@pagopa/io-wallet-utils 1.5.7 → 2.0.0-apt

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/dist/index.d.mts +610 -61
  2. package/dist/index.d.ts +610 -61
  3. package/dist/index.js +662 -41
  4. package/dist/index.js.map +1 -1
  5. package/dist/index.mjs +629 -42
  6. package/dist/index.mjs.map +1 -1
  7. package/package.json +2 -4
package/dist/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../src/index.ts","../src/config.ts","../src/constants.ts","../src/errors/parse.ts","../src/errors/errors.ts","../src/fetcher.ts","../src/parse.ts","../src/validation.ts","../src/verify.ts","../src/version-dispatcher.ts"],"sourcesContent":["export * from \"./config\";\nexport * from \"./constants\";\nexport * from \"./errors/errors\";\nexport * from \"./errors/parse\";\nexport * from \"./fetcher\";\nexport type * from \"./globals\";\nexport * from \"./parse\";\nexport * from \"./validation\";\nexport * from \"./verify\";\nexport * from \"./version-dispatcher\";\n\nexport {\n type CallbackContext,\n HashAlgorithm,\n type HashCallback,\n type JwtSignerJwk,\n calculateJwkThumbprint,\n decodeJwt,\n} from \"@openid4vc/oauth2\";\n\nexport {\n ContentType,\n type Fetch,\n JsonParseError,\n addSecondsToDate,\n createFetcher,\n dateToSeconds,\n decodeBase64,\n decodeUtf8String,\n encodeToBase64Url,\n encodeToUtf8String,\n objectToQueryParams,\n parseIfJson,\n setGlobalConfig,\n stringToJsonWithErrorHandling,\n} from \"@openid4vc/utils\";\n","/**\n * Supported versions of the Italian Wallet technical specifications\n */\nexport enum ItWalletSpecsVersion {\n V1_0 = \"V1_0\",\n V1_3 = \"V1_3\",\n V1_4 = \"V1_4\",\n}\n\n/**\n * Configuration options for the IO Wallet SDK\n */\nexport interface IoWalletSdkConfigOptions<\n V extends ItWalletSpecsVersion = ItWalletSpecsVersion,\n> {\n /**\n * The version of the Italian Wallet specification to use.\n * REQUIRED - must be explicitly set by the user.\n *\n * @example\n * const config = new IoWalletSdkConfig({ itWalletSpecsVersion: ItWalletSpecsVersion.V1_3 });\n */\n itWalletSpecsVersion: V;\n}\n\ninterface WithConfig {\n config: IoWalletSdkConfig;\n}\n\ntype WithConfigVersion<\n T extends WithConfig,\n V extends ItWalletSpecsVersion,\n> = T extends { config: IoWalletSdkConfig<V> } ? T : never;\n\n/**\n * Type guard to check if the provided options have a specific config version\n *\n * @param options - The options object containing the config to check\n * @param version - The version to check against\n * @returns True if the options' config version matches the provided version\n */\nexport function hasConfigVersion<\n T extends WithConfig,\n V extends ItWalletSpecsVersion,\n>(options: T, version: V): options is WithConfigVersion<T, V> {\n return options.config.itWalletSpecsVersion === version;\n}\n\n/**\n * Configuration class for the IO Wallet SDK\n *\n * This class manages the version of the Italian Wallet technical specifications\n * to use throughout the SDK. The version determines the format of credential\n * requests and responses.\n *\n * @example Basic usage\n * const config = new IoWalletSdkConfig({ itWalletSpecsVersion: ItWalletSpecsVersion.V1_0 });\n * console.log(config.itWalletSpecsVersion); // ItWalletSpecsVersion.V1_0\n *\n * @example Type guard usage\n * if (config.isVersion(ItWalletSpecsVersion.V1_3)) {\n * // TypeScript narrows config.itWalletSpecsVersion to ItWalletSpecsVersion.V1_3\n * }\n */\nexport class IoWalletSdkConfig<\n V extends ItWalletSpecsVersion = ItWalletSpecsVersion,\n> {\n public readonly itWalletSpecsVersion: V;\n\n /**\n * Creates an SDK configuration for a specific IT-Wallet specification version.\n *\n * @param options - Configuration options.\n * @param options.itWalletSpecsVersion - IT-Wallet specification version to use.\n */\n constructor(options: IoWalletSdkConfigOptions<V>) {\n this.itWalletSpecsVersion = options.itWalletSpecsVersion;\n }\n\n /**\n * Type guard for version checking\n *\n * @param version - The version to check against\n * @returns True if the config's version matches the provided version\n *\n * @internal\n */\n isVersion<W extends ItWalletSpecsVersion>(\n version: W,\n ): this is IoWalletSdkConfig<W> {\n const currentVersion: ItWalletSpecsVersion = this.itWalletSpecsVersion;\n return currentVersion === version;\n }\n}\n","/**\n * HTTP Content-Type constants for OAuth2 requests\n */\nexport const CONTENT_TYPES = {\n FORM_URLENCODED: \"application/x-www-form-urlencoded\",\n JSON: \"application/json\",\n} as const;\n\n/**\n * HTTP Header constants\n */\nexport const HEADERS = {\n AUTHORIZATION: \"Authorization\",\n CONTENT_TYPE: \"Content-Type\",\n DPOP: \"DPoP\",\n OAUTH_CLIENT_ATTESTATION: \"OAuth-Client-Attestation\",\n OAUTH_CLIENT_ATTESTATION_POP: \"OAuth-Client-Attestation-PoP\",\n} as const;\n\nexport const MAX_IAT_AGE_SECONDS = 5 * 60;\nexport const CLOCK_SKEW_TOLERANCE_SECONDS = 60;\n","import type z from \"zod\";\n\n/**\n * Some code comes from `zod-validation-error` package (MIT License) and\n * was slightly simplified to fit our needs.\n */\nconst constants = {\n identifierRegex: /[$_\\p{ID_Start}][$\\u200c\\u200d\\p{ID_Continue}]*/u,\n issueSeparator: \"\\n\\t- \",\n unionSeparator: \", or \",\n};\n\nfunction escapeQuotes(str: string): string {\n return str.replace(/\\\\/g, \"\\\\\\\\\").replace(/\"/g, '\\\\\"');\n}\n\ntype ZodIssue = z.ZodError[\"issues\"][number];\n\nfunction joinPath(path: PropertyKey[]): string {\n if (path.length === 1 && path[0] !== undefined) {\n return String(path[0]);\n }\n\n return path.reduce<string>((acc, item) => {\n // handle numeric indices\n if (typeof item === \"number\") {\n return `${acc}[${item.toString()}]`;\n }\n\n if (typeof item === \"symbol\") {\n return `${acc}[${JSON.stringify(String(item))}]`;\n }\n\n // handle quoted values\n if (item.includes('\"')) {\n return `${acc}[\"${escapeQuotes(item)}\"]`;\n }\n\n // handle special characters\n if (!constants.identifierRegex.test(item)) {\n return `${acc}[\"${item}\"]`;\n }\n\n // handle normal values\n const separator = acc.length === 0 ? \"\" : \".\";\n return acc + separator + item;\n }, \"\");\n}\nfunction getMessageFromZodIssue(issue: ZodIssue): string {\n if (issue.code === \"invalid_union\") {\n return getMessageFromUnionErrors(issue.errors);\n }\n\n if (issue.path.length !== 0) {\n // handle array indices\n if (issue.path.length === 1) {\n const identifier = issue.path[0];\n\n if (typeof identifier === \"number\") {\n return `${issue.message} at index ${identifier}`;\n }\n }\n\n return `${issue.message} at \"${joinPath(issue.path)}\"`;\n }\n\n return issue.message;\n}\n\nfunction getMessageFromUnionErrors(unionErrors: ZodIssue[][]): string {\n return unionErrors\n .reduce<string[]>((acc, issues) => {\n const newIssues = issues\n .map((issue) => getMessageFromZodIssue(issue))\n .join(constants.issueSeparator);\n\n if (!acc.includes(newIssues)) acc.push(newIssues);\n\n return acc;\n }, [])\n .join(constants.unionSeparator);\n}\n\n/**\n * Formats a Zod error into a readable multi-line message.\n *\n * @param error - Optional Zod error to format.\n * @returns Empty string when no error is provided, otherwise a formatted issue list.\n */\nexport function formatZodError(error?: z.ZodError): string {\n if (!error) return \"\";\n\n return `\\t- ${error?.issues.map((issue) => getMessageFromZodIssue(issue)).join(constants.issueSeparator)}`;\n}\n","import type { ZodError, z } from \"zod\";\n\nimport { formatZodError } from \"./parse\";\n\n// An error reason that supports both a string and a generic JSON object\ntype GenericErrorReason = Record<string, unknown> | string;\n\n/**\n * utility to format a set of attributes into an error message string\n *\n * @example\n * // returns \"foo=value bar=(list, item)\"\n * serializeAttrs({ foo: \"value\", bar: [\"list\", \"item\"] })\n *\n * @param attrs A key value record set\n * @returns a human-readable serialization of the set\n */\nexport const serializeAttrs = (\n attrs: Record<string, GenericErrorReason | number | string[] | undefined>,\n): string =>\n Object.entries(attrs)\n .filter(([, v]) => v !== undefined)\n .map(([k, v]) => {\n if (Array.isArray(v)) return [k, `(${v.join(\", \")})`];\n if (typeof v !== \"string\") return [k, JSON.stringify(v)];\n return [k, v];\n })\n .map((_) => _.join(\"=\"))\n .join(\" \");\n\n/**\n * An error subclass thrown when an HTTP request has a status code different from the one expected.\n */\nexport class UnexpectedStatusCodeError extends Error {\n code = \"ERR_UNEXPECTED_STATUS_CODE\";\n reason: GenericErrorReason;\n statusCode: number;\n\n constructor({\n message,\n reason,\n statusCode,\n }: {\n message: string;\n reason: GenericErrorReason;\n statusCode: number;\n }) {\n super(serializeAttrs({ message, reason, statusCode }));\n this.reason = reason;\n this.statusCode = statusCode;\n }\n}\n\n/**\n * An error subclass thrown when an unsupported Italian Wallet specification version is requested.\n *\n * This error is thrown when:\n * - A feature or method is called with a version that it doesn't support\n * - An invalid version identifier is provided\n *\n * @example\n * throw new ItWalletSpecsVersionError(\n * 'createCredentialRequest',\n * '2.0.0',\n * [ItWalletSpecsVersion.V1_0, ItWalletSpecsVersion.V1_3]\n * );\n * // Error: Feature \"createCredentialRequest\" does not support version 2.0.0.\n * // Supported versions: V1_0, V1_3\n */\nexport class ItWalletSpecsVersionError extends Error {\n public readonly code = \"IT_WALLET_SPECS_VERSION_ERROR\";\n\n constructor(\n public readonly feature: string,\n public readonly requestedVersion: string,\n public readonly supportedVersions: readonly string[],\n ) {\n super(\n `Feature \"${feature}\" does not support version ${requestedVersion}.\\n` +\n `Supported versions: ${supportedVersions.join(\", \")}`,\n );\n this.name = \"ItWalletSpecsVersionError\";\n\n // Maintain proper stack trace for V8 engines (Node.js, Chrome)\n const ErrorConstructor = Error as {\n captureStackTrace?: (target: object, constructor: unknown) => void;\n };\n if (typeof ErrorConstructor.captureStackTrace === \"function\") {\n ErrorConstructor.captureStackTrace(this, ItWalletSpecsVersionError);\n }\n }\n}\n\n/**\n * Error thrown when runtime validation fails.\n */\nexport class ValidationError extends Error {\n public zodError: ZodError | undefined;\n\n constructor(message: string, zodError?: z.ZodError) {\n super(message);\n\n const formattedError = formatZodError(zodError);\n this.message = `${message}\\n${formattedError}`;\n\n Object.defineProperty(this, \"zodError\", {\n enumerable: false,\n value: zodError,\n writable: false,\n });\n }\n}\n","import { UnexpectedStatusCodeError } from \"./errors/errors\";\n\n/**\n * Check if a response is in the expected status, otherwise throw an error\n * @param status - The expected status\n * @param customError - A custom error compatible with {@link UnexpectedStatusCodeError}\n * @throws UnexpectedStatusCodeError if the status is different from the one expected\n * @returns The given response object\n */\nexport const hasStatusOrThrow =\n (status: number | number[], customError?: typeof UnexpectedStatusCodeError) =>\n async (res: Response): Promise<Response> => {\n if (\n Array.isArray(status)\n ? !status.includes(res.status)\n : res.status !== status\n ) {\n const ErrorClass = customError ?? UnexpectedStatusCodeError;\n throw new ErrorClass({\n message: `Http request failed. Expected ${status}, got ${res.status}, url: ${res.url}`,\n reason: await parseRawHttpResponse(res), // Pass the response body as reason so the original error can surface\n statusCode: res.status,\n });\n }\n return res;\n };\n\n/**\n * Utility function to parse a raw HTTP response as JSON if supported, otherwise as text.\n *\n * @param response - Raw HTTP response to parse.\n * @returns Parsed JSON for JSON responses, otherwise response text.\n */\nexport const parseRawHttpResponse = <T extends Record<string, unknown>>(\n response: Response,\n) =>\n response.headers.get(\"content-type\")?.includes(\"application/json\")\n ? (response.json() as Promise<T>)\n : response.text();\n","import { z } from \"zod\";\n\nimport { ValidationError } from \"./errors/errors\";\n\nexport type BaseSchema = z.ZodTypeAny;\n\nconst SAFE_STRINGIFY_MAX_LENGTH = 200;\n\nfunction safeStringify(value: unknown): string {\n try {\n const result = JSON.stringify(value, (_key, val) =>\n typeof val === \"bigint\" ? `[BigInt: ${val}]` : val,\n );\n if (result === undefined) {\n return String(value);\n }\n return result.length > SAFE_STRINGIFY_MAX_LENGTH\n ? `${result.slice(0, SAFE_STRINGIFY_MAX_LENGTH)}…`\n : result;\n } catch {\n return \"[unserializable]\";\n }\n}\n\n/**\n * Parses data with a Zod schema and throws the SDK `ValidationError` on failure.\n *\n * @param schema - Zod schema used for validation.\n * @param data - Unknown value to parse.\n * @param customErrorMessage - Optional error message used when validation fails.\n * @returns Parsed schema output.\n * @throws {ValidationError} If the value does not satisfy the provided schema.\n */\nexport function parseWithErrorHandling<Schema extends BaseSchema>(\n schema: Schema,\n data: unknown,\n customErrorMessage?: string,\n): z.infer<Schema> {\n const parseResult = schema.safeParse(data);\n\n if (!parseResult.success) {\n throw new ValidationError(\n customErrorMessage ??\n `Error validating schema with data ${safeStringify(data)}`,\n parseResult.error,\n );\n }\n\n return parseResult.data;\n}\n\n/**\n * Prefixes an error message with optional contextual text.\n *\n * @param message - Base error message.\n * @param prefix - Optional prefix to prepend.\n * @returns Formatted error message.\n */\nexport function formatError(message: string, prefix?: string): string {\n return prefix ? `${prefix} ${message}` : message;\n}\n","import z from \"zod\";\n\n/**\n * For the moment, these are all the supported algorithms in both\n * {@link https://italia.github.io/eid-wallet-it-docs/releases/1.3.3/en/algorithms.html#cryptographic-algorithms|v1.3.3} and\n * {@link https://italia.github.io/eid-wallet-it-docs/releases/1.0.2/en/algorithms.html#cryptographic-algorithms|v1.0.2},\n * and in both specifications the `alg` field MUST be one of those values.\n */\nexport const zItwSupportedSignatureAlg = z.enum([\n \"ES256\",\n \"ES384\",\n \"ES512\",\n \"PS256\",\n \"PS384\",\n \"PS512\",\n]);\nexport type ItwSupportedSignatureAlg = z.infer<\n typeof zItwSupportedSignatureAlg\n>;\n\nexport const zHttpMethod = z.enum([\n \"GET\",\n \"POST\",\n \"PUT\",\n \"DELETE\",\n \"HEAD\",\n \"OPTIONS\",\n \"TRACE\",\n \"CONNECT\",\n \"PATCH\",\n]);\nexport type HttpMethod = z.infer<typeof zHttpMethod>;\n","import { CLOCK_SKEW_TOLERANCE_SECONDS, MAX_IAT_AGE_SECONDS } from \"./constants\";\n\n/**\n * Validates a JWT `iat` claim against SDK age and clock-skew limits.\n *\n * @param options - Validation options.\n * @param options.iat - Issued-at timestamp in seconds.\n * @param options.now - Optional current date, defaults to the current time.\n * @throws {Error} If `iat` is too old or too far in the future.\n */\nexport function verifyJwtIatOrThrow(options: { iat: number; now?: Date }) {\n const now = options.now ?? new Date();\n const nowSeconds = Math.floor(now.getTime() / 1000);\n\n if (nowSeconds - options.iat > MAX_IAT_AGE_SECONDS) {\n throw new Error(\"iat claim in JWT is too old (must be within 5 minutes)\");\n }\n\n if (options.iat - nowSeconds > CLOCK_SKEW_TOLERANCE_SECONDS) {\n throw new Error(\"iat claim in JWT is too far in the future\");\n }\n}\n","import { ItWalletSpecsVersion } from \"./config\";\nimport { ItWalletSpecsVersionError } from \"./errors/errors\";\n\nexport interface VersionedOptions {\n config: { itWalletSpecsVersion: ItWalletSpecsVersion };\n}\n\n/**\n * Creates a version-aware dispatcher that routes a function call\n * based on options.config.itWalletSpecsVersion.\n *\n * All versions declared in `ItWalletSpecsVersion` must be provided\n * (`Required` contract). Adding a new spec version therefore requires\n * updating every `createVersionDispatcher` call site. This is an\n * intentional trade-off: compile-time exhaustiveness is preferred over\n * sparse-map flexibility.\n *\n * @param handlers - Map of version → handler function\n * @returns Dispatcher function that invokes the handler for `options.config.itWalletSpecsVersion`.\n * @throws {ItWalletSpecsVersionError} If no handler is registered for the configured version.\n */\nexport function createVersionDispatcher<\n TOptions extends VersionedOptions,\n TResult,\n>(\n handlers: Required<\n Record<ItWalletSpecsVersion, (options: TOptions) => TResult>\n >,\n): (options: TOptions) => TResult {\n return (options: TOptions): TResult => {\n const version = options.config.itWalletSpecsVersion;\n const handler = handlers[version];\n if (typeof handler !== \"function\") {\n throw new ItWalletSpecsVersionError(\n \"version-dispatcher\",\n version,\n Object.keys(handlers),\n );\n }\n return handler(options);\n };\n}\n\n/**\n * Dispatches by a bare version value (no options object needed).\n *\n * @param version - The version to dispatch on\n * @param handlers - Map of version → zero-argument handler function\n * @returns Result returned by the selected version handler.\n * @throws {ItWalletSpecsVersionError} If no handler is registered for the version.\n */\nexport function dispatchByVersion<TResult>(\n version: ItWalletSpecsVersion,\n handlers: Required<Record<ItWalletSpecsVersion, () => TResult>>,\n): TResult {\n const handler = handlers[version];\n if (typeof handler !== \"function\") {\n throw new ItWalletSpecsVersionError(\n \"version-dispatcher\",\n version,\n Object.keys(handlers),\n );\n }\n return handler();\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACGO,IAAK,uBAAL,kBAAKA,0BAAL;AACL,EAAAA,sBAAA,UAAO;AACP,EAAAA,sBAAA,UAAO;AACP,EAAAA,sBAAA,UAAO;AAHG,SAAAA;AAAA,GAAA;AAsCL,SAAS,iBAGd,SAAY,SAAgD;AAC5D,SAAO,QAAQ,OAAO,yBAAyB;AACjD;AAkBO,IAAM,oBAAN,MAEL;AAAA,EACgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQhB,YAAY,SAAsC;AAChD,SAAK,uBAAuB,QAAQ;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,UACE,SAC8B;AAC9B,UAAM,iBAAuC,KAAK;AAClD,WAAO,mBAAmB;AAAA,EAC5B;AACF;;;AC1FO,IAAM,gBAAgB;AAAA,EAC3B,iBAAiB;AAAA,EACjB,MAAM;AACR;AAKO,IAAM,UAAU;AAAA,EACrB,eAAe;AAAA,EACf,cAAc;AAAA,EACd,MAAM;AAAA,EACN,0BAA0B;AAAA,EAC1B,8BAA8B;AAChC;AAEO,IAAM,sBAAsB,IAAI;AAChC,IAAM,+BAA+B;;;ACd5C,IAAM,YAAY;AAAA,EAChB,iBAAiB;AAAA,EACjB,gBAAgB;AAAA,EAChB,gBAAgB;AAClB;AAEA,SAAS,aAAa,KAAqB;AACzC,SAAO,IAAI,QAAQ,OAAO,MAAM,EAAE,QAAQ,MAAM,KAAK;AACvD;AAIA,SAAS,SAAS,MAA6B;AAC7C,MAAI,KAAK,WAAW,KAAK,KAAK,CAAC,MAAM,QAAW;AAC9C,WAAO,OAAO,KAAK,CAAC,CAAC;AAAA,EACvB;AAEA,SAAO,KAAK,OAAe,CAAC,KAAK,SAAS;AAExC,QAAI,OAAO,SAAS,UAAU;AAC5B,aAAO,GAAG,GAAG,IAAI,KAAK,SAAS,CAAC;AAAA,IAClC;AAEA,QAAI,OAAO,SAAS,UAAU;AAC5B,aAAO,GAAG,GAAG,IAAI,KAAK,UAAU,OAAO,IAAI,CAAC,CAAC;AAAA,IAC/C;AAGA,QAAI,KAAK,SAAS,GAAG,GAAG;AACtB,aAAO,GAAG,GAAG,KAAK,aAAa,IAAI,CAAC;AAAA,IACtC;AAGA,QAAI,CAAC,UAAU,gBAAgB,KAAK,IAAI,GAAG;AACzC,aAAO,GAAG,GAAG,KAAK,IAAI;AAAA,IACxB;AAGA,UAAM,YAAY,IAAI,WAAW,IAAI,KAAK;AAC1C,WAAO,MAAM,YAAY;AAAA,EAC3B,GAAG,EAAE;AACP;AACA,SAAS,uBAAuB,OAAyB;AACvD,MAAI,MAAM,SAAS,iBAAiB;AAClC,WAAO,0BAA0B,MAAM,MAAM;AAAA,EAC/C;AAEA,MAAI,MAAM,KAAK,WAAW,GAAG;AAE3B,QAAI,MAAM,KAAK,WAAW,GAAG;AAC3B,YAAM,aAAa,MAAM,KAAK,CAAC;AAE/B,UAAI,OAAO,eAAe,UAAU;AAClC,eAAO,GAAG,MAAM,OAAO,aAAa,UAAU;AAAA,MAChD;AAAA,IACF;AAEA,WAAO,GAAG,MAAM,OAAO,QAAQ,SAAS,MAAM,IAAI,CAAC;AAAA,EACrD;AAEA,SAAO,MAAM;AACf;AAEA,SAAS,0BAA0B,aAAmC;AACpE,SAAO,YACJ,OAAiB,CAAC,KAAK,WAAW;AACjC,UAAM,YAAY,OACf,IAAI,CAAC,UAAU,uBAAuB,KAAK,CAAC,EAC5C,KAAK,UAAU,cAAc;AAEhC,QAAI,CAAC,IAAI,SAAS,SAAS,EAAG,KAAI,KAAK,SAAS;AAEhD,WAAO;AAAA,EACT,GAAG,CAAC,CAAC,EACJ,KAAK,UAAU,cAAc;AAClC;AAQO,SAAS,eAAe,OAA4B;AACzD,MAAI,CAAC,MAAO,QAAO;AAEnB,SAAO,MAAO,OAAO,OAAO,IAAI,CAAC,UAAU,uBAAuB,KAAK,CAAC,EAAE,KAAK,UAAU,cAAc,CAAC;AAC1G;;;AC5EO,IAAM,iBAAiB,CAC5B,UAEA,OAAO,QAAQ,KAAK,EACjB,OAAO,CAAC,CAAC,EAAE,CAAC,MAAM,MAAM,MAAS,EACjC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM;AACf,MAAI,MAAM,QAAQ,CAAC,EAAG,QAAO,CAAC,GAAG,IAAI,EAAE,KAAK,IAAI,CAAC,GAAG;AACpD,MAAI,OAAO,MAAM,SAAU,QAAO,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC;AACvD,SAAO,CAAC,GAAG,CAAC;AACd,CAAC,EACA,IAAI,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,EACtB,KAAK,GAAG;AAKN,IAAM,4BAAN,cAAwC,MAAM;AAAA,EACnD,OAAO;AAAA,EACP;AAAA,EACA;AAAA,EAEA,YAAY;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAIG;AACD,UAAM,eAAe,EAAE,SAAS,QAAQ,WAAW,CAAC,CAAC;AACrD,SAAK,SAAS;AACd,SAAK,aAAa;AAAA,EACpB;AACF;AAkBO,IAAM,4BAAN,MAAM,mCAAkC,MAAM;AAAA,EAGnD,YACkB,SACA,kBACA,mBAChB;AACA;AAAA,MACE,YAAY,OAAO,8BAA8B,gBAAgB;AAAA,sBACxC,kBAAkB,KAAK,IAAI,CAAC;AAAA,IACvD;AAPgB;AACA;AACA;AAMhB,SAAK,OAAO;AAGZ,UAAM,mBAAmB;AAGzB,QAAI,OAAO,iBAAiB,sBAAsB,YAAY;AAC5D,uBAAiB,kBAAkB,MAAM,0BAAyB;AAAA,IACpE;AAAA,EACF;AAAA,EAjBkB;AAAA,EACA;AAAA,EACA;AAAA,EALF,OAAO;AAqBzB;AAKO,IAAM,kBAAN,cAA8B,MAAM;AAAA,EAClC;AAAA,EAEP,YAAY,SAAiB,UAAuB;AAClD,UAAM,OAAO;AAEb,UAAM,iBAAiB,eAAe,QAAQ;AAC9C,SAAK,UAAU,GAAG,OAAO;AAAA,EAAK,cAAc;AAE5C,WAAO,eAAe,MAAM,YAAY;AAAA,MACtC,YAAY;AAAA,MACZ,OAAO;AAAA,MACP,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACF;;;ACtGO,IAAM,mBACX,CAAC,QAA2B,gBAC5B,OAAO,QAAqC;AAC1C,MACE,MAAM,QAAQ,MAAM,IAChB,CAAC,OAAO,SAAS,IAAI,MAAM,IAC3B,IAAI,WAAW,QACnB;AACA,UAAM,aAAa,eAAe;AAClC,UAAM,IAAI,WAAW;AAAA,MACnB,SAAS,iCAAiC,MAAM,SAAS,IAAI,MAAM,UAAU,IAAI,GAAG;AAAA,MACpF,QAAQ,MAAM,qBAAqB,GAAG;AAAA;AAAA,MACtC,YAAY,IAAI;AAAA,IAClB,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAQK,IAAM,uBAAuB,CAClC,aAEA,SAAS,QAAQ,IAAI,cAAc,GAAG,SAAS,kBAAkB,IAC5D,SAAS,KAAK,IACf,SAAS,KAAK;;;AChCpB,IAAM,4BAA4B;AAElC,SAAS,cAAc,OAAwB;AAC7C,MAAI;AACF,UAAM,SAAS,KAAK;AAAA,MAAU;AAAA,MAAO,CAAC,MAAM,QAC1C,OAAO,QAAQ,WAAW,YAAY,GAAG,MAAM;AAAA,IACjD;AACA,QAAI,WAAW,QAAW;AACxB,aAAO,OAAO,KAAK;AAAA,IACrB;AACA,WAAO,OAAO,SAAS,4BACnB,GAAG,OAAO,MAAM,GAAG,yBAAyB,CAAC,WAC7C;AAAA,EACN,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAWO,SAAS,uBACd,QACA,MACA,oBACiB;AACjB,QAAM,cAAc,OAAO,UAAU,IAAI;AAEzC,MAAI,CAAC,YAAY,SAAS;AACxB,UAAM,IAAI;AAAA,MACR,sBACE,qCAAqC,cAAc,IAAI,CAAC;AAAA,MAC1D,YAAY;AAAA,IACd;AAAA,EACF;AAEA,SAAO,YAAY;AACrB;AASO,SAAS,YAAY,SAAiB,QAAyB;AACpE,SAAO,SAAS,GAAG,MAAM,IAAI,OAAO,KAAK;AAC3C;;;AC5DA,iBAAc;AAQP,IAAM,4BAA4B,WAAAC,QAAE,KAAK;AAAA,EAC9C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAKM,IAAM,cAAc,WAAAA,QAAE,KAAK;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;;;ACpBM,SAAS,oBAAoB,SAAsC;AACxE,QAAM,MAAM,QAAQ,OAAO,oBAAI,KAAK;AACpC,QAAM,aAAa,KAAK,MAAM,IAAI,QAAQ,IAAI,GAAI;AAElD,MAAI,aAAa,QAAQ,MAAM,qBAAqB;AAClD,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AAEA,MAAI,QAAQ,MAAM,aAAa,8BAA8B;AAC3D,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC7D;AACF;;;ACAO,SAAS,wBAId,UAGgC;AAChC,SAAO,CAAC,YAA+B;AACrC,UAAM,UAAU,QAAQ,OAAO;AAC/B,UAAM,UAAU,SAAS,OAAO;AAChC,QAAI,OAAO,YAAY,YAAY;AACjC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA,OAAO,KAAK,QAAQ;AAAA,MACtB;AAAA,IACF;AACA,WAAO,QAAQ,OAAO;AAAA,EACxB;AACF;AAUO,SAAS,kBACd,SACA,UACS;AACT,QAAM,UAAU,SAAS,OAAO;AAChC,MAAI,OAAO,YAAY,YAAY;AACjC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,OAAO,KAAK,QAAQ;AAAA,IACtB;AAAA,EACF;AACA,SAAO,QAAQ;AACjB;;;ATrDA,oBAOO;AAEP,mBAeO;","names":["ItWalletSpecsVersion","z"]}
1
+ {"version":3,"sources":["../src/index.ts","../src/config.ts","../src/constants.ts","../src/content-type.ts","../src/crypto/hash.ts","../src/encoding.ts","../src/errors/parse.ts","../src/errors/errors.ts","../src/parse.ts","../src/crypto/jwk/z-jwk.ts","../src/crypto/z-common.ts","../src/crypto/jwk/calculate-jwk-thumbprint.ts","../src/crypto/jwt/z-jwt.ts","../src/crypto/jwt/decode-jwt-header.ts","../src/crypto/jwt/decode-jwt.ts","../src/date.ts","../src/crypto/jwt/verify-jwt.ts","../src/crypto/jwt/z-jwe.ts","../src/fetcher.ts","../src/url.ts","../src/validation.ts","../src/verify.ts","../src/version-dispatcher.ts"],"sourcesContent":["export * from \"./config\";\nexport * from \"./constants\";\nexport { ContentType } from \"./content-type\";\nexport type * from \"./crypto/callback-context\";\nexport * from \"./crypto/hash\";\nexport * from \"./crypto/jwk/calculate-jwk-thumbprint\";\nexport * from \"./crypto/jwk/z-jwk\";\nexport * from \"./crypto/jwt/decode-jwt\";\nexport * from \"./crypto/jwt/decode-jwt-header\";\nexport * from \"./crypto/jwt/verify-jwt\";\nexport * from \"./crypto/jwt/z-jwe\";\nexport * from \"./crypto/jwt/z-jwt\";\nexport * from \"./crypto/z-common\";\nexport { addSecondsToDate, dateToSeconds } from \"./date\";\nexport {\n decodeBase64,\n decodeUtf8String,\n encodeToBase64Url,\n encodeToUtf8String,\n} from \"./encoding\";\nexport * from \"./errors/errors\";\nexport * from \"./errors/parse\";\nexport * from \"./fetcher\";\nexport type * from \"./globals\";\nexport * from \"./parse\";\nexport { objectToQueryParams } from \"./url\";\nexport * from \"./validation\";\nexport * from \"./verify\";\nexport * from \"./version-dispatcher\";\n","/**\n * Supported versions of the Italian Wallet technical specifications\n */\nexport enum ItWalletSpecsVersion {\n APTITUDE = \"APTITUDE\",\n V1_0 = \"V1_0\",\n V1_3 = \"V1_3\",\n V1_4 = \"V1_4\",\n}\n\n/**\n * Configuration options for the IO Wallet SDK\n */\nexport interface IoWalletSdkConfigOptions<\n V extends ItWalletSpecsVersion = ItWalletSpecsVersion,\n> {\n /**\n * The version of the Italian Wallet specification to use.\n * REQUIRED - must be explicitly set by the user.\n *\n * @example\n * const config = new IoWalletSdkConfig({ itWalletSpecsVersion: ItWalletSpecsVersion.V1_3 });\n */\n itWalletSpecsVersion: V;\n}\n\ninterface WithConfig {\n config: IoWalletSdkConfig;\n}\n\ntype WithConfigVersion<\n T extends WithConfig,\n V extends ItWalletSpecsVersion,\n> = T extends { config: IoWalletSdkConfig<V> } ? T : never;\n\n/**\n * Type guard to check if the provided options have a specific config version\n *\n * @param options - The options object containing the config to check\n * @param version - The version to check against\n * @returns True if the options' config version matches the provided version\n */\nexport function hasConfigVersion<\n T extends WithConfig,\n V extends ItWalletSpecsVersion,\n>(options: T, version: V): options is WithConfigVersion<T, V> {\n return options.config.itWalletSpecsVersion === version;\n}\n\n/**\n * Configuration class for the IO Wallet SDK\n *\n * This class manages the version of the Italian Wallet technical specifications\n * to use throughout the SDK. The version determines the format of credential\n * requests and responses.\n *\n * @example Basic usage\n * const config = new IoWalletSdkConfig({ itWalletSpecsVersion: ItWalletSpecsVersion.V1_0 });\n * console.log(config.itWalletSpecsVersion); // ItWalletSpecsVersion.V1_0\n *\n * @example Type guard usage\n * if (config.isVersion(ItWalletSpecsVersion.V1_3)) {\n * // TypeScript narrows config.itWalletSpecsVersion to ItWalletSpecsVersion.V1_3\n * }\n */\nexport class IoWalletSdkConfig<\n V extends ItWalletSpecsVersion = ItWalletSpecsVersion,\n> {\n public readonly itWalletSpecsVersion: V;\n\n /**\n * Creates an SDK configuration for a specific IT-Wallet specification version.\n *\n * @param options - Configuration options.\n * @param options.itWalletSpecsVersion - IT-Wallet specification version to use.\n */\n constructor(options: IoWalletSdkConfigOptions<V>) {\n this.itWalletSpecsVersion = options.itWalletSpecsVersion;\n }\n\n /**\n * Type guard for version checking\n *\n * @param version - The version to check against\n * @returns True if the config's version matches the provided version\n *\n * @internal\n */\n isVersion<W extends ItWalletSpecsVersion>(\n version: W,\n ): this is IoWalletSdkConfig<W> {\n const currentVersion: ItWalletSpecsVersion = this.itWalletSpecsVersion;\n return currentVersion === version;\n }\n}\n","/**\n * HTTP Content-Type constants for OAuth2 requests\n */\nexport const CONTENT_TYPES = {\n FORM_URLENCODED: \"application/x-www-form-urlencoded\",\n JSON: \"application/json\",\n} as const;\n\n/**\n * HTTP Header constants\n */\nexport const HEADERS = {\n AUTHORIZATION: \"Authorization\",\n CONTENT_TYPE: \"Content-Type\",\n DPOP: \"DPoP\",\n OAUTH_CLIENT_ATTESTATION: \"OAuth-Client-Attestation\",\n OAUTH_CLIENT_ATTESTATION_POP: \"OAuth-Client-Attestation-PoP\",\n} as const;\n\nexport const MAX_IAT_AGE_SECONDS = 5 * 60;\nexport const CLOCK_SKEW_TOLERANCE_SECONDS = 60;\n","export enum ContentType {\n Html = \"text/html\",\n Json = \"application/json\",\n JwkSet = \"application/jwk-set+json\",\n Jwt = \"application/jwt\",\n OAuthAuthorizationRequestJwt = \"application/oauth-authz-req+jwt\",\n XWwwFormUrlencoded = \"application/x-www-form-urlencoded\",\n}\n","type OrPromise<T> = Promise<T> | T;\n\nexport enum HashAlgorithm {\n Sha256 = \"sha-256\",\n Sha384 = \"sha-384\",\n Sha512 = \"sha-512\",\n}\n\nexport type HashCallback = (\n data: Uint8Array,\n alg: HashAlgorithm,\n) => OrPromise<Uint8Array>;\n","const utf8Encoder = new TextEncoder();\nconst utf8Decoder = new TextDecoder();\n\nfunction base64UrlToBase64(base64: string): string {\n const normalized = base64.replace(/-/g, \"+\").replace(/_/g, \"/\");\n const paddingLength = normalized.length % 4;\n\n return paddingLength === 0\n ? normalized\n : normalized.padEnd(normalized.length + (4 - paddingLength), \"=\");\n}\n\nfunction base64ToBase64Url(base64: string): string {\n return base64.replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=/g, \"\");\n}\n\nfunction encodeBase64(data: Uint8Array): string {\n let binary = \"\";\n for (const byte of data) {\n binary += String.fromCharCode(byte);\n }\n return btoa(binary);\n}\n\nexport function decodeUtf8String(value: string): Uint8Array {\n return utf8Encoder.encode(value);\n}\n\nexport function encodeToUtf8String(data: Uint8Array): string {\n return utf8Decoder.decode(data);\n}\n\n/**\n * Also supports base64 url encoded input.\n */\nexport function decodeBase64(base64: string): Uint8Array {\n const binary = atob(base64UrlToBase64(base64));\n return Uint8Array.from(binary, (char) => char.charCodeAt(0));\n}\n\nexport function encodeToBase64Url(data: Uint8Array | string): string {\n return base64ToBase64Url(\n encodeBase64(typeof data === \"string\" ? decodeUtf8String(data) : data),\n );\n}\n","import type z from \"zod\";\n\n/**\n * Some code comes from `zod-validation-error` package (MIT License) and\n * was slightly simplified to fit our needs.\n */\nconst constants = {\n identifierRegex: /[$_\\p{ID_Start}][$\\u200c\\u200d\\p{ID_Continue}]*/u,\n issueSeparator: \"\\n\\t- \",\n unionSeparator: \", or \",\n};\n\nfunction escapeQuotes(str: string): string {\n return str.replace(/\\\\/g, \"\\\\\\\\\").replace(/\"/g, '\\\\\"');\n}\n\ntype ZodIssue = z.ZodError[\"issues\"][number];\n\nfunction joinPath(path: PropertyKey[]): string {\n if (path.length === 1 && path[0] !== undefined) {\n return String(path[0]);\n }\n\n return path.reduce<string>((acc, item) => {\n // handle numeric indices\n if (typeof item === \"number\") {\n return `${acc}[${item.toString()}]`;\n }\n\n if (typeof item === \"symbol\") {\n return `${acc}[${JSON.stringify(String(item))}]`;\n }\n\n // handle quoted values\n if (item.includes('\"')) {\n return `${acc}[\"${escapeQuotes(item)}\"]`;\n }\n\n // handle special characters\n if (!constants.identifierRegex.test(item)) {\n return `${acc}[\"${item}\"]`;\n }\n\n // handle normal values\n const separator = acc.length === 0 ? \"\" : \".\";\n return acc + separator + item;\n }, \"\");\n}\nfunction getMessageFromZodIssue(issue: ZodIssue): string {\n if (issue.code === \"invalid_union\") {\n return getMessageFromUnionErrors(issue.errors);\n }\n\n if (issue.path.length !== 0) {\n // handle array indices\n if (issue.path.length === 1) {\n const identifier = issue.path[0];\n\n if (typeof identifier === \"number\") {\n return `${issue.message} at index ${identifier}`;\n }\n }\n\n return `${issue.message} at \"${joinPath(issue.path)}\"`;\n }\n\n return issue.message;\n}\n\nfunction getMessageFromUnionErrors(unionErrors: ZodIssue[][]): string {\n return unionErrors\n .reduce<string[]>((acc, issues) => {\n const newIssues = issues\n .map((issue) => getMessageFromZodIssue(issue))\n .join(constants.issueSeparator);\n\n if (!acc.includes(newIssues)) acc.push(newIssues);\n\n return acc;\n }, [])\n .join(constants.unionSeparator);\n}\n\n/**\n * Formats a Zod error into a readable multi-line message.\n *\n * @param error - Optional Zod error to format.\n * @returns Empty string when no error is provided, otherwise a formatted issue list.\n */\nexport function formatZodError(error?: z.ZodError): string {\n if (!error) return \"\";\n\n return `\\t- ${error?.issues.map((issue) => getMessageFromZodIssue(issue)).join(constants.issueSeparator)}`;\n}\n","import type { ZodError, z } from \"zod\";\n\nimport { formatZodError } from \"./parse\";\n\nexport class JsonParseError extends Error {\n constructor(message: string, jsonString: string) {\n super(`${message}\\n${jsonString}`);\n this.name = \"JsonParseError\";\n }\n}\n\nexport class JwtParseError extends Error {\n constructor(message?: string) {\n super(message ?? \"Error parsing jwt\");\n this.name = \"JwtParseError\";\n }\n}\n\nexport class JwtVerificationError extends Error {\n constructor(message?: string, options?: ErrorOptions) {\n const errorMessage = message ?? \"Error verifying jwt.\";\n const causeMessage =\n options?.cause instanceof Error\n ? ` ${options.cause.message}`\n : options?.cause\n ? ` ${String(options.cause)}`\n : \"\";\n\n super(`${errorMessage}${causeMessage}`, options);\n this.name = \"JwtVerificationError\";\n }\n}\n\n// An error reason that supports both a string and a generic JSON object\ntype GenericErrorReason = Record<string, unknown> | string;\n\n/**\n * utility to format a set of attributes into an error message string\n *\n * @example\n * // returns \"foo=value bar=(list, item)\"\n * serializeAttrs({ foo: \"value\", bar: [\"list\", \"item\"] })\n *\n * @param attrs A key value record set\n * @returns a human-readable serialization of the set\n */\nexport const serializeAttrs = (\n attrs: Record<string, GenericErrorReason | number | string[] | undefined>,\n): string =>\n Object.entries(attrs)\n .filter(([, v]) => v !== undefined)\n .map(([k, v]) => {\n if (Array.isArray(v)) return [k, `(${v.join(\", \")})`];\n if (typeof v !== \"string\") return [k, JSON.stringify(v)];\n return [k, v];\n })\n .map((_) => _.join(\"=\"))\n .join(\" \");\n\n/**\n * An error subclass thrown when an HTTP request has a status code different from the one expected.\n */\nexport class UnexpectedStatusCodeError extends Error {\n code = \"ERR_UNEXPECTED_STATUS_CODE\";\n reason: GenericErrorReason;\n statusCode: number;\n\n constructor({\n message,\n reason,\n statusCode,\n }: {\n message: string;\n reason: GenericErrorReason;\n statusCode: number;\n }) {\n super(serializeAttrs({ message, reason, statusCode }));\n this.reason = reason;\n this.statusCode = statusCode;\n }\n}\n\n/**\n * An error subclass thrown when an unsupported Italian Wallet specification version is requested.\n *\n * This error is thrown when:\n * - A feature or method is called with a version that it doesn't support\n * - An invalid version identifier is provided\n *\n * @example\n * throw new ItWalletSpecsVersionError(\n * 'createCredentialRequest',\n * '2.0.0',\n * [ItWalletSpecsVersion.V1_0, ItWalletSpecsVersion.V1_3]\n * );\n * // Error: Feature \"createCredentialRequest\" does not support version 2.0.0.\n * // Supported versions: V1_0, V1_3\n */\nexport class ItWalletSpecsVersionError extends Error {\n public readonly code = \"IT_WALLET_SPECS_VERSION_ERROR\";\n\n constructor(\n public readonly feature: string,\n public readonly requestedVersion: string,\n public readonly supportedVersions: readonly string[],\n ) {\n super(\n `Feature \"${feature}\" does not support version ${requestedVersion}.\\n` +\n `Supported versions: ${supportedVersions.join(\", \")}`,\n );\n this.name = \"ItWalletSpecsVersionError\";\n\n // Maintain proper stack trace for V8 engines (Node.js, Chrome)\n const ErrorConstructor = Error as {\n captureStackTrace?: (target: object, constructor: unknown) => void;\n };\n if (typeof ErrorConstructor.captureStackTrace === \"function\") {\n ErrorConstructor.captureStackTrace(this, ItWalletSpecsVersionError);\n }\n }\n}\n\n/**\n * Error thrown when runtime validation fails.\n */\nexport class ValidationError extends Error {\n public zodError: ZodError | undefined;\n\n constructor(message: string, zodError?: z.ZodError) {\n super(message);\n\n const formattedError = formatZodError(zodError);\n this.message = `${message}\\n${formattedError}`;\n\n Object.defineProperty(this, \"zodError\", {\n enumerable: false,\n value: zodError,\n writable: false,\n });\n }\n}\n","import { z } from \"zod\";\n\nimport { JsonParseError, ValidationError } from \"./errors/errors\";\n\nexport type BaseSchema = z.ZodTypeAny;\n\nconst SAFE_STRINGIFY_MAX_LENGTH = 200;\n\nfunction safeStringify(value: unknown): string {\n try {\n const result = JSON.stringify(value, (_key, val) =>\n typeof val === \"bigint\" ? `[BigInt: ${val}]` : val,\n );\n if (result === undefined) {\n return String(value);\n }\n return result.length > SAFE_STRINGIFY_MAX_LENGTH\n ? `${result.slice(0, SAFE_STRINGIFY_MAX_LENGTH)}…`\n : result;\n } catch {\n return \"[unserializable]\";\n }\n}\n\n/**\n * Parses a JSON string and throws the SDK `JsonParseError` on failure.\n *\n * @param value - JSON string to parse.\n * @param errorMessage - Optional error message used when parsing fails.\n * @returns Parsed JSON object.\n * @throws {JsonParseError} If the value is not valid JSON.\n */\nexport function stringToJsonWithErrorHandling(\n value: string,\n errorMessage?: string,\n): Record<string, unknown> {\n try {\n return JSON.parse(value) as Record<string, unknown>;\n } catch {\n throw new JsonParseError(\n errorMessage ?? \"Unable to parse string to JSON.\",\n value,\n );\n }\n}\n\nexport function parseIfJson<T>(data: T): Record<string, unknown> | T {\n if (typeof data !== \"string\") {\n return data;\n }\n\n try {\n return JSON.parse(data) as Record<string, unknown>;\n } catch {\n return data;\n }\n}\n\nexport function parseWithErrorHandling<Schema extends BaseSchema>(\n schema: Schema,\n data: unknown,\n customErrorMessage?: string,\n): z.infer<Schema> {\n const parseResult = schema.safeParse(data);\n\n if (!parseResult.success) {\n throw new ValidationError(\n customErrorMessage ??\n `Error validating schema with data ${safeStringify(data)}`,\n parseResult.error,\n );\n }\n\n return parseResult.data;\n}\n\n/**\n * Prefixes an error message with optional contextual text.\n *\n * @param message - Base error message.\n * @param prefix - Optional prefix to prepend.\n * @returns Formatted error message.\n */\nexport function formatError(message: string, prefix?: string): string {\n return prefix ? `${prefix} ${message}` : message;\n}\n","import z from \"zod\";\n\nimport { zCertificateChain } from \"../z-common\";\n\nexport const zJwk = z.looseObject({\n alg: z.optional(z.string()),\n crv: z.optional(z.string()),\n d: z.optional(z.string()),\n dp: z.optional(z.string()),\n dq: z.optional(z.string()),\n e: z.optional(z.string()),\n ext: z.optional(z.boolean()),\n k: z.optional(z.string()),\n key_ops: z.optional(z.array(z.string())),\n kid: z.optional(z.string()),\n kty: z.string(),\n n: z.optional(z.string()),\n oth: z.optional(\n z.array(\n z.looseObject({\n d: z.optional(z.string()),\n r: z.optional(z.string()),\n t: z.optional(z.string()),\n }),\n ),\n ),\n p: z.optional(z.string()),\n q: z.optional(z.string()),\n qi: z.optional(z.string()),\n use: z.optional(z.string()),\n x: z.optional(z.string()),\n x5c: z.optional(zCertificateChain),\n x5t: z.optional(z.string()),\n \"x5t#S256\": z.optional(z.string()),\n x5u: z.optional(z.string()),\n y: z.optional(z.string()),\n});\n\nexport type Jwk = z.infer<typeof zJwk>;\n\nexport const zJwkSet = z.looseObject({ keys: z.array(zJwk) });\n\nexport type JwkSet = z.infer<typeof zJwkSet>;\n","import z from \"zod\";\n\nexport const zTrustChain = z.tuple([z.string()], z.string());\nexport type TrustChain = z.infer<typeof zTrustChain>;\n\nexport const zCertificateChain = z.array(z.string()).nonempty();\nexport type CertificateChain = z.infer<typeof zCertificateChain>;\n\nexport const zAlgValueNotNone = z\n .string()\n .refine((alg) => alg !== \"none\", { message: `alg value may not be 'none'` });\n","import { decodeUtf8String, encodeToBase64Url } from \"../../encoding\";\nimport { ValidationError } from \"../../errors/errors\";\nimport { parseWithErrorHandling } from \"../../parse\";\nimport { HashAlgorithm, type HashCallback } from \"../hash\";\nimport { Jwk, zJwk } from \"./z-jwk\";\n\nfunction createJwkThumbprintComponents(jwk: Jwk) {\n if (jwk.kty === \"EC\") {\n if (!jwk.crv || !jwk.x || !jwk.y) {\n throw new ValidationError(\n \"Provided jwk does not match a supported jwk structure. Either the 'kty' is not supported, or required values are missing.\",\n );\n }\n\n return {\n crv: jwk.crv,\n kty: jwk.kty,\n x: jwk.x,\n y: jwk.y,\n };\n }\n\n if (jwk.kty === \"RSA\") {\n if (!jwk.e || !jwk.n) {\n throw new ValidationError(\n \"Provided jwk does not match a supported jwk structure. Either the 'kty' is not supported, or required values are missing.\",\n );\n }\n\n return {\n e: jwk.e,\n kty: jwk.kty,\n n: jwk.n,\n };\n }\n\n if (jwk.kty === \"oct\") {\n if (!jwk.k) {\n throw new ValidationError(\n \"Provided jwk does not match a supported jwk structure. Either the 'kty' is not supported, or required values are missing.\",\n );\n }\n\n return {\n k: jwk.k,\n kty: jwk.kty,\n };\n }\n\n throw new ValidationError(\n \"Provided jwk does not match a supported jwk structure. Either the 'kty' is not supported, or required values are missing.\",\n );\n}\n\nexport async function calculateJwkThumbprint(options: {\n hashAlgorithm: HashAlgorithm;\n hashCallback: HashCallback;\n jwk: Jwk;\n}): Promise<string> {\n const parsedJwk = parseWithErrorHandling(\n zJwk,\n options.jwk,\n \"Provided jwk does not match a supported jwk structure. Either the 'kty' is not supported, or required values are missing.\",\n );\n\n const jwkThumbprintComponents = createJwkThumbprintComponents(parsedJwk);\n\n return encodeToBase64Url(\n await options.hashCallback(\n decodeUtf8String(JSON.stringify(jwkThumbprintComponents)),\n options.hashAlgorithm,\n ),\n );\n}\n","import z from \"zod\";\n\nimport { Jwk, zJwk } from \"../jwk/z-jwk\";\nimport {\n TrustChain,\n zAlgValueNotNone,\n zCertificateChain,\n zTrustChain,\n} from \"../z-common\";\n\nexport const MAX_JTI_LENGTH = 256;\n\nexport interface JwtSignerDid {\n alg: string;\n didUrl: string;\n /**\n * The key id that should be used for signing. You need to make sure the kid actually matches\n * with the key associated with the didUrl.\n */\n kid?: string;\n\n method: \"did\";\n}\n\nexport interface JwtSignerJwk {\n alg: string;\n /**\n * The key id that should be used for signing. You need to make sure the kid actually matches\n * with the key associated with the jwk.\n *\n * If not provided the kid can also be extracted from the `publicJwk`. Providing it here means the `kid` won't\n * be included in the JWT header.\n */\n kid?: string;\n method: \"jwk\";\n\n publicJwk: Jwk;\n}\n\nexport interface JwtSignerX5c {\n alg: string;\n /**\n * The key id that should be used for signing. You need to make sure the kid actually matches\n * with the key associated with the leaf certificate.\n */\n kid?: string;\n method: \"x5c\";\n\n trustChain?: TrustChain;\n x5c: string[];\n}\n\nexport interface JwtSignerFederation {\n alg: string;\n /**\n * The key id that should be used for signing. You need to make sure the kid actually matches\n * with a key present in the federation.\n */\n kid: string;\n method: \"federation\";\n\n trustChain?: TrustChain;\n}\n\n// In case of custom nothing will be added to the header\nexport interface JwtSignerCustom {\n alg: string;\n /**\n * The key id that should be used for signing.\n */\n kid?: string;\n\n method: \"custom\";\n}\n\nexport type JwtSigner =\n | JwtSignerCustom\n | JwtSignerDid\n | JwtSignerFederation\n | JwtSignerJwk\n | JwtSignerX5c;\n\nexport type JwtSignerWithJwk = { publicJwk: Jwk } & JwtSigner;\n\nexport type JweEncryptor = {\n /**\n * base64-url encoded apu\n */\n apu?: string;\n\n /**\n * base64-url encoded apv\n */\n apv?: string;\n\n enc: string;\n} & JwtSignerJwk;\n\nexport const zCompactJwt = z\n .string()\n .regex(/^([a-zA-Z0-9-_]+)\\.([a-zA-Z0-9-_]+)\\.([a-zA-Z0-9-_]+)$/, {\n message: \"Not a valid compact jwt\",\n });\n\nexport const zJwtConfirmationPayload = z.looseObject({\n // RFC9449. jwk thumbprint of the dpop public key to which the access token is bound\n jkt: z.string().optional(),\n jwk: zJwk.optional(),\n});\n\nexport const zJwtPayload = z.looseObject({\n aud: z.string().or(z.array(z.string())).optional(),\n cnf: zJwtConfirmationPayload.optional(),\n exp: z.number().int().optional(),\n iat: z.number().int().optional(),\n iss: z.string().optional(),\n jti: z.string().max(MAX_JTI_LENGTH).optional(),\n nbf: z.number().int().optional(),\n nonce: z.string().optional(),\n // Reserved for status parameters\n status: z.record(z.string(), z.any()).optional(),\n sub: z.string().optional(),\n // Reserved for OpenID Federation\n trust_chain: zTrustChain.optional(),\n});\n\nexport type JwtPayload = z.infer<typeof zJwtPayload>;\n\nexport const zJwtHeader = z.looseObject({\n alg: zAlgValueNotNone,\n jwk: zJwk.optional(),\n kid: z.string().optional(),\n // Reserved for OpenID Federation\n trust_chain: zTrustChain.optional(),\n typ: z.string().optional(),\n x5c: zCertificateChain.optional(),\n});\n\nexport type JwtHeader = z.infer<typeof zJwtHeader>;\n","import type { InferSchemaOrDefaultOutput } from \"./decode-jwt\";\n\nimport { decodeBase64, encodeToUtf8String } from \"../../encoding\";\nimport { JwtParseError } from \"../../errors/errors\";\nimport {\n BaseSchema,\n formatError,\n parseWithErrorHandling,\n stringToJsonWithErrorHandling,\n} from \"../../parse\";\nimport { JwtHeader, JwtPayload, JwtSigner, zJwtHeader } from \"./z-jwt\";\n\nexport interface DecodeJwtHeaderOptions<\n HeaderSchema extends BaseSchema | undefined,\n> {\n /**\n * Optional prefix for error messages thrown during decoding, to provide more context on where the error occurred\n */\n errorMessagePrefix?: string;\n\n /**\n * Schema to use for validating the header. If not provided the\n * default `zJwtHeader` schema will be used\n */\n headerSchema?: HeaderSchema;\n\n /**\n * The compact encoded jwt\n */\n jwt: string;\n}\n\nexport interface DecodeJwtHeaderResult<\n HeaderSchema extends BaseSchema | undefined = undefined,\n> {\n header: InferSchemaOrDefaultOutput<HeaderSchema, typeof zJwtHeader>;\n}\n\n/**\n * Decodes and validates the header of a compact JWT.\n *\n * This helper does not verify the JWT signature or parse the payload.\n *\n * @param options - Header decode options.\n * @param options.errorMessagePrefix - Optional context prefix for thrown parse/validation errors.\n * @param options.headerSchema - Optional schema for the JWT header; defaults to `zJwtHeader`.\n * @param options.jwt - Compact JWT to decode.\n * @returns Decoded and schema-validated JWT header.\n * @throws {JwtParseError} If the JWT shape or header JSON is invalid.\n * @throws {ValidationError} If header schema validation fails.\n */\nexport function decodeJwtHeader<\n HeaderSchema extends BaseSchema | undefined = undefined,\n>(\n options: DecodeJwtHeaderOptions<HeaderSchema>,\n): DecodeJwtHeaderResult<HeaderSchema> {\n const jwtParts = options.jwt.split(\".\");\n if (jwtParts.length <= 2) {\n throw new JwtParseError(\n formatError(\n \"Unable to decode because Jwt is not a valid!\",\n options.errorMessagePrefix,\n ),\n );\n }\n\n const [headerPart] = jwtParts as [string, ...string[]];\n\n let headerJson: Record<string, unknown>;\n try {\n headerJson = stringToJsonWithErrorHandling(\n encodeToUtf8String(decodeBase64(headerPart)),\n formatError(\n \"Unable to parse jwt header to JSON\",\n options.errorMessagePrefix,\n ),\n );\n } catch (error) {\n throw new JwtParseError(\n formatError(\n `Error parsing JWT. ${error instanceof Error ? error.message : \"\"}`,\n options.errorMessagePrefix,\n ),\n );\n }\n\n const header = parseWithErrorHandling(\n options.headerSchema ?? zJwtHeader,\n headerJson,\n formatError(\"Invalid JWT header\", options.errorMessagePrefix),\n ) as InferSchemaOrDefaultOutput<HeaderSchema, typeof zJwtHeader>;\n\n return {\n header,\n };\n}\n\n/**\n * Builds a JWT header from an SDK signer descriptor.\n *\n * @param signer - Signer descriptor used by SDK signing callbacks.\n * @returns Header fields required by the signer method.\n */\nexport function jwtHeaderFromJwtSigner(signer: JwtSigner) {\n if (signer.method === \"did\") {\n return {\n alg: signer.alg,\n kid: signer.didUrl,\n };\n }\n\n if (signer.method === \"federation\") {\n return {\n alg: signer.alg,\n kid: signer.kid,\n trust_chain: signer.trustChain,\n };\n }\n\n if (signer.method === \"jwk\") {\n return {\n alg: signer.alg,\n jwk: signer.publicJwk,\n };\n }\n\n if (signer.method === \"x5c\") {\n return {\n alg: signer.alg,\n kid: signer.kid,\n trust_chain: signer.trustChain,\n x5c: signer.x5c,\n };\n }\n\n return { alg: signer.alg };\n}\n\n/**\n * Derives the SDK signer descriptor from a decoded JWT header and payload.\n *\n * @param options.allowedSignerMethods - Signer methods accepted by the caller; all are allowed when omitted.\n * @param options.header - Decoded JWT header.\n * @param options.payload - Decoded JWT payload.\n * @returns The first valid, allowed signer found in the JWT.\n * @throws {JwtParseError} If no allowed signer can be extracted from the JWT.\n */\n// eslint-disable-next-line complexity\nexport function jwtSignerFromJwt(options: {\n allowedSignerMethods?: JwtSigner[\"method\"][];\n header: Pick<JwtHeader, \"alg\" | \"jwk\" | \"kid\" | \"trust_chain\" | \"x5c\">;\n payload: Pick<JwtPayload, \"iss\">;\n}): JwtSigner {\n const { allowedSignerMethods, header, payload } = options;\n const found: (\n | {\n error: string;\n method: JwtSigner[\"method\"];\n valid: false;\n }\n | {\n method: JwtSigner[\"method\"];\n signer: JwtSigner;\n valid: true;\n }\n )[] = [];\n\n if (header.x5c) {\n found.push({\n method: \"x5c\",\n signer: {\n alg: header.alg,\n kid: header.kid,\n method: \"x5c\",\n trustChain: header.trust_chain,\n x5c: header.x5c,\n },\n valid: true,\n });\n }\n\n if (header.trust_chain) {\n if (!header.kid) {\n found.push({\n error:\n \"When 'trust_chain' is used in jwt header, the 'kid' parameter is required.\",\n method: \"federation\",\n valid: false,\n });\n } else {\n found.push({\n method: \"federation\",\n signer: {\n alg: header.alg,\n kid: header.kid,\n method: \"federation\",\n trustChain: header.trust_chain,\n },\n valid: true,\n });\n }\n }\n\n if (header.kid?.startsWith(\"did:\") || payload.iss?.startsWith(\"did:\")) {\n if (\n payload.iss &&\n header.kid?.startsWith(\"did:\") &&\n !header.kid.startsWith(payload.iss)\n ) {\n found.push({\n error:\n \"kid in header starts with did that is different from did value in 'iss'\",\n method: \"did\",\n valid: false,\n });\n } else if (\n !header.kid?.startsWith(\"did:\") &&\n !header.kid?.startsWith(\"#\")\n ) {\n found.push({\n error:\n \"kid in header must start with either 'did:' or '#' when 'iss' value is a did\",\n method: \"did\",\n valid: false,\n });\n } else if (header.kid) {\n found.push({\n method: \"did\",\n signer: {\n alg: header.alg,\n didUrl: header.kid.startsWith(\"did:\")\n ? header.kid\n : `${payload.iss}${header.kid}`,\n method: \"did\",\n },\n valid: true,\n });\n }\n }\n\n if (header.jwk) {\n found.push({\n method: \"jwk\",\n signer: {\n alg: header.alg,\n method: \"jwk\",\n publicJwk: header.jwk,\n },\n valid: true,\n });\n }\n\n const allowedFoundMethods = found.filter(\n (candidate) =>\n !allowedSignerMethods || allowedSignerMethods.includes(candidate.method),\n );\n const allowedValidMethods = allowedFoundMethods.filter(\n (candidate) => candidate.valid,\n );\n\n const firstAllowedValidMethod = allowedValidMethods[0];\n if (firstAllowedValidMethod && firstAllowedValidMethod.valid) {\n return firstAllowedValidMethod.signer;\n }\n\n if (allowedFoundMethods.length > 0) {\n throw new JwtParseError(\n `Unable to extract signer method from jwt. Found ${allowedFoundMethods.length} allowed signer method(s) but contained invalid configuration:\\n${allowedFoundMethods\n .map((candidate) =>\n candidate.valid\n ? \"\"\n : `FAILED: method ${candidate.method} - ${candidate.error}`,\n )\n .join(\"\\n\")}`,\n );\n }\n\n if (found.length > 0) {\n throw new JwtParseError(\n `Unable to extract signer method from jwt. Found ${found.length} signer method(s) that are not allowed:\\n${found\n .map((candidate) =>\n candidate.valid\n ? `SUCCEEDED: method ${candidate.method}`\n : `FAILED: method ${candidate.method} - ${candidate.error}`,\n )\n .join(\"\\n\")}`,\n );\n }\n\n if (!allowedSignerMethods || allowedSignerMethods.includes(\"custom\")) {\n return {\n alg: header.alg,\n kid: header.kid,\n method: \"custom\",\n };\n }\n\n throw new JwtParseError(\n \"Unable to extract signer method from jwt. Found no signer methods and 'custom' signer method is not allowed.\",\n );\n}\n","import z from \"zod\";\n\nimport { decodeBase64, encodeToUtf8String } from \"../../encoding\";\nimport { JwtParseError } from \"../../errors/errors\";\nimport {\n BaseSchema,\n formatError,\n parseWithErrorHandling,\n stringToJsonWithErrorHandling,\n} from \"../../parse\";\nimport { decodeJwtHeader } from \"./decode-jwt-header\";\nimport { zJwtHeader, zJwtPayload } from \"./z-jwt\";\n\nexport interface DecodeJwtOptions<\n HeaderSchema extends BaseSchema | undefined,\n PayloadSchema extends BaseSchema | undefined,\n> {\n /**\n * Optional prefix for error messages thrown during decoding, to provide more context on where the error occurred\n */\n errorMessagePrefix?: string;\n\n /**\n * Schema to use for validating the header. If not provided the\n * default `zJwtHeader` schema will be used\n */\n headerSchema?: HeaderSchema;\n\n /**\n * The compact encoded jwt\n */\n jwt: string;\n\n /**\n * Schema to use for validating the payload. If not provided the\n * default `zJwtPayload` schema will be used\n */\n payloadSchema?: PayloadSchema;\n}\n\nexport interface DecodeJwtResult<\n HeaderSchema extends BaseSchema | undefined = undefined,\n PayloadSchema extends BaseSchema | undefined = undefined,\n> {\n compact: string;\n header: InferSchemaOrDefaultOutput<HeaderSchema, typeof zJwtHeader>;\n payload: InferSchemaOrDefaultOutput<PayloadSchema, typeof zJwtPayload>;\n signature: string;\n}\n\n/**\n * Decodes a compact JWT and validates its header and payload with Zod schemas.\n *\n * This helper does not verify the JWT signature.\n *\n * @param options - Decode options.\n * @param options.errorMessagePrefix - Optional context prefix for thrown parse/validation errors.\n * @param options.headerSchema - Optional schema for the JWT header; defaults to `zJwtHeader`.\n * @param options.jwt - Compact JWT to decode.\n * @param options.payloadSchema - Optional schema for the JWT payload; defaults to `zJwtPayload`.\n * @returns Decoded and schema-validated JWT header, payload, and signature segment.\n * @throws {JwtParseError} If the JWT shape or base64url JSON segments are invalid.\n * @throws {ValidationError} If header or payload schema validation fails.\n */\nexport function decodeJwt<\n HeaderSchema extends BaseSchema | undefined = undefined,\n PayloadSchema extends BaseSchema | undefined = undefined,\n>(\n options: DecodeJwtOptions<HeaderSchema, PayloadSchema>,\n): DecodeJwtResult<HeaderSchema, PayloadSchema> {\n const jwtParts = options.jwt.split(\".\");\n if (jwtParts.length !== 3) {\n throw new JwtParseError(\n formatError(\n \"Unable to decode because Jwt is not a valid!\",\n options.errorMessagePrefix,\n ),\n );\n }\n\n let payloadJson: Record<string, unknown>;\n try {\n const payloadPart = jwtParts[1];\n if (payloadPart === undefined) {\n throw new JwtParseError(\n formatError(\n \"Unable to decode because Jwt is not a valid!\",\n options.errorMessagePrefix,\n ),\n );\n }\n payloadJson = stringToJsonWithErrorHandling(\n encodeToUtf8String(decodeBase64(payloadPart)),\n formatError(\n \"Unable to parse jwt payload to JSON\",\n options.errorMessagePrefix,\n ),\n );\n } catch (error) {\n throw new JwtParseError(\n formatError(\n `Error parsing JWT. ${error instanceof Error ? error.message : \"\"}`,\n options.errorMessagePrefix,\n ),\n );\n }\n\n const signaturePart = jwtParts[2];\n if (signaturePart === undefined) {\n throw new JwtParseError(\n formatError(\n \"Unable to decode because Jwt is not a valid!\",\n options.errorMessagePrefix,\n ),\n );\n }\n\n const { header } = decodeJwtHeader({\n errorMessagePrefix: options.errorMessagePrefix,\n headerSchema: options.headerSchema,\n jwt: options.jwt,\n });\n const payload = parseWithErrorHandling(\n options.payloadSchema ?? zJwtPayload,\n payloadJson,\n formatError(\"Invalid JWT payload\", options.errorMessagePrefix),\n );\n\n return {\n compact: options.jwt,\n header: header as InferSchemaOrDefaultOutput<\n HeaderSchema,\n typeof zJwtHeader\n >,\n payload: payload as InferSchemaOrDefaultOutput<\n PayloadSchema,\n typeof zJwtPayload\n >,\n signature: signaturePart,\n };\n}\n\n// Helper type to check if a schema is provided\ntype IsSchemaProvided<T> = T extends undefined ? false : true;\n\n// Helper type to infer the output type based on whether a schema is provided\nexport type InferSchemaOrDefaultOutput<\n ProvidedSchema extends BaseSchema | undefined,\n DefaultSchema extends BaseSchema,\n> =\n IsSchemaProvided<ProvidedSchema> extends true\n ? ProvidedSchema extends BaseSchema\n ? z.infer<ProvidedSchema>\n : never\n : z.infer<DefaultSchema>;\n","/**\n * Get the time in seconds since epoch for a date.\n * If date is not provided the current time will be used.\n */\nexport function dateToSeconds(date?: Date): number {\n const milliseconds = date?.getTime() ?? Date.now();\n return Math.floor(milliseconds / 1000);\n}\n\nexport function addSecondsToDate(date: Date, seconds: number): Date {\n return new Date(date.getTime() + seconds * 1000);\n}\n","import type { VerifyJwtCallback } from \"../callback-context\";\n\nimport { dateToSeconds } from \"../../date\";\nimport { JwtVerificationError } from \"../../errors/errors\";\nimport { JwtHeader, JwtPayload, JwtSigner, JwtSignerWithJwk } from \"./z-jwt\";\n\nexport interface VerifyJwtOptions {\n allowedSkewInSeconds?: number;\n compact: string;\n errorMessage?: string;\n expectedAudience?: string;\n expectedIssuer?: string;\n expectedNonce?: string;\n expectedSubject?: string;\n header: JwtHeader;\n now?: Date;\n payload: JwtPayload;\n requiredClaims?: (keyof JwtPayload)[];\n signer: JwtSigner;\n skipTimeBasedValidation?: boolean;\n verifyJwtCallback: VerifyJwtCallback;\n}\n\nexport interface VerifyJwtReturn {\n signer: JwtSignerWithJwk;\n}\n\n// eslint-disable-next-line complexity\nexport async function verifyJwt(\n options: VerifyJwtOptions,\n): Promise<VerifyJwtReturn> {\n const errorMessage =\n options.errorMessage ?? \"Error during verification of jwt.\";\n\n let signerJwk;\n try {\n const result = await options.verifyJwtCallback(options.signer, {\n compact: options.compact,\n header: options.header,\n payload: options.payload,\n });\n\n if (!result.verified) {\n throw new JwtVerificationError(errorMessage);\n }\n\n signerJwk = result.signerJwk;\n } catch (error) {\n if (error instanceof JwtVerificationError) {\n throw error;\n }\n\n throw new JwtVerificationError(errorMessage, { cause: error });\n }\n\n const nowInSeconds = dateToSeconds(options.now ?? new Date());\n const skewInSeconds = options.allowedSkewInSeconds ?? 0;\n const timeBasedValidation =\n options.skipTimeBasedValidation !== undefined\n ? !options.skipTimeBasedValidation\n : true;\n\n if (\n timeBasedValidation &&\n options.payload.nbf &&\n nowInSeconds < options.payload.nbf - skewInSeconds\n ) {\n throw new JwtVerificationError(\n `${errorMessage} jwt 'nbf' is in the future`,\n );\n }\n\n if (\n timeBasedValidation &&\n options.payload.exp &&\n nowInSeconds > options.payload.exp + skewInSeconds\n ) {\n throw new JwtVerificationError(`${errorMessage} jwt 'exp' is in the past`);\n }\n\n if (options.expectedAudience) {\n const { aud } = options.payload;\n if (\n (Array.isArray(aud) && !aud.includes(options.expectedAudience)) ||\n (typeof aud === \"string\" && aud !== options.expectedAudience)\n ) {\n throw new JwtVerificationError(\n `${errorMessage} jwt 'aud' does not match expected value.`,\n );\n }\n }\n\n if (\n options.expectedIssuer &&\n options.expectedIssuer !== options.payload.iss\n ) {\n throw new JwtVerificationError(\n `${errorMessage} jwt 'iss' does not match expected value.`,\n );\n }\n\n if (\n options.expectedNonce &&\n options.expectedNonce !== options.payload.nonce\n ) {\n throw new JwtVerificationError(\n `${errorMessage} jwt 'nonce' does not match expected value.`,\n );\n }\n\n if (\n options.expectedSubject &&\n options.expectedSubject !== options.payload.sub\n ) {\n throw new JwtVerificationError(\n `${errorMessage} jwt 'sub' does not match expected value.`,\n );\n }\n\n if (options.requiredClaims) {\n for (const claim of options.requiredClaims) {\n if (!options.payload[claim]) {\n throw new JwtVerificationError(\n `${errorMessage} jwt '${claim}' is missing.`,\n );\n }\n }\n }\n\n return {\n signer: {\n ...options.signer,\n publicJwk: signerJwk,\n },\n };\n}\n","import { z } from \"zod\";\n\nexport const zCompactJwe = z\n .string()\n .regex(\n /^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]*\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$/,\n {\n message: \"Not a valid compact jwe\",\n },\n );\n","import type { Fetch } from \"./globals\";\n\nimport { UnexpectedStatusCodeError } from \"./errors/errors\";\n\nconst defaultFetcher = fetch;\n\nexport function createFetcher(fetcher: Fetch = defaultFetcher): Fetch {\n return (input, init) =>\n fetcher(\n input,\n init\n ? {\n ...init,\n body:\n init.body instanceof URLSearchParams\n ? init.body.toString()\n : init.body,\n }\n : undefined,\n ).catch((error) => {\n throw new Error(\n `Unknown error occurred during fetch to '${String(input)}'\\nCause: ${error instanceof Error ? error.message : String(error)}`,\n );\n });\n}\n\n/**\n * Check if a response is in the expected status, otherwise throw an error\n * @param status - The expected status\n * @param customError - A custom error compatible with {@link UnexpectedStatusCodeError}\n * @throws UnexpectedStatusCodeError if the status is different from the one expected\n * @returns The given response object\n */\nexport const hasStatusOrThrow =\n (status: number | number[], customError?: typeof UnexpectedStatusCodeError) =>\n async (res: Response): Promise<Response> => {\n if (\n Array.isArray(status)\n ? !status.includes(res.status)\n : res.status !== status\n ) {\n const ErrorClass = customError ?? UnexpectedStatusCodeError;\n throw new ErrorClass({\n message: `Http request failed. Expected ${status}, got ${res.status}, url: ${res.url}`,\n reason: await parseRawHttpResponse(res), // Pass the response body as reason so the original error can surface\n statusCode: res.status,\n });\n }\n return res;\n };\n\n/**\n * Utility function to parse a raw HTTP response as JSON if supported, otherwise as text.\n *\n * @param response - Raw HTTP response to parse.\n * @returns Parsed JSON for JSON responses, otherwise response text.\n */\nexport const parseRawHttpResponse = <T extends Record<string, unknown>>(\n response: Response,\n) =>\n response.headers.get(\"content-type\")?.includes(\"application/json\")\n ? (response.json() as Promise<T>)\n : response.text();\n","export function objectToQueryParams(\n object: Record<string, unknown>,\n): URLSearchParams {\n const params = new URLSearchParams();\n\n for (const [key, value] of Object.entries(object)) {\n if (value != null) {\n params.append(\n key,\n typeof value === \"object\" ? JSON.stringify(value) : String(value),\n );\n }\n }\n\n return params;\n}\n","import z from \"zod\";\n\n/**\n * For the moment, these are all the supported algorithms in both\n * {@link https://italia.github.io/eid-wallet-it-docs/releases/1.3.3/en/algorithms.html#cryptographic-algorithms|v1.3.3} and\n * {@link https://italia.github.io/eid-wallet-it-docs/releases/1.0.2/en/algorithms.html#cryptographic-algorithms|v1.0.2},\n * and in both specifications the `alg` field MUST be one of those values.\n */\nexport const zItwSupportedSignatureAlg = z.enum([\n \"ES256\",\n \"ES384\",\n \"ES512\",\n \"PS256\",\n \"PS384\",\n \"PS512\",\n]);\nexport type ItwSupportedSignatureAlg = z.infer<\n typeof zItwSupportedSignatureAlg\n>;\n\nexport const zHttpMethod = z.enum([\n \"GET\",\n \"POST\",\n \"PUT\",\n \"DELETE\",\n \"HEAD\",\n \"OPTIONS\",\n \"TRACE\",\n \"CONNECT\",\n \"PATCH\",\n]);\nexport type HttpMethod = z.infer<typeof zHttpMethod>;\n","import { CLOCK_SKEW_TOLERANCE_SECONDS, MAX_IAT_AGE_SECONDS } from \"./constants\";\n\n/**\n * Validates a JWT `iat` claim against SDK age and clock-skew limits.\n *\n * @param options - Validation options.\n * @param options.iat - Issued-at timestamp in seconds.\n * @param options.now - Optional current date, defaults to the current time.\n * @throws {Error} If `iat` is too old or too far in the future.\n */\nexport function verifyJwtIatOrThrow(options: { iat: number; now?: Date }) {\n const now = options.now ?? new Date();\n const nowSeconds = Math.floor(now.getTime() / 1000);\n\n if (nowSeconds - options.iat > MAX_IAT_AGE_SECONDS) {\n throw new Error(\"iat claim in JWT is too old (must be within 5 minutes)\");\n }\n\n if (options.iat - nowSeconds > CLOCK_SKEW_TOLERANCE_SECONDS) {\n throw new Error(\"iat claim in JWT is too far in the future\");\n }\n}\n","import { ItWalletSpecsVersion } from \"./config\";\nimport { ItWalletSpecsVersionError } from \"./errors/errors\";\n\nexport interface VersionedOptions {\n config: { itWalletSpecsVersion: ItWalletSpecsVersion };\n}\n\n/**\n * Creates a version-aware dispatcher that routes a function call\n * based on options.config.itWalletSpecsVersion.\n *\n * All versions declared in `ItWalletSpecsVersion` must be provided\n * (`Required` contract). Adding a new spec version therefore requires\n * updating every `createVersionDispatcher` call site. This is an\n * intentional trade-off: compile-time exhaustiveness is preferred over\n * sparse-map flexibility.\n *\n * @param handlers - Map of version → handler function\n * @returns Dispatcher function that invokes the handler for `options.config.itWalletSpecsVersion`.\n * @throws {ItWalletSpecsVersionError} If no handler is registered for the configured version.\n */\nexport function createVersionDispatcher<\n TOptions extends VersionedOptions,\n TResult,\n>(\n handlers: Required<\n Record<ItWalletSpecsVersion, (options: TOptions) => TResult>\n >,\n): (options: TOptions) => TResult {\n return (options: TOptions): TResult => {\n const version = options.config.itWalletSpecsVersion;\n const handler = handlers[version];\n if (typeof handler !== \"function\") {\n throw new ItWalletSpecsVersionError(\n \"version-dispatcher\",\n version,\n Object.keys(handlers),\n );\n }\n return handler(options);\n };\n}\n\n/**\n * Dispatches by a bare version value (no options object needed).\n *\n * @param version - The version to dispatch on\n * @param handlers - Map of version → zero-argument handler function\n * @returns Result returned by the selected version handler.\n * @throws {ItWalletSpecsVersionError} If no handler is registered for the version.\n */\nexport function dispatchByVersion<TResult>(\n version: ItWalletSpecsVersion,\n handlers: Required<Record<ItWalletSpecsVersion, () => TResult>>,\n): TResult {\n const handler = handlers[version];\n if (typeof handler !== \"function\") {\n throw new ItWalletSpecsVersionError(\n \"version-dispatcher\",\n version,\n Object.keys(handlers),\n );\n }\n return handler();\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACGO,IAAK,uBAAL,kBAAKA,0BAAL;AACL,EAAAA,sBAAA,cAAW;AACX,EAAAA,sBAAA,UAAO;AACP,EAAAA,sBAAA,UAAO;AACP,EAAAA,sBAAA,UAAO;AAJG,SAAAA;AAAA,GAAA;AAuCL,SAAS,iBAGd,SAAY,SAAgD;AAC5D,SAAO,QAAQ,OAAO,yBAAyB;AACjD;AAkBO,IAAM,oBAAN,MAEL;AAAA,EACgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQhB,YAAY,SAAsC;AAChD,SAAK,uBAAuB,QAAQ;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,UACE,SAC8B;AAC9B,UAAM,iBAAuC,KAAK;AAClD,WAAO,mBAAmB;AAAA,EAC5B;AACF;;;AC3FO,IAAM,gBAAgB;AAAA,EAC3B,iBAAiB;AAAA,EACjB,MAAM;AACR;AAKO,IAAM,UAAU;AAAA,EACrB,eAAe;AAAA,EACf,cAAc;AAAA,EACd,MAAM;AAAA,EACN,0BAA0B;AAAA,EAC1B,8BAA8B;AAChC;AAEO,IAAM,sBAAsB,IAAI;AAChC,IAAM,+BAA+B;;;ACpBrC,IAAK,cAAL,kBAAKC,iBAAL;AACL,EAAAA,aAAA,UAAO;AACP,EAAAA,aAAA,UAAO;AACP,EAAAA,aAAA,YAAS;AACT,EAAAA,aAAA,SAAM;AACN,EAAAA,aAAA,kCAA+B;AAC/B,EAAAA,aAAA,wBAAqB;AANX,SAAAA;AAAA,GAAA;;;ACEL,IAAK,gBAAL,kBAAKC,mBAAL;AACL,EAAAA,eAAA,YAAS;AACT,EAAAA,eAAA,YAAS;AACT,EAAAA,eAAA,YAAS;AAHC,SAAAA;AAAA,GAAA;;;ACFZ,IAAM,cAAc,IAAI,YAAY;AACpC,IAAM,cAAc,IAAI,YAAY;AAEpC,SAAS,kBAAkB,QAAwB;AACjD,QAAM,aAAa,OAAO,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AAC9D,QAAM,gBAAgB,WAAW,SAAS;AAE1C,SAAO,kBAAkB,IACrB,aACA,WAAW,OAAO,WAAW,UAAU,IAAI,gBAAgB,GAAG;AACpE;AAEA,SAAS,kBAAkB,QAAwB;AACjD,SAAO,OAAO,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,MAAM,EAAE;AACxE;AAEA,SAAS,aAAa,MAA0B;AAC9C,MAAI,SAAS;AACb,aAAW,QAAQ,MAAM;AACvB,cAAU,OAAO,aAAa,IAAI;AAAA,EACpC;AACA,SAAO,KAAK,MAAM;AACpB;AAEO,SAAS,iBAAiB,OAA2B;AAC1D,SAAO,YAAY,OAAO,KAAK;AACjC;AAEO,SAAS,mBAAmB,MAA0B;AAC3D,SAAO,YAAY,OAAO,IAAI;AAChC;AAKO,SAAS,aAAa,QAA4B;AACvD,QAAM,SAAS,KAAK,kBAAkB,MAAM,CAAC;AAC7C,SAAO,WAAW,KAAK,QAAQ,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC;AAC7D;AAEO,SAAS,kBAAkB,MAAmC;AACnE,SAAO;AAAA,IACL,aAAa,OAAO,SAAS,WAAW,iBAAiB,IAAI,IAAI,IAAI;AAAA,EACvE;AACF;;;ACtCA,IAAM,YAAY;AAAA,EAChB,iBAAiB;AAAA,EACjB,gBAAgB;AAAA,EAChB,gBAAgB;AAClB;AAEA,SAAS,aAAa,KAAqB;AACzC,SAAO,IAAI,QAAQ,OAAO,MAAM,EAAE,QAAQ,MAAM,KAAK;AACvD;AAIA,SAAS,SAAS,MAA6B;AAC7C,MAAI,KAAK,WAAW,KAAK,KAAK,CAAC,MAAM,QAAW;AAC9C,WAAO,OAAO,KAAK,CAAC,CAAC;AAAA,EACvB;AAEA,SAAO,KAAK,OAAe,CAAC,KAAK,SAAS;AAExC,QAAI,OAAO,SAAS,UAAU;AAC5B,aAAO,GAAG,GAAG,IAAI,KAAK,SAAS,CAAC;AAAA,IAClC;AAEA,QAAI,OAAO,SAAS,UAAU;AAC5B,aAAO,GAAG,GAAG,IAAI,KAAK,UAAU,OAAO,IAAI,CAAC,CAAC;AAAA,IAC/C;AAGA,QAAI,KAAK,SAAS,GAAG,GAAG;AACtB,aAAO,GAAG,GAAG,KAAK,aAAa,IAAI,CAAC;AAAA,IACtC;AAGA,QAAI,CAAC,UAAU,gBAAgB,KAAK,IAAI,GAAG;AACzC,aAAO,GAAG,GAAG,KAAK,IAAI;AAAA,IACxB;AAGA,UAAM,YAAY,IAAI,WAAW,IAAI,KAAK;AAC1C,WAAO,MAAM,YAAY;AAAA,EAC3B,GAAG,EAAE;AACP;AACA,SAAS,uBAAuB,OAAyB;AACvD,MAAI,MAAM,SAAS,iBAAiB;AAClC,WAAO,0BAA0B,MAAM,MAAM;AAAA,EAC/C;AAEA,MAAI,MAAM,KAAK,WAAW,GAAG;AAE3B,QAAI,MAAM,KAAK,WAAW,GAAG;AAC3B,YAAM,aAAa,MAAM,KAAK,CAAC;AAE/B,UAAI,OAAO,eAAe,UAAU;AAClC,eAAO,GAAG,MAAM,OAAO,aAAa,UAAU;AAAA,MAChD;AAAA,IACF;AAEA,WAAO,GAAG,MAAM,OAAO,QAAQ,SAAS,MAAM,IAAI,CAAC;AAAA,EACrD;AAEA,SAAO,MAAM;AACf;AAEA,SAAS,0BAA0B,aAAmC;AACpE,SAAO,YACJ,OAAiB,CAAC,KAAK,WAAW;AACjC,UAAM,YAAY,OACf,IAAI,CAAC,UAAU,uBAAuB,KAAK,CAAC,EAC5C,KAAK,UAAU,cAAc;AAEhC,QAAI,CAAC,IAAI,SAAS,SAAS,EAAG,KAAI,KAAK,SAAS;AAEhD,WAAO;AAAA,EACT,GAAG,CAAC,CAAC,EACJ,KAAK,UAAU,cAAc;AAClC;AAQO,SAAS,eAAe,OAA4B;AACzD,MAAI,CAAC,MAAO,QAAO;AAEnB,SAAO,MAAO,OAAO,OAAO,IAAI,CAAC,UAAU,uBAAuB,KAAK,CAAC,EAAE,KAAK,UAAU,cAAc,CAAC;AAC1G;;;ACzFO,IAAM,iBAAN,cAA6B,MAAM;AAAA,EACxC,YAAY,SAAiB,YAAoB;AAC/C,UAAM,GAAG,OAAO;AAAA,EAAK,UAAU,EAAE;AACjC,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,gBAAN,cAA4B,MAAM;AAAA,EACvC,YAAY,SAAkB;AAC5B,UAAM,WAAW,mBAAmB;AACpC,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,uBAAN,cAAmC,MAAM;AAAA,EAC9C,YAAY,SAAkB,SAAwB;AACpD,UAAM,eAAe,WAAW;AAChC,UAAM,eACJ,SAAS,iBAAiB,QACtB,IAAI,QAAQ,MAAM,OAAO,KACzB,SAAS,QACP,IAAI,OAAO,QAAQ,KAAK,CAAC,KACzB;AAER,UAAM,GAAG,YAAY,GAAG,YAAY,IAAI,OAAO;AAC/C,SAAK,OAAO;AAAA,EACd;AACF;AAeO,IAAM,iBAAiB,CAC5B,UAEA,OAAO,QAAQ,KAAK,EACjB,OAAO,CAAC,CAAC,EAAE,CAAC,MAAM,MAAM,MAAS,EACjC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM;AACf,MAAI,MAAM,QAAQ,CAAC,EAAG,QAAO,CAAC,GAAG,IAAI,EAAE,KAAK,IAAI,CAAC,GAAG;AACpD,MAAI,OAAO,MAAM,SAAU,QAAO,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC;AACvD,SAAO,CAAC,GAAG,CAAC;AACd,CAAC,EACA,IAAI,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,EACtB,KAAK,GAAG;AAKN,IAAM,4BAAN,cAAwC,MAAM;AAAA,EACnD,OAAO;AAAA,EACP;AAAA,EACA;AAAA,EAEA,YAAY;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAIG;AACD,UAAM,eAAe,EAAE,SAAS,QAAQ,WAAW,CAAC,CAAC;AACrD,SAAK,SAAS;AACd,SAAK,aAAa;AAAA,EACpB;AACF;AAkBO,IAAM,4BAAN,MAAM,mCAAkC,MAAM;AAAA,EAGnD,YACkB,SACA,kBACA,mBAChB;AACA;AAAA,MACE,YAAY,OAAO,8BAA8B,gBAAgB;AAAA,sBACxC,kBAAkB,KAAK,IAAI,CAAC;AAAA,IACvD;AAPgB;AACA;AACA;AAMhB,SAAK,OAAO;AAGZ,UAAM,mBAAmB;AAGzB,QAAI,OAAO,iBAAiB,sBAAsB,YAAY;AAC5D,uBAAiB,kBAAkB,MAAM,0BAAyB;AAAA,IACpE;AAAA,EACF;AAAA,EAjBkB;AAAA,EACA;AAAA,EACA;AAAA,EALF,OAAO;AAqBzB;AAKO,IAAM,kBAAN,cAA8B,MAAM;AAAA,EAClC;AAAA,EAEP,YAAY,SAAiB,UAAuB;AAClD,UAAM,OAAO;AAEb,UAAM,iBAAiB,eAAe,QAAQ;AAC9C,SAAK,UAAU,GAAG,OAAO;AAAA,EAAK,cAAc;AAE5C,WAAO,eAAe,MAAM,YAAY;AAAA,MACtC,YAAY;AAAA,MACZ,OAAO;AAAA,MACP,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACF;;;ACtIA,IAAM,4BAA4B;AAElC,SAAS,cAAc,OAAwB;AAC7C,MAAI;AACF,UAAM,SAAS,KAAK;AAAA,MAAU;AAAA,MAAO,CAAC,MAAM,QAC1C,OAAO,QAAQ,WAAW,YAAY,GAAG,MAAM;AAAA,IACjD;AACA,QAAI,WAAW,QAAW;AACxB,aAAO,OAAO,KAAK;AAAA,IACrB;AACA,WAAO,OAAO,SAAS,4BACnB,GAAG,OAAO,MAAM,GAAG,yBAAyB,CAAC,WAC7C;AAAA,EACN,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAUO,SAAS,8BACd,OACA,cACyB;AACzB,MAAI;AACF,WAAO,KAAK,MAAM,KAAK;AAAA,EACzB,QAAQ;AACN,UAAM,IAAI;AAAA,MACR,gBAAgB;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,YAAe,MAAsC;AACnE,MAAI,OAAO,SAAS,UAAU;AAC5B,WAAO;AAAA,EACT;AAEA,MAAI;AACF,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,uBACd,QACA,MACA,oBACiB;AACjB,QAAM,cAAc,OAAO,UAAU,IAAI;AAEzC,MAAI,CAAC,YAAY,SAAS;AACxB,UAAM,IAAI;AAAA,MACR,sBACE,qCAAqC,cAAc,IAAI,CAAC;AAAA,MAC1D,YAAY;AAAA,IACd;AAAA,EACF;AAEA,SAAO,YAAY;AACrB;AASO,SAAS,YAAY,SAAiB,QAAyB;AACpE,SAAO,SAAS,GAAG,MAAM,IAAI,OAAO,KAAK;AAC3C;;;ACrFA,IAAAC,cAAc;;;ACAd,iBAAc;AAEP,IAAM,cAAc,WAAAC,QAAE,MAAM,CAAC,WAAAA,QAAE,OAAO,CAAC,GAAG,WAAAA,QAAE,OAAO,CAAC;AAGpD,IAAM,oBAAoB,WAAAA,QAAE,MAAM,WAAAA,QAAE,OAAO,CAAC,EAAE,SAAS;AAGvD,IAAM,mBAAmB,WAAAA,QAC7B,OAAO,EACP,OAAO,CAAC,QAAQ,QAAQ,QAAQ,EAAE,SAAS,8BAA8B,CAAC;;;ADNtE,IAAM,OAAO,YAAAC,QAAE,YAAY;AAAA,EAChC,KAAK,YAAAA,QAAE,SAAS,YAAAA,QAAE,OAAO,CAAC;AAAA,EAC1B,KAAK,YAAAA,QAAE,SAAS,YAAAA,QAAE,OAAO,CAAC;AAAA,EAC1B,GAAG,YAAAA,QAAE,SAAS,YAAAA,QAAE,OAAO,CAAC;AAAA,EACxB,IAAI,YAAAA,QAAE,SAAS,YAAAA,QAAE,OAAO,CAAC;AAAA,EACzB,IAAI,YAAAA,QAAE,SAAS,YAAAA,QAAE,OAAO,CAAC;AAAA,EACzB,GAAG,YAAAA,QAAE,SAAS,YAAAA,QAAE,OAAO,CAAC;AAAA,EACxB,KAAK,YAAAA,QAAE,SAAS,YAAAA,QAAE,QAAQ,CAAC;AAAA,EAC3B,GAAG,YAAAA,QAAE,SAAS,YAAAA,QAAE,OAAO,CAAC;AAAA,EACxB,SAAS,YAAAA,QAAE,SAAS,YAAAA,QAAE,MAAM,YAAAA,QAAE,OAAO,CAAC,CAAC;AAAA,EACvC,KAAK,YAAAA,QAAE,SAAS,YAAAA,QAAE,OAAO,CAAC;AAAA,EAC1B,KAAK,YAAAA,QAAE,OAAO;AAAA,EACd,GAAG,YAAAA,QAAE,SAAS,YAAAA,QAAE,OAAO,CAAC;AAAA,EACxB,KAAK,YAAAA,QAAE;AAAA,IACL,YAAAA,QAAE;AAAA,MACA,YAAAA,QAAE,YAAY;AAAA,QACZ,GAAG,YAAAA,QAAE,SAAS,YAAAA,QAAE,OAAO,CAAC;AAAA,QACxB,GAAG,YAAAA,QAAE,SAAS,YAAAA,QAAE,OAAO,CAAC;AAAA,QACxB,GAAG,YAAAA,QAAE,SAAS,YAAAA,QAAE,OAAO,CAAC;AAAA,MAC1B,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EACA,GAAG,YAAAA,QAAE,SAAS,YAAAA,QAAE,OAAO,CAAC;AAAA,EACxB,GAAG,YAAAA,QAAE,SAAS,YAAAA,QAAE,OAAO,CAAC;AAAA,EACxB,IAAI,YAAAA,QAAE,SAAS,YAAAA,QAAE,OAAO,CAAC;AAAA,EACzB,KAAK,YAAAA,QAAE,SAAS,YAAAA,QAAE,OAAO,CAAC;AAAA,EAC1B,GAAG,YAAAA,QAAE,SAAS,YAAAA,QAAE,OAAO,CAAC;AAAA,EACxB,KAAK,YAAAA,QAAE,SAAS,iBAAiB;AAAA,EACjC,KAAK,YAAAA,QAAE,SAAS,YAAAA,QAAE,OAAO,CAAC;AAAA,EAC1B,YAAY,YAAAA,QAAE,SAAS,YAAAA,QAAE,OAAO,CAAC;AAAA,EACjC,KAAK,YAAAA,QAAE,SAAS,YAAAA,QAAE,OAAO,CAAC;AAAA,EAC1B,GAAG,YAAAA,QAAE,SAAS,YAAAA,QAAE,OAAO,CAAC;AAC1B,CAAC;AAIM,IAAM,UAAU,YAAAA,QAAE,YAAY,EAAE,MAAM,YAAAA,QAAE,MAAM,IAAI,EAAE,CAAC;;;AElC5D,SAAS,8BAA8B,KAAU;AAC/C,MAAI,IAAI,QAAQ,MAAM;AACpB,QAAI,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,GAAG;AAChC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL,KAAK,IAAI;AAAA,MACT,KAAK,IAAI;AAAA,MACT,GAAG,IAAI;AAAA,MACP,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AAEA,MAAI,IAAI,QAAQ,OAAO;AACrB,QAAI,CAAC,IAAI,KAAK,CAAC,IAAI,GAAG;AACpB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL,GAAG,IAAI;AAAA,MACP,KAAK,IAAI;AAAA,MACT,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AAEA,MAAI,IAAI,QAAQ,OAAO;AACrB,QAAI,CAAC,IAAI,GAAG;AACV,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL,GAAG,IAAI;AAAA,MACP,KAAK,IAAI;AAAA,IACX;AAAA,EACF;AAEA,QAAM,IAAI;AAAA,IACR;AAAA,EACF;AACF;AAEA,eAAsB,uBAAuB,SAIzB;AAClB,QAAM,YAAY;AAAA,IAChB;AAAA,IACA,QAAQ;AAAA,IACR;AAAA,EACF;AAEA,QAAM,0BAA0B,8BAA8B,SAAS;AAEvE,SAAO;AAAA,IACL,MAAM,QAAQ;AAAA,MACZ,iBAAiB,KAAK,UAAU,uBAAuB,CAAC;AAAA,MACxD,QAAQ;AAAA,IACV;AAAA,EACF;AACF;;;ACzEA,IAAAC,cAAc;AAUP,IAAM,iBAAiB;AAwFvB,IAAM,cAAc,YAAAC,QACxB,OAAO,EACP,MAAM,0DAA0D;AAAA,EAC/D,SAAS;AACX,CAAC;AAEI,IAAM,0BAA0B,YAAAA,QAAE,YAAY;AAAA;AAAA,EAEnD,KAAK,YAAAA,QAAE,OAAO,EAAE,SAAS;AAAA,EACzB,KAAK,KAAK,SAAS;AACrB,CAAC;AAEM,IAAM,cAAc,YAAAA,QAAE,YAAY;AAAA,EACvC,KAAK,YAAAA,QAAE,OAAO,EAAE,GAAG,YAAAA,QAAE,MAAM,YAAAA,QAAE,OAAO,CAAC,CAAC,EAAE,SAAS;AAAA,EACjD,KAAK,wBAAwB,SAAS;AAAA,EACtC,KAAK,YAAAA,QAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/B,KAAK,YAAAA,QAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/B,KAAK,YAAAA,QAAE,OAAO,EAAE,SAAS;AAAA,EACzB,KAAK,YAAAA,QAAE,OAAO,EAAE,IAAI,cAAc,EAAE,SAAS;AAAA,EAC7C,KAAK,YAAAA,QAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/B,OAAO,YAAAA,QAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE3B,QAAQ,YAAAA,QAAE,OAAO,YAAAA,QAAE,OAAO,GAAG,YAAAA,QAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC/C,KAAK,YAAAA,QAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEzB,aAAa,YAAY,SAAS;AACpC,CAAC;AAIM,IAAM,aAAa,YAAAA,QAAE,YAAY;AAAA,EACtC,KAAK;AAAA,EACL,KAAK,KAAK,SAAS;AAAA,EACnB,KAAK,YAAAA,QAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEzB,aAAa,YAAY,SAAS;AAAA,EAClC,KAAK,YAAAA,QAAE,OAAO,EAAE,SAAS;AAAA,EACzB,KAAK,kBAAkB,SAAS;AAClC,CAAC;;;ACrFM,SAAS,gBAGd,SACqC;AACrC,QAAM,WAAW,QAAQ,IAAI,MAAM,GAAG;AACtC,MAAI,SAAS,UAAU,GAAG;AACxB,UAAM,IAAI;AAAA,MACR;AAAA,QACE;AAAA,QACA,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF;AAEA,QAAM,CAAC,UAAU,IAAI;AAErB,MAAI;AACJ,MAAI;AACF,iBAAa;AAAA,MACX,mBAAmB,aAAa,UAAU,CAAC;AAAA,MAC3C;AAAA,QACE;AAAA,QACA,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR;AAAA,QACE,sBAAsB,iBAAiB,QAAQ,MAAM,UAAU,EAAE;AAAA,QACjE,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAAS;AAAA,IACb,QAAQ,gBAAgB;AAAA,IACxB;AAAA,IACA,YAAY,sBAAsB,QAAQ,kBAAkB;AAAA,EAC9D;AAEA,SAAO;AAAA,IACL;AAAA,EACF;AACF;AAQO,SAAS,uBAAuB,QAAmB;AACxD,MAAI,OAAO,WAAW,OAAO;AAC3B,WAAO;AAAA,MACL,KAAK,OAAO;AAAA,MACZ,KAAK,OAAO;AAAA,IACd;AAAA,EACF;AAEA,MAAI,OAAO,WAAW,cAAc;AAClC,WAAO;AAAA,MACL,KAAK,OAAO;AAAA,MACZ,KAAK,OAAO;AAAA,MACZ,aAAa,OAAO;AAAA,IACtB;AAAA,EACF;AAEA,MAAI,OAAO,WAAW,OAAO;AAC3B,WAAO;AAAA,MACL,KAAK,OAAO;AAAA,MACZ,KAAK,OAAO;AAAA,IACd;AAAA,EACF;AAEA,MAAI,OAAO,WAAW,OAAO;AAC3B,WAAO;AAAA,MACL,KAAK,OAAO;AAAA,MACZ,KAAK,OAAO;AAAA,MACZ,aAAa,OAAO;AAAA,MACpB,KAAK,OAAO;AAAA,IACd;AAAA,EACF;AAEA,SAAO,EAAE,KAAK,OAAO,IAAI;AAC3B;AAYO,SAAS,iBAAiB,SAInB;AACZ,QAAM,EAAE,sBAAsB,QAAQ,QAAQ,IAAI;AAClD,QAAM,QAWA,CAAC;AAEP,MAAI,OAAO,KAAK;AACd,UAAM,KAAK;AAAA,MACT,QAAQ;AAAA,MACR,QAAQ;AAAA,QACN,KAAK,OAAO;AAAA,QACZ,KAAK,OAAO;AAAA,QACZ,QAAQ;AAAA,QACR,YAAY,OAAO;AAAA,QACnB,KAAK,OAAO;AAAA,MACd;AAAA,MACA,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AAEA,MAAI,OAAO,aAAa;AACtB,QAAI,CAAC,OAAO,KAAK;AACf,YAAM,KAAK;AAAA,QACT,OACE;AAAA,QACF,QAAQ;AAAA,QACR,OAAO;AAAA,MACT,CAAC;AAAA,IACH,OAAO;AACL,YAAM,KAAK;AAAA,QACT,QAAQ;AAAA,QACR,QAAQ;AAAA,UACN,KAAK,OAAO;AAAA,UACZ,KAAK,OAAO;AAAA,UACZ,QAAQ;AAAA,UACR,YAAY,OAAO;AAAA,QACrB;AAAA,QACA,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,EACF;AAEA,MAAI,OAAO,KAAK,WAAW,MAAM,KAAK,QAAQ,KAAK,WAAW,MAAM,GAAG;AACrE,QACE,QAAQ,OACR,OAAO,KAAK,WAAW,MAAM,KAC7B,CAAC,OAAO,IAAI,WAAW,QAAQ,GAAG,GAClC;AACA,YAAM,KAAK;AAAA,QACT,OACE;AAAA,QACF,QAAQ;AAAA,QACR,OAAO;AAAA,MACT,CAAC;AAAA,IACH,WACE,CAAC,OAAO,KAAK,WAAW,MAAM,KAC9B,CAAC,OAAO,KAAK,WAAW,GAAG,GAC3B;AACA,YAAM,KAAK;AAAA,QACT,OACE;AAAA,QACF,QAAQ;AAAA,QACR,OAAO;AAAA,MACT,CAAC;AAAA,IACH,WAAW,OAAO,KAAK;AACrB,YAAM,KAAK;AAAA,QACT,QAAQ;AAAA,QACR,QAAQ;AAAA,UACN,KAAK,OAAO;AAAA,UACZ,QAAQ,OAAO,IAAI,WAAW,MAAM,IAChC,OAAO,MACP,GAAG,QAAQ,GAAG,GAAG,OAAO,GAAG;AAAA,UAC/B,QAAQ;AAAA,QACV;AAAA,QACA,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,EACF;AAEA,MAAI,OAAO,KAAK;AACd,UAAM,KAAK;AAAA,MACT,QAAQ;AAAA,MACR,QAAQ;AAAA,QACN,KAAK,OAAO;AAAA,QACZ,QAAQ;AAAA,QACR,WAAW,OAAO;AAAA,MACpB;AAAA,MACA,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AAEA,QAAM,sBAAsB,MAAM;AAAA,IAChC,CAAC,cACC,CAAC,wBAAwB,qBAAqB,SAAS,UAAU,MAAM;AAAA,EAC3E;AACA,QAAM,sBAAsB,oBAAoB;AAAA,IAC9C,CAAC,cAAc,UAAU;AAAA,EAC3B;AAEA,QAAM,0BAA0B,oBAAoB,CAAC;AACrD,MAAI,2BAA2B,wBAAwB,OAAO;AAC5D,WAAO,wBAAwB;AAAA,EACjC;AAEA,MAAI,oBAAoB,SAAS,GAAG;AAClC,UAAM,IAAI;AAAA,MACR,mDAAmD,oBAAoB,MAAM;AAAA,EAAmE,oBAC7I;AAAA,QAAI,CAAC,cACJ,UAAU,QACN,KACA,kBAAkB,UAAU,MAAM,MAAM,UAAU,KAAK;AAAA,MAC7D,EACC,KAAK,IAAI,CAAC;AAAA,IACf;AAAA,EACF;AAEA,MAAI,MAAM,SAAS,GAAG;AACpB,UAAM,IAAI;AAAA,MACR,mDAAmD,MAAM,MAAM;AAAA,EAA4C,MACxG;AAAA,QAAI,CAAC,cACJ,UAAU,QACN,qBAAqB,UAAU,MAAM,KACrC,kBAAkB,UAAU,MAAM,MAAM,UAAU,KAAK;AAAA,MAC7D,EACC,KAAK,IAAI,CAAC;AAAA,IACf;AAAA,EACF;AAEA,MAAI,CAAC,wBAAwB,qBAAqB,SAAS,QAAQ,GAAG;AACpE,WAAO;AAAA,MACL,KAAK,OAAO;AAAA,MACZ,KAAK,OAAO;AAAA,MACZ,QAAQ;AAAA,IACV;AAAA,EACF;AAEA,QAAM,IAAI;AAAA,IACR;AAAA,EACF;AACF;;;AC5OO,SAAS,UAId,SAC8C;AAC9C,QAAM,WAAW,QAAQ,IAAI,MAAM,GAAG;AACtC,MAAI,SAAS,WAAW,GAAG;AACzB,UAAM,IAAI;AAAA,MACR;AAAA,QACE;AAAA,QACA,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,UAAM,cAAc,SAAS,CAAC;AAC9B,QAAI,gBAAgB,QAAW;AAC7B,YAAM,IAAI;AAAA,QACR;AAAA,UACE;AAAA,UACA,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AACA,kBAAc;AAAA,MACZ,mBAAmB,aAAa,WAAW,CAAC;AAAA,MAC5C;AAAA,QACE;AAAA,QACA,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR;AAAA,QACE,sBAAsB,iBAAiB,QAAQ,MAAM,UAAU,EAAE;AAAA,QACjE,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF;AAEA,QAAM,gBAAgB,SAAS,CAAC;AAChC,MAAI,kBAAkB,QAAW;AAC/B,UAAM,IAAI;AAAA,MACR;AAAA,QACE;AAAA,QACA,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF;AAEA,QAAM,EAAE,OAAO,IAAI,gBAAgB;AAAA,IACjC,oBAAoB,QAAQ;AAAA,IAC5B,cAAc,QAAQ;AAAA,IACtB,KAAK,QAAQ;AAAA,EACf,CAAC;AACD,QAAM,UAAU;AAAA,IACd,QAAQ,iBAAiB;AAAA,IACzB;AAAA,IACA,YAAY,uBAAuB,QAAQ,kBAAkB;AAAA,EAC/D;AAEA,SAAO;AAAA,IACL,SAAS,QAAQ;AAAA,IACjB;AAAA,IAIA;AAAA,IAIA,WAAW;AAAA,EACb;AACF;;;ACxIO,SAAS,cAAc,MAAqB;AACjD,QAAM,eAAe,MAAM,QAAQ,KAAK,KAAK,IAAI;AACjD,SAAO,KAAK,MAAM,eAAe,GAAI;AACvC;AAEO,SAAS,iBAAiB,MAAY,SAAuB;AAClE,SAAO,IAAI,KAAK,KAAK,QAAQ,IAAI,UAAU,GAAI;AACjD;;;ACiBA,eAAsB,UACpB,SAC0B;AAC1B,QAAM,eACJ,QAAQ,gBAAgB;AAE1B,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ,kBAAkB,QAAQ,QAAQ;AAAA,MAC7D,SAAS,QAAQ;AAAA,MACjB,QAAQ,QAAQ;AAAA,MAChB,SAAS,QAAQ;AAAA,IACnB,CAAC;AAED,QAAI,CAAC,OAAO,UAAU;AACpB,YAAM,IAAI,qBAAqB,YAAY;AAAA,IAC7C;AAEA,gBAAY,OAAO;AAAA,EACrB,SAAS,OAAO;AACd,QAAI,iBAAiB,sBAAsB;AACzC,YAAM;AAAA,IACR;AAEA,UAAM,IAAI,qBAAqB,cAAc,EAAE,OAAO,MAAM,CAAC;AAAA,EAC/D;AAEA,QAAM,eAAe,cAAc,QAAQ,OAAO,oBAAI,KAAK,CAAC;AAC5D,QAAM,gBAAgB,QAAQ,wBAAwB;AACtD,QAAM,sBACJ,QAAQ,4BAA4B,SAChC,CAAC,QAAQ,0BACT;AAEN,MACE,uBACA,QAAQ,QAAQ,OAChB,eAAe,QAAQ,QAAQ,MAAM,eACrC;AACA,UAAM,IAAI;AAAA,MACR,GAAG,YAAY;AAAA,IACjB;AAAA,EACF;AAEA,MACE,uBACA,QAAQ,QAAQ,OAChB,eAAe,QAAQ,QAAQ,MAAM,eACrC;AACA,UAAM,IAAI,qBAAqB,GAAG,YAAY,2BAA2B;AAAA,EAC3E;AAEA,MAAI,QAAQ,kBAAkB;AAC5B,UAAM,EAAE,IAAI,IAAI,QAAQ;AACxB,QACG,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,SAAS,QAAQ,gBAAgB,KAC5D,OAAO,QAAQ,YAAY,QAAQ,QAAQ,kBAC5C;AACA,YAAM,IAAI;AAAA,QACR,GAAG,YAAY;AAAA,MACjB;AAAA,IACF;AAAA,EACF;AAEA,MACE,QAAQ,kBACR,QAAQ,mBAAmB,QAAQ,QAAQ,KAC3C;AACA,UAAM,IAAI;AAAA,MACR,GAAG,YAAY;AAAA,IACjB;AAAA,EACF;AAEA,MACE,QAAQ,iBACR,QAAQ,kBAAkB,QAAQ,QAAQ,OAC1C;AACA,UAAM,IAAI;AAAA,MACR,GAAG,YAAY;AAAA,IACjB;AAAA,EACF;AAEA,MACE,QAAQ,mBACR,QAAQ,oBAAoB,QAAQ,QAAQ,KAC5C;AACA,UAAM,IAAI;AAAA,MACR,GAAG,YAAY;AAAA,IACjB;AAAA,EACF;AAEA,MAAI,QAAQ,gBAAgB;AAC1B,eAAW,SAAS,QAAQ,gBAAgB;AAC1C,UAAI,CAAC,QAAQ,QAAQ,KAAK,GAAG;AAC3B,cAAM,IAAI;AAAA,UACR,GAAG,YAAY,SAAS,KAAK;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,QAAQ;AAAA,MACN,GAAG,QAAQ;AAAA,MACX,WAAW;AAAA,IACb;AAAA,EACF;AACF;;;ACvIA,IAAAC,cAAkB;AAEX,IAAM,cAAc,cACxB,OAAO,EACP;AAAA,EACC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,EACX;AACF;;;ACLF,IAAM,iBAAiB;AAEhB,SAAS,cAAc,UAAiB,gBAAuB;AACpE,SAAO,CAAC,OAAO,SACb;AAAA,IACE;AAAA,IACA,OACI;AAAA,MACE,GAAG;AAAA,MACH,MACE,KAAK,gBAAgB,kBACjB,KAAK,KAAK,SAAS,IACnB,KAAK;AAAA,IACb,IACA;AAAA,EACN,EAAE,MAAM,CAAC,UAAU;AACjB,UAAM,IAAI;AAAA,MACR,2CAA2C,OAAO,KAAK,CAAC;AAAA,SAAa,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IAC7H;AAAA,EACF,CAAC;AACL;AASO,IAAM,mBACX,CAAC,QAA2B,gBAC5B,OAAO,QAAqC;AAC1C,MACE,MAAM,QAAQ,MAAM,IAChB,CAAC,OAAO,SAAS,IAAI,MAAM,IAC3B,IAAI,WAAW,QACnB;AACA,UAAM,aAAa,eAAe;AAClC,UAAM,IAAI,WAAW;AAAA,MACnB,SAAS,iCAAiC,MAAM,SAAS,IAAI,MAAM,UAAU,IAAI,GAAG;AAAA,MACpF,QAAQ,MAAM,qBAAqB,GAAG;AAAA;AAAA,MACtC,YAAY,IAAI;AAAA,IAClB,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAQK,IAAM,uBAAuB,CAClC,aAEA,SAAS,QAAQ,IAAI,cAAc,GAAG,SAAS,kBAAkB,IAC5D,SAAS,KAAK,IACf,SAAS,KAAK;;;AC9Db,SAAS,oBACd,QACiB;AACjB,QAAM,SAAS,IAAI,gBAAgB;AAEnC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,SAAS,MAAM;AACjB,aAAO;AAAA,QACL;AAAA,QACA,OAAO,UAAU,WAAW,KAAK,UAAU,KAAK,IAAI,OAAO,KAAK;AAAA,MAClE;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;;;ACfA,IAAAC,cAAc;AAQP,IAAM,4BAA4B,YAAAC,QAAE,KAAK;AAAA,EAC9C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAKM,IAAM,cAAc,YAAAA,QAAE,KAAK;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;;;ACpBM,SAAS,oBAAoB,SAAsC;AACxE,QAAM,MAAM,QAAQ,OAAO,oBAAI,KAAK;AACpC,QAAM,aAAa,KAAK,MAAM,IAAI,QAAQ,IAAI,GAAI;AAElD,MAAI,aAAa,QAAQ,MAAM,qBAAqB;AAClD,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AAEA,MAAI,QAAQ,MAAM,aAAa,8BAA8B;AAC3D,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC7D;AACF;;;ACAO,SAAS,wBAId,UAGgC;AAChC,SAAO,CAAC,YAA+B;AACrC,UAAM,UAAU,QAAQ,OAAO;AAC/B,UAAM,UAAU,SAAS,OAAO;AAChC,QAAI,OAAO,YAAY,YAAY;AACjC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA,OAAO,KAAK,QAAQ;AAAA,MACtB;AAAA,IACF;AACA,WAAO,QAAQ,OAAO;AAAA,EACxB;AACF;AAUO,SAAS,kBACd,SACA,UACS;AACT,QAAM,UAAU,SAAS,OAAO;AAChC,MAAI,OAAO,YAAY,YAAY;AACjC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,OAAO,KAAK,QAAQ;AAAA,IACtB;AAAA,EACF;AACA,SAAO,QAAQ;AACjB;","names":["ItWalletSpecsVersion","ContentType","HashAlgorithm","import_zod","z","z","import_zod","z","import_zod","import_zod","z"]}