ubid-common 0.1.0

package/dist/x509/X509ChainVerifier.d.ts

@@ -0,0 +1,59 @@
+import { X509ChainVerificationError } from "../error";
+import type { Result } from "../types";
+export type X509RevocationStatus = "good" | "revoked" | "unknown";
+export interface X509RevocationCheckInput {
+    certificateDer: Uint8Array;
+    issuerCertificateDer: Uint8Array;
+    validationTime: Date;
+}
+export interface X509RevocationChecker {
+    check(input: X509RevocationCheckInput): Promise<X509RevocationStatus>;
+}
+export interface X509ChainVerifierPolicy {
+    maxChainLength?: number;
+    maxCertificateBytes?: number;
+    maxTotalBytes?: number;
+    requireDigitalSignatureKeyUsage?: boolean;
+    requiredExtendedKeyUsages?: readonly string[];
+    requireSubjectAlternativeName?: boolean;
+    revocationMode?: "disabled" | "required";
+    revocationChecker?: X509RevocationChecker;
+}
+export interface X509ChainVerificationInput {
+    /**
+     * JWS `x5c` order: leaf first, followed by intermediates. A root may be
+     * included but is trusted only when it exactly matches a configured anchor.
+     */
+    x5c: readonly string[];
+    /**
+     * PEM or Base64 DER trust anchors configured locally by the consumer.
+     */
+    trustedCertificates: readonly string[];
+    /**
+     * JOSE algorithm from the protected header. When supplied, the leaf SPKI
+     * must have the corresponding key type and curve.
+     */
+    algorithm?: string;
+    /**
+     * DNS name or HTTPS issuer URL. Matching uses subjectAltName dNSName only;
+     * Common Name fallback is intentionally disabled.
+     */
+    expectedHostname?: string;
+    validationTime?: Date;
+}
+export interface X509ChainVerificationResult {
+    leafCertificatePem: string;
+    leafCertificateDer: Uint8Array;
+    chainLength: number;
+    subjectAlternativeNames: readonly string[];
+    trustAnchorFingerprintSha256: string;
+}
+export interface X509ChainVerifierI {
+    verify(input: X509ChainVerificationInput): Promise<Result<X509ChainVerificationResult, X509ChainVerificationError>>;
+}
+export declare class X509ChainVerifier implements X509ChainVerifierI {
+    private readonly policy;
+    constructor(policy?: X509ChainVerifierPolicy);
+    verify(input: X509ChainVerificationInput): Promise<Result<X509ChainVerificationResult, X509ChainVerificationError>>;
+}
+//# sourceMappingURL=X509ChainVerifier.d.ts.map

package/dist/x509/X509ChainVerifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"X509ChainVerifier.d.ts","sourceRoot":"","sources":["../../src/x509/X509ChainVerifier.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,0BAA0B,EAAE,MAAM,UAAU,CAAC;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AA+CvC,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;AAElE,MAAM,WAAW,wBAAwB;IACxC,cAAc,EAAE,UAAU,CAAC;IAC3B,oBAAoB,EAAE,UAAU,CAAC;IACjC,cAAc,EAAE,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACrC,KAAK,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACtE;AAED,MAAM,WAAW,uBAAuB;IACvC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,+BAA+B,CAAC,EAAE,OAAO,CAAC;IAC1C,yBAAyB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,6BAA6B,CAAC,EAAE,OAAO,CAAC;IACxC,cAAc,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;IACzC,iBAAiB,CAAC,EAAE,qBAAqB,CAAC;CAC1C;AAaD,MAAM,WAAW,0BAA0B;IAC1C;;;OAGG;IACH,GAAG,EAAE,SAAS,MAAM,EAAE,CAAC;IACvB;;OAEG;IACH,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,2BAA2B;IAC3C,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kBAAkB,EAAE,UAAU,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,uBAAuB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,4BAA4B,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,kBAAkB;IAClC,MAAM,CACL,KAAK,EAAE,0BAA0B,GAC/B,OAAO,CAAC,MAAM,CAAC,2BAA2B,EAAE,0BAA0B,CAAC,CAAC,CAAC;CAC5E;AAgQD,qBAAa,iBAAkB,YAAW,kBAAkB;IAC3D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;gBAE9B,MAAM,GAAE,uBAA4B;IAI1C,MAAM,CACX,KAAK,EAAE,0BAA0B,GAC/B,OAAO,CAAC,MAAM,CAAC,2BAA2B,EAAE,0BAA0B,CAAC,CAAC;CAuN3E"}

package/dist/x509/X509ChainVerifier.js

@@ -0,0 +1,458 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.X509ChainVerifier = void 0;
+const asn1js = __importStar(require("asn1js"));
+const pkijs = __importStar(require("pkijs"));
+const buffer_1 = require("buffer");
+const uncrypto_1 = __importDefault(require("uncrypto"));
+const error_1 = require("../error");
+const OID = Object.freeze({
+    ecPublicKey: "1.2.840.10045.2.1",
+    rsaEncryption: "1.2.840.113549.1.1.1",
+    ed25519: "1.3.101.112",
+    p256: "1.2.840.10045.3.1.7",
+    p384: "1.3.132.0.34",
+    p521: "1.3.132.0.35",
+    secp256k1: "1.3.132.0.10",
+    basicConstraints: "2.5.29.19",
+    keyUsage: "2.5.29.15",
+    extendedKeyUsage: "2.5.29.37",
+    subjectAltName: "2.5.29.17",
+    anyExtendedKeyUsage: "2.5.29.37.0",
+});
+const WEAK_SIGNATURE_ALGORITHM_OIDS = new Set([
+    "1.2.840.113549.1.1.2", // md2WithRSAEncryption
+    "1.2.840.113549.1.1.3", // md4WithRSAEncryption
+    "1.2.840.113549.1.1.4", // md5WithRSAEncryption
+    "1.2.840.113549.1.1.5", // sha1WithRSAEncryption
+    "1.2.840.10040.4.3", // dsaWithSha1
+    "1.2.840.10045.4.1", // ecdsa-with-SHA1
+]);
+const SUPPORTED_CRITICAL_EXTENSION_OIDS = new Set([
+    "2.5.29.14", // subjectKeyIdentifier
+    "2.5.29.15", // keyUsage
+    "2.5.29.17", // subjectAltName
+    "2.5.29.18", // issuerAltName
+    "2.5.29.19", // basicConstraints
+    "2.5.29.30", // nameConstraints
+    "2.5.29.31", // cRLDistributionPoints
+    "2.5.29.32", // certificatePolicies
+    "2.5.29.33", // policyMappings
+    "2.5.29.35", // authorityKeyIdentifier
+    "2.5.29.36", // policyConstraints
+    "2.5.29.37", // extendedKeyUsage
+    "2.5.29.46", // freshestCRL
+    "2.5.29.54", // inhibitAnyPolicy
+]);
+const DEFAULT_MAX_CHAIN_LENGTH = 8;
+const DEFAULT_MAX_CERTIFICATE_BYTES = 64 * 1024;
+const DEFAULT_MAX_TOTAL_BYTES = 256 * 1024;
+function failure(error) {
+    return { success: false, error };
+}
+function positiveInteger(value, fallback, field) {
+    const normalized = value ?? fallback;
+    if (!Number.isSafeInteger(normalized) || normalized <= 0) {
+        throw new TypeError(`${field} must be a positive safe integer`);
+    }
+    return normalized;
+}
+function normalizePolicy(policy) {
+    const requiredExtendedKeyUsages = policy.requiredExtendedKeyUsages ?? [];
+    if (requiredExtendedKeyUsages.some((value) => typeof value !== "string" || !/^[0-9]+(?:\.[0-9]+)+$/.test(value)) ||
+        new Set(requiredExtendedKeyUsages).size !== requiredExtendedKeyUsages.length) {
+        throw new TypeError("requiredExtendedKeyUsages must contain unique OIDs");
+    }
+    const revocationMode = policy.revocationMode ?? "disabled";
+    if (revocationMode === "required" && !policy.revocationChecker) {
+        throw new TypeError("revocationChecker is required when revocationMode is required");
+    }
+    return Object.freeze({
+        maxChainLength: positiveInteger(policy.maxChainLength, DEFAULT_MAX_CHAIN_LENGTH, "maxChainLength"),
+        maxCertificateBytes: positiveInteger(policy.maxCertificateBytes, DEFAULT_MAX_CERTIFICATE_BYTES, "maxCertificateBytes"),
+        maxTotalBytes: positiveInteger(policy.maxTotalBytes, DEFAULT_MAX_TOTAL_BYTES, "maxTotalBytes"),
+        requireDigitalSignatureKeyUsage: policy.requireDigitalSignatureKeyUsage !== false,
+        requiredExtendedKeyUsages: Object.freeze([...requiredExtendedKeyUsages]),
+        requireSubjectAlternativeName: policy.requireSubjectAlternativeName !== false,
+        revocationMode,
+        revocationChecker: policy.revocationChecker,
+    });
+}
+function normalizeBase64Der(value, allowPem) {
+    let base64 = value.trim();
+    const pemMatch = base64.match(/^-----BEGIN CERTIFICATE-----\s*([A-Za-z0-9+/=\s]+?)\s*-----END CERTIFICATE-----$/);
+    if (pemMatch) {
+        if (!allowPem)
+            return undefined;
+        base64 = pemMatch[1].replace(/\s/g, "");
+    }
+    else if (/\s/.test(base64)) {
+        return undefined;
+    }
+    if (base64.length === 0 ||
+        base64.length % 4 !== 0 ||
+        !/^[A-Za-z0-9+/]+={0,2}$/.test(base64)) {
+        return undefined;
+    }
+    return base64;
+}
+function parseCertificate(value, allowPem, maxCertificateBytes) {
+    const base64 = normalizeBase64Der(value, allowPem);
+    if (!base64)
+        return undefined;
+    let bytes;
+    try {
+        bytes = new Uint8Array(buffer_1.Buffer.from(base64, "base64"));
+    }
+    catch {
+        return undefined;
+    }
+    if (bytes.byteLength === 0 ||
+        bytes.byteLength > maxCertificateBytes ||
+        buffer_1.Buffer.from(bytes).toString("base64") !== base64) {
+        return undefined;
+    }
+    const der = bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+    const asn1 = asn1js.fromBER(der);
+    if (asn1.offset !== der.byteLength || asn1.result.error)
+        return undefined;
+    try {
+        const certificate = new pkijs.Certificate({ schema: asn1.result });
+        return {
+            certificate,
+            der: new Uint8Array(bytes),
+            fingerprintKey: buffer_1.Buffer.from(bytes).toString("hex"),
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+function toPem(der) {
+    const base64 = buffer_1.Buffer.from(der).toString("base64");
+    const lines = base64.match(/.{1,64}/g) ?? [];
+    return `-----BEGIN CERTIFICATE-----\n${lines.join("\n")}\n-----END CERTIFICATE-----`;
+}
+function extension(certificate, oid) {
+    return certificate.extensions?.find((item) => item.extnID === oid);
+}
+function isCertificateAuthority(certificate) {
+    const value = extension(certificate, OID.basicConstraints)?.parsedValue;
+    return value instanceof pkijs.BasicConstraints && value.cA === true;
+}
+function hasDigitalSignatureKeyUsage(certificate) {
+    const value = extension(certificate, OID.keyUsage)?.parsedValue;
+    if (!(value instanceof asn1js.BitString))
+        return false;
+    const bytes = value.valueBlock.valueHexView;
+    return bytes.length > 0 && (bytes[0] & 0x80) === 0x80;
+}
+function extendedKeyUsages(certificate) {
+    const value = extension(certificate, OID.extendedKeyUsage)?.parsedValue;
+    return value instanceof pkijs.ExtKeyUsage ? value.keyPurposes : [];
+}
+function subjectAlternativeNames(certificate) {
+    const value = extension(certificate, OID.subjectAltName)?.parsedValue;
+    if (!(value instanceof pkijs.AltName))
+        return [];
+    return Object.freeze(value.altNames
+        .filter((name) => name.type === 2 && typeof name.value === "string")
+        .map((name) => String(name.value).toLowerCase()));
+}
+function normalizeHostname(value) {
+    let hostname = value.trim();
+    try {
+        hostname = new URL(hostname).hostname;
+    }
+    catch {
+        // A bare DNS name is accepted below.
+    }
+    hostname = hostname.toLowerCase().replace(/\.$/, "");
+    if (hostname.length === 0 ||
+        hostname.length > 253 ||
+        hostname.includes(":") ||
+        hostname.split(".").some((label) => label.length === 0 ||
+            label.length > 63 ||
+            !/^[a-z0-9-]+$/.test(label) ||
+            label.startsWith("-") ||
+            label.endsWith("-"))) {
+        return undefined;
+    }
+    return hostname;
+}
+function dnsNameMatches(hostname, certificateName) {
+    const pattern = certificateName.toLowerCase().replace(/\.$/, "");
+    if (!pattern.includes("*"))
+        return pattern === hostname;
+    if (!pattern.startsWith("*.") ||
+        pattern.indexOf("*", 1) !== -1) {
+        return false;
+    }
+    const suffix = pattern.slice(2);
+    const hostnameLabels = hostname.split(".");
+    const suffixLabels = suffix.split(".");
+    return (suffixLabels.length >= 2 &&
+        hostnameLabels.length === suffixLabels.length + 1 &&
+        hostnameLabels.slice(1).join(".") === suffix);
+}
+function objectIdentifierValue(value) {
+    return value instanceof asn1js.ObjectIdentifier
+        ? value.valueBlock.toString()
+        : undefined;
+}
+function algorithmMatches(certificate, algorithm) {
+    const publicKeyAlgorithm = certificate.subjectPublicKeyInfo.algorithm;
+    const keyOid = publicKeyAlgorithm.algorithmId;
+    const curveOid = objectIdentifierValue(publicKeyAlgorithm.algorithmParams);
+    switch (algorithm) {
+        case "ES256":
+            return keyOid === OID.ecPublicKey && curveOid === OID.p256;
+        case "ES384":
+            return keyOid === OID.ecPublicKey && curveOid === OID.p384;
+        case "ES512":
+            return keyOid === OID.ecPublicKey && curveOid === OID.p521;
+        case "ES256K":
+            return keyOid === OID.ecPublicKey && curveOid === OID.secp256k1;
+        case "RS256":
+        case "RS384":
+        case "RS512":
+        case "PS256":
+        case "PS384":
+        case "PS512":
+            return keyOid === OID.rsaEncryption;
+        case "EdDSA":
+            return keyOid === OID.ed25519;
+        default:
+            return false;
+    }
+}
+function isWeaklySigned(certificate) {
+    return WEAK_SIGNATURE_ALGORITHM_OIDS.has(certificate.signatureAlgorithm.algorithmId);
+}
+function certificateTimeError(certificate, validationTime) {
+    if (certificate.notBefore.value.getTime() > validationTime.getTime()) {
+        return error_1.X509ChainVerificationError.CertificateNotYetValid;
+    }
+    if (certificate.notAfter.value.getTime() < validationTime.getTime()) {
+        return error_1.X509ChainVerificationError.CertificateExpired;
+    }
+    return undefined;
+}
+async function sha256Hex(value) {
+    const digest = await uncrypto_1.default.subtle.digest("SHA-256", new Uint8Array(value));
+    return buffer_1.Buffer.from(digest).toString("hex");
+}
+class X509ChainVerifier {
+    policy;
+    constructor(policy = {}) {
+        this.policy = normalizePolicy(policy);
+    }
+    async verify(input) {
+        if (!Array.isArray(input.x5c) || input.x5c.length === 0) {
+            return failure(error_1.X509ChainVerificationError.EmptyChain);
+        }
+        if (input.x5c.length > this.policy.maxChainLength) {
+            return failure(error_1.X509ChainVerificationError.ChainTooLong);
+        }
+        if (!Array.isArray(input.trustedCertificates) ||
+            input.trustedCertificates.length === 0) {
+            return failure(error_1.X509ChainVerificationError.NoTrustAnchors);
+        }
+        const chain = [];
+        let totalBytes = 0;
+        for (const encodedCertificate of input.x5c) {
+            if (typeof encodedCertificate !== "string") {
+                return failure(error_1.X509ChainVerificationError.InvalidCertificateEncoding);
+            }
+            const parsed = parseCertificate(encodedCertificate, false, this.policy.maxCertificateBytes);
+            if (!parsed) {
+                return failure(error_1.X509ChainVerificationError.InvalidCertificateEncoding);
+            }
+            totalBytes += parsed.der.byteLength;
+            if (totalBytes > this.policy.maxTotalBytes) {
+                return failure(error_1.X509ChainVerificationError.ChainTooLarge);
+            }
+            chain.push(parsed);
+        }
+        if (new Set(chain.map((item) => item.fingerprintKey)).size !== chain.length) {
+            return failure(error_1.X509ChainVerificationError.DuplicateCertificate);
+        }
+        const trustAnchors = [];
+        for (const encodedCertificate of input.trustedCertificates) {
+            if (typeof encodedCertificate !== "string") {
+                return failure(error_1.X509ChainVerificationError.InvalidTrustAnchor);
+            }
+            const parsed = parseCertificate(encodedCertificate, true, this.policy.maxCertificateBytes);
+            if (!parsed) {
+                return failure(error_1.X509ChainVerificationError.InvalidTrustAnchor);
+            }
+            trustAnchors.push(parsed);
+        }
+        if (new Set(trustAnchors.map((item) => item.fingerprintKey)).size !==
+            trustAnchors.length) {
+            return failure(error_1.X509ChainVerificationError.InvalidTrustAnchor);
+        }
+        for (let index = 0; index < chain.length - 1; index++) {
+            if (!chain[index].certificate.issuer.isEqual(chain[index + 1].certificate.subject)) {
+                return failure(error_1.X509ChainVerificationError.InvalidChainOrder);
+            }
+        }
+        const validationTime = input.validationTime
+            ? new Date(input.validationTime)
+            : new Date();
+        if (Number.isNaN(validationTime.getTime())) {
+            return failure(error_1.X509ChainVerificationError.InvalidValidationTime);
+        }
+        for (const item of [...chain, ...trustAnchors]) {
+            const timeError = certificateTimeError(item.certificate, validationTime);
+            if (timeError)
+                return failure(timeError);
+        }
+        if (chain.some((item) => isWeaklySigned(item.certificate))) {
+            return failure(error_1.X509ChainVerificationError.WeakCertificateSignature);
+        }
+        if (chain.some((item) => item.certificate.extensions?.some((item) => item.critical && !SUPPORTED_CRITICAL_EXTENSION_OIDS.has(item.extnID)))) {
+            return failure(error_1.X509ChainVerificationError.UnsupportedCriticalExtension);
+        }
+        const leaf = chain[0].certificate;
+        if (isCertificateAuthority(leaf)) {
+            return failure(error_1.X509ChainVerificationError.LeafIsCertificateAuthority);
+        }
+        if (this.policy.requireDigitalSignatureKeyUsage &&
+            !hasDigitalSignatureKeyUsage(leaf)) {
+            return failure(error_1.X509ChainVerificationError.InvalidLeafKeyUsage);
+        }
+        if (input.algorithm !== undefined && !algorithmMatches(leaf, input.algorithm)) {
+            return failure(error_1.X509ChainVerificationError.AlgorithmMismatch);
+        }
+        const leafExtendedKeyUsages = extendedKeyUsages(leaf);
+        if (this.policy.requiredExtendedKeyUsages.length > 0 &&
+            !leafExtendedKeyUsages.includes(OID.anyExtendedKeyUsage) &&
+            !this.policy.requiredExtendedKeyUsages.some((oid) => leafExtendedKeyUsages.includes(oid))) {
+            return failure(error_1.X509ChainVerificationError.ExtendedKeyUsageMismatch);
+        }
+        const names = subjectAlternativeNames(leaf);
+        if (input.expectedHostname !== undefined) {
+            const expectedHostname = normalizeHostname(input.expectedHostname);
+            if (!expectedHostname) {
+                return failure(error_1.X509ChainVerificationError.InvalidExpectedHostname);
+            }
+            if ((this.policy.requireSubjectAlternativeName && names.length === 0) ||
+                !names.some((name) => dnsNameMatches(expectedHostname, name))) {
+                return failure(error_1.X509ChainVerificationError.HostnameMismatch);
+            }
+        }
+        pkijs.setEngine("ubid-x509-webcrypto", uncrypto_1.default, new pkijs.CryptoEngine({
+            name: "ubid-x509-webcrypto",
+            crypto: uncrypto_1.default,
+            subtle: uncrypto_1.default.subtle,
+        }));
+        let path;
+        try {
+            const verificationResult = await new pkijs.CertificateChainValidationEngine({
+                trustedCerts: trustAnchors.map((item) => item.certificate),
+                certs: chain.map((item) => item.certificate).reverse(),
+                checkDate: validationTime,
+            }).verify();
+            if (!verificationResult.result || !verificationResult.certificatePath) {
+                console.error("[X509ChainVerifier] PKIjs validation failed", {
+                    result: verificationResult.result,
+                    resultCode: verificationResult.resultCode,
+                    resultMessage: verificationResult.resultMessage,
+                    inputChainLength: chain.length,
+                    trustAnchorCount: trustAnchors.length,
+                });
+                return failure(error_1.X509ChainVerificationError.InvalidCertificateChain);
+            }
+            path = verificationResult.certificatePath;
+        }
+        catch (error) {
+            console.error("[X509ChainVerifier] PKIjs threw", {
+                name: error instanceof Error ? error.name : undefined,
+                message: error instanceof Error ? error.message : String(error),
+                inputChainLength: chain.length,
+                trustAnchorCount: trustAnchors.length,
+            });
+            return failure(error_1.X509ChainVerificationError.InvalidCertificateChain);
+        }
+        const trustAnchor = path[path.length - 1];
+        const parsedTrustAnchor = trustAnchors.find((item) => item.certificate.tbsView.byteLength === trustAnchor.tbsView.byteLength &&
+            item.fingerprintKey === buffer_1.Buffer.from(trustAnchor.toSchema().toBER(false)).toString("hex"));
+        if (!parsedTrustAnchor) {
+            return failure(error_1.X509ChainVerificationError.UntrustedRoot);
+        }
+        if (this.policy.revocationMode === "required") {
+            const checker = this.policy.revocationChecker;
+            if (!checker) {
+                return failure(error_1.X509ChainVerificationError.RevocationStatusUnavailable);
+            }
+            for (let index = 0; index < path.length - 1; index++) {
+                let status;
+                try {
+                    status = await checker.check({
+                        certificateDer: new Uint8Array(path[index].toSchema().toBER(false)),
+                        issuerCertificateDer: new Uint8Array(path[index + 1].toSchema().toBER(false)),
+                        validationTime: new Date(validationTime),
+                    });
+                }
+                catch {
+                    return failure(error_1.X509ChainVerificationError.RevocationStatusUnavailable);
+                }
+                if (status === "revoked") {
+                    return failure(error_1.X509ChainVerificationError.CertificateRevoked);
+                }
+                if (status !== "good") {
+                    return failure(error_1.X509ChainVerificationError.RevocationStatusUnavailable);
+                }
+            }
+        }
+        return {
+            success: true,
+            value: {
+                leafCertificatePem: toPem(chain[0].der),
+                leafCertificateDer: new Uint8Array(chain[0].der),
+                chainLength: path.length,
+                subjectAlternativeNames: names,
+                trustAnchorFingerprintSha256: await sha256Hex(parsedTrustAnchor.der),
+            },
+        };
+    }
+}
+exports.X509ChainVerifier = X509ChainVerifier;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiWDUwOUNoYWluVmVyaWZpZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMveDUwOS9YNTA5Q2hhaW5WZXJpZmllci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSwrQ0FBaUM7QUFDakMsNkNBQStCO0FBQy9CLG1DQUFnQztBQUNoQyx3REFBaUM7QUFDakMsb0NBQXNEO0FBR3RELE1BQU0sR0FBRyxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDekIsV0FBVyxFQUFFLG1CQUFtQjtJQUNoQyxhQUFhLEVBQUUsc0JBQXNCO0lBQ3JDLE9BQU8sRUFBRSxhQUFhO0lBQ3RCLElBQUksRUFBRSxxQkFBcUI7SUFDM0IsSUFBSSxFQUFFLGNBQWM7SUFDcEIsSUFBSSxFQUFFLGNBQWM7SUFDcEIsU0FBUyxFQUFFLGNBQWM7SUFDekIsZ0JBQWdCLEVBQUUsV0FBVztJQUM3QixRQUFRLEVBQUUsV0FBVztJQUNyQixnQkFBZ0IsRUFBRSxXQUFXO0lBQzdCLGNBQWMsRUFBRSxXQUFXO0lBQzNCLG1CQUFtQixFQUFFLGFBQWE7Q0FDbEMsQ0FBQyxDQUFDO0FBRUgsTUFBTSw2QkFBNkIsR0FBRyxJQUFJLEdBQUcsQ0FBQztJQUM3QyxzQkFBc0IsRUFBRSx1QkFBdUI7SUFDL0Msc0JBQXNCLEVBQUUsdUJBQXVCO0lBQy9DLHNCQUFzQixFQUFFLHVCQUF1QjtJQUMvQyxzQkFBc0IsRUFBRSx3QkFBd0I7SUFDaEQsbUJBQW1CLEVBQUUsY0FBYztJQUNuQyxtQkFBbUIsRUFBRSxrQkFBa0I7Q0FDdkMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxpQ0FBaUMsR0FBRyxJQUFJLEdBQUcsQ0FBQztJQUNqRCxXQUFXLEVBQUUsdUJBQXVCO0lBQ3BDLFdBQVcsRUFBRSxXQUFXO0lBQ3hCLFdBQVcsRUFBRSxpQkFBaUI7SUFDOUIsV0FBVyxFQUFFLGdCQUFnQjtJQUM3QixXQUFXLEVBQUUsbUJBQW1CO0lBQ2hDLFdBQVcsRUFBRSxrQkFBa0I7SUFDL0IsV0FBVyxFQUFFLHdCQUF3QjtJQUNyQyxXQUFXLEVBQUUsc0JBQXNCO0lBQ25DLFdBQVcsRUFBRSxpQkFBaUI7SUFDOUIsV0FBVyxFQUFFLHlCQUF5QjtJQUN0QyxXQUFXLEVBQUUsb0JBQW9CO0lBQ2pDLFdBQVcsRUFBRSxtQkFBbUI7SUFDaEMsV0FBVyxFQUFFLGNBQWM7SUFDM0IsV0FBVyxFQUFFLG1CQUFtQjtDQUNoQyxDQUFDLENBQUM7QUFFSCxNQUFNLHdCQUF3QixHQUFHLENBQUMsQ0FBQztBQUNuQyxNQUFNLDZCQUE2QixHQUFHLEVBQUUsR0FBRyxJQUFJLENBQUM7QUFDaEQsTUFBTSx1QkFBdUIsR0FBRyxHQUFHLEdBQUcsSUFBSSxDQUFDO0FBK0UzQyxTQUFTLE9BQU8sQ0FDZixLQUFpQztJQUVqQyxPQUFPLEVBQUUsT0FBTyxFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUUsQ0FBQztBQUNsQyxDQUFDO0FBRUQsU0FBUyxlQUFlLENBQUMsS0FBeUIsRUFBRSxRQUFnQixFQUFFLEtBQWE7SUFDbEYsTUFBTSxVQUFVLEdBQUcsS0FBSyxJQUFJLFFBQVEsQ0FBQztJQUNyQyxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxVQUFVLENBQUMsSUFBSSxVQUFVLElBQUksQ0FBQyxFQUFFLENBQUM7UUFDMUQsTUFBTSxJQUFJLFNBQVMsQ0FBQyxHQUFHLEtBQUssa0NBQWtDLENBQUMsQ0FBQztJQUNqRSxDQUFDO0lBQ0QsT0FBTyxVQUFVLENBQUM7QUFDbkIsQ0FBQztBQUVELFNBQVMsZUFBZSxDQUFDLE1BQStCO0lBQ3ZELE1BQU0seUJBQXlCLEdBQUcsTUFBTSxDQUFDLHlCQUF5QixJQUFJLEVBQUUsQ0FBQztJQUN6RSxJQUNDLHlCQUF5QixDQUFDLElBQUksQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQ3hDLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxDQUFDLHVCQUF1QixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNuRSxJQUFJLEdBQUcsQ0FBQyx5QkFBeUIsQ0FBQyxDQUFDLElBQUksS0FBSyx5QkFBeUIsQ0FBQyxNQUFNLEVBQzNFLENBQUM7UUFDRixNQUFNLElBQUksU0FBUyxDQUFDLG9EQUFvRCxDQUFDLENBQUM7SUFDM0UsQ0FBQztJQUNELE1BQU0sY0FBYyxHQUFHLE1BQU0sQ0FBQyxjQUFjLElBQUksVUFBVSxDQUFDO0lBQzNELElBQUksY0FBYyxLQUFLLFVBQVUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO1FBQ2hFLE1BQU0sSUFBSSxTQUFTLENBQUMsK0RBQStELENBQUMsQ0FBQztJQUN0RixDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUMsTUFBTSxDQUFDO1FBQ3BCLGNBQWMsRUFBRSxlQUFlLENBQzlCLE1BQU0sQ0FBQyxjQUFjLEVBQ3JCLHdCQUF3QixFQUN4QixnQkFBZ0IsQ0FDaEI7UUFDRCxtQkFBbUIsRUFBRSxlQUFlLENBQ25DLE1BQU0sQ0FBQyxtQkFBbUIsRUFDMUIsNkJBQTZCLEVBQzdCLHFCQUFxQixDQUNyQjtRQUNELGFBQWEsRUFBRSxlQUFlLENBQzdCLE1BQU0sQ0FBQyxhQUFhLEVBQ3BCLHVCQUF1QixFQUN2QixlQUFlLENBQ2Y7UUFDRCwrQkFBK0IsRUFBRSxNQUFNLENBQUMsK0JBQStCLEtBQUssS0FBSztRQUNqRix5QkFBeUIsRUFBRSxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsR0FBRyx5QkFBeUIsQ0FBQyxDQUFDO1FBQ3hFLDZCQUE2QixFQUFFLE1BQU0sQ0FBQyw2QkFBNkIsS0FBSyxLQUFLO1FBQzdFLGNBQWM7UUFDZCxpQkFBaUIsRUFBRSxNQUFNLENBQUMsaUJBQWlCO0tBQzNDLENBQUMsQ0FBQztBQUNKLENBQUM7QUFFRCxTQUFTLGtCQUFrQixDQUFDLEtBQWEsRUFBRSxRQUFpQjtJQUMzRCxJQUFJLE1BQU0sR0FBRyxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDMUIsTUFBTSxRQUFRLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FDNUIsa0ZBQWtGLENBQ2xGLENBQUM7SUFDRixJQUFJLFFBQVEsRUFBRSxDQUFDO1FBQ2QsSUFBSSxDQUFDLFFBQVE7WUFBRSxPQUFPLFNBQVMsQ0FBQztRQUNoQyxNQUFNLEdBQUcsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDekMsQ0FBQztTQUFNLElBQUksSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQzlCLE9BQU8sU0FBUyxDQUFDO0lBQ2xCLENBQUM7SUFDRCxJQUNDLE1BQU0sQ0FBQyxNQUFNLEtBQUssQ0FBQztRQUNuQixNQUFNLENBQUMsTUFBTSxHQUFHLENBQUMsS0FBSyxDQUFDO1FBQ3ZCLENBQUMsd0JBQXdCLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUNyQyxDQUFDO1FBQ0YsT0FBTyxTQUFTLENBQUM7SUFDbEIsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2YsQ0FBQztBQUVELFNBQVMsZ0JBQWdCLENBQ3hCLEtBQWEsRUFDYixRQUFpQixFQUNqQixtQkFBMkI7SUFFM0IsTUFBTSxNQUFNLEdBQUcsa0JBQWtCLENBQUMsS0FBSyxFQUFFLFFBQVEsQ0FBQyxDQUFDO0lBQ25ELElBQUksQ0FBQyxNQUFNO1FBQUUsT0FBTyxTQUFTLENBQUM7SUFDOUIsSUFBSSxLQUFpQixDQUFDO0lBQ3RCLElBQUksQ0FBQztRQUNKLEtBQUssR0FBRyxJQUFJLFVBQVUsQ0FBQyxlQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQ3ZELENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUixPQUFPLFNBQVMsQ0FBQztJQUNsQixDQUFDO0lBQ0QsSUFDQyxLQUFLLENBQUMsVUFBVSxLQUFLLENBQUM7UUFDdEIsS0FBSyxDQUFDLFVBQVUsR0FBRyxtQkFBbUI7UUFDdEMsZUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLEtBQUssTUFBTSxFQUMvQyxDQUFDO1FBQ0YsT0FBTyxTQUFTLENBQUM7SUFDbEIsQ0FBQztJQUNELE1BQU0sR0FBRyxHQUFHLEtBQUssQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUM3QixLQUFLLENBQUMsVUFBVSxFQUNoQixLQUFLLENBQUMsVUFBVSxHQUFHLEtBQUssQ0FBQyxVQUFVLENBQ3BCLENBQUM7SUFDakIsTUFBTSxJQUFJLEdBQUcsTUFBTSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUNqQyxJQUFJLElBQUksQ0FBQyxNQUFNLEtBQUssR0FBRyxDQUFDLFVBQVUsSUFBSSxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUs7UUFBRSxPQUFPLFNBQVMsQ0FBQztJQUMxRSxJQUFJLENBQUM7UUFDSixNQUFNLFdBQVcsR0FBRyxJQUFJLEtBQUssQ0FBQyxXQUFXLENBQUMsRUFBRSxNQUFNLEVBQUUsSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUM7UUFDbkUsT0FBTztZQUNOLFdBQVc7WUFDWCxHQUFHLEVBQUUsSUFBSSxVQUFVLENBQUMsS0FBSyxDQUFDO1lBQzFCLGNBQWMsRUFBRSxlQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUM7U0FDbEQsQ0FBQztJQUNILENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUixPQUFPLFNBQVMsQ0FBQztJQUNsQixDQUFDO0FBQ0YsQ0FBQztBQUVELFNBQVMsS0FBSyxDQUFDLEdBQWU7SUFDN0IsTUFBTSxNQUFNLEdBQUcsZUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDbkQsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDN0MsT0FBTyxnQ0FBZ0MsS0FBSyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsNkJBQTZCLENBQUM7QUFDdEYsQ0FBQztBQUVELFNBQVMsU0FBUyxDQUNqQixXQUE4QixFQUM5QixHQUFXO0lBRVgsT0FBTyxXQUFXLENBQUMsVUFBVSxFQUFFLElBQUksQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFDLE1BQU0sS0FBSyxHQUFHLENBQUMsQ0FBQztBQUNwRSxDQUFDO0FBRUQsU0FBUyxzQkFBc0IsQ0FBQyxXQUE4QjtJQUM3RCxNQUFNLEtBQUssR0FBRyxTQUFTLENBQUMsV0FBVyxFQUFFLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxFQUFFLFdBQVcsQ0FBQztJQUN4RSxPQUFPLEtBQUssWUFBWSxLQUFLLENBQUMsZ0JBQWdCLElBQUksS0FBSyxDQUFDLEVBQUUsS0FBSyxJQUFJLENBQUM7QUFDckUsQ0FBQztBQUVELFNBQVMsMkJBQTJCLENBQUMsV0FBOEI7SUFDbEUsTUFBTSxLQUFLLEdBQUcsU0FBUyxDQUFDLFdBQVcsRUFBRSxHQUFHLENBQUMsUUFBUSxDQUFDLEVBQUUsV0FBVyxDQUFDO0lBQ2hFLElBQUksQ0FBQyxDQUFDLEtBQUssWUFBWSxNQUFNLENBQUMsU0FBUyxDQUFDO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDdkQsTUFBTSxLQUFLLEdBQUcsS0FBSyxDQUFDLFVBQVUsQ0FBQyxZQUFZLENBQUM7SUFDNUMsT0FBTyxLQUFLLENBQUMsTUFBTSxHQUFHLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsR0FBRyxJQUFJLENBQUMsS0FBSyxJQUFJLENBQUM7QUFDdkQsQ0FBQztBQUVELFNBQVMsaUJBQWlCLENBQUMsV0FBOEI7SUFDeEQsTUFBTSxLQUFLLEdBQUcsU0FBUyxDQUFDLFdBQVcsRUFBRSxHQUFHLENBQUMsZ0JBQWdCLENBQUMsRUFBRSxXQUFXLENBQUM7SUFDeEUsT0FBTyxLQUFLLFlBQVksS0FBSyxDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO0FBQ3BFLENBQUM7QUFFRCxTQUFTLHVCQUF1QixDQUFDLFdBQThCO0lBQzlELE1BQU0sS0FBSyxHQUFHLFNBQVMsQ0FBQyxXQUFXLEVBQUUsR0FBRyxDQUFDLGNBQWMsQ0FBQyxFQUFFLFdBQVcsQ0FBQztJQUN0RSxJQUFJLENBQUMsQ0FBQyxLQUFLLFlBQVksS0FBSyxDQUFDLE9BQU8sQ0FBQztRQUFFLE9BQU8sRUFBRSxDQUFDO0lBQ2pELE9BQU8sTUFBTSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsUUFBUTtTQUNqQyxNQUFNLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyxJQUFJLEtBQUssQ0FBQyxJQUFJLE9BQU8sSUFBSSxDQUFDLEtBQUssS0FBSyxRQUFRLENBQUM7U0FDbkUsR0FBRyxDQUFDLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLFdBQVcsRUFBRSxDQUFDLENBQUMsQ0FBQztBQUNwRCxDQUFDO0FBRUQsU0FBUyxpQkFBaUIsQ0FBQyxLQUFhO0lBQ3ZDLElBQUksUUFBUSxHQUFHLEtBQUssQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUM1QixJQUFJLENBQUM7UUFDSixRQUFRLEdBQUcsSUFBSSxHQUFHLENBQUMsUUFBUSxDQUFDLENBQUMsUUFBUSxDQUFDO0lBQ3ZDLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUixxQ0FBcUM7SUFDdEMsQ0FBQztJQUNELFFBQVEsR0FBRyxRQUFRLENBQUMsV0FBVyxFQUFFLENBQUMsT0FBTyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQztJQUNyRCxJQUNDLFFBQVEsQ0FBQyxNQUFNLEtBQUssQ0FBQztRQUNyQixRQUFRLENBQUMsTUFBTSxHQUFHLEdBQUc7UUFDckIsUUFBUSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUM7UUFDdEIsUUFBUSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUNsQyxLQUFLLENBQUMsTUFBTSxLQUFLLENBQUM7WUFDbEIsS0FBSyxDQUFDLE1BQU0sR0FBRyxFQUFFO1lBQ2pCLENBQUMsY0FBYyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUM7WUFDM0IsS0FBSyxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUM7WUFDckIsS0FBSyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQyxFQUNwQixDQUFDO1FBQ0YsT0FBTyxTQUFTLENBQUM7SUFDbEIsQ0FBQztJQUNELE9BQU8sUUFBUSxDQUFDO0FBQ2pCLENBQUM7QUFFRCxTQUFTLGNBQWMsQ0FBQyxRQUFnQixFQUFFLGVBQXVCO0lBQ2hFLE1BQU0sT0FBTyxHQUFHLGVBQWUsQ0FBQyxXQUFXLEVBQUUsQ0FBQyxPQUFPLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDO0lBQ2pFLElBQUksQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQztRQUFFLE9BQU8sT0FBTyxLQUFLLFFBQVEsQ0FBQztJQUN4RCxJQUNDLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUM7UUFDekIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxHQUFHLEVBQUUsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQzdCLENBQUM7UUFDRixPQUFPLEtBQUssQ0FBQztJQUNkLENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBRyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ2hDLE1BQU0sY0FBYyxHQUFHLFFBQVEsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDM0MsTUFBTSxZQUFZLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUN2QyxPQUFPLENBQ04sWUFBWSxDQUFDLE1BQU0sSUFBSSxDQUFDO1FBQ3hCLGNBQWMsQ0FBQyxNQUFNLEtBQUssWUFBWSxDQUFDLE1BQU0sR0FBRyxDQUFDO1FBQ2pELGNBQWMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxLQUFLLE1BQU0sQ0FDNUMsQ0FBQztBQUNILENBQUM7QUFFRCxTQUFTLHFCQUFxQixDQUFDLEtBQWM7SUFDNUMsT0FBTyxLQUFLLFlBQVksTUFBTSxDQUFDLGdCQUFnQjtRQUM5QyxDQUFDLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxRQUFRLEVBQUU7UUFDN0IsQ0FBQyxDQUFDLFNBQVMsQ0FBQztBQUNkLENBQUM7QUFFRCxTQUFTLGdCQUFnQixDQUFDLFdBQThCLEVBQUUsU0FBaUI7SUFDMUUsTUFBTSxrQkFBa0IsR0FBRyxXQUFXLENBQUMsb0JBQW9CLENBQUMsU0FBUyxDQUFDO0lBQ3RFLE1BQU0sTUFBTSxHQUFHLGtCQUFrQixDQUFDLFdBQVcsQ0FBQztJQUM5QyxNQUFNLFFBQVEsR0FBRyxxQkFBcUIsQ0FBQyxrQkFBa0IsQ0FBQyxlQUFlLENBQUMsQ0FBQztJQUMzRSxRQUFRLFNBQVMsRUFBRSxDQUFDO1FBQ25CLEtBQUssT0FBTztZQUNYLE9BQU8sTUFBTSxLQUFLLEdBQUcsQ0FBQyxXQUFXLElBQUksUUFBUSxLQUFLLEdBQUcsQ0FBQyxJQUFJLENBQUM7UUFDNUQsS0FBSyxPQUFPO1lBQ1gsT0FBTyxNQUFNLEtBQUssR0FBRyxDQUFDLFdBQVcsSUFBSSxRQUFRLEtBQUssR0FBRyxDQUFDLElBQUksQ0FBQztRQUM1RCxLQUFLLE9BQU87WUFDWCxPQUFPLE1BQU0sS0FBSyxHQUFHLENBQUMsV0FBVyxJQUFJLFFBQVEsS0FBSyxHQUFHLENBQUMsSUFBSSxDQUFDO1FBQzVELEtBQUssUUFBUTtZQUNaLE9BQU8sTUFBTSxLQUFLLEdBQUcsQ0FBQyxXQUFXLElBQUksUUFBUSxLQUFLLEdBQUcsQ0FBQyxTQUFTLENBQUM7UUFDakUsS0FBSyxPQUFPLENBQUM7UUFDYixLQUFLLE9BQU8sQ0FBQztRQUNiLEtBQUssT0FBTyxDQUFDO1FBQ2IsS0FBSyxPQUFPLENBQUM7UUFDYixLQUFLLE9BQU8sQ0FBQztRQUNiLEtBQUssT0FBTztZQUNYLE9BQU8sTUFBTSxLQUFLLEdBQUcsQ0FBQyxhQUFhLENBQUM7UUFDckMsS0FBSyxPQUFPO1lBQ1gsT0FBTyxNQUFNLEtBQUssR0FBRyxDQUFDLE9BQU8sQ0FBQztRQUMvQjtZQUNDLE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztBQUNGLENBQUM7QUFFRCxTQUFTLGNBQWMsQ0FBQyxXQUE4QjtJQUNyRCxPQUFPLDZCQUE2QixDQUFDLEdBQUcsQ0FDdkMsV0FBVyxDQUFDLGtCQUFrQixDQUFDLFdBQVcsQ0FDMUMsQ0FBQztBQUNILENBQUM7QUFFRCxTQUFTLG9CQUFvQixDQUM1QixXQUE4QixFQUM5QixjQUFvQjtJQUVwQixJQUFJLFdBQVcsQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLE9BQU8sRUFBRSxHQUFHLGNBQWMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDO1FBQ3RFLE9BQU8sa0NBQTBCLENBQUMsc0JBQXNCLENBQUM7SUFDMUQsQ0FBQztJQUNELElBQUksV0FBVyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsT0FBTyxFQUFFLEdBQUcsY0FBYyxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUM7UUFDckUsT0FBTyxrQ0FBMEIsQ0FBQyxrQkFBa0IsQ0FBQztJQUN0RCxDQUFDO0lBQ0QsT0FBTyxTQUFTLENBQUM7QUFDbEIsQ0FBQztBQUVELEtBQUssVUFBVSxTQUFTLENBQUMsS0FBaUI7SUFDekMsTUFBTSxNQUFNLEdBQUcsTUFBTSxrQkFBUyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLElBQUksVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7SUFDL0UsT0FBTyxlQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQztBQUM1QyxDQUFDO0FBRUQsTUFBYSxpQkFBaUI7SUFDWixNQUFNLENBQW1CO0lBRTFDLFlBQVksU0FBa0MsRUFBRTtRQUMvQyxJQUFJLENBQUMsTUFBTSxHQUFHLGVBQWUsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUN2QyxDQUFDO0lBRUQsS0FBSyxDQUFDLE1BQU0sQ0FDWCxLQUFpQztRQUVqQyxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLElBQUksS0FBSyxDQUFDLEdBQUcsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDekQsT0FBTyxPQUFPLENBQUMsa0NBQTBCLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDdkQsQ0FBQztRQUNELElBQUksS0FBSyxDQUFDLEdBQUcsQ0FBQyxNQUFNLEdBQUcsSUFBSSxDQUFDLE1BQU0sQ0FBQyxjQUFjLEVBQUUsQ0FBQztZQUNuRCxPQUFPLE9BQU8sQ0FBQyxrQ0FBMEIsQ0FBQyxZQUFZLENBQUMsQ0FBQztRQUN6RCxDQUFDO1FBQ0QsSUFDQyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLG1CQUFtQixDQUFDO1lBQ3pDLEtBQUssQ0FBQyxtQkFBbUIsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUNyQyxDQUFDO1lBQ0YsT0FBTyxPQUFPLENBQUMsa0NBQTBCLENBQUMsY0FBYyxDQUFDLENBQUM7UUFDM0QsQ0FBQztRQUVELE1BQU0sS0FBSyxHQUF3QixFQUFFLENBQUM7UUFDdEMsSUFBSSxVQUFVLEdBQUcsQ0FBQyxDQUFDO1FBQ25CLEtBQUssTUFBTSxrQkFBa0IsSUFBSSxLQUFLLENBQUMsR0FBRyxFQUFFLENBQUM7WUFDNUMsSUFBSSxPQUFPLGtCQUFrQixLQUFLLFFBQVEsRUFBRSxDQUFDO2dCQUM1QyxPQUFPLE9BQU8sQ0FBQyxrQ0FBMEIsQ0FBQywwQkFBMEIsQ0FBQyxDQUFDO1lBQ3ZFLENBQUM7WUFDRCxNQUFNLE1BQU0sR0FBRyxnQkFBZ0IsQ0FDOUIsa0JBQWtCLEVBQ2xCLEtBQUssRUFDTCxJQUFJLENBQUMsTUFBTSxDQUFDLG1CQUFtQixDQUMvQixDQUFDO1lBQ0YsSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDO2dCQUNiLE9BQU8sT0FBTyxDQUFDLGtDQUEwQixDQUFDLDBCQUEwQixDQUFDLENBQUM7WUFDdkUsQ0FBQztZQUNELFVBQVUsSUFBSSxNQUFNLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQztZQUNwQyxJQUFJLFVBQVUsR0FBRyxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsRUFBRSxDQUFDO2dCQUM1QyxPQUFPLE9BQU8sQ0FBQyxrQ0FBMEIsQ0FBQyxhQUFhLENBQUMsQ0FBQztZQUMxRCxDQUFDO1lBQ0QsS0FBSyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUNwQixDQUFDO1FBQ0QsSUFBSSxJQUFJLEdBQUcsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQyxJQUFJLENBQUMsY0FBYyxDQUFDLENBQUMsQ0FBQyxJQUFJLEtBQUssS0FBSyxDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQzdFLE9BQU8sT0FBTyxDQUFDLGtDQUEwQixDQUFDLG9CQUFvQixDQUFDLENBQUM7UUFDakUsQ0FBQztRQUVELE1BQU0sWUFBWSxHQUF3QixFQUFFLENBQUM7UUFDN0MsS0FBSyxNQUFNLGtCQUFrQixJQUFJLEtBQUssQ0FBQyxtQkFBbUIsRUFBRSxDQUFDO1lBQzVELElBQUksT0FBTyxrQkFBa0IsS0FBSyxRQUFRLEVBQUUsQ0FBQztnQkFDNUMsT0FBTyxPQUFPLENBQUMsa0NBQTBCLENBQUMsa0JBQWtCLENBQUMsQ0FBQztZQUMvRCxDQUFDO1lBQ0QsTUFBTSxNQUFNLEdBQUcsZ0JBQWdCLENBQzlCLGtCQUFrQixFQUNsQixJQUFJLEVBQ0osSUFBSSxDQUFDLE1BQU0sQ0FBQyxtQkFBbUIsQ0FDL0IsQ0FBQztZQUNGLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztnQkFDYixPQUFPLE9BQU8sQ0FBQyxrQ0FBMEIsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO1lBQy9ELENBQUM7WUFDRCxZQUFZLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQzNCLENBQUM7UUFDRCxJQUNDLElBQUksR0FBRyxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyxjQUFjLENBQUMsQ0FBQyxDQUFDLElBQUk7WUFDN0QsWUFBWSxDQUFDLE1BQU0sRUFDbEIsQ0FBQztZQUNGLE9BQU8sT0FBTyxDQUFDLGtDQUEwQixDQUFDLGtCQUFrQixDQUFDLENBQUM7UUFDL0QsQ0FBQztRQUVELEtBQUssSUFBSSxLQUFLLEdBQUcsQ0FBQyxFQUFFLEtBQUssR0FBRyxLQUFLLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDO1lBQ3ZELElBQUksQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUMsV0FBVyxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLEtBQUssR0FBRyxDQUFDLENBQUMsQ0FBQyxXQUFXLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztnQkFDcEYsT0FBTyxPQUFPLENBQUMsa0NBQTBCLENBQUMsaUJBQWlCLENBQUMsQ0FBQztZQUM5RCxDQUFDO1FBQ0YsQ0FBQztRQUVELE1BQU0sY0FBYyxHQUFHLEtBQUssQ0FBQyxjQUFjO1lBQzFDLENBQUMsQ0FBQyxJQUFJLElBQUksQ0FBQyxLQUFLLENBQUMsY0FBYyxDQUFDO1lBQ2hDLENBQUMsQ0FBQyxJQUFJLElBQUksRUFBRSxDQUFDO1FBQ2QsSUFBSSxNQUFNLENBQUMsS0FBSyxDQUFDLGNBQWMsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxFQUFFLENBQUM7WUFDNUMsT0FBTyxPQUFPLENBQUMsa0NBQTBCLENBQUMscUJBQXFCLENBQUMsQ0FBQztRQUNsRSxDQUFDO1FBQ0QsS0FBSyxNQUFNLElBQUksSUFBSSxDQUFDLEdBQUcsS0FBSyxFQUFFLEdBQUcsWUFBWSxDQUFDLEVBQUUsQ0FBQztZQUNoRCxNQUFNLFNBQVMsR0FBRyxvQkFBb0IsQ0FBQyxJQUFJLENBQUMsV0FBVyxFQUFFLGNBQWMsQ0FBQyxDQUFDO1lBQ3pFLElBQUksU0FBUztnQkFBRSxPQUFPLE9BQU8sQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUMxQyxDQUFDO1FBQ0QsSUFBSSxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQyxjQUFjLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUM1RCxPQUFPLE9BQU8sQ0FBQyxrQ0FBMEIsQ0FBQyx3QkFBd0IsQ0FBQyxDQUFDO1FBQ3JFLENBQUM7UUFDRCxJQUNDLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsVUFBVSxFQUFFLElBQUksQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLENBQy9ELElBQUksQ0FBQyxRQUFRLElBQUksQ0FBQyxpQ0FBaUMsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFDdEUsQ0FBQztZQUNGLE9BQU8sT0FBTyxDQUFDLGtDQUEwQixDQUFDLDRCQUE0QixDQUFDLENBQUM7UUFDekUsQ0FBQztRQUVELE1BQU0sSUFBSSxHQUFHLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxXQUFXLENBQUM7UUFDbEMsSUFBSSxzQkFBc0IsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO1lBQ2xDLE9BQU8sT0FBTyxDQUFDLGtDQUEwQixDQUFDLDBCQUEwQixDQUFDLENBQUM7UUFDdkUsQ0FBQztRQUNELElBQ0MsSUFBSSxDQUFDLE1BQU0sQ0FBQywrQkFBK0I7WUFDM0MsQ0FBQywyQkFBMkIsQ0FBQyxJQUFJLENBQUMsRUFDakMsQ0FBQztZQUNGLE9BQU8sT0FBTyxDQUFDLGtDQUEwQixDQUFDLG1CQUFtQixDQUFDLENBQUM7UUFDaEUsQ0FBQztRQUNELElBQUksS0FBSyxDQUFDLFNBQVMsS0FBSyxTQUFTLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLEVBQUUsS0FBSyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7WUFDL0UsT0FBTyxPQUFPLENBQUMsa0NBQTBCLENBQUMsaUJBQWlCLENBQUMsQ0FBQztRQUM5RCxDQUFDO1FBRUQsTUFBTSxxQkFBcUIsR0FBRyxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUN0RCxJQUNDLElBQUksQ0FBQyxNQUFNLENBQUMseUJBQXlCLENBQUMsTUFBTSxHQUFHLENBQUM7WUFDaEQsQ0FBQyxxQkFBcUIsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLG1CQUFtQixDQUFDO1lBQ3hELENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyx5QkFBeUIsQ0FBQyxJQUFJLENBQUMsQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUNuRCxxQkFBcUIsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUMsRUFDcEMsQ0FBQztZQUNGLE9BQU8sT0FBTyxDQUFDLGtDQUEwQixDQUFDLHdCQUF3QixDQUFDLENBQUM7UUFDckUsQ0FBQztRQUVELE1BQU0sS0FBSyxHQUFHLHVCQUF1QixDQUFDLElBQUksQ0FBQyxDQUFDO1FBQzVDLElBQUksS0FBSyxDQUFDLGdCQUFnQixLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQzFDLE1BQU0sZ0JBQWdCLEdBQUcsaUJBQWlCLENBQUMsS0FBSyxDQUFDLGdCQUFnQixDQUFDLENBQUM7WUFDbkUsSUFBSSxDQUFDLGdCQUFnQixFQUFFLENBQUM7Z0JBQ3ZCLE9BQU8sT0FBTyxDQUFDLGtDQUEwQixDQUFDLHVCQUF1QixDQUFDLENBQUM7WUFDcEUsQ0FBQztZQUNELElBQ0MsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLDZCQUE2QixJQUFJLEtBQUssQ0FBQyxNQUFNLEtBQUssQ0FBQyxDQUFDO2dCQUNqRSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLGNBQWMsQ0FBQyxnQkFBZ0IsRUFBRSxJQUFJLENBQUMsQ0FBQyxFQUM1RCxDQUFDO2dCQUNGLE9BQU8sT0FBTyxDQUFDLGtDQUEwQixDQUFDLGdCQUFnQixDQUFDLENBQUM7WUFDN0QsQ0FBQztRQUNGLENBQUM7UUFFRCxLQUFLLENBQUMsU0FBUyxDQUNkLHFCQUFxQixFQUNyQixrQkFBUyxFQUNULElBQUksS0FBSyxDQUFDLFlBQVksQ0FBQztZQUN0QixJQUFJLEVBQUUscUJBQXFCO1lBQzNCLE1BQU0sRUFBRSxrQkFBUztZQUNqQixNQUFNLEVBQUUsa0JBQVMsQ0FBQyxNQUFNO1NBQ3hCLENBQUMsQ0FDRixDQUFDO1FBRUYsSUFBSSxJQUF5QixDQUFDO1FBQzlCLElBQUksQ0FBQztZQUNILE1BQU0sa0JBQWtCLEdBQ3RCLE1BQU0sSUFBSSxLQUFLLENBQUMsZ0NBQWdDLENBQUM7Z0JBQy9DLFlBQVksRUFBRSxZQUFZLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDO2dCQUMxRCxLQUFLLEVBQUUsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxDQUFDLE9BQU8sRUFBRTtnQkFDdEQsU0FBUyxFQUFFLGNBQWM7YUFDMUIsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDO1lBRWQsSUFBSSxDQUFDLGtCQUFrQixDQUFDLE1BQU0sSUFBSSxDQUFDLGtCQUFrQixDQUFDLGVBQWUsRUFBRSxDQUFDO2dCQUN0RSxPQUFPLENBQUMsS0FBSyxDQUFDLDZDQUE2QyxFQUFFO29CQUMzRCxNQUFNLEVBQUUsa0JBQWtCLENBQUMsTUFBTTtvQkFDakMsVUFBVSxFQUFFLGtCQUFrQixDQUFDLFVBQVU7b0JBQ3pDLGFBQWEsRUFBRSxrQkFBa0IsQ0FBQyxhQUFhO29CQUMvQyxnQkFBZ0IsRUFBRSxLQUFLLENBQUMsTUFBTTtvQkFDOUIsZ0JBQWdCLEVBQUUsWUFBWSxDQUFDLE1BQU07aUJBQ3RDLENBQUMsQ0FBQztnQkFDSCxPQUFPLE9BQU8sQ0FBQyxrQ0FBMEIsQ0FBQyx1QkFBdUIsQ0FBQyxDQUFDO1lBQ3JFLENBQUM7WUFFRCxJQUFJLEdBQUcsa0JBQWtCLENBQUMsZUFBZSxDQUFDO1FBQzVDLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsT0FBTyxDQUFDLEtBQUssQ0FBQyxpQ0FBaUMsRUFBRTtnQkFDL0MsSUFBSSxFQUFFLEtBQUssWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLFNBQVM7Z0JBQ3JELE9BQU8sRUFBRSxLQUFLLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDO2dCQUMvRCxnQkFBZ0IsRUFBRSxLQUFLLENBQUMsTUFBTTtnQkFDOUIsZ0JBQWdCLEVBQUUsWUFBWSxDQUFDLE1BQU07YUFDdEMsQ0FBQyxDQUFDO1lBQ0gsT0FBTyxPQUFPLENBQUMsa0NBQTBCLENBQUMsdUJBQXVCLENBQUMsQ0FBQztRQUNyRSxDQUFDO1FBRUQsTUFBTSxXQUFXLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDLENBQUM7UUFDMUMsTUFBTSxpQkFBaUIsR0FBRyxZQUFZLENBQUMsSUFBSSxDQUFDLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FDcEQsSUFBSSxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQUMsVUFBVSxLQUFLLFdBQVcsQ0FBQyxPQUFPLENBQUMsVUFBVTtZQUN0RSxJQUFJLENBQUMsY0FBYyxLQUFLLGVBQU0sQ0FBQyxJQUFJLENBQ2xDLFdBQVcsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQ25DLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7UUFDcEIsSUFBSSxDQUFDLGlCQUFpQixFQUFFLENBQUM7WUFDeEIsT0FBTyxPQUFPLENBQUMsa0NBQTBCLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDMUQsQ0FBQztRQUVELElBQUksSUFBSSxDQUFDLE1BQU0sQ0FBQyxjQUFjLEtBQUssVUFBVSxFQUFFLENBQUM7WUFDL0MsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLE1BQU0sQ0FBQyxpQkFBaUIsQ0FBQztZQUM5QyxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7Z0JBQ2QsT0FBTyxPQUFPLENBQUMsa0NBQTBCLENBQUMsMkJBQTJCLENBQUMsQ0FBQztZQUN4RSxDQUFDO1lBQ0QsS0FBSyxJQUFJLEtBQUssR0FBRyxDQUFDLEVBQUUsS0FBSyxHQUFHLElBQUksQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLEtBQUssRUFBRSxFQUFFLENBQUM7Z0JBQ3RELElBQUksTUFBNEIsQ0FBQztnQkFDakMsSUFBSSxDQUFDO29CQUNKLE1BQU0sR0FBRyxNQUFNLE9BQU8sQ0FBQyxLQUFLLENBQUM7d0JBQzVCLGNBQWMsRUFBRSxJQUFJLFVBQVUsQ0FDN0IsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLFFBQVEsRUFBRSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FDbkM7d0JBQ0Qsb0JBQW9CLEVBQUUsSUFBSSxVQUFVLENBQ25DLElBQUksQ0FBQyxLQUFLLEdBQUcsQ0FBQyxDQUFDLENBQUMsUUFBUSxFQUFFLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUN2Qzt3QkFDRCxjQUFjLEVBQUUsSUFBSSxJQUFJLENBQUMsY0FBYyxDQUFDO3FCQUN4QyxDQUFDLENBQUM7Z0JBQ0osQ0FBQztnQkFBQyxNQUFNLENBQUM7b0JBQ1IsT0FBTyxPQUFPLENBQUMsa0NBQTBCLENBQUMsMkJBQTJCLENBQUMsQ0FBQztnQkFDeEUsQ0FBQztnQkFDRCxJQUFJLE1BQU0sS0FBSyxTQUFTLEVBQUUsQ0FBQztvQkFDMUIsT0FBTyxPQUFPLENBQUMsa0NBQTBCLENBQUMsa0JBQWtCLENBQUMsQ0FBQztnQkFDL0QsQ0FBQztnQkFDRCxJQUFJLE1BQU0sS0FBSyxNQUFNLEVBQUUsQ0FBQztvQkFDdkIsT0FBTyxPQUFPLENBQUMsa0NBQTBCLENBQUMsMkJBQTJCLENBQUMsQ0FBQztnQkFDeEUsQ0FBQztZQUNGLENBQUM7UUFDRixDQUFDO1FBRUQsT0FBTztZQUNOLE9BQU8sRUFBRSxJQUFJO1lBQ2IsS0FBSyxFQUFFO2dCQUNOLGtCQUFrQixFQUFFLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDO2dCQUN2QyxrQkFBa0IsRUFBRSxJQUFJLFVBQVUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDO2dCQUNoRCxXQUFXLEVBQUUsSUFBSSxDQUFDLE1BQU07Z0JBQ3hCLHVCQUF1QixFQUFFLEtBQUs7Z0JBQzlCLDRCQUE0QixFQUFFLE1BQU0sU0FBUyxDQUFDLGlCQUFpQixDQUFDLEdBQUcsQ0FBQzthQUNwRTtTQUNELENBQUM7SUFDSCxDQUFDO0NBQ0Q7QUFoT0QsOENBZ09DIn0=

package/package.json

@@ -0,0 +1,82 @@
+{
+  "name": "ubid-common",
+  "version": "0.1.0",
+  "description": "Shared credential parsing, rendering, verification, trust, and cryptographic utility components for the UbID ecosystem.",
+  "keywords": [
+    "ubid",
+    "digital-identity",
+    "verifiable-credentials",
+    "openid4vci",
+    "openid4vp",
+    "sd-jwt",
+    "mdoc",
+    "digital-credentials",
+    "identity",
+    "verification"
+  ],
+  "type": "commonjs",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "require": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/paradigma-cl/ubid-common.git"
+  },
+  "bugs": {
+    "url": "https://github.com/paradigma-cl/ubid-common/issues"
+  },
+  "homepage": "https://github.com/paradigma-cl/ubid-common#readme",
+  "engines": {
+    "node": ">=20.19"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "scripts": {
+    "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
+    "build": "npm run clean && tsc",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run --maxWorkers=1",
+    "test:watch": "vitest",
+    "prepack": "npm run build"
+  },
+  "dependencies": {
+    "@auth0/mdl": "^2.2.0",
+    "@sd-jwt/core": "^0.10.0",
+    "@sd-jwt/sd-jwt-vc": "^0.13.0",
+    "asn1js": "^3.0.5",
+    "axios": "^1.20.0",
+    "buffer": "^6.0.3",
+    "cose-kit": "^1.7.1",
+    "jose": "^5.9.6",
+    "jsonpointer": "^5.0.1",
+    "pako": "2.1.0",
+    "pkijs": "^3.2.4",
+    "uncrypto": "^0.1.3",
+    "zod": "^3.24.1"
+  },
+  "devDependencies": {
+    "@sd-jwt/types": "^0.10.0",
+    "@types/node": "^22.20.1",
+    "@xmldom/xmldom": "^0.9.12",
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.10"
+  },
+  "overrides": {
+    "ajv": "8.20.0",
+    "fast-uri": "3.1.6",
+    "form-data": "4.0.6",
+    "follow-redirects": "1.16.0"
+  }
+}