UAAU,KAAK,SAAS,WAAW,SAAS,GAAG;AACrE,WAAO,EAAE,UAAU,QAAQ,kBAAoB;AAAA,EACjD;AAEA,QAAM,YAAY,SAAS,MAAM,GAAG,UAAU;AAC9C,QAAM,OAAO,SAAS,MAAM,aAAa,CAAC;AAE1C,MAAI,cAAc,6BAA0B;AAC1C,WAAO,EAAE,UAAU,MAAM,QAAQ,4BAAyB;AAAA,EAC5D;AACA,MAAI,cAAc,6CAAkC;AAClD,WAAO,EAAE,UAAU,MAAM,QAAQ,4CAAiC;AAAA,EACpE;AAEA,QAAM,IAAI;AAAA,IACR,iCAAiC,SAAS;AAAA,EAC5C;AACF;AAEA,eAAsB,uBACpB,SACiB;AACjB,SAAO,GAAG,2BAAwB,IAAI,MAAM,6BAA6B,OAAO,CAAC;AACnF;AAEA,eAAe,6BACb,SACA;AACA,QAAM,kBAAkB,mBAAmB,QAAQ,gBAAgB;AAEnE,SAAO;AAAA,IACL,MAAM,QAAQ,KAAK,aAAa,eAAe,GAAG,cAAc,MAAM;AAAA,EACxE;AACF;AAEA,eAAsB,0CAA0C,SAIrC;AACzB,QAAM,gBAAgB,sBAAsB,QAAQ,QAAQ,SAAS;AAErE,MAAI,cAAc,WAAW,6BAA0B;AACrD,WAAO;AAAA,EACT;AAEA,QAAM,EAAE,IAAI,IAAI,QAAQ;AACxB,MAAI,CAAC,MAAM,QAAQ,GAAG,KAAK,IAAI,WAAW,GAAG;AAC3C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,QAAQ,MAAM;AACjB,WAAO;AAAA,EACT;AAEA,QAAM,0BAA0B,MAAM,6BAA6B;AAAA,IACjE,kBAAkB;AAAA,IAClB,MAAM,QAAQ;AAAA,EAChB,CAAC;AAED,MAAI,4BAA4B,cAAc,UAAU;AACtD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,mBAAmB,kBAA4B;AACtD,QAAM,kBAAkB,iBAAiB,CAAC;AAE1C,MAAI,CAAC,iBAAiB;AACpB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;;;ACrHA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,8CAA8C;AACvD,SAAS,SAAS;AAOlB,IAAM,uCACJ,uCAAuC,QAAQ;AAAA,EAC7C,kBAAkB;AAAA,EAClB,WAAW;AAAA,EACX,aAAa;AAAA,EACb,UAAU;AAAA,EACV,cAAc;AAAA,EACd,eAAe;AACjB,CAAC;AAMI,IAAM,wCAAwC,EAClD,YAAY;AAAA,EACX,WAAW,EAAE,OAAO;AAAA,EACpB,iBAAiB,qCAAqC,SAAS;AAAA,EAC/D,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,IAAI,CAAC;AAAA,EACxC,OAAO,EAAE,OAAO;AAAA,EAChB,aAAa,EAAE,IAAI,EAAE,SAAS;AAAA,EAC9B,oBAAoB,EAAE,SAAS,EAAE,OAAO,CAAC;AAAA,EACzC,eAAe,EAAE,QAAQ,iBAAiB;AAAA,EAC1C,eAAe,EAAE,QAAQ,UAAU;AAAA,EACnC,cAAc,EAAE,IAAI;AAAA,EACpB,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,kBAAkB,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1D,6BAA6B,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EAC1D,cAAc,EAAE,OAAO,EAAE,SAAS;AACpC,CAAC,EACA;AAAA,EACC,EAAE,OAAO;AAAA,IACP,GAAG,YAAY;AAAA,EACjB,CAAC;AACH;AAMF,IAAM,2CAA2C,EAAE,OAAO;AAAA,EACxD,KAAK;AAAA,EACL,KAAK,EAAE,OAAO;AAAA,EACd,KAAK;AACP,CAAC;AAEM,IAAM,2CACX,yCACG,OAAO;AAAA,EACN,aAAa;AACf,CAAC,EACA,MAAM;AAMJ,IAAM,2CACX,yCACG,OAAO;AAAA,EACN,aAAa,YAAY,SAAS;AAAA,EAClC,KAAK,kBAAkB,SAAS;AAClC,CAAC,EACA,MAAM;;;AH0DX,IAAM,qCAAqC,wBAGzC;AAAA,EACA,CAAC,qBAAqB,IAAI,GAAG,OAAO,MAClC;AAAA,IACE;AAAA,IACA;AAAA,EACF;AAAA,EACF,CAAC,qBAAqB,IAAI,GAAG,OAAO,MAClC;AAAA,IACE;AAAA,IACA;AAAA,EACF;AAAA;AAAA,EAEF,CAAC,qBAAqB,IAAI,GAAG,OAAO,MAClC;AAAA,IACE;AAAA,IACA;AAAA,EACF;AACJ,CAAC;AAwBD,eAAsB,2BACpB,SAC2C;AAC3C,MAAI;AACF,WAAO,MAAM,mCAAmC,OAAO;AAAA,EACzD,SAAS,OAAO;AACd,QAAI,iBAAiB,iBAAiB;AACpC,YAAM,IAAI,YAAY,kCAAkC,MAAM,OAAO,EAAE;AAAA,IACzE;AACA,UAAM;AAAA,EACR;AACF;AAEA,eAAe,qCACb,SACA,cAGqD;AACrD,QAAM,EAAE,WAAW,KAAK,SAAS,eAAe,IAAI;AAEpD,QAAM,6BAA6B,uBAAuB,cAAc;AAAA,IACtE,GAAG,uBAAuB,IAAI,SAAS;AAAA,IACvC,KAAK;AAAA,EACP,CAAC;AAED,QAAM,8BAA8B;AAAA,IAClC;AAAA,IACA,QAAQ;AAAA,EACV;AAEA;AAAA,IACE,QAAQ,OAAO;AAAA,IACf,IAAI;AAAA,IACJ;AAAA,EACF;AAEA,4CAA0C;AAAA,IACxC,MAAM,QAAQ,UAAU;AAAA,IACxB,QAAQ;AAAA,IACR,SAAS;AAAA,EACX,CAAC;AAED,QAAM,uBAAuB,CAAC,IAAI,sBAAsB,MACpD,EAAE,GAAG,IAAI,sBAAsB,KAAK,IAAI,WAAW,IACnD,IAAI;AAER,QAAM,YAAY,MAAM,iBAAiB;AAAA,IACvC,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,SAAO;AAAA,IACL,sBAAsB;AAAA,MACpB;AAAA,MACA,UAAU;AAAA,IACZ;AAAA,IACA,4BAA4B,UAAU;AAAA,IACtC;AAAA,IACA,KAAK,EAAE,GAAG,KAAK,GAAG,UAAU;AAAA,EAC9B;AACF;AAEA,SAAS,8BACP,QACA,SACA;AACA,QAAM,MAAM,IAAI,IAAI,MAAM;AAE1B,QAAM,eAAe,IAAI,gBAAgB;AAAA,IACvC,GAAG,IAAI,aAAa,QAAQ;AAAA,IAC5B,GAAG,oBAAoB,OAAO,EAAE,QAAQ;AAAA,EAC1C,CAAC;AAED,MAAI,SAAS,aAAa,SAAS;AAEnC,SAAO,IAAI,SAAS;AACtB;AAEA,SAAS,yCACP,cACA,WACA,SACA;AACA,MAAI,iBAAiB,qBAAqB,MAAM;AAC9C;AAAA,EACF;AAEA,QAAM,EAAE,OAAO,IAAI,sBAAsB,QAAQ,SAAS;AAE1D,MAAI,0CAAuC,UAAU,WAAW,OAAO;AACrE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,MACE,0CACA,UAAU,WAAW,cACrB;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;;;AIhSA,SAA+B,2BAA2B;AAC1D;AAAA,EACE;AAAA,EACA,mBAAAC;AAAA,EACA;AAAA,EACA;AAAA,OACK;;;ACWA,SAAS,mCACd,QACA;AAEA,MAAI,OAAO,WAAW,OAAO,aAAa;AACxC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAGA,MAAI,CAAC,OAAO,WAAW,CAAC,OAAO,aAAa;AAC1C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAGA,MAAI,OAAO,oBAAoB;AAC7B,UAAMC,oBAAmB,OAAO,mBAAmB,YAAY;AAC/D,QAAIA,sBAAqB,SAASA,sBAAqB,QAAQ;AAC7D,YAAM,IAAI;AAAA,QACR,gCAAgC,OAAO,kBAAkB;AAAA,MAC3D;AAAA,IACF;AAAA,EACF;AAGA,MAAI,OAAO,sBAAsB,CAAC,OAAO,aAAa;AACpD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAGA,QAAM,mBAAmB,OAAO,qBAC3B,OAAO,mBAAmB,YAAY,IACvC;AAEJ,SAAO;AAAA,IACL,GAAG;AAAA,IACH,oBAAoB;AAAA,EACtB;AASF;;;AC1CA,eAAsB,6BACpB,SACe;AACf,QAAM,WAAW,MAAM,QAAQ,UAAU;AAAA,IACvC,QAAQ;AAAA,EACV;AAEA,aAAW,YAAY,QAAQ,WAAW;AACxC,QAAI,CAAC,SAAS,KAAK;AACjB;AAAA,IACF;AAEA;AAAA,MACE,EAAE,MAAM,SAAS,MAAM,KAAK,SAAS,IAAI;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,gCACP,UACA,UACA;AACA,QAAM,cAAc,iBAAiB,QAAQ;AAC7C,QAAM,cAAc,SAAS,eAAe,CAAC;AAC7C,QAAM,gBAAgB,YAAY;AAAA,IAChC,CAAC,eAAe,0BAA0B,UAAU,MAAM,YAAY;AAAA,EACxE;AACA,QAAM,cAAc,SAAS,eAAe,CAAC;AAC7C,QAAM,gBAAgB,YAAY;AAAA,IAAK,CAAC,eACtC,sBAAsB,YAAY,YAAY,QAAQ;AAAA,EACxD;AAEA,MAAI,iBAAiB,eAAe;AAClC;AAAA,EACF;AAEA,QAAM,IAAI;AAAA,IACR,GAAG,SAAS,IAAI;AAAA,EAClB;AACF;AAEA,SAAS,0BAA0B,KAAa;AAC9C,MAAI;AACF,WAAO,IAAI,IAAI,GAAG,EAAE;AAAA,EACtB,SAAS,OAAO;AACd,UAAM,IAAI,YAAY,2CAA2C,GAAG,IAAI;AAAA,MACtE,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACF;AAEA,SAAS,sBAAsB,YAAoB,UAAkB;AACnE,QAAM,uBAAuB,WAAW,YAAY;AACpD,QAAM,qBAAqB,SAAS,YAAY;AAEhD,MAAI,yBAAyB,oBAAoB;AAC/C,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,qBAAqB,SAAS,GAAG,GAAG;AACvC,WAAO;AAAA,EACT;AAEA,QAAM,gBAAgB,CAAC,GAAG,oBAAoB,EAAE;AAAA,IAC9C,CAAC,cAAc,cAAc;AAAA,EAC/B,EAAE;AACF,QAAM,YAAY,qBAAqB,MAAM,GAAG;AAChD,QAAM,iBAAiB,mBAAmB,MAAM,GAAG;AAEnD,SACE,kBAAkB,KAClB,UAAU,CAAC,MAAM,OACjB,UAAU,WAAW,eAAe,UACpC,UACG,MAAM,CAAC,EACP,MAAM,CAAC,OAAO,UAAU,UAAU,eAAe,QAAQ,CAAC,CAAC;AAElE;AAEA,SAAS,iBAAiB,UAAyC;AACjE,MAAI;AACF,WAAO,IAAI,IAAI,SAAS,GAAG;AAAA,EAC7B,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR,GAAG,SAAS,IAAI,wBAAwB,SAAS,GAAG;AAAA,MACpD,EAAE,OAAO,MAAM;AAAA,IACjB;AAAA,EACF;AACF;;;ACnHA,OAAOC,QAAO;AAMP,IAAM,iCAAiCA,GAAE,YAAY;AAAA,EAC1D,WAAWA,GAAE,OAAO;AAAA,EACpB,SAASA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAC7B,aAAaA,GAAE,IAAI,EAAE,SAAS;AAAA;AAAA,EAC9B,oBAAoBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EACxC,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA;AAC7B,CAAC;;;AH8FM,SAAS,mBAAmB,qBAA2C;AAC5E,QAAM,MAAM,IAAI,IAAI,mBAAmB;AAEvC,QAAM,YAAY;AAAA,IAChB,WAAW,IAAI,aAAa,IAAI,WAAW,KAAK;AAAA,IAChD,SAAS,IAAI,aAAa,IAAI,SAAS,KAAK;AAAA,IAC5C,aAAa,IAAI,aAAa,IAAI,aAAa,KAAK;AAAA,IACpD,oBAAoB,IAAI,aAAa,IAAI,oBAAoB,KAAK;AAAA,IAClE,OAAO,IAAI,aAAa,IAAI,OAAO,KAAK;AAAA,EAC1C;AAEA,QAAM,eAAe,+BAA+B,MAAM,SAAS;AACnE,QAAM,kBAAkB,mCAAmC,YAAY;AACvE,QAAM,SAAS,gBAAgB,UAAU,UAAU;AAEnD,SAAO;AAAA,IACL,UAAU,gBAAgB;AAAA,IAC1B,SAAS,gBAAgB;AAAA,IACzB,YAAY,gBAAgB;AAAA,IAC5B,kBACE,WAAW,cACN,gBAAgB,sBAAsB,QACvC;AAAA,EACR;AACF;AAYA,eAAsB,sBACpB,YACA,SAMiB;AACjB,QAAM,QAAQ,cAAc,QAAQ,KAAK;AAGzC,QAAM,cAA2B;AAAA,IAC/B,QAAQ,QAAQ,OAAO,YAAY;AAAA,EACrC;AAGA,MAAI,QAAQ,WAAW,QAAQ;AAC7B,UAAM,WAAW,IAAI,gBAAgB;AAGrC,QAAI,QAAQ,gBAAgB;AAC1B,eAAS;AAAA,QACP;AAAA,QACA,KAAK,UAAU,QAAQ,cAAc;AAAA,MACvC;AAAA,IACF;AAGA,QAAI,QAAQ,aAAa;AACvB,eAAS,OAAO,gBAAgB,QAAQ,WAAW;AAAA,IACrD;AAEA,gBAAY,UAAU;AAAA,MACpB,gBAAgB;AAAA,IAClB;AACA,gBAAY,OAAO,SAAS,SAAS;AAAA,EACvC;AAEA,QAAM,WAAW,MAAM,MAAM,YAAY,WAAW;AAEpD,QAAM,iBAAiB,KAAK,yBAAyB,EAAE,QAAQ;AAE/D,SAAO,MAAM,SAAS,KAAK;AAC7B;AA0DA,eAAsB,0BACpB,SAC0C;AAC1C,MAAI;AACF,UAAM,eAAe,mBAAmB,QAAQ,mBAAmB;AAGnE,QAAI;AACJ,QAAI,aAAa,SAAS;AACxB,yBAAmB,aAAa;AAAA,IAClC,OAAO;AACL,UAAI,QAAQ,iBAAiB;AAC3B,cAAM,6BAA6B;AAAA,UACjC,WAAW,QAAQ,gBAAgB;AAAA,UACnC,aAAa,QAAQ,gBAAgB;AAAA,UACrC,WAAW;AAAA,YACT;AAAA,cACE,MAAM;AAAA,cACN,KAAK,aAAa;AAAA,YACpB;AAAA,UACF;AAAA,QACF,CAAC;AAAA,MACH;AAGA,yBAAmB,MAAM;AAAA,QACvB,aAAa;AAAA,QACb;AAAA,UACE,OAAO,QAAQ,UAAU;AAAA,UACzB,QAAQ,aAAa,oBAAoB;AAAA,UACzC,gBAAgB,QAAQ;AAAA,UACxB,aAAa,QAAQ;AAAA,QACvB;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,QAAQ,aAAa,UAAU,UAAU;AAAA,IAC3C;AAAA,EACF,SAAS,OAAO;AACd,QACE,iBAAiBC,oBACjB,iBAAiB,uBACjB,iBAAiB,eACjB,iBAAiB,2BACjB;AACA,YAAM;AAAA,IACR;AAEA,UAAM,IAAI;AAAA,MACR,wDAAwD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IAChH;AAAA,EACF;AACF;;;AI3SA;AAAA,EAGE,uBAAAC;AAAA,EACA;AAAA,OACK;AACP,SAAS,iBAAiB;AAC1B;AAAA,EAEE,wBAAAC;AAAA,EACA;AAAA,EACA,mBAAAC;AAAA,EACA;AAAA,OACK;AA0CP,SAAS,4BAA4B,SAGvB;AACZ,QAAM,EAAE,QAAQ,QAAQ,IAAI;AAE5B,QAAM,EAAE,QAAQ,eAAe,IAAI,sBAAsB,QAAQ,SAAS;AAE1E,MACE,kEACA,sCACA;AACA,QAAI,CAAC,OAAO,KAAK;AACf,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL,KAAK,OAAO;AAAA,MACZ,KAAK,OAAO;AAAA,MACZ,QAAQ;AAAA,MACR,GAAI,OAAO,eAAe,EAAE,YAAY,OAAO,YAAY;AAAA,IAC7D;AAAA,EACF;AAEA,MAAI,gDAA6C;AAC/C,QAAI,CAAC,MAAM,QAAQ,OAAO,GAAG,KAAK,OAAO,IAAI,WAAW,GAAG;AACzD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL,KAAK,OAAO;AAAA,MACZ,KAAK,OAAO;AAAA,MACZ,QAAQ;AAAA,MACR,GAAI,OAAO,eAAe,EAAE,YAAY,OAAO,YAAY;AAAA,MAC3D,KAAK,OAAO;AAAA,IACd;AAAA,EACF;AAEA,QAAM,IAAI;AAAA,IACR,2FACE;AAAA,EACJ;AACF;AA0DA,eAAsB,sBACpB,SACuC;AACvC,MAAI;AACF,UAAM,eAAe,kBAGnB,QAAQ,OAAO,sBAAsB;AAAA,MACrC,CAACC,sBAAqB,IAAI,GAAG,MAC3B;AAAA,MACF,CAACA,sBAAqB,IAAI,GAAG,MAC3B;AAAA,MACF,CAACA,sBAAqB,IAAI,GAAG,MAC3B;AAAA,IACJ,CAAC;AAED,UAAM,UAAU,UAAU;AAAA,MACxB,oBAAoB;AAAA,MACpB;AAAA,MACA,KAAK,QAAQ;AAAA,MACb,eAAe;AAAA,IACjB,CAAC;AAED,QAAI,QAAQ,OAAO,yBAAyBA,sBAAqB,MAAM;AACrE,YAAM,0CAA0C;AAAA,QAC9C,MAAM,QAAQ,WAAW;AAAA,QACzB,QAAQ,QAAQ;AAAA,QAChB,SAAS,QAAQ;AAAA,MACnB,CAAC;AAAA,IACH;AAEA,UAAM,MACJ,SAAS,QAAQ,UACjB,MAAM,QAAQ,QAAQ,OAAO,GAAG,KAChC,QAAQ,OAAO,IAAI,SAAS,IACvB,QAAQ,OAAO,MAChB;AAEN,QAAI,OAAO,QAAQ,WAAW,4BAA4B;AACxD,YAAM,6BAA6B;AAAA,QACjC,WAAW;AAAA,UACT,4BACE,QAAQ,UAAU;AAAA,QACtB;AAAA,QACA,aAAa,IAAI,CAAC;AAAA,QAClB,WAAW;AAAA,UACT,EAAE,MAAM,eAAe,KAAK,QAAQ,QAAQ,YAAY;AAAA,UACxD,EAAE,MAAM,gBAAgB,KAAK,QAAQ,QAAQ,aAAa;AAAA,QAC5D;AAAA,MACF,CAAC;AAAA,IACH;AAEA,QAAI,QAAQ,WAAW,WAAW;AAChC,YAAM,SAAS,4BAA4B;AAAA,QACzC,QAAQ,QAAQ;AAAA,QAChB,SAAS,QAAQ;AAAA,MACnB,CAAC;AAED,YAAM,UAAU;AAAA,QACd,SAAS,QAAQ;AAAA,QACjB,cAAc;AAAA,QACd,QAAQ,QAAQ;AAAA,QAChB,SAAS,QAAQ;AAAA,QACjB;AAAA,QACA,mBAAmB,QAAQ,UAAU;AAAA,MACvC,CAAC;AAAA,IACH;AAEA,WAAO;AAAA,MACL,QAAQ,QAAQ;AAAA,MAChB,SAAS,QAAQ;AAAA,MACjB,GAAI,OAAO;AAAA,QACT,iBAAiB;AAAA,UACf,iBAAiB,IAAI,CAAC;AAAA,UACtB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,QACE,iBAAiB,6BACjB,iBAAiBC,oBACjB,iBAAiBC,wBACjB,iBAAiB;AAEjB,YAAM;AACR,UAAM,IAAI;AAAA,MACR,mDAAmD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IAC3G;AAAA,EACF;AACF;;;ACzPA;AAAA,EACE,wBAAAC;AAAA,EACA,2BAAAC;AAAA,OACK;;;ACAP,SAAS,qBAAAC,0BAAyB;;;ACW3B,SAAS,6BACd,MACA;AAAA,EACE;AAAA,EACA;AACF,GAIA;AACA,MAAI,KAAK;AACP,WAAO,KAAK,KAAK,KAAK,CAAC,QAAQ,IAAI,QAAQ,GAAG;AAAA,EAChD;AAEA,MAAI,cAAc,KAAK,KAAK;AAAA,IAC1B,CAAC,QAAQ,IAAI,OAAO,oBAAoB,SAAS,IAAI,GAAG;AAAA,EAC1D;AACA,MAAI,YAAY,WAAW,EAAG,eAAc,KAAK;AAEjD,MAAI,cAAc,YAAY,OAAO,CAAC,QAAQ,IAAI,QAAQ,KAAK;AAC/D,MAAI,YAAY,WAAW,GAAG;AAC5B,kBAAc,YAAY,OAAO,CAAC,QAAQ,IAAI,QAAQ,KAAK;AAAA,EAC7D;AAEA,SAAO,YAAY,SAAS,IAAI,YAAY,CAAC,IAAI,KAAK,KAAK,CAAC;AAC9D;;;ADjBA,SAAS,gBACP,WACA,WACA,UACQ;AACR,MAAI,CAAC,UAAW,QAAO,aAAa;AACpC,SACE,UAAU,KAAK,CAAC,MAAM,MAAM,SAAS,KACrC,UAAU,CAAC,KACX,aACA;AAEJ;AAOA,eAAsB,kBACpB,SAC4C;AAC5C,MAAI;AACF,UAAM,gBACJ,QAAQ,wCAAwC;AAClD,UAAM,gBACJ,QAAQ,wCAAwC;AAElD,UAAM,+BAA+B;AAAA,MACnC,OAAO,QAAQ,cAAc;AAAA,MAC7B,UAAU,QAAQ;AAAA,IACpB;AAEA,UAAM,gBAAgB,6BAA6B,QAAQ,gBAAgB;AAAA,MACzE,oBAAoB,CAAC,aAAa;AAAA,IACpC,CAAC;AACD,QAAI,CAAC,eAAe;AAClB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,cAAc,KAAK;AACtB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,MAAM;AAAA,MACV,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,IACF;AAEA,UAAM,MAAM;AAEZ,UAAM,aAAa,MAAM,QAAQ,UAAU,eAAe,EAAE;AAE5D,UAAM,eAA6B;AAAA,MACjC;AAAA,MACA,KAAKC,mBAAkB,UAAU;AAAA,MACjC,KAAKA,mBAAkB,QAAQ,cAAc,KAAK;AAAA,MAClD;AAAA,MACA,KAAK,cAAc;AAAA,MACnB,QAAQ;AAAA,MACR,WAAW;AAAA,IACb;AAEA,UAAM,EAAE,eAAe,SAAS,IAAI,IAAI,MAAM,QAAQ,UAAU;AAAA,MAC9D;AAAA,MACA,KAAK,UAAU,4BAA4B;AAAA,IAC7C;AAEA,WAAO;AAAA,MACL;AAAA,MACA,MAAM;AAAA,QACJ,eAAe;AAAA,QACf,aAAa;AAAA,MACf;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,QAAI,iBAAiB,kCAAkC;AACrD,YAAM;AAAA,IACR;AACA,UAAM,IAAI;AAAA,MACR,4DAA4D,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IACpH;AAAA,EACF;AACF;;;AE5FA,eAAsB,4BACpB,SAC4C;AAC5C,QAAM,EAAE,cAAc,IAAI;AAC1B,QAAM,iBAAiB,cAAc;AACrC,QAAM,EAAE,QAAQ,eAAe,IAAI;AAAA,IACjC,cAAc;AAAA,EAChB;AAEA,MAAI,kDAA+C,CAAC,gBAAgB;AAClE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAKA,QAAM,0BACJ,iEACI,SACA;AAEN,QAAM,iBAAiB,0BACnB,wBAAwB,OACxB,QAAQ,OAAO;AAEnB,QAAM,qBACJ,yBAAyB,2CACzB,QAAQ,OAAO;AAEjB,SAAO,kBAAkB;AAAA,IACvB,sCACE,QAAQ;AAAA,IACV,sCACE,QAAQ;AAAA,IACV,WAAW,QAAQ;AAAA,IACnB;AAAA,IACA;AAAA,IACA,eAAe,QAAQ;AAAA,IACvB,UAAU,QAAQ;AAAA,EACpB,CAAC;AACH;;;ACvCA,eAAsBC,6BACpB,SAC4C;AAC5C,QAAM,EAAE,cAAc,IAAI;AAC1B,QAAM,iBAAiB,cAAc;AACrC,QAAM,EAAE,QAAQ,eAAe,IAAI;AAAA,IACjC,cAAc;AAAA,EAChB;AAEA,MAAI,kDAA+C,CAAC,gBAAgB;AAClE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,iBAAiB,gBAAgB,QAAQ,QAAQ,OAAO;AAE9D,QAAM,qBACJ,gBAAgB,2CAChB,QAAQ,OAAO;AAEjB,SAAO,kBAAkB;AAAA,IACvB,sCACE,QAAQ;AAAA,IACV,sCACE,QAAQ;AAAA,IACV,WAAW,QAAQ;AAAA,IACnB;AAAA,IACA;AAAA,IACA,eAAe,QAAQ;AAAA,IACvB,UAAU,QAAQ;AAAA,EACpB,CAAC;AACH;;;AJ9BA,IAAM,sCAAsCC,yBAG1C;AAAA,EACA,CAACC,sBAAqB,IAAI,GAAG,CAAC;AAAA;AAAA,IAEvB;AAAA,MACH;AAAA,IACF;AAAA;AAAA,EACF,CAACA,sBAAqB,IAAI,GAAG,CAAC,MACvB;AAAA,IACH;AAAA,EACF;AAAA,EACF,CAACA,sBAAqB,IAAI,GAAG,CAAC,MACvBC;AAAA,IACH;AAAA,EACF;AACJ,CAAC;AAgBD,eAAsBA,6BACpB,SAC4C;AAC5C,SAAO,oCAAoC,OAAO;AACpD;;;AK3DA;AAAA,EACE;AAAA,EACA;AAAA,EACA,6BAAAC;AAAA,EACA,mBAAAC;AAAA,EACA,iBAAAC;AAAA,EACA,oBAAAC;AAAA,EACA,0BAAAC;AAAA,OACK;;;ACTP,OAAOC,QAAO;;;ACAd,SAAS,KAAAC,UAAS;AAEX,IAAM,WAAWA,GAAE;AAAA,EACxBA,GAAE,OAAO;AAAA,EACTA,GAAE,OAAO,EAAE,GAAGA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS,CAAC;AAAA,EAC5C;AAAA,IACE,SACE;AAAA,EACJ;AACF;;;ADLO,IAAM,kCAAkCC,GAAE,OAAO;AAAA,EACtD,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,UAAU;AACZ,CAAC;AAMM,IAAM,wCAAwCA,GAAE,OAAO;AAAA,EAC5D,cAAcA,GAAE,IAAI,EAAE,SAAS;AACjC,CAAC;;;AD+CD,eAAsB,2BACpB,SAC+C;AAC/C,MAAI;AACF,QAAI,QAAQ,iBAAiB;AAC3B,YAAM,6BAA6B;AAAA,QACjC,WAAW,QAAQ,gBAAgB;AAAA,QACnC,aAAa,QAAQ,gBAAgB;AAAA,QACrC,WAAW;AAAA,UACT,EAAE,MAAM,gBAAgB,KAAK,QAAQ,wBAAwB;AAAA,QAC/D;AAAA,MACF,CAAC;AAAA,IACH;AAEA,UAAM,QAAQC,eAAc,QAAQ,UAAU,KAAK;AACnD,UAAM,8BAA8B,MAAM;AAAA,MACxC,QAAQ;AAAA,MACR;AAAA,QACE,MAAM,IAAI,gBAAgB;AAAA,UACxB,UAAU,QAAQ;AAAA,QACpB,CAAC;AAAA,QACD,SAAS;AAAA,UACP,CAAC,QAAQ,YAAY,GAAG,cAAc;AAAA,QACxC;AAAA,QACA,QAAQ;AAAA,MACV;AAAA,IACF;AAEA,UAAMC;AAAA,MACJ;AAAA,MACAC;AAAA,IACF,EAAE,2BAA2B;AAE7B,UAAM,kCACJ,MAAM,4BAA4B,KAAK;AAGzC,UAAM,oCAAoCC;AAAA,MACxC;AAAA,MACA;AAAA,IACF;AAEA,QAAI,QAAQ,iBAAiB;AAC3B,YAAM,6BAA6B;AAAA,QACjC,WAAW,QAAQ,gBAAgB;AAAA,QACnC,aAAa,QAAQ,gBAAgB;AAAA,QACrC,WAAW;AAAA,UACT;AAAA,YACE,MAAM;AAAA,YACN,KAAK,kCAAkC;AAAA,UACzC;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAEA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QACE,iBAAiBD,8BACjB,iBAAiBE,oBACjB,iBAAiB,iCACjB;AACA,YAAM;AAAA,IACR;AACA,UAAM,IAAI;AAAA,MACR,oDAAoD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IAC5G;AAAA,EACF;AACF;;;AGjIA,SAAS,0BAAAC,+BAA8B;;;ACDvC;AAAA,EAEE,mBAAAC;AAAA,EACA,eAAAC;AAAA,EACA,eAAAC;AAAA,OACK;AACP,SAAS,0BAAAC,+BAA8B;AACvC,OAAOC,QAAO;;;ACPd,SAAS,aAAa,0BAAAC,+BAA8B;AAW7C,SAAS,aAAa,SAAkB;AAC7C,SAAOC;AAAA,IACL;AAAA,IACA,YAAY,OAAO;AAAA,IACnB;AAAA,EACF;AACF;;;ACcO,SAAS,8CACd,SAC8C;AAC9C,QAAM,EAAE,6BAA6B,6BAA6B,IAAI;AAEtE,MACE,4BAA4B,UAAU,6BAA6B,OACnE;AACA,UAAM,IAAI,YAAY,kDAAkD;AAAA,EAC1E;AAEA,QAAM,gBAAgB,aAAa,6BAA6B,QAAQ;AAExE,SAAO;AAAA,IACL;AAAA,IACA,OAAO,4BAA4B;AAAA,EACrC;AACF;;;AChDA,SAAS,wBAAwB;AACjC;AAAA,EAGE;AAAA,EACA,aAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,cAAAC;AAAA,OACK;AACP,SAAS,qCAAqC;AAC9C,OAAOC,QAAO;;;ACZd,SAAS,YAAY,eAAAC,oBAAmB;AACxC,SAAS,KAAAC,UAAS;AAEX,IAAM,cAAcA,GAAE,OAAO;AAAA,EAClC,GAAG,WAAW;AAAA,EACd,KAAKA,GAAE,OAAO,EAAE,SAAS;AAAA,EACzB,KAAKA,GAAE,OAAO,EAAE,SAAS;AAAA,EACzB,KAAKA,GAAE,OAAO;AAChB,CAAC;AAIM,IAAM,uBAAuBA,GAAE,OAAO;AAAA,EAC3C,GAAG,WAAW;AAAA,EACd,KAAKA,GAAE,OAAO,EAAE,SAAS;AAAA,EACzB,KAAKA,GAAE,OAAO,EAAE,SAAS;AAAA,EACzB,KAAKA,GAAE,OAAO,EAAE,SAAS;AAAA,EACzB,KAAKA,GAAE,OAAO;AAChB,CAAC;AAIM,IAAM,6BAA6BA,GAAE,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtD,GAAGD,aAAY;AAAA,EACf,GAAGA,aAAY,KAAK,EAAE,KAAK,MAAM,KAAK,MAAM,KAAK,KAAK,CAAC,EAAE,SAAS,EAAE;AAAA,EACpE,OAAOC,GAAE,SAASA,GAAE,OAAO,CAAC;AAC9B,CAAC;AAMM,IAAM,0CAA0CA,GAAE,YAAY;AAAA,EACnE,GAAGD,aAAY;AAAA,EACf,OAAOC,GAAE,SAASA,GAAE,OAAO,CAAC;AAC9B,CAAC;;;ADbM,IAAK,WAAL,kBAAKC,cAAL;AACL,EAAAA,UAAA,eAAY;AACZ,EAAAA,UAAA,YAAS;AACT,EAAAA,UAAA,qBAAkB;AAHR,SAAAA;AAAA,GAAA;AAMZ,IAAM,sCAAsC,OAAO,YAI7C;AACJ,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AAEJ,MAAI;AACJ,QAAM,EAAE,OAAO,IAAI,gBAAgB;AAAA,IACjC,cAAc;AAAA,IACd,KAAK;AAAA,EACP,CAAC;AAED,QAAM,OAAO,4BAA4B,iBAAiB;AAE1D,MAAI,MAAM;AACR,oBAAgB,6BAA6B,MAAM,EAAE,KAAK,OAAO,IAAI,CAAC;AAAA,EACxE;AAEA,QAAM,SAAS,MAAM,UAAU,WAAW,8BAA8B;AAAA,IACtE,KAAK;AAAA,EACP,CAAC;AAED,MAAI,CAAC,OAAO,WAAW;AACrB,UAAM,IAAI,YAAY,uCAAuC;AAAA,EAC/D;AAEA,SAAO;AAAA,IACL,eAAe,OAAO;AAAA,IACtB,SAAS,OAAO;AAAA,EAClB;AACF;AAwDA,eAAsB,gCACpB,SACA;AACA,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AAEJ,QAAM,yBAAyB,YAAY;AAAA,IACzC;AAAA,EACF,EAAE;AACF,QAAM,uBAAuB,yBACzB,MAAM,oCAAoC;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,IACD,EAAE,eAAe,QAAW,SAAS,6BAA6B;AAEtE,QAAM,mBAAmB,YAAY;AAAA,IACnC,qBAAqB;AAAA,EACvB,EAAE;AAEF,MAAI,CAAC,0BAA0B,CAAC,kBAAkB;AAChD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AAIJ,MAAI,kBAAkB;AACpB,UAAM,EAAE,QAAQ,oBAAoB,SAAS,WAAW,IAAIC,WAAU;AAAA,MACpE,oBAAoB;AAAA,MACpB,cAAcC,GAAE,OAAO,EAAE,GAAGC,YAAW,OAAO,KAAKD,GAAE,OAAO,EAAE,CAAC;AAAA,MAC/D,KAAK,qBAAqB;AAAA,IAC5B,CAAC;AAED,UAAM,WAAW,2BAA2B,MAAM,UAAU;AAC5D,UAAM,YAAY,iBAAiB;AAAA,MACjC,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,UAAM,qBAAqB,MAAM,QAAQ,UAAU,UAAU,WAAW;AAAA,MACtE,SAAS,qBAAqB;AAAA,MAC9B,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,QAAI,CAAC,mBAAmB,UAAU;AAChC,YAAM,IAAI,YAAY,kCAAkC;AAAA,IAC1D;AAEA,UAAM,mBAAmB,4BAA4B;AACrD,UAAM,iBAAiB,4BAA4B;AACnD,QAAI,SAAS,QAAQ,kBAAkB;AACrC,YAAM,IAAI;AAAA,QACR,4CAA4C,SAAS,GAAG,oBAAoB,gBAAgB;AAAA,MAC9F;AAAA,IACF;AAEA,QAAI,kBAAkB,SAAS,QAAQ,gBAAgB;AACrD,YAAM,IAAI;AAAA,QACR,4CAA4C,SAAS,GAAG,oBAAoB,cAAc;AAAA,MAC5F;AAAA,IACF;AAEA,UAAM,MAAM,QAAQ,OAAO,oBAAI,KAAK;AACpC,UAAM,aAAa,KAAK,MAAM,IAAI,QAAQ,IAAI,GAAI;AAClD,QAAI,SAAS,MAAM,YAAY;AAC7B,YAAM,IAAI,YAAY,iCAAiC;AAAA,IACzD;AAEA,QAAI,SAAS,QAAQ,UAAa,SAAS,MAAM,YAAY;AAC3D,YAAM,IAAI,YAAY,uCAAuC;AAAA,IAC/D;AAEA,gCAA4B;AAAA,EAC9B,OAAO;AACL,UAAM,kBAAkB;AAAA,MACtB,qBAAqB;AAAA,MACrB;AAAA,IACF;AACA,gCACE,wCAAwC,MAAM,eAAe;AAAA,EACjE;AAEA,QAAM,OACJ,0BAA0B,mBACtB,0CACA,yBACE,8BACA;AAER,QAAM,SAAS,0BAA0B;AAEzC,SAAO;AAAA,IACL,eAAe,qBAAqB;AAAA,IACpC;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;;;AHxLA,eAAsB,+BACpB,SAC2C;AAC3C,QAAM,EAAE,6BAA6B,WAAW,iBAAiB,IAAI,IACnE;AAEF,QAAM,+BAA+BE;AAAA,IACnCC,GAAE,MAAM,CAACC,cAAaC,YAAW,CAAC;AAAA,IAClC;AAAA,IACA;AAAA,EACF;AAEA,QAAM,uBAAuB,MAAM,gCAAgC;AAAA,IACjE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,EAAE,QAAQ,WAAW,IAAIC,iBAAgB;AAAA,IAC7C,cAAc;AAAA,IACd,KAAK;AAAA,EACP,CAAC;AAED,QAAM,+BAA+BJ;AAAA,IACnC;AAAA,IACA,qBAAqB;AAAA,IACrB;AAAA,EACF;AAEA,QAAM,4BACJ,8CAA8C;AAAA,IAC5C;AAAA,IACA;AAAA,EACF,CAAC;AAEH,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,eAAe,4BAA4B;AAAA,IAC3C,MAAM,EAAE,GAAG,sBAAsB,WAAW;AAAA,EAC9C;AACF;;;ADpCA,eAAsB,2BACpB,SAC2C;AAC3C,QAAM,EAAE,6BAA6B,uBAAuB,UAAU,IACpE;AAEF,MAAI,sBAAsB,UAAU;AAClC,QAAI,OAAO,sBAAsB,aAAa,UAAU;AACtD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,WAAO,+BAA+B;AAAA,MACpC;AAAA,MACA;AAAA,MACA,iBAAiB,sBAAsB;AAAA,IACzC,CAAC;AAAA,EACH;AAEA,QAAM,+BAA+BK;AAAA,IACnC;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,QAAM,6BACJ,8CAA8C;AAAA,IAC5C;AAAA,IACA;AAAA,EACF,CAAC;AAEH,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,eAAe,4BAA4B;AAAA,EAC7C;AACF;;;AMrEA;AAAA,EAIE;AAAA,OACK;","names":["ClientIdPrefix","ValidationError","normalizedMethod","z","ValidationError","Oauth2JwtParseError","ItWalletSpecsVersion","ValidationError","ItWalletSpecsVersion","ValidationError","Oauth2JwtParseError","ItWalletSpecsVersion","createVersionDispatcher","encodeToBase64Url","encodeToBase64Url","createAuthorizationResponse","createVersionDispatcher","ItWalletSpecsVersion","createAuthorizationResponse","UnexpectedStatusCodeError","ValidationError","createFetcher","hasStatusOrThrow","parseWithErrorHandling","z","z","z","createFetcher","hasStatusOrThrow","UnexpectedStatusCodeError","parseWithErrorHandling","ValidationError","parseWithErrorHandling","decodeJwtHeader","zCompactJwe","zCompactJwt","parseWithErrorHandling","z","parseWithErrorHandling","parseWithErrorHandling","decodeJwt","zJwtHeader","z","zJwtPayload","z","JarmMode","decodeJwt","z","zJwtHeader","parseWithErrorHandling","z","zCompactJwt","zCompactJwe","decodeJwtHeader","parseWithErrorHandling"]}
+{"version":3,"sources":["../src/authorization-request/create-authorization-request.ts","../src/errors.ts","../src/authorization-request/client-id-prefix.ts","../src/authorization-request/z-authorization-request.ts","../src/authorization-request/fetch-authorization-request.ts","../src/authorization-request/validate-authorization-request.ts","../src/authorization-request/validate-certificate-endpoints.ts","../src/authorization-request/z-authorization-request-url.ts","../src/authorization-request/parse-authorization-request.ts","../src/authorization-response/create-authorization-response.ts","../src/authorization-response/build-jarm-response.ts","../src/jarm/jarm-extract-jwks.ts","../src/authorization-response/v1.3/create-authorization-response.ts","../src/authorization-response/v1.4/create-authorization-response.ts","../src/authorization-response/fetch-authorization-response.ts","../src/authorization-response/z-authorization-response.ts","../src/vp-token/z-vp-token.ts","../src/authorization-response/parse-authorization-response.ts","../src/jarm/parse-jarm-authorization-response.ts","../src/vp-token/parse-vp-token.ts","../src/authorization-response/validate-authorization-response.ts","../src/jarm/verify-jarm-authorization-response.ts","../src/jarm/z-jarm.ts","../src/index.ts"],"sourcesContent":["import {\n  type CallbackContext,\n  type CreateJarRequestOptions,\n  CreateJarRequestResult,\n  JarAuthorizationRequest,\n  JwtSignerFederation,\n  JwtSignerX5c,\n  createJarRequest,\n  jwtHeaderFromJwtSigner,\n  signedAuthorizationRequestJwtHeaderTyp,\n} from \"@pagopa/io-wallet-oauth2\";\nimport {\n  IoWalletSdkConfig,\n  ItWalletSpecsVersion,\n  ValidationError,\n  createVersionDispatcher,\n  objectToQueryParams,\n  parseWithErrorHandling,\n} from \"@pagopa/io-wallet-utils\";\n\nimport { Oid4vpError } from \"../errors\";\nimport {\n  ClientIdPrefix,\n  extractClientIdPrefix,\n  validateAuthorizationRequestClientBinding,\n} from \"./client-id-prefix\";\nimport {\n  Openid4vpAuthorizationRequestPayload,\n  zOpenid4vpAuthorizationRequestHeaderV1_0,\n  zOpenid4vpAuthorizationRequestHeaderV1_3,\n  zOpenid4vpAuthorizationRequestPayload,\n} from \"./z-authorization-request\";\n\ntype BaseJarOptions<TSigner extends JwtSignerFederation | JwtSignerX5c> = {\n  jwtSigner: TSigner;\n} & Pick<\n  CreateJarRequestOptions,\n  \"additionalJwtPayload\" | \"expiresInSeconds\" | \"now\" | \"requestUri\"\n>;\n\nexport type JarOptionsV1_0 = BaseJarOptions<JwtSignerFederation>;\n\nexport type JarOptionsV1_3 = BaseJarOptions<JwtSignerFederation | JwtSignerX5c>;\n\nexport type JarOptionsV1_4 = JarOptionsV1_3;\n\ntype JarOptions = JarOptionsV1_0 | JarOptionsV1_3 | JarOptionsV1_4;\n\ninterface BaseCreateAuthorizationRequestOptions<\n  V extends ItWalletSpecsVersion,\n  TJar extends JarOptions,\n> {\n  /**\n   * Authorization request payload to be validated and serialized.\n   */\n  authorizationRequestPayload: Openid4vpAuthorizationRequestPayload;\n\n  /**\n   * Required callbacks used to create a signed/encrypted Request Object.\n   */\n  callbacks: Partial<Pick<CallbackContext, \"encryptJwe\">> &\n    Partial<Pick<CallbackContext, \"hash\">> &\n    Pick<CallbackContext, \"signJwt\">;\n\n  config: IoWalletSdkConfig<V>;\n\n  /**\n   * The request is generated as a JAR authorization request.\n   * When `additionalJwtPayload.aud` is missing, it is set to `requestUri`.\n   */\n  jar: TJar;\n\n  /**\n   * Authorization request URL scheme.\n   * @default \"openid4vp://\"\n   */\n  scheme?: string;\n}\n\n/**\n * Options for creating an OpenID4VP authorization request URL.\n */\nexport type CreateAuthorizationRequestOptionsV1_0 =\n  BaseCreateAuthorizationRequestOptions<\n    ItWalletSpecsVersion.V1_0,\n    JarOptionsV1_0\n  >;\n\nexport type CreateAuthorizationRequestOptionsV1_3 =\n  BaseCreateAuthorizationRequestOptions<\n    ItWalletSpecsVersion.V1_3,\n    JarOptionsV1_3\n  >;\n\nexport type CreateAuthorizationRequestOptionsV1_4 =\n  BaseCreateAuthorizationRequestOptions<\n    ItWalletSpecsVersion.V1_4,\n    JarOptionsV1_4\n  >;\n\nexport type CreateAuthorizationRequestOptions =\n  | CreateAuthorizationRequestOptionsV1_0\n  | CreateAuthorizationRequestOptionsV1_3\n  | CreateAuthorizationRequestOptionsV1_4;\n\ninterface BaseCreateAuthorizationRequestResult<TJar extends JarOptions> {\n  authorizationRequest: string;\n  authorizationRequestObject: JarAuthorizationRequest;\n  authorizationRequestPayload: Openid4vpAuthorizationRequestPayload;\n  jar: CreateJarRequestResult & TJar;\n}\n\nexport type CreateAuthorizationRequestResultV1_0 =\n  BaseCreateAuthorizationRequestResult<JarOptionsV1_0>;\n\nexport type CreateAuthorizationRequestResultV1_3 =\n  BaseCreateAuthorizationRequestResult<JarOptionsV1_3>;\n\nexport type CreateAuthorizationRequestResultV1_4 =\n  BaseCreateAuthorizationRequestResult<JarOptionsV1_4>;\n\nexport type CreateAuthorizationRequestResult =\n  | CreateAuthorizationRequestResultV1_0\n  | CreateAuthorizationRequestResultV1_3\n  | CreateAuthorizationRequestResultV1_4;\n\n/**\n * Creates an OpenID4VP authorization request URL.\n *\n * This function creates a JAR request object through\n * `createJarRequest` and serializes it into the URL query parameters.\n *\n * @param options {@link CreateAuthorizationRequestOptions}\n * @returns Authorization request URL plus request object details used to build it\n * @throws When authorization request payload validation fails\n * @throws When JAR creation fails\n */\nconst dispatchCreateAuthorizationRequest = createVersionDispatcher<\n  CreateAuthorizationRequestOptions,\n  Promise<CreateAuthorizationRequestResult>\n>({\n  [ItWalletSpecsVersion.V1_0]: async (o) =>\n    createAuthorizationRequestWithHeader(\n      o as CreateAuthorizationRequestOptionsV1_0,\n      zOpenid4vpAuthorizationRequestHeaderV1_0,\n    ),\n  [ItWalletSpecsVersion.V1_3]: async (o) =>\n    createAuthorizationRequestWithHeader(\n      o as CreateAuthorizationRequestOptionsV1_3,\n      zOpenid4vpAuthorizationRequestHeaderV1_3,\n    ),\n  // V1_4 reuses the V1_3 JAR header schema; the conditional x5c rule is a normative 1.4.4 LTS backport.\n  [ItWalletSpecsVersion.V1_4]: async (o) =>\n    createAuthorizationRequestWithHeader(\n      o as CreateAuthorizationRequestOptionsV1_4,\n      zOpenid4vpAuthorizationRequestHeaderV1_3,\n    ),\n});\n\n/**\n * Creates an OpenID4VP authorization request URL for the configured IT-Wallet version.\n *\n * This function creates a JAR request object through `createJarRequest` and\n * serializes it into authorization request URL query parameters.\n *\n * @param options - Version-specific authorization request creation options.\n * @returns Authorization request URL plus request object details used to build it.\n * @throws {Oid4vpError} If authorization request payload validation fails.\n */\nexport async function createAuthorizationRequest(\n  options: CreateAuthorizationRequestOptionsV1_0,\n): Promise<CreateAuthorizationRequestResultV1_0>;\n\nexport async function createAuthorizationRequest(\n  options: CreateAuthorizationRequestOptionsV1_3,\n): Promise<CreateAuthorizationRequestResultV1_3>;\n\nexport async function createAuthorizationRequest(\n  options: CreateAuthorizationRequestOptionsV1_4,\n): Promise<CreateAuthorizationRequestResultV1_4>;\n\nexport async function createAuthorizationRequest(\n  options: CreateAuthorizationRequestOptions,\n): Promise<CreateAuthorizationRequestResult> {\n  try {\n    return await dispatchCreateAuthorizationRequest(options);\n  } catch (error) {\n    if (error instanceof ValidationError) {\n      throw new Oid4vpError(`Invalid authorization request: ${error.message}`);\n    }\n    throw error;\n  }\n}\n\nasync function createAuthorizationRequestWithHeader<TJar extends JarOptions>(\n  options: BaseCreateAuthorizationRequestOptions<ItWalletSpecsVersion, TJar>,\n  headerSchema:\n    | typeof zOpenid4vpAuthorizationRequestHeaderV1_0\n    | typeof zOpenid4vpAuthorizationRequestHeaderV1_3,\n): Promise<BaseCreateAuthorizationRequestResult<TJar>> {\n  const { callbacks, jar, scheme = \"openid4vp://\" } = options;\n\n  const authorizationRequestHeader = parseWithErrorHandling(headerSchema, {\n    ...jwtHeaderFromJwtSigner(jar.jwtSigner),\n    typ: signedAuthorizationRequestJwtHeaderTyp,\n  });\n\n  const authorizationRequestPayload = parseWithErrorHandling(\n    zOpenid4vpAuthorizationRequestPayload,\n    options.authorizationRequestPayload,\n  );\n\n  validateJarSignerForAuthorizationRequest(\n    options.config.itWalletSpecsVersion,\n    jar.jwtSigner,\n    authorizationRequestPayload,\n  );\n\n  validateAuthorizationRequestClientBinding({\n    hash: options.callbacks.hash,\n    header: authorizationRequestHeader,\n    payload: authorizationRequestPayload,\n  });\n\n  const additionalJwtPayload = !jar.additionalJwtPayload?.aud\n    ? { ...jar.additionalJwtPayload, aud: jar.requestUri }\n    : jar.additionalJwtPayload;\n\n  const jarResult = await createJarRequest({\n    ...jar,\n    additionalJwtPayload,\n    authorizationRequestHeader,\n    authorizationRequestPayload,\n    callbacks,\n  });\n\n  return {\n    authorizationRequest: createAuthorizationRequestUrl(\n      scheme,\n      jarResult.jarAuthorizationRequest,\n    ),\n    authorizationRequestObject: jarResult.jarAuthorizationRequest,\n    authorizationRequestPayload,\n    jar: { ...jar, ...jarResult },\n  };\n}\n\nfunction createAuthorizationRequestUrl(\n  scheme: string,\n  request: JarAuthorizationRequest,\n) {\n  const url = new URL(scheme);\n\n  const searchParams = new URLSearchParams([\n    ...url.searchParams.entries(),\n    ...objectToQueryParams(request).entries(),\n  ]);\n\n  url.search = searchParams.toString();\n\n  return url.toString();\n}\n\nfunction validateJarSignerForAuthorizationRequest(\n  specsVersion: ItWalletSpecsVersion,\n  jwtSigner: JwtSignerFederation | JwtSignerX5c,\n  payload: Openid4vpAuthorizationRequestPayload,\n) {\n  if (specsVersion === ItWalletSpecsVersion.V1_0) {\n    return;\n  }\n\n  const { prefix } = extractClientIdPrefix(payload.client_id);\n\n  if (prefix === ClientIdPrefix.X509_HASH && jwtSigner.method !== \"x5c\") {\n    throw new Oid4vpError(\n      \"x509_hash client_id requires a JAR signer with method x5c\",\n    );\n  }\n\n  if (\n    prefix !== ClientIdPrefix.X509_HASH &&\n    jwtSigner.method !== \"federation\"\n  ) {\n    throw new Oid4vpError(\n      \"openid_federation and legacy client_id values require a JAR signer with method federation\",\n    );\n  }\n}\n","/**\n * Generic error thrown during Oid4vp operations\n */\nexport class Oid4vpError extends Error {\n  readonly statusCode?: number;\n  constructor(\n    message: string,\n    options?: { statusCode?: number } & ErrorOptions,\n  ) {\n    super(message, options);\n    this.name = \"Oid4vpError\";\n    this.statusCode = options?.statusCode;\n  }\n}\n\n/**\n * Error thrown by {@link parseAuthorizeRequest} when the passed\n * request object has an invalid signature or unexpected errors\n * are thrown\n */\nexport class ParseAuthorizeRequestError extends Oid4vpError {\n  readonly statusCode?: number;\n  constructor(\n    message: string,\n    options?: { statusCode?: number } & ErrorOptions,\n  ) {\n    super(message, options);\n    this.name = \"ParseAuthorizeRequestError\";\n    this.statusCode = options?.statusCode;\n  }\n}\n\n/**\n * Error thrown by {@link fetchAuthorizationResponse}\n */\nexport class FetchAuthorizationResponseError extends Oid4vpError {\n  readonly statusCode?: number;\n  constructor(\n    message: string,\n    options?: { statusCode?: number } & ErrorOptions,\n  ) {\n    super(message, options);\n    this.name = \"FetchAuthorizationResponseError\";\n    this.statusCode = options?.statusCode;\n  }\n}\n\n/**\n * Error thrown by {@link createAuthorizationResponse} in case there\n * are unexpected errors.\n */\nexport class CreateAuthorizationResponseError extends Oid4vpError {\n  readonly statusCode?: number;\n  constructor(\n    message: string,\n    options?: { statusCode?: number } & ErrorOptions,\n  ) {\n    super(message, options);\n    this.name = \"CreateAuthorizationResponseError\";\n    this.statusCode = options?.statusCode;\n  }\n}\n\n/**\n * Error thrown when request_uri_method parameter has an invalid value.\n * Valid values are \"get\" or \"post\" (case-insensitive).\n */\nexport class InvalidRequestUriMethodError extends Oid4vpError {\n  constructor(message: string, options?: ErrorOptions) {\n    super(message, options);\n    this.name = \"InvalidRequestUriMethodError\";\n  }\n}\n","import {\n  HashAlgorithm,\n  type HashCallback,\n  decodeBase64,\n  encodeToBase64Url,\n} from \"@pagopa/io-wallet-utils\";\n\nimport { Oid4vpError, ParseAuthorizeRequestError } from \"../errors\";\nimport {\n  Openid4vpAuthorizationRequestHeaderV1_3,\n  Openid4vpAuthorizationRequestPayload,\n} from \"./z-authorization-request\";\n\nexport enum ClientIdPrefix {\n  NONE = \"none\",\n  OPENID_FEDERATION = \"openid_federation\",\n  X509_HASH = \"x509_hash\",\n}\n\nexport interface ClientIdParts {\n  clientId: string;\n  prefix: ClientIdPrefix;\n}\n\nexport interface CreateX509HashClientIdOptions {\n  certificateChain: string[];\n  hash: HashCallback;\n}\n\nexport function extractClientIdPrefix(clientId: string): ClientIdParts {\n  const colonIndex = clientId.indexOf(\":\");\n\n  if (colonIndex === -1) {\n    return { clientId, prefix: ClientIdPrefix.NONE };\n  }\n\n  if (clientId.startsWith(\"https://\") || clientId.startsWith(\"http://\")) {\n    return { clientId, prefix: ClientIdPrefix.NONE };\n  }\n\n  const rawPrefix = clientId.slice(0, colonIndex);\n  const rest = clientId.slice(colonIndex + 1);\n\n  if (rawPrefix === ClientIdPrefix.X509_HASH) {\n    return { clientId: rest, prefix: ClientIdPrefix.X509_HASH };\n  }\n  if (rawPrefix === ClientIdPrefix.OPENID_FEDERATION) {\n    return { clientId: rest, prefix: ClientIdPrefix.OPENID_FEDERATION };\n  }\n\n  throw new Oid4vpError(\n    `Unsupported client_id prefix \"${rawPrefix}\": only \"openid_federation\" and \"x509_hash\" are allowed by the IT-Wallet profile`,\n  );\n}\n\nexport async function createX509HashClientId(\n  options: CreateX509HashClientIdOptions,\n): Promise<string> {\n  return `${ClientIdPrefix.X509_HASH}:${await calculateX509CertificateHash(options)}`;\n}\n\nasync function calculateX509CertificateHash(\n  options: CreateX509HashClientIdOptions,\n) {\n  const leafCertificate = getLeafCertificate(options.certificateChain);\n\n  return encodeToBase64Url(\n    await options.hash(decodeBase64(leafCertificate), HashAlgorithm.Sha256),\n  );\n}\n\nexport async function validateAuthorizationRequestClientBinding(options: {\n  hash?: HashCallback;\n  header: Openid4vpAuthorizationRequestHeaderV1_3;\n  payload: Openid4vpAuthorizationRequestPayload;\n}): Promise<ClientIdParts> {\n  const clientIdParts = extractClientIdPrefix(options.payload.client_id);\n\n  if (clientIdParts.prefix !== ClientIdPrefix.X509_HASH) {\n    return clientIdParts;\n  }\n\n  const { x5c } = options.header;\n  if (!Array.isArray(x5c) || x5c.length === 0) {\n    throw new ParseAuthorizeRequestError(\n      \"x5c is required in JWT header for x509_hash client_id\",\n    );\n  }\n\n  if (!options.hash) {\n    return clientIdParts;\n  }\n\n  const expectedCertificateHash = await calculateX509CertificateHash({\n    certificateChain: x5c,\n    hash: options.hash,\n  });\n\n  if (expectedCertificateHash !== clientIdParts.clientId) {\n    throw new ParseAuthorizeRequestError(\n      \"x509_hash client_id does not match the JWT header leaf certificate\",\n    );\n  }\n\n  return clientIdParts;\n}\n\nfunction getLeafCertificate(certificateChain: string[]) {\n  const leafCertificate = certificateChain[0];\n\n  if (!leafCertificate) {\n    throw new ParseAuthorizeRequestError(\n      \"Certificate chain is empty, cannot validate x509_hash\",\n    );\n  }\n\n  return leafCertificate;\n}\n","import {\n  zAlgValueNotNone,\n  zCertificateChain,\n  zJwtPayload,\n  zSignedAuthorizationRequestJwtHeaderTyp,\n  zTrustChain,\n} from \"@pagopa/io-wallet-oauth2\";\nimport { itWalletCredentialVerifierMetadataV1_3 } from \"@pagopa/io-wallet-oid-federation\";\nimport { z } from \"zod\";\n\n/**\n * This schema is a less strict version of {@link itWalletCredentialVerifierMetadataV1_3} because\n * only a subset of the Credential Verifier metadata fields are required in the Request Object.\n * @see https://italia.github.io/eid-wallet-it-docs/releases/1.3.3/en/remote-flow.html#request-object\n */\nconst zOpenid4vpCredentialVerifierMetadata =\n  itWalletCredentialVerifierMetadataV1_3.partial({\n    application_type: true,\n    client_id: true,\n    client_name: true,\n    logo_uri: true,\n    request_uris: true,\n    response_uris: true,\n  });\n\n/**\n * Zod parser that describes a JWT payload\n * containing an OID4VP Request Object\n */\nexport const zOpenid4vpAuthorizationRequestPayload = z\n  .looseObject({\n    client_id: z.string(),\n    client_metadata: zOpenid4vpCredentialVerifierMetadata.optional(),\n    dcql_query: z.record(z.string(), z.any()),\n    nonce: z.string(),\n    request_uri: z.url().optional(),\n    request_uri_method: z.optional(z.string()),\n    response_mode: z.literal(\"direct_post.jwt\"),\n    response_type: z.literal(\"vp_token\"),\n    response_uri: z.url(),\n    scope: z.string().optional(),\n    state: z.string().optional(),\n    transaction_data: z.array(z.string()).nonempty().optional(),\n    transaction_data_hashes_alg: z.array(z.string()).optional(),\n    wallet_nonce: z.string().optional(),\n  })\n  .and(\n    z.object({\n      ...zJwtPayload.shape,\n    }),\n  );\n\nexport type Openid4vpAuthorizationRequestPayload = z.infer<\n  typeof zOpenid4vpAuthorizationRequestPayload\n>;\n\nconst zOpenid4vpAuthorizationRequestHeaderBase = z.object({\n  alg: zAlgValueNotNone,\n  kid: z.string(),\n  typ: zSignedAuthorizationRequestJwtHeaderTyp,\n});\n\nexport const zOpenid4vpAuthorizationRequestHeaderV1_0 =\n  zOpenid4vpAuthorizationRequestHeaderBase\n    .extend({\n      trust_chain: zTrustChain,\n    })\n    .loose();\n\nexport type Openid4vpAuthorizationRequestHeaderV1_0 = z.infer<\n  typeof zOpenid4vpAuthorizationRequestHeaderV1_0\n>;\n\nexport const zOpenid4vpAuthorizationRequestHeaderV1_3 =\n  zOpenid4vpAuthorizationRequestHeaderBase\n    .extend({\n      // kid is only mandatory for openid_federation/legacy; x509_hash RPs use x5c instead (see getPublicKeyForVerification).\n      kid: z.string().optional(),\n      trust_chain: zTrustChain.optional(),\n      x5c: zCertificateChain.optional(),\n    })\n    .loose();\n\nexport type Openid4vpAuthorizationRequestHeaderV1_3 = z.infer<\n  typeof zOpenid4vpAuthorizationRequestHeaderV1_3\n>;\n\nexport type Openid4vpAuthorizationRequestHeader =\n  | Openid4vpAuthorizationRequestHeaderV1_0\n  | Openid4vpAuthorizationRequestHeaderV1_3;\n","import { type CallbackContext, Oauth2JwtParseError } from \"@openid4vc/oauth2\";\nimport {\n  UnexpectedStatusCodeError,\n  ValidationError,\n  createFetcher,\n  hasStatusOrThrow,\n} from \"@pagopa/io-wallet-utils\";\n\nimport { Oid4vpError } from \"../errors\";\nimport { validateAuthorizationRequestParams } from \"./validate-authorization-request\";\nimport {\n  X509CertificateBinding,\n  validateCertificateEndpoints,\n} from \"./validate-certificate-endpoints\";\nimport { zAuthorizationRequestUrlParams } from \"./z-authorization-request-url\";\n\nexport interface FetchAuthorizationRequestOptions {\n  /**\n   * The authorization URL from the QR code\n   * Should contain `client_id` and either `request` or `request_uri` query parameters\n   */\n  authorizeRequestUrl: string;\n\n  /**\n   * Callback functions for making HTTP requests\n   * Allows for custom fetch implementation\n   */\n  callbacks: Pick<CallbackContext, \"fetch\">;\n\n  /**\n   * Optional wallet metadata to send when request_uri_method=post.\n   * If not provided and POST is required, sends an empty body (basic implementation).\n   *\n   * Specification: IT-Wallet v1.3.3 recommends (SHOULD) sending wallet capabilities\n   * in application/x-www-form-urlencoded format when using POST.\n   */\n  walletMetadata?: {\n    authorization_endpoint?: string;\n    client_id_prefixes_supported?: string[];\n    request_object_signing_alg_values_supported?: string[];\n    response_modes_supported?: string[];\n    response_types_supported?: string[];\n    vp_formats_supported?: Record<string, unknown>;\n  };\n\n  /**\n   * Optional wallet nonce for replay attack prevention (RECOMMENDED per spec)\n   */\n  walletNonce?: string;\n\n  /**\n   * Optional RP certificate context used to bind `request_uri` to the certificate SAN entries.\n   */\n  x509Certificate?: {\n    binding: X509CertificateBinding;\n    leafCertificate: string;\n  };\n}\n\nexport interface ParsedQrCode {\n  /**\n   * The `client_id` from the authorization URL\n   */\n  clientId: string;\n\n  /**\n   * It contains the base64url-encoded and signed Request Object. For the content of the Request Object, see {@link Openid4vpAuthorizationRequestPayload}.\n   */\n  request?: string;\n  /**\n   * The `request_uri` from the authorization URL\n   */\n  requestUri?: string;\n  /**\n   * The `request_uri_method` from the authorization URL (get or post)\n   */\n  requestUriMethod?: \"get\" | \"post\";\n}\n\nexport interface FetchAuthorizationRequestResult {\n  /**\n   * The parsed QR code data\n   * Includes `clientId`, `requestUri` and `requestUriMethod`\n   */\n  parsedQrCode: ParsedQrCode;\n\n  /**\n   * The original Request Object JWT, either fetched from `request_uri` or extracted from `request` parameter.\n   */\n  requestObjectJwt: string;\n\n  /**\n   * Transmission mode indicator\n   * - \"value\": Request Object JWT passed inline via `request` parameter\n   * - \"reference\": Request Object JWT fetched from `request_uri`\n   */\n  sendBy: \"reference\" | \"value\";\n}\n\n/**\n * Parses an authorization request URL and builds a {@link ParsedQrCode} object.\n *\n * @param authorizeRequestUrl - The authorization URL extracted from the QR code\n * @returns The parsed QR code data including `clientId`, `requestUri`, and `requestUriMethod`\n * @throws {ValidationError} If URL parameters fail schema validation or business logic checks\n */\nexport function createParsedQrCode(authorizeRequestUrl: string): ParsedQrCode {\n  const url = new URL(authorizeRequestUrl);\n\n  const rawParams = {\n    client_id: url.searchParams.get(\"client_id\") ?? undefined,\n    request: url.searchParams.get(\"request\") ?? undefined,\n    request_uri: url.searchParams.get(\"request_uri\") ?? undefined,\n    request_uri_method: url.searchParams.get(\"request_uri_method\") ?? undefined,\n    state: url.searchParams.get(\"state\") ?? undefined,\n  };\n\n  const parsedParams = zAuthorizationRequestUrlParams.parse(rawParams);\n  const validatedParams = validateAuthorizationRequestParams(parsedParams);\n  const sendBy = validatedParams.request ? \"value\" : \"reference\";\n\n  return {\n    clientId: validatedParams.client_id,\n    request: validatedParams.request,\n    requestUri: validatedParams.request_uri,\n    requestUriMethod:\n      sendBy === \"reference\"\n        ? (validatedParams.request_uri_method ?? \"get\")\n        : undefined,\n  };\n}\n\n/**\n * Helper function to fetch Request Object JWT from request_uri.\n * Supports GET and POST methods, with optional wallet metadata for POST.\n *\n * @param requestUri - URI to fetch Request Object from\n * @param options - Fetch options including method and wallet metadata\n * @returns The Request Object JWT as a string\n * @throws {UnexpectedStatusCodeError} If the server returns a non-200 status code\n * @throws {Error} If the underlying fetch/createFetcher call fails (for example, due to network errors)\n */\nexport async function fetchRequestObjectJwt(\n  requestUri: string,\n  options: {\n    fetch: CallbackContext[\"fetch\"];\n    method: \"get\" | \"post\";\n    walletMetadata?: FetchAuthorizationRequestOptions[\"walletMetadata\"];\n    walletNonce?: string;\n  },\n): Promise<string> {\n  const fetch = createFetcher(options.fetch);\n\n  // Prepare request configuration\n  const requestInit: RequestInit = {\n    method: options.method.toUpperCase(),\n  };\n\n  // Add body for POST requests per IT-Wallet spec (SHOULD include metadata)\n  if (options.method === \"post\") {\n    const formData = new URLSearchParams();\n\n    // Add wallet_metadata if provided (spec: OPTIONAL)\n    if (options.walletMetadata) {\n      formData.append(\n        \"wallet_metadata\",\n        JSON.stringify(options.walletMetadata),\n      );\n    }\n\n    // Add wallet_nonce if provided (spec: RECOMMENDED)\n    if (options.walletNonce) {\n      formData.append(\"wallet_nonce\", options.walletNonce);\n    }\n\n    requestInit.headers = {\n      \"Content-Type\": \"application/x-www-form-urlencoded\",\n    };\n    requestInit.body = formData.toString();\n  }\n\n  const response = await fetch(requestUri, requestInit);\n\n  await hasStatusOrThrow(200, UnexpectedStatusCodeError)(response);\n\n  return await response.text();\n}\n\n/**\n * Fetches an OpenID4VP authorization request JWT from a QR code URL.\n *\n * Supports two transmission modes:\n * - **By Value**: Request Object JWT passed inline via `request` parameter\n * - **By Reference**: Request Object JWT fetched from `request_uri`\n *\n * The function:\n * 1. Parses the authorization URL to extract parameters\n * 2. Validates that exactly one of `request` or `request_uri` is present\n * 3. Either uses inline JWT or fetches from URI (GET/POST based on request_uri_method)\n * 4. Returns the Request Object JWT along with transmission mode metadata\n *\n * Note: This function does NOT parse or verify the JWT. Use {@link parseAuthorizeRequest}\n * separately to decode and optionally verify the signature.\n *\n * @param options {@link FetchAuthorizationRequestOptions}\n * @returns Promise that resolves to {@link FetchAuthorizationRequestResult}\n * @throws {Oid4vpError} When required query parameters are missing, the URL is invalid, or an unexpected error occurs during fetch or parsing\n * @throws {UnexpectedStatusCodeError} When the server returns a non-200 status code during fetch\n * @throws {ValidationError} When URL parameters fail schema validation\n *\n * @example By Value mode\n * ```typescript\n * const url = \"[https://wallet.example.org/authorize](https://wallet.example.org/authorize)?\" +\n *   \"client_id=openid_federation%23https%3A%2F%2Frp.example.org\" +\n *   \"&request=eyJhbGciOiJFUzI1NiIs...\";\n *\n * const result = await fetchAuthorizationRequest({\n *   authorizeRequestUrl: url,\n *   callbacks: { fetch },\n * });\n * // result.sendBy === \"value\"\n * // result.requestObjectJwt === \"eyJhbGciOiJFUzI1NiIs...\"\n * ```\n *\n * @example By Reference mode with POST\n * ```typescript\n * const url = \"[https://wallet.example.org/authorize](https://wallet.example.org/authorize)?\" +\n *   \"client_id=openid_federation%23https%3A%2F%2Frp.example.org\" +\n *   \"&request_uri=https%3A%2F%2Frp.example.org%2Frequest\" +\n *   \"&request_uri_method=post\";\n *\n * const result = await fetchAuthorizationRequest({\n *   authorizeRequestUrl: url,\n *   callbacks: { fetch },\n *   walletMetadata: {\n *     authorization_endpoint: \"[https://wallet.example.org/authorize](https://wallet.example.org/authorize)\",\n *     response_types_supported: [\"vp_token\"],\n *   },\n *   walletNonce: \"random-nonce\",\n * });\n * // result.sendBy === \"reference\"\n * // result.requestObjectJwt === fetched JWT from request_uri\n * ```\n */\nexport async function fetchAuthorizationRequest(\n  options: FetchAuthorizationRequestOptions,\n): Promise<FetchAuthorizationRequestResult> {\n  try {\n    const parsedQrCode = createParsedQrCode(options.authorizeRequestUrl);\n\n    // Get JWT: either inline or fetch from URI\n    let requestObjectJwt: string;\n    if (parsedQrCode.request) {\n      requestObjectJwt = parsedQrCode.request;\n    } else {\n      if (options.x509Certificate) {\n        await validateCertificateEndpoints({\n          callbacks: options.x509Certificate.binding,\n          certificate: options.x509Certificate.leafCertificate,\n          endpoints: [\n            {\n              name: \"request_uri\",\n              uri: parsedQrCode.requestUri,\n            },\n          ],\n        });\n      }\n\n      // Type system guarantees request_uri is defined here due to validation\n      requestObjectJwt = await fetchRequestObjectJwt(\n        parsedQrCode.requestUri as string,\n        {\n          fetch: options.callbacks.fetch,\n          method: parsedQrCode.requestUriMethod ?? \"get\",\n          walletMetadata: options.walletMetadata,\n          walletNonce: options.walletNonce,\n        },\n      );\n    }\n\n    return {\n      parsedQrCode,\n      requestObjectJwt,\n      sendBy: parsedQrCode.request ? \"value\" : \"reference\",\n    };\n  } catch (error) {\n    if (\n      error instanceof ValidationError ||\n      error instanceof Oauth2JwtParseError ||\n      error instanceof Oid4vpError ||\n      error instanceof UnexpectedStatusCodeError\n    ) {\n      throw error;\n    }\n\n    throw new Oid4vpError(\n      `Unexpected error during fetch authorization request: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n}\n","import { InvalidRequestUriMethodError, Oid4vpError } from \"../errors\";\nimport { AuthorizationRequestUrlParams } from \"./z-authorization-request-url\";\n\n/**\n * Validates authorization request URL parameters according to IT-Wallet and OpenID4VP specifications.\n *\n * Validation rules:\n * 1. Exactly one of `request` or `request_uri` must be present (mutual exclusivity)\n * 2. `request_uri_method` must be \"get\" or \"post\" (case-insensitive) if present\n * 3. `request_uri_method` can only be used with `request_uri` parameter\n *\n * @param params - Parsed authorization request URL parameters\n * @returns Type-narrowed params ensuring mutual exclusivity\n * @throws {Oid4vpError} When both or neither request/request_uri are present\n * @throws {InvalidRequestUriMethodError} When request_uri_method is not \"get\" or \"post\"\n * @throws {Oid4vpError} When request_uri_method is used without request_uri\n */\nexport function validateAuthorizationRequestParams(\n  params: AuthorizationRequestUrlParams,\n) {\n  // Mutual exclusivity check\n  if (params.request && params.request_uri) {\n    throw new Oid4vpError(\n      \"request and request_uri cannot both be present in an authorization request\",\n    );\n  }\n\n  // At least one must be present\n  if (!params.request && !params.request_uri) {\n    throw new Oid4vpError(\n      \"Either request or request_uri parameter must be present\",\n    );\n  }\n\n  // Validate request_uri_method if present\n  if (params.request_uri_method) {\n    const normalizedMethod = params.request_uri_method.toLowerCase();\n    if (normalizedMethod !== \"get\" && normalizedMethod !== \"post\") {\n      throw new InvalidRequestUriMethodError(\n        `Invalid request_uri_method: '${params.request_uri_method}'. Must be 'get' or 'post'`,\n      );\n    }\n  }\n\n  // request_uri_method only allowed with request_uri\n  if (params.request_uri_method && !params.request_uri) {\n    throw new Oid4vpError(\n      \"request_uri_method can only be used with request_uri parameter\",\n    );\n  }\n\n  // Normalize request_uri_method to lowercase if present\n  const normalizedMethod = params.request_uri_method\n    ? (params.request_uri_method.toLowerCase() as \"get\" | \"post\")\n    : undefined;\n\n  return {\n    ...params,\n    request_uri_method: normalizedMethod,\n  } as (\n    | {\n        request?: never;\n        request_uri: string;\n        request_uri_method?: \"get\" | \"post\";\n      }\n    | { request: string; request_uri?: never; request_uri_method?: never }\n  ) &\n    typeof params;\n}\n","import { Oid4vpError } from \"../errors\";\n\nexport interface X509CertificateMetadata {\n  sanDnsNames?: string[];\n  sanUriNames?: string[];\n}\n\nexport type GetX509CertificateMetadataCallback = (\n  certificate: string,\n) => Promise<X509CertificateMetadata> | X509CertificateMetadata;\n\nexport interface X509CertificateBinding {\n  getX509CertificateMetadata: GetX509CertificateMetadataCallback;\n}\n\nexport interface CertificateEndpoint {\n  name: string;\n  uri?: string;\n}\n\nexport interface ValidateCertificateEndpointsOptions {\n  callbacks: X509CertificateBinding;\n  certificate: string;\n  endpoints: CertificateEndpoint[];\n}\n\nexport async function validateCertificateEndpoints(\n  options: ValidateCertificateEndpointsOptions,\n): Promise<void> {\n  const metadata = await options.callbacks.getX509CertificateMetadata(\n    options.certificate,\n  );\n\n  for (const endpoint of options.endpoints) {\n    if (!endpoint.uri) {\n      continue;\n    }\n\n    validateEndpointAgainstMetadata(\n      { name: endpoint.name, uri: endpoint.uri },\n      metadata,\n    );\n  }\n}\n\nfunction validateEndpointAgainstMetadata(\n  endpoint: { name: string; uri: string },\n  metadata: X509CertificateMetadata,\n) {\n  const endpointUrl = parseEndpointUrl(endpoint);\n  const sanUriNames = metadata.sanUriNames ?? [];\n  const matchesUriSan = sanUriNames.some(\n    (sanUriName) => normalizeUriForComparison(sanUriName) === endpointUrl.href,\n  );\n  const sanDnsNames = metadata.sanDnsNames ?? [];\n  const matchesDnsSan = sanDnsNames.some((sanDnsName) =>\n    matchesDnsSanHostname(sanDnsName, endpointUrl.hostname),\n  );\n\n  if (matchesUriSan || matchesDnsSan) {\n    return;\n  }\n\n  throw new Oid4vpError(\n    `${endpoint.name} is not covered by the Relying Party certificate SAN entries`,\n  );\n}\n\nfunction normalizeUriForComparison(uri: string) {\n  try {\n    return new URL(uri).href;\n  } catch (error) {\n    throw new Oid4vpError(`Certificate URI SAN is not a valid URL: ${uri}`, {\n      cause: error,\n    });\n  }\n}\n\nfunction matchesDnsSanHostname(sanDnsName: string, hostname: string) {\n  const normalizedSanDnsName = sanDnsName.toLowerCase();\n  const normalizedHostname = hostname.toLowerCase();\n\n  if (normalizedSanDnsName === normalizedHostname) {\n    return true;\n  }\n\n  if (!normalizedSanDnsName.includes(\"*\")) {\n    return false;\n  }\n\n  const wildcardCount = [...normalizedSanDnsName].filter(\n    (character) => character === \"*\",\n  ).length;\n  const sanLabels = normalizedSanDnsName.split(\".\");\n  const hostnameLabels = normalizedHostname.split(\".\");\n\n  return (\n    wildcardCount === 1 &&\n    sanLabels[0] === \"*\" &&\n    sanLabels.length === hostnameLabels.length &&\n    sanLabels\n      .slice(1)\n      .every((label, index) => label === hostnameLabels[index + 1])\n  );\n}\n\nfunction parseEndpointUrl(endpoint: { name: string; uri: string }) {\n  try {\n    return new URL(endpoint.uri);\n  } catch (error) {\n    throw new Oid4vpError(\n      `${endpoint.name} is not a valid URL: ${endpoint.uri}`,\n      { cause: error },\n    );\n  }\n}\n","import z from \"zod\";\n\n/**\n * Schema for authorization request URL query parameters.\n * Note: `request` contains the signed Request Object JWT, it is NOT a claim inside the Request Object.\n */\nexport const zAuthorizationRequestUrlParams = z.looseObject({\n  client_id: z.string(),\n  request: z.string().optional(), // JWT containing Request Object (by value)\n  request_uri: z.url().optional(), // URI to fetch Request Object (by reference)\n  request_uri_method: z.string().optional(), // HTTP method for request_uri (validated in business logic)\n  state: z.string().optional(), // Optional state parameter\n});\n\nexport type AuthorizationRequestUrlParams = z.infer<\n  typeof zAuthorizationRequestUrlParams\n>;\n","import {\n  CallbackContext,\n  JwtSigner,\n  Oauth2JwtParseError,\n  verifyJwt,\n} from \"@openid4vc/oauth2\";\nimport { decodeJwt } from \"@pagopa/io-wallet-oauth2\";\nimport {\n  IoWalletSdkConfig,\n  ItWalletSpecsVersion,\n  ItWalletSpecsVersionError,\n  ValidationError,\n  dispatchByVersion,\n} from \"@pagopa/io-wallet-utils\";\n\nimport { Oid4vpError, ParseAuthorizeRequestError } from \"../errors\";\nimport {\n  ClientIdPrefix,\n  extractClientIdPrefix,\n  validateAuthorizationRequestClientBinding,\n} from \"./client-id-prefix\";\nimport {\n  X509CertificateBinding,\n  validateCertificateEndpoints,\n} from \"./validate-certificate-endpoints\";\nimport {\n  Openid4vpAuthorizationRequestHeader,\n  Openid4vpAuthorizationRequestHeaderV1_3,\n  Openid4vpAuthorizationRequestPayload,\n  zOpenid4vpAuthorizationRequestHeaderV1_0,\n  zOpenid4vpAuthorizationRequestHeaderV1_3,\n  zOpenid4vpAuthorizationRequestPayload,\n} from \"./z-authorization-request\";\n\nexport {\n  type ClientIdParts,\n  ClientIdPrefix,\n  createX509HashClientId,\n  extractClientIdPrefix,\n} from \"./client-id-prefix\";\n\n/**\n * Retrieves the public key for verifying the Request Object JWT signature\n * according to IT Wallet specifications.\n *\n * Prefix routing:\n * 1. If client_id uses x509_hash: use x5c certificate chain from header.\n * 2. If client_id uses openid_federation or no prefix: return a federation signer;\n *    if trust_chain is present it is forwarded, otherwise the verifyJwt callback is\n *    responsible for reconstructing the chain from client_id.\n *\n * @param options - Parse options containing decoded JWT\n * @returns The JWK to use for signature verification\n * @throws {ParseAuthorizeRequestError} When no valid public key can be found\n */\nfunction getPublicKeyForVerification(options: {\n  header: Openid4vpAuthorizationRequestHeader;\n  payload: Openid4vpAuthorizationRequestPayload;\n}): JwtSigner {\n  const { header, payload } = options;\n\n  const { prefix: clientIdPrefix } = extractClientIdPrefix(payload.client_id);\n\n  if (\n    clientIdPrefix === ClientIdPrefix.OPENID_FEDERATION ||\n    clientIdPrefix === ClientIdPrefix.NONE\n  ) {\n    if (!header.kid) {\n      throw new ParseAuthorizeRequestError(\n        \"kid is required in JWT header for openid_federation client_id or no prefix\",\n      );\n    }\n\n    return {\n      alg: header.alg,\n      kid: header.kid,\n      method: \"federation\" as const,\n      ...(header.trust_chain && { trustChain: header.trust_chain }),\n    };\n  }\n\n  if (clientIdPrefix === ClientIdPrefix.X509_HASH) {\n    if (!Array.isArray(header.x5c) || header.x5c.length === 0) {\n      throw new ParseAuthorizeRequestError(\n        \"x5c is required in JWT header for x509_hash client_id\",\n      );\n    }\n\n    return {\n      alg: header.alg,\n      kid: header.kid,\n      method: \"x5c\" as const,\n      ...(header.trust_chain && { trustChain: header.trust_chain }),\n      x5c: header.x5c,\n    };\n  }\n\n  throw new ParseAuthorizeRequestError(\n    \"Unable to determine public key for Request Object verification with client_id prefix: \" +\n      clientIdPrefix,\n  );\n}\n\nexport interface ParseAuthorizeRequestOptions {\n  /**\n   * Optional callback context for JWT signature verification and hashing x509 client_id for digest comparison.\n   * If not provided, signature verification is skipped or hash skips the x509_hash digest comparison.\n   */\n  callbacks?: Partial<Pick<CallbackContext, \"hash\" | \"verifyJwt\">> &\n    Partial<X509CertificateBinding>;\n\n  config: IoWalletSdkConfig;\n\n  /**\n   * The Authorization Request Object JWT.\n   */\n  requestObjectJwt: string;\n}\n\nexport interface ParsedAuthorizeRequestResult {\n  /**\n   * The JWT header of the authorization request object.\n   */\n  header: Openid4vpAuthorizationRequestHeader;\n  /**\n   * The parsed authorization request object.\n   */\n  payload: Openid4vpAuthorizationRequestPayload;\n\n  /**\n   * X.509 context extracted from the Request Object header when `x5c` is present.\n   */\n  x509Certificate?: {\n    leafCertificate: string;\n    x5c: [string, ...string[]];\n  };\n}\n\n/**\n * Parses and optionally verifies a JWT containing an OpenID4VP Request Object.\n *\n * This method decodes the Request Object JWT and validates its structure. If the `verifyJwt`\n * callback is provided, it also verifies the JWT signature using the public key obtained\n * according to IT Wallet specifications:\n * 1. If client_id uses x509_hash: pass an x5c signer to the callback.\n * 2. If client_id uses openid_federation or a legacy HTTPS identifier, pass a federation signer;\n *    trust_chain is forwarded when present, otherwise the callback must reconstruct the chain from client_id.\n *\n * For x509_hash client identifiers, x5c is always required. When `callbacks.hash` is provided,\n * this method also checks the SHA-256 base64url certificate digest embedded in client_id.\n *\n * Security: If `verifyJwt` callback is not provided in options, JWT signature verification is skipped.\n *\n * @param options {@link ParseAuthorizeRequestOptions}\n * @returns A {@link ParsedAuthorizeRequestResult} containing the RP required credentials payload and the {@link Openid4vpAuthorizationRequestHeader} JWT header\n * @throws {ValidationError} in case there are errors validating the Request Object structure\n * @throws {Oauth2JwtParseError} in case the request object jwt is malformed (e.g missing header, bad encoding)\n * @throws {@link ParseAuthorizeRequestError} in case the JWT signature is invalid (when verifyJwt is provided) or there are unexpected errors\n */\nexport async function parseAuthorizeRequest(\n  options: ParseAuthorizeRequestOptions,\n): Promise<ParsedAuthorizeRequestResult> {\n  try {\n    const headerSchema = dispatchByVersion<\n      | typeof zOpenid4vpAuthorizationRequestHeaderV1_0\n      | typeof zOpenid4vpAuthorizationRequestHeaderV1_3\n    >(options.config.itWalletSpecsVersion, {\n      [ItWalletSpecsVersion.V1_0]: () =>\n        zOpenid4vpAuthorizationRequestHeaderV1_0,\n      [ItWalletSpecsVersion.V1_3]: () =>\n        zOpenid4vpAuthorizationRequestHeaderV1_3,\n      [ItWalletSpecsVersion.V1_4]: () =>\n        zOpenid4vpAuthorizationRequestHeaderV1_3,\n    });\n\n    const decoded = decodeJwt({\n      errorMessagePrefix: \"Error decoding authorization request JWT:\",\n      headerSchema,\n      jwt: options.requestObjectJwt,\n      payloadSchema: zOpenid4vpAuthorizationRequestPayload,\n    });\n\n    if (options.config.itWalletSpecsVersion !== ItWalletSpecsVersion.V1_0) {\n      await validateAuthorizationRequestClientBinding({\n        hash: options.callbacks?.hash,\n        header: decoded.header as Openid4vpAuthorizationRequestHeaderV1_3,\n        payload: decoded.payload,\n      });\n    }\n\n    const x5c =\n      \"x5c\" in decoded.header &&\n      Array.isArray(decoded.header.x5c) &&\n      decoded.header.x5c.length > 0\n        ? (decoded.header.x5c as [string, ...string[]])\n        : undefined;\n\n    if (x5c && options.callbacks?.getX509CertificateMetadata) {\n      await validateCertificateEndpoints({\n        callbacks: {\n          getX509CertificateMetadata:\n            options.callbacks.getX509CertificateMetadata,\n        },\n        certificate: x5c[0],\n        endpoints: [\n          { name: \"request_uri\", uri: decoded.payload.request_uri },\n          { name: \"response_uri\", uri: decoded.payload.response_uri },\n        ],\n      });\n    }\n\n    if (options.callbacks?.verifyJwt) {\n      const signer = getPublicKeyForVerification({\n        header: decoded.header,\n        payload: decoded.payload,\n      });\n\n      await verifyJwt({\n        compact: options.requestObjectJwt,\n        errorMessage: \"Error verifying Request Object signature\",\n        header: decoded.header,\n        payload: decoded.payload,\n        signer,\n        verifyJwtCallback: options.callbacks.verifyJwt,\n      });\n    }\n\n    return {\n      header: decoded.header,\n      payload: decoded.payload,\n      ...(x5c && {\n        x509Certificate: {\n          leafCertificate: x5c[0],\n          x5c,\n        },\n      }),\n    };\n  } catch (error) {\n    if (\n      error instanceof ItWalletSpecsVersionError ||\n      error instanceof ValidationError ||\n      error instanceof Oauth2JwtParseError ||\n      error instanceof Oid4vpError\n    )\n      throw error;\n    throw new ParseAuthorizeRequestError(\n      `Unexpected error during Request Object parsing: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n}\n","import {\n  ItWalletSpecsVersion,\n  createVersionDispatcher,\n} from \"@pagopa/io-wallet-utils\";\n\nimport type {\n  CreateAuthorizationResponseOptionsV1_3,\n  CreateAuthorizationResponseOptionsV1_4,\n  CreateAuthorizationResponseResult,\n  CreateAuthorizationResponseVersionedOptions,\n} from \"./types\";\n\nimport * as V1_3 from \"./v1.3/create-authorization-response\";\nimport * as V1_4 from \"./v1.4/create-authorization-response\";\n\nexport type {\n  CreateAuthorizationResponseOptionsV1_0,\n  CreateAuthorizationResponseOptionsV1_3,\n  CreateAuthorizationResponseOptionsV1_4,\n  CreateAuthorizationResponseResult,\n  CreateAuthorizationResponseVersionedOptions,\n} from \"./types\";\n\nconst dispatchCreateAuthorizationResponse = createVersionDispatcher<\n  CreateAuthorizationResponseVersionedOptions,\n  Promise<CreateAuthorizationResponseResult>\n>({\n  [ItWalletSpecsVersion.V1_0]: (o) =>\n    // V1_0 shares the v1.3 response logic — JWKS / enc resolution is identical.\n    V1_3.createAuthorizationResponse(\n      o as CreateAuthorizationResponseOptionsV1_3,\n    ),\n  [ItWalletSpecsVersion.V1_3]: (o) =>\n    V1_3.createAuthorizationResponse(\n      o as CreateAuthorizationResponseOptionsV1_3,\n    ),\n  [ItWalletSpecsVersion.V1_4]: (o) =>\n    V1_4.createAuthorizationResponse(\n      o as CreateAuthorizationResponseOptionsV1_4,\n    ),\n});\n\n/**\n * Creates an encrypted JARM authorization response for OpenID4VP presentation.\n *\n * Routes to the version-specific implementation based on `config.itWalletSpecsVersion`.\n *\n * **Version differences:**\n * - v1.0 / v1.3: When `openid_federation` client_id prefix is used, `client_metadata`\n *   is ignored and `rpJwks` is used for JWKS resolution.\n * - v1.4: `client_metadata.jwks` is used directly when present, regardless of\n *   the `client_id` prefix, falling back to `rpJwks.jwks`.\n *\n * @throws {CreateAuthorizationResponseError} If response generation or encryption fails\n * @throws {ItWalletSpecsVersionError} If `config.itWalletSpecsVersion` is not a recognised version at runtime\n */\nexport async function createAuthorizationResponse(\n  options: CreateAuthorizationResponseVersionedOptions,\n): Promise<CreateAuthorizationResponseResult> {\n  return dispatchCreateAuthorizationResponse(options);\n}\n","import type { JwkSet } from \"@pagopa/io-wallet-oauth2\";\n\nimport { CallbackContext, JweEncryptor } from \"@pagopa/io-wallet-oauth2\";\nimport { encodeToBase64Url } from \"@pagopa/io-wallet-utils\";\n\nimport type { CreateAuthorizationResponseResult } from \"./types\";\n\nimport { Openid4vpAuthorizationRequestPayload } from \"../authorization-request/z-authorization-request\";\nimport { CreateAuthorizationResponseError } from \"../errors\";\nimport { extractEncryptionJwkFromJwks } from \"../jarm/jarm-extract-jwks\";\nimport { VpToken } from \"../vp-token/z-vp-token\";\n\nexport interface BuildJarmResponseOptions {\n  authorization_encrypted_response_alg?: string;\n  authorization_encrypted_response_enc?: string;\n  callbacks: Pick<CallbackContext, \"encryptJwe\" | \"generateRandom\">;\n  encValuesSupported: string[] | undefined;\n  encryptionJwks: JwkSet;\n  requestObject: Pick<Openid4vpAuthorizationRequestPayload, \"nonce\" | \"state\">;\n  vp_token: VpToken;\n}\n\nfunction resolveEncValue(\n  supported: string[] | undefined,\n  requested: string | undefined,\n  fallback: string,\n): string {\n  if (!supported) return requested ?? fallback;\n  return (\n    supported.find((e) => e === requested) ??\n    supported[0] ??\n    requested ??\n    fallback\n  );\n}\n\n/**\n * Shared core: resolves enc/alg, encrypts the VP token into a JARM JWE, and returns the result.\n * Callers are responsible for resolving `encryptionJwks` and `encValuesSupported`\n * according to their version-specific metadata rules before invoking this function.\n */\nexport async function buildJarmResponse(\n  options: BuildJarmResponseOptions,\n): Promise<CreateAuthorizationResponseResult> {\n  try {\n    const encryptionAlg =\n      options.authorization_encrypted_response_alg ?? \"ECDH-ES\";\n    const encryptionEnc =\n      options.authorization_encrypted_response_enc ?? \"A256GCM\";\n\n    const authorizationResponsePayload = {\n      state: options.requestObject.state,\n      vp_token: options.vp_token,\n    };\n\n    const encryptionJwk = extractEncryptionJwkFromJwks(options.encryptionJwks, {\n      supportedAlgValues: [encryptionAlg],\n    });\n    if (!encryptionJwk) {\n      throw new CreateAuthorizationResponseError(\n        \"No encryption JWK found in metadata\",\n      );\n    }\n\n    if (!encryptionJwk.kid) {\n      throw new CreateAuthorizationResponseError(\n        \"Encryption JWK must have a 'kid' parameter\",\n      );\n    }\n\n    const enc = resolveEncValue(\n      options.encValuesSupported,\n      options.authorization_encrypted_response_enc,\n      encryptionEnc,\n    );\n\n    const alg = encryptionAlg;\n\n    const nonceBytes = await options.callbacks.generateRandom(32);\n\n    const jweEncryptor: JweEncryptor = {\n      alg,\n      apu: encodeToBase64Url(nonceBytes),\n      apv: encodeToBase64Url(options.requestObject.nonce),\n      enc,\n      kid: encryptionJwk.kid,\n      method: \"jwk\",\n      publicJwk: encryptionJwk,\n    };\n\n    const { encryptionJwk: usedJwk, jwe } = await options.callbacks.encryptJwe(\n      jweEncryptor,\n      JSON.stringify(authorizationResponsePayload),\n    );\n\n    return {\n      authorizationResponsePayload,\n      jarm: {\n        encryptionJwk: usedJwk,\n        responseJwe: jwe,\n      },\n    };\n  } catch (error) {\n    if (error instanceof CreateAuthorizationResponseError) {\n      throw error;\n    }\n    throw new CreateAuthorizationResponseError(\n      `Unexpected error during authorization response creation: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n}\n","import type { JwkSet } from \"@pagopa/io-wallet-oauth2\";\n\n/**\n * Selects an encryption JWK from a JWKS.\n *\n * Selection prefers an explicit `kid`, then keys whose `alg` is supported, then\n * keys marked for encryption or not explicitly marked for signatures.\n *\n * @param jwks - JSON Web Key Set to search.\n * @param options - Optional selection constraints.\n * @param options.kid - Key ID to select directly.\n * @param options.supportedAlgValues - Encryption algorithms accepted by the caller.\n * @returns Matching encryption JWK, or the first available key when no better match exists.\n */\nexport function extractEncryptionJwkFromJwks(\n  jwks: JwkSet,\n  {\n    kid,\n    supportedAlgValues,\n  }: {\n    kid?: string;\n    supportedAlgValues?: string[];\n  },\n) {\n  if (kid) {\n    return jwks.keys.find((jwk) => jwk.kid === kid);\n  }\n\n  let algFiltered = jwks.keys.filter(\n    (key) => key.alg && supportedAlgValues?.includes(key.alg),\n  );\n  if (algFiltered.length === 0) algFiltered = jwks.keys;\n\n  let encFiltered = algFiltered.filter((key) => key.use === \"enc\");\n  if (encFiltered.length === 0) {\n    encFiltered = algFiltered.filter((key) => key.use !== \"sig\");\n  }\n\n  return encFiltered.length > 0 ? encFiltered[0] : jwks.keys[0];\n}\n","import type {\n  CreateAuthorizationResponseOptionsV1_3,\n  CreateAuthorizationResponseResult,\n} from \"../types\";\n\nimport {\n  ClientIdPrefix,\n  extractClientIdPrefix,\n} from \"../../authorization-request/parse-authorization-request\";\nimport { CreateAuthorizationResponseError } from \"../../errors\";\nimport { buildJarmResponse } from \"../build-jarm-response\";\n\n/**\n * Creates an encrypted JARM authorization response for OpenID4VP presentation — v1.0 / v1.3 variant.\n *\n * When the `openid_federation` client_id prefix is used, `client_metadata` is ignored\n * and `rpJwks` is used for JWKS resolution, as required by the Italian specification.\n */\nexport async function createAuthorizationResponse(\n  options: CreateAuthorizationResponseOptionsV1_3,\n): Promise<CreateAuthorizationResponseResult> {\n  const { requestObject } = options;\n  const clientMetadata = requestObject.client_metadata;\n  const { prefix: clientIdPrefix } = extractClientIdPrefix(\n    requestObject.client_id,\n  );\n\n  if (clientIdPrefix === ClientIdPrefix.X509_HASH && !clientMetadata) {\n    throw new CreateAuthorizationResponseError(\n      \"clientMetadata is required when client_id uses x509_hash prefix\",\n    );\n  }\n\n  // When using OpenID Federation, client_metadata may be present in the request\n  // but per the Italian specification most of its content should be ignored —\n  // use rpJwks for encryption parameters instead.\n  const effectiveClientMetadata =\n    clientIdPrefix === ClientIdPrefix.OPENID_FEDERATION\n      ? undefined\n      : clientMetadata;\n\n  const encryptionJwks = effectiveClientMetadata\n    ? effectiveClientMetadata.jwks\n    : options.rpJwks.jwks;\n\n  const encValuesSupported =\n    effectiveClientMetadata?.encrypted_response_enc_values_supported ??\n    options.rpJwks.encrypted_response_enc_values_supported;\n\n  return buildJarmResponse({\n    authorization_encrypted_response_alg:\n      options.authorization_encrypted_response_alg,\n    authorization_encrypted_response_enc:\n      options.authorization_encrypted_response_enc,\n    callbacks: options.callbacks,\n    encValuesSupported,\n    encryptionJwks,\n    requestObject: options.requestObject,\n    vp_token: options.vp_token,\n  });\n}\n","import type {\n  CreateAuthorizationResponseOptionsV1_4,\n  CreateAuthorizationResponseResult,\n} from \"../types\";\n\nimport {\n  ClientIdPrefix,\n  extractClientIdPrefix,\n} from \"../../authorization-request/parse-authorization-request\";\nimport { CreateAuthorizationResponseError } from \"../../errors\";\nimport { buildJarmResponse } from \"../build-jarm-response\";\n\n/**\n * Creates an encrypted JARM authorization response for OpenID4VP presentation — v1.4 variant.\n *\n * **v1.4 behavior:** both `encryptionJwks` and `encValuesSupported`\n * are resolved directly from `requestObject.client_metadata`, falling back to `rpJwks`, regardless\n * of the `client_id` prefix. The IT-Wallet spec (RPR-113) permits `client_metadata.jwks` and\n * `encrypted_response_enc_values_supported` to carry request-specific ephemeral encryption keys\n * even when the `openid_federation` prefix is active.\n */\nexport async function createAuthorizationResponse(\n  options: CreateAuthorizationResponseOptionsV1_4,\n): Promise<CreateAuthorizationResponseResult> {\n  const { requestObject } = options;\n  const clientMetadata = requestObject.client_metadata;\n  const { prefix: clientIdPrefix } = extractClientIdPrefix(\n    requestObject.client_id,\n  );\n\n  if (clientIdPrefix === ClientIdPrefix.X509_HASH && !clientMetadata) {\n    throw new CreateAuthorizationResponseError(\n      \"clientMetadata is required when client_id uses x509_hash prefix\",\n    );\n  }\n\n  const encryptionJwks = clientMetadata?.jwks ?? options.rpJwks.jwks;\n\n  const encValuesSupported =\n    clientMetadata?.encrypted_response_enc_values_supported ??\n    options.rpJwks.encrypted_response_enc_values_supported;\n\n  return buildJarmResponse({\n    authorization_encrypted_response_alg:\n      options.authorization_encrypted_response_alg,\n    authorization_encrypted_response_enc:\n      options.authorization_encrypted_response_enc,\n    callbacks: options.callbacks,\n    encValuesSupported,\n    encryptionJwks,\n    requestObject: options.requestObject,\n    vp_token: options.vp_token,\n  });\n}\n","import { CallbackContext } from \"@openid4vc/oauth2\";\nimport {\n  CONTENT_TYPES,\n  HEADERS,\n  UnexpectedStatusCodeError,\n  ValidationError,\n  createFetcher,\n  hasStatusOrThrow,\n  parseWithErrorHandling,\n} from \"@pagopa/io-wallet-utils\";\n\nimport {\n  X509CertificateBinding,\n  validateCertificateEndpoints,\n} from \"../authorization-request/validate-certificate-endpoints\";\nimport { FetchAuthorizationResponseError } from \"../errors\";\nimport {\n  Openid4vpAuthorizationResponseResult,\n  zOpenid4vpAuthorizationResponseResult,\n} from \"./z-authorization-response\";\n\n/**\n * Configuration options for fetching OID4VP Presentation Result\n */\nexport interface FetchAuthorizationResponseOptions {\n  /**\n   * The signed and encrypted {@link Openid4vpAuthorizationResponse} in base64 format\n   */\n  authorizationResponseJarm: string;\n\n  /**\n   * Callback functions for making HTTP requests\n   * Allows for custom fetch implementations\n   */\n  callbacks: Pick<CallbackContext, \"fetch\">;\n\n  /**\n   * The response_uri field contained in the {@link Openid4vpAuthorizationRequestPayload}\n   */\n  presentationResponseUri: string;\n\n  /**\n   * Optional RP certificate context from the parsed Request Object.\n   * When provided, `presentationResponseUri` and the returned `redirect_uri`\n   * are checked against the certificate SAN entries through the supplied callback.\n   */\n  x509Certificate?: {\n    binding: X509CertificateBinding;\n    leafCertificate: string;\n  };\n}\n\n/**\n * Sends the {@link Openid4vpAuthorizationResponse} to the response uri provided by the session's\n * {@link Openid4vpAuthorizationRequestPayload} and returns the {@link Openid4vpAuthorizationResponseResult} object\n * containing the redirect_uri at which to continue the presentation\n *\n * @param options {@link FetchAuthorizationResponseOptions}\n * @returns Promise that resolves to the parsed {@link Openid4vpAuthorizationResponseResult}\n * @throws {UnexpectedStatusCodeError} When the server returns a non-200 status code\n * @throws {ValidationError} When the response cannot be parsed or is invalid\n */\nexport async function fetchAuthorizationResponse(\n  options: FetchAuthorizationResponseOptions,\n): Promise<Openid4vpAuthorizationResponseResult> {\n  try {\n    if (options.x509Certificate) {\n      await validateCertificateEndpoints({\n        callbacks: options.x509Certificate.binding,\n        certificate: options.x509Certificate.leafCertificate,\n        endpoints: [\n          { name: \"response_uri\", uri: options.presentationResponseUri },\n        ],\n      });\n    }\n\n    const fetch = createFetcher(options.callbacks.fetch);\n    const authorizationResponseResult = await fetch(\n      options.presentationResponseUri,\n      {\n        body: new URLSearchParams({\n          response: options.authorizationResponseJarm,\n        }),\n        headers: {\n          [HEADERS.CONTENT_TYPE]: CONTENT_TYPES.FORM_URLENCODED,\n        },\n        method: \"POST\",\n      },\n    );\n\n    await hasStatusOrThrow(\n      200,\n      UnexpectedStatusCodeError,\n    )(authorizationResponseResult);\n\n    const authorizationResponseResultJson =\n      await authorizationResponseResult.json();\n\n    //Response could be anything, so it's returned as is for further processing\n    const parsedAuthorizationResponseResult = parseWithErrorHandling(\n      zOpenid4vpAuthorizationResponseResult,\n      authorizationResponseResultJson,\n    );\n\n    if (options.x509Certificate) {\n      await validateCertificateEndpoints({\n        callbacks: options.x509Certificate.binding,\n        certificate: options.x509Certificate.leafCertificate,\n        endpoints: [\n          {\n            name: \"redirect_uri\",\n            uri: parsedAuthorizationResponseResult.redirect_uri,\n          },\n        ],\n      });\n    }\n\n    return parsedAuthorizationResponseResult;\n  } catch (error) {\n    if (\n      error instanceof UnexpectedStatusCodeError ||\n      error instanceof ValidationError ||\n      error instanceof FetchAuthorizationResponseError\n    ) {\n      throw error;\n    }\n    throw new FetchAuthorizationResponseError(\n      `Unexpected error sending authorization response: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n}\n","import z from \"zod\";\n\nimport { zVpToken } from \"../vp-token/z-vp-token\";\n\nexport const zOpenid4vpAuthorizationResponse = z.object({\n  state: z.string().optional(),\n  vp_token: zVpToken,\n});\n\nexport type Openid4vpAuthorizationResponse = z.infer<\n  typeof zOpenid4vpAuthorizationResponse\n>;\n\nexport const zOpenid4vpAuthorizationResponseResult = z.object({\n  redirect_uri: z.url().optional(),\n});\n\nexport type Openid4vpAuthorizationResponseResult = z.infer<\n  typeof zOpenid4vpAuthorizationResponseResult\n>;\n","import { z } from \"zod\";\n\nexport const zVpToken = z.record(\n  z.string(),\n  z.string().or(z.array(z.string()).nonempty()),\n  {\n    message:\n      \"vp_token must be an object where each key is a string and each value is a non-empty array of strings (v1.3) or a string (v1.0)\",\n  },\n);\n\nexport type VpToken = z.infer<typeof zVpToken>;\n","import { CallbackContext } from \"@pagopa/io-wallet-oauth2\";\nimport { parseWithErrorHandling } from \"@pagopa/io-wallet-utils\";\n\nimport { Openid4vpAuthorizationRequestPayload } from \"../authorization-request/z-authorization-request\";\nimport { Oid4vpError } from \"../errors\";\nimport { parseJarmAuthorizationResponse } from \"../jarm/parse-jarm-authorization-response\";\nimport { VerifyJarmAuthorizationResponseResult } from \"../jarm/verify-jarm-authorization-response\";\nimport { JarmHeader } from \"../jarm/z-jarm\";\nimport {\n  ValidateOpenid4vpAuthorizationResponseResult,\n  validateOpenid4vpAuthorizationResponsePayload,\n} from \"./validate-authorization-response\";\nimport {\n  Openid4vpAuthorizationResponse,\n  zOpenid4vpAuthorizationResponse,\n} from \"./z-authorization-response\";\n\nexport interface ParseAuthorizationResponseOptions {\n  /**\n   * Parsed authorization request payload used to validate response parameters.\n   */\n  authorizationRequestPayload: Openid4vpAuthorizationRequestPayload;\n  /**\n   * Authorization response received from the verifier endpoint or redirect URI.\n   */\n  authorizationResponse: Record<string, unknown>;\n  /**\n   * Callbacks required when the response is returned in JARM format.\n   */\n  callbacks: Pick<CallbackContext, \"decryptJwe\" | \"verifyJwt\">;\n}\n\n/**\n * Parsed and validated authorization response.\n */\nexport type ParseAuthorizationResponseResult = {\n  authorizationResponsePayload: Openid4vpAuthorizationResponse;\n  expectedNonce: string;\n  jarm?: {\n    jarmHeader: JarmHeader;\n  } & VerifyJarmAuthorizationResponseResult;\n} & ValidateOpenid4vpAuthorizationResponseResult;\n\n/**\n * Parses an OpenID4VP authorization response and validates it against the request.\n *\n * If the response includes a `response` parameter, the JARM flow is used.\n * Otherwise, the plain authorization response payload is parsed and validated.\n *\n * @param options {@link ParseAuthorizationResponseOptions}\n * @returns A parsed and validated authorization response.\n */\nexport async function parseAuthorizationResponse(\n  options: ParseAuthorizationResponseOptions,\n): Promise<ParseAuthorizationResponseResult> {\n  const { authorizationRequestPayload, authorizationResponse, callbacks } =\n    options;\n\n  if (authorizationResponse.response) {\n    if (typeof authorizationResponse.response !== \"string\") {\n      throw new Oid4vpError(\n        \"Invalid jarm authorization response: 'response' parameter must be a jwt string.\",\n      );\n    }\n\n    return parseJarmAuthorizationResponse({\n      authorizationRequestPayload,\n      callbacks,\n      jarmResponseJwt: authorizationResponse.response,\n    });\n  }\n\n  const authorizationResponsePayload = parseWithErrorHandling(\n    zOpenid4vpAuthorizationResponse,\n    authorizationResponse,\n    \"Failed to parse openid4vp authorization response.\",\n  );\n\n  const validatedOpenId4vpResponse =\n    validateOpenid4vpAuthorizationResponsePayload({\n      authorizationRequestPayload: authorizationRequestPayload,\n      authorizationResponsePayload: authorizationResponsePayload,\n    });\n\n  return {\n    ...validatedOpenId4vpResponse,\n    authorizationResponsePayload,\n    expectedNonce: authorizationRequestPayload.nonce,\n  };\n}\n","import {\n  type CallbackContext,\n  decodeJwtHeader,\n  zCompactJwe,\n  zCompactJwt,\n} from \"@pagopa/io-wallet-oauth2\";\nimport { parseWithErrorHandling } from \"@pagopa/io-wallet-utils\";\nimport z from \"zod\";\n\nimport { Openid4vpAuthorizationRequestPayload } from \"../authorization-request/z-authorization-request\";\nimport { ParseAuthorizationResponseResult } from \"../authorization-response/parse-authorization-response\";\nimport { validateOpenid4vpAuthorizationResponsePayload } from \"../authorization-response/validate-authorization-response\";\nimport { zOpenid4vpAuthorizationResponse } from \"../authorization-response/z-authorization-response\";\nimport { verifyJarmAuthorizationResponse } from \"./verify-jarm-authorization-response\";\nimport { zJarmHeader } from \"./z-jarm\";\n\nexport interface ParseJarmAuthorizationResponseOptions {\n  /**\n   * Parsed authorization request payload used to validate JARM claims.\n   */\n  authorizationRequestPayload: Openid4vpAuthorizationRequestPayload;\n  /**\n   * Callbacks used to decrypt and verify JARM JWT/JWE responses.\n   */\n  callbacks: Pick<CallbackContext, \"decryptJwe\" | \"verifyJwt\">;\n  /**\n   * Compact JARM authorization response (`response` parameter value).\n   */\n  jarmResponseJwt: string;\n  /**\n   * Current time used for temporal claim validation (`exp`, `nbf`).\n   * Defaults to current date-time when omitted.\n   */\n  now?: Date;\n}\n\n/**\n * Parses and validates a JARM authorization response for OpenID4VP.\n *\n * This function validates compact format, decrypts and/or verifies the JARM token,\n * parses the resulting OpenID4VP authorization response, and validates it against\n * the originating authorization request.\n *\n * @param options {@link ParseJarmAuthorizationResponseOptions}\n * @returns Parsed authorization response enriched with JARM metadata.\n */\nexport async function parseJarmAuthorizationResponse(\n  options: ParseJarmAuthorizationResponseOptions,\n): Promise<ParseAuthorizationResponseResult> {\n  const { authorizationRequestPayload, callbacks, jarmResponseJwt, now } =\n    options;\n\n  const jarmAuthorizationResponseJwt = parseWithErrorHandling(\n    z.union([zCompactJwt, zCompactJwe]),\n    jarmResponseJwt,\n    \"Invalid jarm authorization response jwt.\",\n  );\n\n  const verifiedJarmResponse = await verifyJarmAuthorizationResponse({\n    authorizationRequestPayload,\n    callbacks,\n    jarmAuthorizationResponseJwt,\n    now,\n  });\n\n  const { header: jarmHeader } = decodeJwtHeader({\n    headerSchema: zJarmHeader,\n    jwt: jarmAuthorizationResponseJwt,\n  });\n\n  const authorizationResponsePayload = parseWithErrorHandling(\n    zOpenid4vpAuthorizationResponse,\n    verifiedJarmResponse.jarmAuthorizationResponse,\n    \"Failed to parse openid4vp authorization response.\",\n  );\n\n  const validateOpenId4vpResponse =\n    validateOpenid4vpAuthorizationResponsePayload({\n      authorizationRequestPayload: authorizationRequestPayload,\n      authorizationResponsePayload: authorizationResponsePayload,\n    });\n\n  return {\n    ...validateOpenId4vpResponse,\n    authorizationResponsePayload,\n    expectedNonce: authorizationRequestPayload.nonce,\n    jarm: { ...verifiedJarmResponse, jarmHeader },\n  };\n}\n","import { parseIfJson, parseWithErrorHandling } from \"@pagopa/io-wallet-utils\";\n\nimport { zVpToken } from \"./z-vp-token\";\n\n/**\n * Parses a DCQL VP token into the SDK VP token shape.\n *\n * @param vpToken - Raw VP token object or JSON string.\n * @returns Parsed VP token.\n * @throws {ValidationError} If the token is not an object of encoded presentations.\n */\nexport function parseVpToken(vpToken: unknown) {\n  return parseWithErrorHandling(\n    zVpToken,\n    parseIfJson(vpToken),\n    \"Could not parse dcql vp_token. Expected an object where the values are encoded presentations\",\n  );\n}\n","import { Openid4vpAuthorizationRequestPayload } from \"../authorization-request/z-authorization-request\";\nimport { Oid4vpError } from \"../errors\";\nimport { parseVpToken } from \"../vp-token/parse-vp-token\";\nimport { Openid4vpAuthorizationResponse } from \"./z-authorization-response\";\n\nexport interface ValidateOpenid4vpAuthorizationResponseOptions {\n  /**\n   * Parsed request payload used as validation source.\n   */\n  authorizationRequestPayload: Openid4vpAuthorizationRequestPayload;\n  /**\n   * Parsed authorization response payload to validate.\n   */\n  authorizationResponsePayload: Openid4vpAuthorizationResponse;\n}\n\n/**\n * Result of authorization response validation.\n */\nexport interface ValidateOpenid4vpAuthorizationResponseResult {\n  presentations: ReturnType<typeof parseVpToken>;\n  query: Openid4vpAuthorizationRequestPayload[\"dcql_query\"];\n}\n\n/**\n * Validates the OpenID4VP authorization response payload against the request payload.\n *\n * @param options {@link ValidateOpenid4vpAuthorizationResponseOptions}\n * @returns Presentations and query extracted from the validated flow.\n * @throws {Oid4vpError} If `state` is present in the request and does not match the response.\n */\nexport function validateOpenid4vpAuthorizationResponsePayload(\n  options: ValidateOpenid4vpAuthorizationResponseOptions,\n): ValidateOpenid4vpAuthorizationResponseResult {\n  const { authorizationRequestPayload, authorizationResponsePayload } = options;\n\n  if (\n    authorizationRequestPayload.state !== authorizationResponsePayload.state\n  ) {\n    throw new Oid4vpError(\"OpenId4Vp Authorization Response state mismatch.\");\n  }\n\n  const presentations = parseVpToken(authorizationResponsePayload.vp_token);\n\n  return {\n    presentations,\n    query: authorizationRequestPayload.dcql_query,\n  };\n}\n","import { jwtSignerFromJwt } from \"@openid4vc/oauth2\";\nimport {\n  type CallbackContext,\n  type Jwk,\n  Oauth2Error,\n  decodeJwt,\n  decodeJwtHeader,\n  zCompactJwe,\n  zCompactJwt,\n  zJwtHeader,\n} from \"@pagopa/io-wallet-oauth2\";\nimport { stringToJsonWithErrorHandling } from \"@pagopa/io-wallet-utils\";\nimport z from \"zod\";\n\nimport { Openid4vpAuthorizationRequestPayload } from \"../authorization-request/z-authorization-request\";\nimport { extractEncryptionJwkFromJwks } from \"./jarm-extract-jwks\";\nimport {\n  JarmAuthorizationResponse,\n  JarmAuthorizationResponseEncryptedOnly,\n  zEncryptedJarmHeader,\n  zJarmAuthorizationResponse,\n  zJarmAuthorizationResponseEncryptedOnly,\n} from \"./z-jarm\";\n\n/**\n * Supported JARM serialization/processing modes.\n */\nexport enum JarmMode {\n  Encrypted = \"Encrypted\",\n  Signed = \"Signed\",\n  SignedEncrypted = \"SignedEncrypted\",\n}\n\nconst decryptJarmAuthorizationResponseJwt = async (options: {\n  authorizationRequestPayload: Openid4vpAuthorizationRequestPayload;\n  callbacks: Pick<CallbackContext, \"decryptJwe\">;\n  jarmAuthorizationResponseJwt: string;\n}) => {\n  const {\n    authorizationRequestPayload,\n    callbacks,\n    jarmAuthorizationResponseJwt,\n  } = options;\n\n  let encryptionJwk: Jwk | undefined;\n  const { header } = decodeJwtHeader({\n    headerSchema: zEncryptedJarmHeader,\n    jwt: jarmAuthorizationResponseJwt,\n  });\n\n  const jwks = authorizationRequestPayload.client_metadata?.jwks;\n\n  if (jwks) {\n    encryptionJwk = extractEncryptionJwkFromJwks(jwks, { kid: header.kid });\n  }\n\n  const result = await callbacks.decryptJwe(jarmAuthorizationResponseJwt, {\n    jwk: encryptionJwk,\n  });\n\n  if (!result.decrypted) {\n    throw new Oauth2Error(\"Failed to decrypt jarm auth response.\");\n  }\n\n  return {\n    decryptionJwk: result.decryptionJwk,\n    payload: result.payload,\n  };\n};\n\nexport interface VerifyJarmAuthorizationResponseOptions {\n  /**\n   * Parsed authorization request payload used to resolve metadata and key material.\n   */\n  authorizationRequestPayload: Openid4vpAuthorizationRequestPayload;\n  /**\n   * Callbacks required for JWE decryption and JWT signature verification.\n   */\n  callbacks: Pick<CallbackContext, \"decryptJwe\" | \"verifyJwt\">;\n  /**\n   * Compact serialized JARM response received from the verifier.\n   */\n  jarmAuthorizationResponseJwt: string;\n  /**\n   * Current time used for temporal claim validation (`exp`, `nbf`).\n   * Defaults to current date-time when omitted.\n   */\n  now?: Date;\n}\n\n/**\n * Verified JARM authorization response data returned by {@link verifyJarmAuthorizationResponse}.\n */\nexport interface VerifyJarmAuthorizationResponseResult {\n  /**\n   * JWK used for decryption when the response is encrypted, or `undefined` if the response was not encrypted.\n   */\n  decryptionJwk: Jwk | undefined;\n  /**\n   * The `iss` claim from the JARM response, representing the issuer of the response.\n   */\n  issuer: string | undefined;\n  /**\n   * The parsed JARM authorization response body, containing claims like `iss`, `aud`, `exp`, etc.\n   */\n  jarmAuthorizationResponse:\n    | JarmAuthorizationResponse\n    | JarmAuthorizationResponseEncryptedOnly;\n  /**\n   * Detected JARM processing mode indicating whether the response was signed, encrypted, or both.\n   */\n  type: JarmMode;\n}\n\n/**\n * Verifies a JARM authorization response in signed, encrypted, or signed+encrypted mode.\n *\n * The function detects the response mode, performs decryption when needed, verifies\n * JWS signatures for signed payloads, and returns the parsed JARM body with metadata.\n *\n * @param options {@link VerifyJarmAuthorizationResponseOptions}\n * @returns Decryption and verification artifacts with parsed JARM payload.\n * @throws {Oauth2Error} If the response mode is invalid, decryption fails, or signature verification fails.\n */\nexport async function verifyJarmAuthorizationResponse(\n  options: VerifyJarmAuthorizationResponseOptions,\n) {\n  const {\n    authorizationRequestPayload,\n    callbacks,\n    jarmAuthorizationResponseJwt,\n  } = options;\n\n  const requestDataIsEncrypted = zCompactJwe.safeParse(\n    jarmAuthorizationResponseJwt,\n  ).success;\n  const decryptedRequestData = requestDataIsEncrypted\n    ? await decryptJarmAuthorizationResponseJwt({\n        authorizationRequestPayload,\n        callbacks,\n        jarmAuthorizationResponseJwt,\n      })\n    : { decryptionJwk: undefined, payload: jarmAuthorizationResponseJwt };\n\n  const responseIsSigned = zCompactJwt.safeParse(\n    decryptedRequestData.payload,\n  ).success;\n\n  if (!requestDataIsEncrypted && !responseIsSigned) {\n    throw new Oauth2Error(\n      \"Jarm Auth Response must be either encrypted, signed, or signed and encrypted.\",\n    );\n  }\n\n  let jarmAuthorizationResponse:\n    | JarmAuthorizationResponse\n    | JarmAuthorizationResponseEncryptedOnly;\n\n  if (responseIsSigned) {\n    const { header: jwsProtectedHeader, payload: jwsPayload } = decodeJwt({\n      errorMessagePrefix: \"Error decoding JARM authorization response JWT:\",\n      headerSchema: z.object({ ...zJwtHeader.shape, kid: z.string() }),\n      jwt: decryptedRequestData.payload,\n    });\n\n    const response = zJarmAuthorizationResponse.parse(jwsPayload);\n    const jwtSigner = jwtSignerFromJwt({\n      header: jwsProtectedHeader,\n      payload: jwsPayload,\n    });\n\n    const verificationResult = await options.callbacks.verifyJwt(jwtSigner, {\n      compact: decryptedRequestData.payload,\n      header: jwsProtectedHeader,\n      payload: jwsPayload,\n    });\n\n    if (!verificationResult.verified) {\n      throw new Oauth2Error(\"Jarm Auth Response is not valid.\");\n    }\n\n    const expectedAudience = authorizationRequestPayload.client_id;\n    const expectedIssuer = authorizationRequestPayload.iss;\n    if (response.aud !== expectedAudience) {\n      throw new Oauth2Error(\n        `Jarm Auth Response contains 'aud' value '${response.aud}', but expected '${expectedAudience}'.`,\n      );\n    }\n\n    if (expectedIssuer && response.iss !== expectedIssuer) {\n      throw new Oauth2Error(\n        `Jarm Auth Response contains 'iss' value '${response.iss}', but expected '${expectedIssuer}'.`,\n      );\n    }\n\n    const now = options.now ?? new Date();\n    const nowSeconds = Math.floor(now.getTime() / 1000);\n    if (response.exp < nowSeconds) {\n      throw new Oauth2Error(\"Jarm Auth Response has expired.\");\n    }\n\n    if (response.nbf !== undefined && response.nbf > nowSeconds) {\n      throw new Oauth2Error(\"Jarm Auth Response is not active yet.\");\n    }\n\n    jarmAuthorizationResponse = response;\n  } else {\n    const jsonRequestData = stringToJsonWithErrorHandling(\n      decryptedRequestData.payload,\n      \"Unable to parse decrypted JARM JWE body to JSON\",\n    );\n    jarmAuthorizationResponse =\n      zJarmAuthorizationResponseEncryptedOnly.parse(jsonRequestData);\n  }\n\n  const type: JarmMode =\n    requestDataIsEncrypted && responseIsSigned\n      ? JarmMode.SignedEncrypted\n      : requestDataIsEncrypted\n        ? JarmMode.Encrypted\n        : JarmMode.Signed;\n\n  const issuer = jarmAuthorizationResponse.iss;\n\n  return {\n    decryptionJwk: decryptedRequestData.decryptionJwk,\n    issuer,\n    jarmAuthorizationResponse,\n    type,\n  };\n}\n","import { zJwtHeader, zJwtPayload } from \"@pagopa/io-wallet-oauth2\";\nimport { z } from \"zod\";\n\nexport const zJarmHeader = z.object({\n  ...zJwtHeader.shape,\n  apu: z.string().optional(),\n  apv: z.string().optional(),\n  kid: z.string(),\n});\n\nexport type JarmHeader = z.infer<typeof zJarmHeader>;\n\nexport const zEncryptedJarmHeader = z.object({\n  ...zJwtHeader.shape,\n  apu: z.string().optional(),\n  apv: z.string().optional(),\n  enc: z.string().optional(),\n  kid: z.string(),\n});\n\nexport type EncryptedJarmHeader = z.infer<typeof zEncryptedJarmHeader>;\n\nexport const zJarmAuthorizationResponse = z.looseObject({\n  /**\n   * iss: The issuer URL of the authorization server that created the response\n   * aud: The client_id of the client the response is intended for\n   * exp: The expiration time of the JWT. A maximum JWT lifetime of 10 minutes is RECOMMENDED.\n   */\n  ...zJwtPayload.shape,\n  ...zJwtPayload.pick({ aud: true, exp: true, iss: true }).required().shape,\n  state: z.optional(z.string()),\n});\n\nexport type JarmAuthorizationResponse = z.infer<\n  typeof zJarmAuthorizationResponse\n>;\n\nexport const zJarmAuthorizationResponseEncryptedOnly = z.looseObject({\n  ...zJwtPayload.shape,\n  state: z.optional(z.string()),\n});\n\nexport type JarmAuthorizationResponseEncryptedOnly = z.infer<\n  typeof zJarmAuthorizationResponseEncryptedOnly\n>;\n","export * from \"./authorization-request/create-authorization-request\";\nexport * from \"./authorization-request/fetch-authorization-request\";\nexport * from \"./authorization-request/parse-authorization-request\";\nexport * from \"./authorization-request/validate-authorization-request\";\nexport * from \"./authorization-request/validate-certificate-endpoints\";\nexport * from \"./authorization-request/z-authorization-request\";\nexport * from \"./authorization-request/z-authorization-request-url\";\nexport * from \"./authorization-response/create-authorization-response\";\nexport * from \"./authorization-response/fetch-authorization-response\";\nexport * from \"./authorization-response/parse-authorization-response\";\nexport * from \"./authorization-response/validate-authorization-response\";\nexport * from \"./authorization-response/z-authorization-response\";\nexport * from \"./errors\";\nexport * from \"./jarm/jarm-extract-jwks\";\nexport * from \"./jarm/parse-jarm-authorization-response\";\nexport * from \"./jarm/verify-jarm-authorization-response\";\nexport * from \"./jarm/z-jarm\";\nexport * from \"./vp-token/parse-vp-token\";\nexport * from \"./vp-token/z-vp-token\";\n\nexport {\n  type CreateOpenid4vpAuthorizationResponseOptions,\n  type CreateOpenid4vpAuthorizationResponseResult,\n  type VpToken,\n  createOpenid4vpAuthorizationResponse,\n} from \"@openid4vc/openid4vp\";\n"],"mappings":";AAAA;AAAA,EAOE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;;;ACfA,IAAM,cAAN,cAA0B,MAAM;AAAA,EAC5B;AAAA,EACT,YACE,SACA,SACA;AACA,UAAM,SAAS,OAAO;AACtB,SAAK,OAAO;AACZ,SAAK,aAAa,SAAS;AAAA,EAC7B;AACF;AAOO,IAAM,6BAAN,cAAyC,YAAY;AAAA,EACjD;AAAA,EACT,YACE,SACA,SACA;AACA,UAAM,SAAS,OAAO;AACtB,SAAK,OAAO;AACZ,SAAK,aAAa,SAAS;AAAA,EAC7B;AACF;AAKO,IAAM,kCAAN,cAA8C,YAAY;AAAA,EACtD;AAAA,EACT,YACE,SACA,SACA;AACA,UAAM,SAAS,OAAO;AACtB,SAAK,OAAO;AACZ,SAAK,aAAa,SAAS;AAAA,EAC7B;AACF;AAMO,IAAM,mCAAN,cAA+C,YAAY;AAAA,EACvD;AAAA,EACT,YACE,SACA,SACA;AACA,UAAM,SAAS,OAAO;AACtB,SAAK,OAAO;AACZ,SAAK,aAAa,SAAS;AAAA,EAC7B;AACF;AAMO,IAAM,+BAAN,cAA2C,YAAY;AAAA,EAC5D,YAAY,SAAiB,SAAwB;AACnD,UAAM,SAAS,OAAO;AACtB,SAAK,OAAO;AAAA,EACd;AACF;;;ACxEA;AAAA,EACE;AAAA,EAEA;AAAA,EACA;AAAA,OACK;AAQA,IAAK,iBAAL,kBAAKA,oBAAL;AACL,EAAAA,gBAAA,UAAO;AACP,EAAAA,gBAAA,uBAAoB;AACpB,EAAAA,gBAAA,eAAY;AAHF,SAAAA;AAAA,GAAA;AAgBL,SAAS,sBAAsB,UAAiC;AACrE,QAAM,aAAa,SAAS,QAAQ,GAAG;AAEvC,MAAI,eAAe,IAAI;AACrB,WAAO,EAAE,UAAU,QAAQ,kBAAoB;AAAA,EACjD;AAEA,MAAI,SAAS,WAAW,UAAU,KAAK,SAAS,WAAW,SAAS,GAAG;AACrE,WAAO,EAAE,UAAU,QAAQ,kBAAoB;AAAA,EACjD;AAEA,QAAM,YAAY,SAAS,MAAM,GAAG,UAAU;AAC9C,QAAM,OAAO,SAAS,MAAM,aAAa,CAAC;AAE1C,MAAI,cAAc,6BAA0B;AAC1C,WAAO,EAAE,UAAU,MAAM,QAAQ,4BAAyB;AAAA,EAC5D;AACA,MAAI,cAAc,6CAAkC;AAClD,WAAO,EAAE,UAAU,MAAM,QAAQ,4CAAiC;AAAA,EACpE;AAEA,QAAM,IAAI;AAAA,IACR,iCAAiC,SAAS;AAAA,EAC5C;AACF;AAEA,eAAsB,uBACpB,SACiB;AACjB,SAAO,GAAG,2BAAwB,IAAI,MAAM,6BAA6B,OAAO,CAAC;AACnF;AAEA,eAAe,6BACb,SACA;AACA,QAAM,kBAAkB,mBAAmB,QAAQ,gBAAgB;AAEnE,SAAO;AAAA,IACL,MAAM,QAAQ,KAAK,aAAa,eAAe,GAAG,cAAc,MAAM;AAAA,EACxE;AACF;AAEA,eAAsB,0CAA0C,SAIrC;AACzB,QAAM,gBAAgB,sBAAsB,QAAQ,QAAQ,SAAS;AAErE,MAAI,cAAc,WAAW,6BAA0B;AACrD,WAAO;AAAA,EACT;AAEA,QAAM,EAAE,IAAI,IAAI,QAAQ;AACxB,MAAI,CAAC,MAAM,QAAQ,GAAG,KAAK,IAAI,WAAW,GAAG;AAC3C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,QAAQ,MAAM;AACjB,WAAO;AAAA,EACT;AAEA,QAAM,0BAA0B,MAAM,6BAA6B;AAAA,IACjE,kBAAkB;AAAA,IAClB,MAAM,QAAQ;AAAA,EAChB,CAAC;AAED,MAAI,4BAA4B,cAAc,UAAU;AACtD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,mBAAmB,kBAA4B;AACtD,QAAM,kBAAkB,iBAAiB,CAAC;AAE1C,MAAI,CAAC,iBAAiB;AACpB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;;;ACrHA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,8CAA8C;AACvD,SAAS,SAAS;AAOlB,IAAM,uCACJ,uCAAuC,QAAQ;AAAA,EAC7C,kBAAkB;AAAA,EAClB,WAAW;AAAA,EACX,aAAa;AAAA,EACb,UAAU;AAAA,EACV,cAAc;AAAA,EACd,eAAe;AACjB,CAAC;AAMI,IAAM,wCAAwC,EAClD,YAAY;AAAA,EACX,WAAW,EAAE,OAAO;AAAA,EACpB,iBAAiB,qCAAqC,SAAS;AAAA,EAC/D,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,IAAI,CAAC;AAAA,EACxC,OAAO,EAAE,OAAO;AAAA,EAChB,aAAa,EAAE,IAAI,EAAE,SAAS;AAAA,EAC9B,oBAAoB,EAAE,SAAS,EAAE,OAAO,CAAC;AAAA,EACzC,eAAe,EAAE,QAAQ,iBAAiB;AAAA,EAC1C,eAAe,EAAE,QAAQ,UAAU;AAAA,EACnC,cAAc,EAAE,IAAI;AAAA,EACpB,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,kBAAkB,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1D,6BAA6B,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EAC1D,cAAc,EAAE,OAAO,EAAE,SAAS;AACpC,CAAC,EACA;AAAA,EACC,EAAE,OAAO;AAAA,IACP,GAAG,YAAY;AAAA,EACjB,CAAC;AACH;AAMF,IAAM,2CAA2C,EAAE,OAAO;AAAA,EACxD,KAAK;AAAA,EACL,KAAK,EAAE,OAAO;AAAA,EACd,KAAK;AACP,CAAC;AAEM,IAAM,2CACX,yCACG,OAAO;AAAA,EACN,aAAa;AACf,CAAC,EACA,MAAM;AAMJ,IAAM,2CACX,yCACG,OAAO;AAAA;AAAA,EAEN,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,aAAa,YAAY,SAAS;AAAA,EAClC,KAAK,kBAAkB,SAAS;AAClC,CAAC,EACA,MAAM;;;AHwDX,IAAM,qCAAqC,wBAGzC;AAAA,EACA,CAAC,qBAAqB,IAAI,GAAG,OAAO,MAClC;AAAA,IACE;AAAA,IACA;AAAA,EACF;AAAA,EACF,CAAC,qBAAqB,IAAI,GAAG,OAAO,MAClC;AAAA,IACE;AAAA,IACA;AAAA,EACF;AAAA;AAAA,EAEF,CAAC,qBAAqB,IAAI,GAAG,OAAO,MAClC;AAAA,IACE;AAAA,IACA;AAAA,EACF;AACJ,CAAC;AAwBD,eAAsB,2BACpB,SAC2C;AAC3C,MAAI;AACF,WAAO,MAAM,mCAAmC,OAAO;AAAA,EACzD,SAAS,OAAO;AACd,QAAI,iBAAiB,iBAAiB;AACpC,YAAM,IAAI,YAAY,kCAAkC,MAAM,OAAO,EAAE;AAAA,IACzE;AACA,UAAM;AAAA,EACR;AACF;AAEA,eAAe,qCACb,SACA,cAGqD;AACrD,QAAM,EAAE,WAAW,KAAK,SAAS,eAAe,IAAI;AAEpD,QAAM,6BAA6B,uBAAuB,cAAc;AAAA,IACtE,GAAG,uBAAuB,IAAI,SAAS;AAAA,IACvC,KAAK;AAAA,EACP,CAAC;AAED,QAAM,8BAA8B;AAAA,IAClC;AAAA,IACA,QAAQ;AAAA,EACV;AAEA;AAAA,IACE,QAAQ,OAAO;AAAA,IACf,IAAI;AAAA,IACJ;AAAA,EACF;AAEA,4CAA0C;AAAA,IACxC,MAAM,QAAQ,UAAU;AAAA,IACxB,QAAQ;AAAA,IACR,SAAS;AAAA,EACX,CAAC;AAED,QAAM,uBAAuB,CAAC,IAAI,sBAAsB,MACpD,EAAE,GAAG,IAAI,sBAAsB,KAAK,IAAI,WAAW,IACnD,IAAI;AAER,QAAM,YAAY,MAAM,iBAAiB;AAAA,IACvC,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,SAAO;AAAA,IACL,sBAAsB;AAAA,MACpB;AAAA,MACA,UAAU;AAAA,IACZ;AAAA,IACA,4BAA4B,UAAU;AAAA,IACtC;AAAA,IACA,KAAK,EAAE,GAAG,KAAK,GAAG,UAAU;AAAA,EAC9B;AACF;AAEA,SAAS,8BACP,QACA,SACA;AACA,QAAM,MAAM,IAAI,IAAI,MAAM;AAE1B,QAAM,eAAe,IAAI,gBAAgB;AAAA,IACvC,GAAG,IAAI,aAAa,QAAQ;AAAA,IAC5B,GAAG,oBAAoB,OAAO,EAAE,QAAQ;AAAA,EAC1C,CAAC;AAED,MAAI,SAAS,aAAa,SAAS;AAEnC,SAAO,IAAI,SAAS;AACtB;AAEA,SAAS,yCACP,cACA,WACA,SACA;AACA,MAAI,iBAAiB,qBAAqB,MAAM;AAC9C;AAAA,EACF;AAEA,QAAM,EAAE,OAAO,IAAI,sBAAsB,QAAQ,SAAS;AAE1D,MAAI,0CAAuC,UAAU,WAAW,OAAO;AACrE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,MACE,0CACA,UAAU,WAAW,cACrB;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;;;AIhSA,SAA+B,2BAA2B;AAC1D;AAAA,EACE;AAAA,EACA,mBAAAC;AAAA,EACA;AAAA,EACA;AAAA,OACK;;;ACWA,SAAS,mCACd,QACA;AAEA,MAAI,OAAO,WAAW,OAAO,aAAa;AACxC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAGA,MAAI,CAAC,OAAO,WAAW,CAAC,OAAO,aAAa;AAC1C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAGA,MAAI,OAAO,oBAAoB;AAC7B,UAAMC,oBAAmB,OAAO,mBAAmB,YAAY;AAC/D,QAAIA,sBAAqB,SAASA,sBAAqB,QAAQ;AAC7D,YAAM,IAAI;AAAA,QACR,gCAAgC,OAAO,kBAAkB;AAAA,MAC3D;AAAA,IACF;AAAA,EACF;AAGA,MAAI,OAAO,sBAAsB,CAAC,OAAO,aAAa;AACpD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAGA,QAAM,mBAAmB,OAAO,qBAC3B,OAAO,mBAAmB,YAAY,IACvC;AAEJ,SAAO;AAAA,IACL,GAAG;AAAA,IACH,oBAAoB;AAAA,EACtB;AASF;;;AC1CA,eAAsB,6BACpB,SACe;AACf,QAAM,WAAW,MAAM,QAAQ,UAAU;AAAA,IACvC,QAAQ;AAAA,EACV;AAEA,aAAW,YAAY,QAAQ,WAAW;AACxC,QAAI,CAAC,SAAS,KAAK;AACjB;AAAA,IACF;AAEA;AAAA,MACE,EAAE,MAAM,SAAS,MAAM,KAAK,SAAS,IAAI;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,gCACP,UACA,UACA;AACA,QAAM,cAAc,iBAAiB,QAAQ;AAC7C,QAAM,cAAc,SAAS,eAAe,CAAC;AAC7C,QAAM,gBAAgB,YAAY;AAAA,IAChC,CAAC,eAAe,0BAA0B,UAAU,MAAM,YAAY;AAAA,EACxE;AACA,QAAM,cAAc,SAAS,eAAe,CAAC;AAC7C,QAAM,gBAAgB,YAAY;AAAA,IAAK,CAAC,eACtC,sBAAsB,YAAY,YAAY,QAAQ;AAAA,EACxD;AAEA,MAAI,iBAAiB,eAAe;AAClC;AAAA,EACF;AAEA,QAAM,IAAI;AAAA,IACR,GAAG,SAAS,IAAI;AAAA,EAClB;AACF;AAEA,SAAS,0BAA0B,KAAa;AAC9C,MAAI;AACF,WAAO,IAAI,IAAI,GAAG,EAAE;AAAA,EACtB,SAAS,OAAO;AACd,UAAM,IAAI,YAAY,2CAA2C,GAAG,IAAI;AAAA,MACtE,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACF;AAEA,SAAS,sBAAsB,YAAoB,UAAkB;AACnE,QAAM,uBAAuB,WAAW,YAAY;AACpD,QAAM,qBAAqB,SAAS,YAAY;AAEhD,MAAI,yBAAyB,oBAAoB;AAC/C,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,qBAAqB,SAAS,GAAG,GAAG;AACvC,WAAO;AAAA,EACT;AAEA,QAAM,gBAAgB,CAAC,GAAG,oBAAoB,EAAE;AAAA,IAC9C,CAAC,cAAc,cAAc;AAAA,EAC/B,EAAE;AACF,QAAM,YAAY,qBAAqB,MAAM,GAAG;AAChD,QAAM,iBAAiB,mBAAmB,MAAM,GAAG;AAEnD,SACE,kBAAkB,KAClB,UAAU,CAAC,MAAM,OACjB,UAAU,WAAW,eAAe,UACpC,UACG,MAAM,CAAC,EACP,MAAM,CAAC,OAAO,UAAU,UAAU,eAAe,QAAQ,CAAC,CAAC;AAElE;AAEA,SAAS,iBAAiB,UAAyC;AACjE,MAAI;AACF,WAAO,IAAI,IAAI,SAAS,GAAG;AAAA,EAC7B,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR,GAAG,SAAS,IAAI,wBAAwB,SAAS,GAAG;AAAA,MACpD,EAAE,OAAO,MAAM;AAAA,IACjB;AAAA,EACF;AACF;;;ACnHA,OAAOC,QAAO;AAMP,IAAM,iCAAiCA,GAAE,YAAY;AAAA,EAC1D,WAAWA,GAAE,OAAO;AAAA,EACpB,SAASA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAC7B,aAAaA,GAAE,IAAI,EAAE,SAAS;AAAA;AAAA,EAC9B,oBAAoBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EACxC,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA;AAC7B,CAAC;;;AH8FM,SAAS,mBAAmB,qBAA2C;AAC5E,QAAM,MAAM,IAAI,IAAI,mBAAmB;AAEvC,QAAM,YAAY;AAAA,IAChB,WAAW,IAAI,aAAa,IAAI,WAAW,KAAK;AAAA,IAChD,SAAS,IAAI,aAAa,IAAI,SAAS,KAAK;AAAA,IAC5C,aAAa,IAAI,aAAa,IAAI,aAAa,KAAK;AAAA,IACpD,oBAAoB,IAAI,aAAa,IAAI,oBAAoB,KAAK;AAAA,IAClE,OAAO,IAAI,aAAa,IAAI,OAAO,KAAK;AAAA,EAC1C;AAEA,QAAM,eAAe,+BAA+B,MAAM,SAAS;AACnE,QAAM,kBAAkB,mCAAmC,YAAY;AACvE,QAAM,SAAS,gBAAgB,UAAU,UAAU;AAEnD,SAAO;AAAA,IACL,UAAU,gBAAgB;AAAA,IAC1B,SAAS,gBAAgB;AAAA,IACzB,YAAY,gBAAgB;AAAA,IAC5B,kBACE,WAAW,cACN,gBAAgB,sBAAsB,QACvC;AAAA,EACR;AACF;AAYA,eAAsB,sBACpB,YACA,SAMiB;AACjB,QAAM,QAAQ,cAAc,QAAQ,KAAK;AAGzC,QAAM,cAA2B;AAAA,IAC/B,QAAQ,QAAQ,OAAO,YAAY;AAAA,EACrC;AAGA,MAAI,QAAQ,WAAW,QAAQ;AAC7B,UAAM,WAAW,IAAI,gBAAgB;AAGrC,QAAI,QAAQ,gBAAgB;AAC1B,eAAS;AAAA,QACP;AAAA,QACA,KAAK,UAAU,QAAQ,cAAc;AAAA,MACvC;AAAA,IACF;AAGA,QAAI,QAAQ,aAAa;AACvB,eAAS,OAAO,gBAAgB,QAAQ,WAAW;AAAA,IACrD;AAEA,gBAAY,UAAU;AAAA,MACpB,gBAAgB;AAAA,IAClB;AACA,gBAAY,OAAO,SAAS,SAAS;AAAA,EACvC;AAEA,QAAM,WAAW,MAAM,MAAM,YAAY,WAAW;AAEpD,QAAM,iBAAiB,KAAK,yBAAyB,EAAE,QAAQ;AAE/D,SAAO,MAAM,SAAS,KAAK;AAC7B;AA0DA,eAAsB,0BACpB,SAC0C;AAC1C,MAAI;AACF,UAAM,eAAe,mBAAmB,QAAQ,mBAAmB;AAGnE,QAAI;AACJ,QAAI,aAAa,SAAS;AACxB,yBAAmB,aAAa;AAAA,IAClC,OAAO;AACL,UAAI,QAAQ,iBAAiB;AAC3B,cAAM,6BAA6B;AAAA,UACjC,WAAW,QAAQ,gBAAgB;AAAA,UACnC,aAAa,QAAQ,gBAAgB;AAAA,UACrC,WAAW;AAAA,YACT;AAAA,cACE,MAAM;AAAA,cACN,KAAK,aAAa;AAAA,YACpB;AAAA,UACF;AAAA,QACF,CAAC;AAAA,MACH;AAGA,yBAAmB,MAAM;AAAA,QACvB,aAAa;AAAA,QACb;AAAA,UACE,OAAO,QAAQ,UAAU;AAAA,UACzB,QAAQ,aAAa,oBAAoB;AAAA,UACzC,gBAAgB,QAAQ;AAAA,UACxB,aAAa,QAAQ;AAAA,QACvB;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,QAAQ,aAAa,UAAU,UAAU;AAAA,IAC3C;AAAA,EACF,SAAS,OAAO;AACd,QACE,iBAAiBC,oBACjB,iBAAiB,uBACjB,iBAAiB,eACjB,iBAAiB,2BACjB;AACA,YAAM;AAAA,IACR;AAEA,UAAM,IAAI;AAAA,MACR,wDAAwD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IAChH;AAAA,EACF;AACF;;;AI3SA;AAAA,EAGE,uBAAAC;AAAA,EACA;AAAA,OACK;AACP,SAAS,iBAAiB;AAC1B;AAAA,EAEE,wBAAAC;AAAA,EACA;AAAA,EACA,mBAAAC;AAAA,EACA;AAAA,OACK;AA0CP,SAAS,4BAA4B,SAGvB;AACZ,QAAM,EAAE,QAAQ,QAAQ,IAAI;AAE5B,QAAM,EAAE,QAAQ,eAAe,IAAI,sBAAsB,QAAQ,SAAS;AAE1E,MACE,kEACA,sCACA;AACA,QAAI,CAAC,OAAO,KAAK;AACf,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL,KAAK,OAAO;AAAA,MACZ,KAAK,OAAO;AAAA,MACZ,QAAQ;AAAA,MACR,GAAI,OAAO,eAAe,EAAE,YAAY,OAAO,YAAY;AAAA,IAC7D;AAAA,EACF;AAEA,MAAI,gDAA6C;AAC/C,QAAI,CAAC,MAAM,QAAQ,OAAO,GAAG,KAAK,OAAO,IAAI,WAAW,GAAG;AACzD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL,KAAK,OAAO;AAAA,MACZ,KAAK,OAAO;AAAA,MACZ,QAAQ;AAAA,MACR,GAAI,OAAO,eAAe,EAAE,YAAY,OAAO,YAAY;AAAA,MAC3D,KAAK,OAAO;AAAA,IACd;AAAA,EACF;AAEA,QAAM,IAAI;AAAA,IACR,2FACE;AAAA,EACJ;AACF;AA0DA,eAAsB,sBACpB,SACuC;AACvC,MAAI;AACF,UAAM,eAAe,kBAGnB,QAAQ,OAAO,sBAAsB;AAAA,MACrC,CAACC,sBAAqB,IAAI,GAAG,MAC3B;AAAA,MACF,CAACA,sBAAqB,IAAI,GAAG,MAC3B;AAAA,MACF,CAACA,sBAAqB,IAAI,GAAG,MAC3B;AAAA,IACJ,CAAC;AAED,UAAM,UAAU,UAAU;AAAA,MACxB,oBAAoB;AAAA,MACpB;AAAA,MACA,KAAK,QAAQ;AAAA,MACb,eAAe;AAAA,IACjB,CAAC;AAED,QAAI,QAAQ,OAAO,yBAAyBA,sBAAqB,MAAM;AACrE,YAAM,0CAA0C;AAAA,QAC9C,MAAM,QAAQ,WAAW;AAAA,QACzB,QAAQ,QAAQ;AAAA,QAChB,SAAS,QAAQ;AAAA,MACnB,CAAC;AAAA,IACH;AAEA,UAAM,MACJ,SAAS,QAAQ,UACjB,MAAM,QAAQ,QAAQ,OAAO,GAAG,KAChC,QAAQ,OAAO,IAAI,SAAS,IACvB,QAAQ,OAAO,MAChB;AAEN,QAAI,OAAO,QAAQ,WAAW,4BAA4B;AACxD,YAAM,6BAA6B;AAAA,QACjC,WAAW;AAAA,UACT,4BACE,QAAQ,UAAU;AAAA,QACtB;AAAA,QACA,aAAa,IAAI,CAAC;AAAA,QAClB,WAAW;AAAA,UACT,EAAE,MAAM,eAAe,KAAK,QAAQ,QAAQ,YAAY;AAAA,UACxD,EAAE,MAAM,gBAAgB,KAAK,QAAQ,QAAQ,aAAa;AAAA,QAC5D;AAAA,MACF,CAAC;AAAA,IACH;AAEA,QAAI,QAAQ,WAAW,WAAW;AAChC,YAAM,SAAS,4BAA4B;AAAA,QACzC,QAAQ,QAAQ;AAAA,QAChB,SAAS,QAAQ;AAAA,MACnB,CAAC;AAED,YAAM,UAAU;AAAA,QACd,SAAS,QAAQ;AAAA,QACjB,cAAc;AAAA,QACd,QAAQ,QAAQ;AAAA,QAChB,SAAS,QAAQ;AAAA,QACjB;AAAA,QACA,mBAAmB,QAAQ,UAAU;AAAA,MACvC,CAAC;AAAA,IACH;AAEA,WAAO;AAAA,MACL,QAAQ,QAAQ;AAAA,MAChB,SAAS,QAAQ;AAAA,MACjB,GAAI,OAAO;AAAA,QACT,iBAAiB;AAAA,UACf,iBAAiB,IAAI,CAAC;AAAA,UACtB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,QACE,iBAAiB,6BACjB,iBAAiBC,oBACjB,iBAAiBC,wBACjB,iBAAiB;AAEjB,YAAM;AACR,UAAM,IAAI;AAAA,MACR,mDAAmD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IAC3G;AAAA,EACF;AACF;;;ACzPA;AAAA,EACE,wBAAAC;AAAA,EACA,2BAAAC;AAAA,OACK;;;ACAP,SAAS,qBAAAC,0BAAyB;;;ACW3B,SAAS,6BACd,MACA;AAAA,EACE;AAAA,EACA;AACF,GAIA;AACA,MAAI,KAAK;AACP,WAAO,KAAK,KAAK,KAAK,CAAC,QAAQ,IAAI,QAAQ,GAAG;AAAA,EAChD;AAEA,MAAI,cAAc,KAAK,KAAK;AAAA,IAC1B,CAAC,QAAQ,IAAI,OAAO,oBAAoB,SAAS,IAAI,GAAG;AAAA,EAC1D;AACA,MAAI,YAAY,WAAW,EAAG,eAAc,KAAK;AAEjD,MAAI,cAAc,YAAY,OAAO,CAAC,QAAQ,IAAI,QAAQ,KAAK;AAC/D,MAAI,YAAY,WAAW,GAAG;AAC5B,kBAAc,YAAY,OAAO,CAAC,QAAQ,IAAI,QAAQ,KAAK;AAAA,EAC7D;AAEA,SAAO,YAAY,SAAS,IAAI,YAAY,CAAC,IAAI,KAAK,KAAK,CAAC;AAC9D;;;ADjBA,SAAS,gBACP,WACA,WACA,UACQ;AACR,MAAI,CAAC,UAAW,QAAO,aAAa;AACpC,SACE,UAAU,KAAK,CAAC,MAAM,MAAM,SAAS,KACrC,UAAU,CAAC,KACX,aACA;AAEJ;AAOA,eAAsB,kBACpB,SAC4C;AAC5C,MAAI;AACF,UAAM,gBACJ,QAAQ,wCAAwC;AAClD,UAAM,gBACJ,QAAQ,wCAAwC;AAElD,UAAM,+BAA+B;AAAA,MACnC,OAAO,QAAQ,cAAc;AAAA,MAC7B,UAAU,QAAQ;AAAA,IACpB;AAEA,UAAM,gBAAgB,6BAA6B,QAAQ,gBAAgB;AAAA,MACzE,oBAAoB,CAAC,aAAa;AAAA,IACpC,CAAC;AACD,QAAI,CAAC,eAAe;AAClB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,cAAc,KAAK;AACtB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,MAAM;AAAA,MACV,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,IACF;AAEA,UAAM,MAAM;AAEZ,UAAM,aAAa,MAAM,QAAQ,UAAU,eAAe,EAAE;AAE5D,UAAM,eAA6B;AAAA,MACjC;AAAA,MACA,KAAKC,mBAAkB,UAAU;AAAA,MACjC,KAAKA,mBAAkB,QAAQ,cAAc,KAAK;AAAA,MAClD;AAAA,MACA,KAAK,cAAc;AAAA,MACnB,QAAQ;AAAA,MACR,WAAW;AAAA,IACb;AAEA,UAAM,EAAE,eAAe,SAAS,IAAI,IAAI,MAAM,QAAQ,UAAU;AAAA,MAC9D;AAAA,MACA,KAAK,UAAU,4BAA4B;AAAA,IAC7C;AAEA,WAAO;AAAA,MACL;AAAA,MACA,MAAM;AAAA,QACJ,eAAe;AAAA,QACf,aAAa;AAAA,MACf;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,QAAI,iBAAiB,kCAAkC;AACrD,YAAM;AAAA,IACR;AACA,UAAM,IAAI;AAAA,MACR,4DAA4D,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IACpH;AAAA,EACF;AACF;;;AE5FA,eAAsB,4BACpB,SAC4C;AAC5C,QAAM,EAAE,cAAc,IAAI;AAC1B,QAAM,iBAAiB,cAAc;AACrC,QAAM,EAAE,QAAQ,eAAe,IAAI;AAAA,IACjC,cAAc;AAAA,EAChB;AAEA,MAAI,kDAA+C,CAAC,gBAAgB;AAClE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAKA,QAAM,0BACJ,iEACI,SACA;AAEN,QAAM,iBAAiB,0BACnB,wBAAwB,OACxB,QAAQ,OAAO;AAEnB,QAAM,qBACJ,yBAAyB,2CACzB,QAAQ,OAAO;AAEjB,SAAO,kBAAkB;AAAA,IACvB,sCACE,QAAQ;AAAA,IACV,sCACE,QAAQ;AAAA,IACV,WAAW,QAAQ;AAAA,IACnB;AAAA,IACA;AAAA,IACA,eAAe,QAAQ;AAAA,IACvB,UAAU,QAAQ;AAAA,EACpB,CAAC;AACH;;;ACvCA,eAAsBC,6BACpB,SAC4C;AAC5C,QAAM,EAAE,cAAc,IAAI;AAC1B,QAAM,iBAAiB,cAAc;AACrC,QAAM,EAAE,QAAQ,eAAe,IAAI;AAAA,IACjC,cAAc;AAAA,EAChB;AAEA,MAAI,kDAA+C,CAAC,gBAAgB;AAClE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,iBAAiB,gBAAgB,QAAQ,QAAQ,OAAO;AAE9D,QAAM,qBACJ,gBAAgB,2CAChB,QAAQ,OAAO;AAEjB,SAAO,kBAAkB;AAAA,IACvB,sCACE,QAAQ;AAAA,IACV,sCACE,QAAQ;AAAA,IACV,WAAW,QAAQ;AAAA,IACnB;AAAA,IACA;AAAA,IACA,eAAe,QAAQ;AAAA,IACvB,UAAU,QAAQ;AAAA,EACpB,CAAC;AACH;;;AJ9BA,IAAM,sCAAsCC,yBAG1C;AAAA,EACA,CAACC,sBAAqB,IAAI,GAAG,CAAC;AAAA;AAAA,IAEvB;AAAA,MACH;AAAA,IACF;AAAA;AAAA,EACF,CAACA,sBAAqB,IAAI,GAAG,CAAC,MACvB;AAAA,IACH;AAAA,EACF;AAAA,EACF,CAACA,sBAAqB,IAAI,GAAG,CAAC,MACvBC;AAAA,IACH;AAAA,EACF;AACJ,CAAC;AAgBD,eAAsBA,6BACpB,SAC4C;AAC5C,SAAO,oCAAoC,OAAO;AACpD;;;AK3DA;AAAA,EACE;AAAA,EACA;AAAA,EACA,6BAAAC;AAAA,EACA,mBAAAC;AAAA,EACA,iBAAAC;AAAA,EACA,oBAAAC;AAAA,EACA,0BAAAC;AAAA,OACK;;;ACTP,OAAOC,QAAO;;;ACAd,SAAS,KAAAC,UAAS;AAEX,IAAM,WAAWA,GAAE;AAAA,EACxBA,GAAE,OAAO;AAAA,EACTA,GAAE,OAAO,EAAE,GAAGA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS,CAAC;AAAA,EAC5C;AAAA,IACE,SACE;AAAA,EACJ;AACF;;;ADLO,IAAM,kCAAkCC,GAAE,OAAO;AAAA,EACtD,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,UAAU;AACZ,CAAC;AAMM,IAAM,wCAAwCA,GAAE,OAAO;AAAA,EAC5D,cAAcA,GAAE,IAAI,EAAE,SAAS;AACjC,CAAC;;;AD+CD,eAAsB,2BACpB,SAC+C;AAC/C,MAAI;AACF,QAAI,QAAQ,iBAAiB;AAC3B,YAAM,6BAA6B;AAAA,QACjC,WAAW,QAAQ,gBAAgB;AAAA,QACnC,aAAa,QAAQ,gBAAgB;AAAA,QACrC,WAAW;AAAA,UACT,EAAE,MAAM,gBAAgB,KAAK,QAAQ,wBAAwB;AAAA,QAC/D;AAAA,MACF,CAAC;AAAA,IACH;AAEA,UAAM,QAAQC,eAAc,QAAQ,UAAU,KAAK;AACnD,UAAM,8BAA8B,MAAM;AAAA,MACxC,QAAQ;AAAA,MACR;AAAA,QACE,MAAM,IAAI,gBAAgB;AAAA,UACxB,UAAU,QAAQ;AAAA,QACpB,CAAC;AAAA,QACD,SAAS;AAAA,UACP,CAAC,QAAQ,YAAY,GAAG,cAAc;AAAA,QACxC;AAAA,QACA,QAAQ;AAAA,MACV;AAAA,IACF;AAEA,UAAMC;AAAA,MACJ;AAAA,MACAC;AAAA,IACF,EAAE,2BAA2B;AAE7B,UAAM,kCACJ,MAAM,4BAA4B,KAAK;AAGzC,UAAM,oCAAoCC;AAAA,MACxC;AAAA,MACA;AAAA,IACF;AAEA,QAAI,QAAQ,iBAAiB;AAC3B,YAAM,6BAA6B;AAAA,QACjC,WAAW,QAAQ,gBAAgB;AAAA,QACnC,aAAa,QAAQ,gBAAgB;AAAA,QACrC,WAAW;AAAA,UACT;AAAA,YACE,MAAM;AAAA,YACN,KAAK,kCAAkC;AAAA,UACzC;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAEA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QACE,iBAAiBD,8BACjB,iBAAiBE,oBACjB,iBAAiB,iCACjB;AACA,YAAM;AAAA,IACR;AACA,UAAM,IAAI;AAAA,MACR,oDAAoD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IAC5G;AAAA,EACF;AACF;;;AGjIA,SAAS,0BAAAC,+BAA8B;;;ACDvC;AAAA,EAEE,mBAAAC;AAAA,EACA,eAAAC;AAAA,EACA,eAAAC;AAAA,OACK;AACP,SAAS,0BAAAC,+BAA8B;AACvC,OAAOC,QAAO;;;ACPd,SAAS,aAAa,0BAAAC,+BAA8B;AAW7C,SAAS,aAAa,SAAkB;AAC7C,SAAOC;AAAA,IACL;AAAA,IACA,YAAY,OAAO;AAAA,IACnB;AAAA,EACF;AACF;;;ACcO,SAAS,8CACd,SAC8C;AAC9C,QAAM,EAAE,6BAA6B,6BAA6B,IAAI;AAEtE,MACE,4BAA4B,UAAU,6BAA6B,OACnE;AACA,UAAM,IAAI,YAAY,kDAAkD;AAAA,EAC1E;AAEA,QAAM,gBAAgB,aAAa,6BAA6B,QAAQ;AAExE,SAAO;AAAA,IACL;AAAA,IACA,OAAO,4BAA4B;AAAA,EACrC;AACF;;;AChDA,SAAS,wBAAwB;AACjC;AAAA,EAGE;AAAA,EACA,aAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,cAAAC;AAAA,OACK;AACP,SAAS,qCAAqC;AAC9C,OAAOC,QAAO;;;ACZd,SAAS,YAAY,eAAAC,oBAAmB;AACxC,SAAS,KAAAC,UAAS;AAEX,IAAM,cAAcA,GAAE,OAAO;AAAA,EAClC,GAAG,WAAW;AAAA,EACd,KAAKA,GAAE,OAAO,EAAE,SAAS;AAAA,EACzB,KAAKA,GAAE,OAAO,EAAE,SAAS;AAAA,EACzB,KAAKA,GAAE,OAAO;AAChB,CAAC;AAIM,IAAM,uBAAuBA,GAAE,OAAO;AAAA,EAC3C,GAAG,WAAW;AAAA,EACd,KAAKA,GAAE,OAAO,EAAE,SAAS;AAAA,EACzB,KAAKA,GAAE,OAAO,EAAE,SAAS;AAAA,EACzB,KAAKA,GAAE,OAAO,EAAE,SAAS;AAAA,EACzB,KAAKA,GAAE,OAAO;AAChB,CAAC;AAIM,IAAM,6BAA6BA,GAAE,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtD,GAAGD,aAAY;AAAA,EACf,GAAGA,aAAY,KAAK,EAAE,KAAK,MAAM,KAAK,MAAM,KAAK,KAAK,CAAC,EAAE,SAAS,EAAE;AAAA,EACpE,OAAOC,GAAE,SAASA,GAAE,OAAO,CAAC;AAC9B,CAAC;AAMM,IAAM,0CAA0CA,GAAE,YAAY;AAAA,EACnE,GAAGD,aAAY;AAAA,EACf,OAAOC,GAAE,SAASA,GAAE,OAAO,CAAC;AAC9B,CAAC;;;ADbM,IAAK,WAAL,kBAAKC,cAAL;AACL,EAAAA,UAAA,eAAY;AACZ,EAAAA,UAAA,YAAS;AACT,EAAAA,UAAA,qBAAkB;AAHR,SAAAA;AAAA,GAAA;AAMZ,IAAM,sCAAsC,OAAO,YAI7C;AACJ,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AAEJ,MAAI;AACJ,QAAM,EAAE,OAAO,IAAI,gBAAgB;AAAA,IACjC,cAAc;AAAA,IACd,KAAK;AAAA,EACP,CAAC;AAED,QAAM,OAAO,4BAA4B,iBAAiB;AAE1D,MAAI,MAAM;AACR,oBAAgB,6BAA6B,MAAM,EAAE,KAAK,OAAO,IAAI,CAAC;AAAA,EACxE;AAEA,QAAM,SAAS,MAAM,UAAU,WAAW,8BAA8B;AAAA,IACtE,KAAK;AAAA,EACP,CAAC;AAED,MAAI,CAAC,OAAO,WAAW;AACrB,UAAM,IAAI,YAAY,uCAAuC;AAAA,EAC/D;AAEA,SAAO;AAAA,IACL,eAAe,OAAO;AAAA,IACtB,SAAS,OAAO;AAAA,EAClB;AACF;AAwDA,eAAsB,gCACpB,SACA;AACA,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AAEJ,QAAM,yBAAyB,YAAY;AAAA,IACzC;AAAA,EACF,EAAE;AACF,QAAM,uBAAuB,yBACzB,MAAM,oCAAoC;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,IACD,EAAE,eAAe,QAAW,SAAS,6BAA6B;AAEtE,QAAM,mBAAmB,YAAY;AAAA,IACnC,qBAAqB;AAAA,EACvB,EAAE;AAEF,MAAI,CAAC,0BAA0B,CAAC,kBAAkB;AAChD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AAIJ,MAAI,kBAAkB;AACpB,UAAM,EAAE,QAAQ,oBAAoB,SAAS,WAAW,IAAIC,WAAU;AAAA,MACpE,oBAAoB;AAAA,MACpB,cAAcC,GAAE,OAAO,EAAE,GAAGC,YAAW,OAAO,KAAKD,GAAE,OAAO,EAAE,CAAC;AAAA,MAC/D,KAAK,qBAAqB;AAAA,IAC5B,CAAC;AAED,UAAM,WAAW,2BAA2B,MAAM,UAAU;AAC5D,UAAM,YAAY,iBAAiB;AAAA,MACjC,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,UAAM,qBAAqB,MAAM,QAAQ,UAAU,UAAU,WAAW;AAAA,MACtE,SAAS,qBAAqB;AAAA,MAC9B,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,QAAI,CAAC,mBAAmB,UAAU;AAChC,YAAM,IAAI,YAAY,kCAAkC;AAAA,IAC1D;AAEA,UAAM,mBAAmB,4BAA4B;AACrD,UAAM,iBAAiB,4BAA4B;AACnD,QAAI,SAAS,QAAQ,kBAAkB;AACrC,YAAM,IAAI;AAAA,QACR,4CAA4C,SAAS,GAAG,oBAAoB,gBAAgB;AAAA,MAC9F;AAAA,IACF;AAEA,QAAI,kBAAkB,SAAS,QAAQ,gBAAgB;AACrD,YAAM,IAAI;AAAA,QACR,4CAA4C,SAAS,GAAG,oBAAoB,cAAc;AAAA,MAC5F;AAAA,IACF;AAEA,UAAM,MAAM,QAAQ,OAAO,oBAAI,KAAK;AACpC,UAAM,aAAa,KAAK,MAAM,IAAI,QAAQ,IAAI,GAAI;AAClD,QAAI,SAAS,MAAM,YAAY;AAC7B,YAAM,IAAI,YAAY,iCAAiC;AAAA,IACzD;AAEA,QAAI,SAAS,QAAQ,UAAa,SAAS,MAAM,YAAY;AAC3D,YAAM,IAAI,YAAY,uCAAuC;AAAA,IAC/D;AAEA,gCAA4B;AAAA,EAC9B,OAAO;AACL,UAAM,kBAAkB;AAAA,MACtB,qBAAqB;AAAA,MACrB;AAAA,IACF;AACA,gCACE,wCAAwC,MAAM,eAAe;AAAA,EACjE;AAEA,QAAM,OACJ,0BAA0B,mBACtB,0CACA,yBACE,8BACA;AAER,QAAM,SAAS,0BAA0B;AAEzC,SAAO;AAAA,IACL,eAAe,qBAAqB;AAAA,IACpC;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;;;AHxLA,eAAsB,+BACpB,SAC2C;AAC3C,QAAM,EAAE,6BAA6B,WAAW,iBAAiB,IAAI,IACnE;AAEF,QAAM,+BAA+BE;AAAA,IACnCC,GAAE,MAAM,CAACC,cAAaC,YAAW,CAAC;AAAA,IAClC;AAAA,IACA;AAAA,EACF;AAEA,QAAM,uBAAuB,MAAM,gCAAgC;AAAA,IACjE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,EAAE,QAAQ,WAAW,IAAIC,iBAAgB;AAAA,IAC7C,cAAc;AAAA,IACd,KAAK;AAAA,EACP,CAAC;AAED,QAAM,+BAA+BJ;AAAA,IACnC;AAAA,IACA,qBAAqB;AAAA,IACrB;AAAA,EACF;AAEA,QAAM,4BACJ,8CAA8C;AAAA,IAC5C;AAAA,IACA;AAAA,EACF,CAAC;AAEH,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,eAAe,4BAA4B;AAAA,IAC3C,MAAM,EAAE,GAAG,sBAAsB,WAAW;AAAA,EAC9C;AACF;;;ADpCA,eAAsB,2BACpB,SAC2C;AAC3C,QAAM,EAAE,6BAA6B,uBAAuB,UAAU,IACpE;AAEF,MAAI,sBAAsB,UAAU;AAClC,QAAI,OAAO,sBAAsB,aAAa,UAAU;AACtD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,WAAO,+BAA+B;AAAA,MACpC;AAAA,MACA;AAAA,MACA,iBAAiB,sBAAsB;AAAA,IACzC,CAAC;AAAA,EACH;AAEA,QAAM,+BAA+BK;AAAA,IACnC;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,QAAM,6BACJ,8CAA8C;AAAA,IAC5C;AAAA,IACA;AAAA,EACF,CAAC;AAEH,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,eAAe,4BAA4B;AAAA,EAC7C;AACF;;;AMrEA;AAAA,EAIE;AAAA,OACK;","names":["ClientIdPrefix","ValidationError","normalizedMethod","z","ValidationError","Oauth2JwtParseError","ItWalletSpecsVersion","ValidationError","ItWalletSpecsVersion","ValidationError","Oauth2JwtParseError","ItWalletSpecsVersion","createVersionDispatcher","encodeToBase64Url","encodeToBase64Url","createAuthorizationResponse","createVersionDispatcher","ItWalletSpecsVersion","createAuthorizationResponse","UnexpectedStatusCodeError","ValidationError","createFetcher","hasStatusOrThrow","parseWithErrorHandling","z","z","z","createFetcher","hasStatusOrThrow","UnexpectedStatusCodeError","parseWithErrorHandling","ValidationError","parseWithErrorHandling","decodeJwtHeader","zCompactJwe","zCompactJwt","parseWithErrorHandling","z","parseWithErrorHandling","parseWithErrorHandling","decodeJwt","zJwtHeader","z","zJwtPayload","z","JarmMode","decodeJwt","z","zJwtHeader","parseWithErrorHandling","z","zCompactJwt","zCompactJwe","decodeJwtHeader","parseWithErrorHandling"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pagopa/io-wallet-oid4vp",
-  "version": "1.5.4",
+  "version": "1.5.5",
   "files": [
     "dist"
   ],
@@ -30,9 +30,9 @@
     "@openid4vc/utils": "0.4.3",
     "@openid4vc/openid4vp": "0.4.3",
     "zod": "^4.3.6",
-    "@pagopa/io-wallet-oid-federation": "1.5.4",
-    "@pagopa/io-wallet-oauth2": "1.5.4",
-    "@pagopa/io-wallet-utils": "1.5.4"
+    "@pagopa/io-wallet-oid-federation": "1.5.5",
+    "@pagopa/io-wallet-oauth2": "1.5.5",
+    "@pagopa/io-wallet-utils": "1.5.5"
   },
   "devDependencies": {
     "jose": "^6.1.0",