{"version":3,"sources":["../src/schemas/metadata.ts","../src/index.ts","../src/protocol-keys.ts","../src/registration/adapter.ts","../src/roles.ts","../src/client-auth/assertion.ts","../src/registration/automatic.ts","../src/constants.ts","../src/registration/helpers.ts","../src/registration/explicit.ts","../src/registration/handler.ts","../src/schemas/explicit-registration.ts","../src/registration/process-automatic.ts","../src/registration/validate-request-object.ts"],"sourcesContent":["/**\n * Typed Zod schemas for all OpenID Federation 1.0 entity type metadata.\n *\n * Covers:\n * - openid_relying_party (OIDC Dynamic Registration 1.0 + Federation 1.0)\n * - openid_provider (OIDC Discovery 1.0 + Federation 1.0)\n * - oauth_authorization_server (RFC 8414 + Federation 1.0)\n * - oauth_client (RFC 7591 + Federation 1.0)\n * - oauth_resource (RFC 9728 + Federation 1.0)\n */\n\nimport {\n\tFederationEntityMetadataSchema,\n\ttype FederationMetadata,\n\tFederationMetadataSchema,\n\tJWKSetSchema,\n} from \"@oidfed/core\";\nimport { z } from \"zod\";\n\nexport type { FederationMetadata };\n// Re-export core schemas for consumers that need OIDC-strict + base schemas together\nexport { FederationEntityMetadataSchema, FederationMetadataSchema };\n\n/** URL that MUST use https scheme and MUST NOT contain a fragment */\nconst httpsUrlNoFragment = z.url().refine(\n\t(val) => {\n\t\ttry {\n\t\t\tconst u = new URL(val);\n\t\t\treturn u.protocol === \"https:\" && !u.hash;\n\t\t} catch {\n\t\t\treturn false;\n\t\t}\n\t},\n\t{ message: \"URL must use https scheme and must not contain a fragment\" },\n);\n\nconst nonEmptyStringArray = z.array(z.string()).min(1);\n\nconst CommonInformationalMetadataShape = {\n\torganization_name: z.string().optional(),\n\tdisplay_name: z.string().optional(),\n\tdescription: z.string().optional(),\n\tkeywords: nonEmptyStringArray.optional(),\n\tcontacts: nonEmptyStringArray.optional(),\n\tlogo_uri: z.string().url().optional(),\n\tpolicy_uri: z.string().url().optional(),\n\tinformation_uri: z.string().url().optional(),\n\torganization_uri: z.string().url().optional(),\n};\n\n// ---------------------------------------------------------------------------\n// 1. OpenID Connect Relying Party (OIDC Registration 1.0 + Federation 1.0)\n// ---------------------------------------------------------------------------\n\n/**\n * Typed OpenID Relying Party metadata schema.\n * Validates parameters from OIDC Dynamic Client Registration 1.0 (Section 2),\n * RFC 7591 core client metadata, logout / CIBA extensions, and\n * OpenID Federation 1.0 Section 5.1/5.2 federation-specific parameters.\n */\nconst OpenIDRelyingPartyMetadataShape = {\n\t// RFC 7591 / OIDC Registration core\n\tredirect_uris: z.array(z.string().url()).optional(),\n\tresponse_types: z.array(z.string()).optional(),\n\tgrant_types: z.array(z.string()).optional(),\n\tapplication_type: z.enum([\"web\", \"native\"]).optional(),\n\tclient_name: z.string().optional(),\n\tclient_uri: z.string().url().optional(),\n\ttos_uri: z.string().url().optional(),\n\t...CommonInformationalMetadataShape,\n\tjwks_uri: httpsUrlNoFragment.optional(),\n\tjwks: JWKSetSchema.optional(),\n\tsector_identifier_uri: z.string().url().optional(),\n\tsubject_type: z.enum([\"public\", \"pairwise\"]).optional(),\n\t// ID Token signing/encryption\n\tid_token_signed_response_alg: z.string().optional(),\n\tid_token_encrypted_response_alg: z.string().optional(),\n\tid_token_encrypted_response_enc: z.string().optional(),\n\t// UserInfo signing/encryption\n\tuserinfo_signed_response_alg: z.string().optional(),\n\tuserinfo_encrypted_response_alg: z.string().optional(),\n\tuserinfo_encrypted_response_enc: z.string().optional(),\n\t// Request Object signing/encryption\n\trequest_object_signing_alg: z.string().optional(),\n\trequest_object_encryption_alg: z.string().optional(),\n\trequest_object_encryption_enc: z.string().optional(),\n\t// Token endpoint auth\n\ttoken_endpoint_auth_method: z.string().optional(),\n\ttoken_endpoint_auth_signing_alg: z.string().optional(),\n\t// Session\n\tdefault_max_age: z.number().int().nonnegative().optional(),\n\trequire_auth_time: z.boolean().optional(),\n\tdefault_acr_values: z.array(z.string()).optional(),\n\tinitiate_login_uri: z.string().url().optional(),\n\tpost_logout_redirect_uris: z.array(z.string().url()).optional(),\n\t// CIBA (OpenID Connect CIBA Core 1.0)\n\tbackchannel_token_delivery_mode: z.string().optional(),\n\tbackchannel_client_notification_endpoint: z.string().url().optional(),\n\tbackchannel_authentication_request_signing_alg: z.string().optional(),\n\tbackchannel_user_code_parameter: z.boolean().optional(),\n\t// Federation-specific (OpenID Federation 1.0 Section 5.1/5.2)\n\tclient_registration_types: z.array(z.string()).optional(),\n\tsigned_jwks_uri: httpsUrlNoFragment.optional(),\n\torganization_identifier: z.string().optional(),\n\tscope: z.string().optional(),\n};\n\nconst OPENID_RP_REGISTRATION_RESPONSE_FIELDS = [\n\t\"client_id\",\n\t\"client_secret\",\n\t\"client_id_issued_at\",\n\t\"client_secret_expires_at\",\n] as const;\n\nexport const OpenIDRelyingPartyMetadataSchema = z\n\t.looseObject(OpenIDRelyingPartyMetadataShape)\n\t.superRefine((meta, ctx) => {\n\t\tfor (const field of OPENID_RP_REGISTRATION_RESPONSE_FIELDS) {\n\t\t\tif (Object.hasOwn(meta, field)) {\n\t\t\t\tctx.addIssue({\n\t\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\t\tmessage: `${field} is only valid in explicit registration response metadata`,\n\t\t\t\t\tpath: [field],\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\t});\n\n/**\n * Typed OpenID Relying Party metadata as carried in an Explicit Registration Response.\n * Includes registration-response credential fields that are not valid in Entity\n * Configuration or Subordinate Statement metadata.\n */\nexport const OpenIDRelyingPartyRegistrationResponseMetadataSchema = z.looseObject({\n\t...OpenIDRelyingPartyMetadataShape,\n\tclient_id: z.string(),\n\tclient_secret: z.string().optional(),\n\tclient_id_issued_at: z.number().int().nonnegative().optional(),\n\tclient_secret_expires_at: z.number().int().nonnegative().optional(),\n});\n\n// ---------------------------------------------------------------------------\n// 2. OpenID Connect Provider (OIDC Discovery 1.0 + Federation 1.0)\n// ---------------------------------------------------------------------------\n\n/**\n * Typed OpenID Provider metadata schema.\n * Validates parameters from OIDC Discovery 1.0 (Section 3),\n * IANA OAuth AS Metadata registry entries, session management / logout,\n * CIBA, and OpenID Federation 1.0 Section 5.1 federation-specific parameters.\n */\nexport const OpenIDProviderMetadataSchema = z\n\t.looseObject({\n\t\tissuer: z.string().url(),\n\t\tauthorization_endpoint: z.string().url(),\n\t\ttoken_endpoint: z.string().url().optional(),\n\t\tuserinfo_endpoint: z.string().url().optional(),\n\t\tjwks_uri: httpsUrlNoFragment.optional(),\n\t\tjwks: JWKSetSchema.optional(),\n\t\tregistration_endpoint: httpsUrlNoFragment.optional(),\n\t\tscopes_supported: z.array(z.string()).optional(),\n\t\tresponse_types_supported: z.array(z.string()),\n\t\tresponse_modes_supported: z.array(z.string()).optional(),\n\t\tgrant_types_supported: z.array(z.string()).optional(),\n\t\tacr_values_supported: z.array(z.string()).optional(),\n\t\tsubject_types_supported: z.array(z.string()),\n\t\t// ID Token signing/encryption\n\t\tid_token_signing_alg_values_supported: z.array(z.string()),\n\t\tid_token_encryption_alg_values_supported: z.array(z.string()).optional(),\n\t\tid_token_encryption_enc_values_supported: z.array(z.string()).optional(),\n\t\t// UserInfo signing/encryption\n\t\tuserinfo_signing_alg_values_supported: z.array(z.string()).optional(),\n\t\tuserinfo_encryption_alg_values_supported: z.array(z.string()).optional(),\n\t\tuserinfo_encryption_enc_values_supported: z.array(z.string()).optional(),\n\t\t// Request Object signing/encryption\n\t\trequest_object_signing_alg_values_supported: z.array(z.string()).optional(),\n\t\trequest_object_encryption_alg_values_supported: z.array(z.string()).optional(),\n\t\trequest_object_encryption_enc_values_supported: z.array(z.string()).optional(),\n\t\t// Token endpoint auth\n\t\ttoken_endpoint_auth_methods_supported: z.array(z.string()).optional(),\n\t\ttoken_endpoint_auth_signing_alg_values_supported: z.array(z.string()).optional(),\n\t\t// Display / claims\n\t\tdisplay_values_supported: z.array(z.string()).optional(),\n\t\tclaim_types_supported: z.array(z.string()).optional(),\n\t\tclaims_supported: z.array(z.string()).optional(),\n\t\tservice_documentation: z.string().url().optional(),\n\t\tclaims_locales_supported: z.array(z.string()).optional(),\n\t\tui_locales_supported: z.array(z.string()).optional(),\n\t\tclaims_parameter_supported: z.boolean().optional(),\n\t\trequest_parameter_supported: z.boolean().optional(),\n\t\trequest_uri_parameter_supported: z.boolean().optional(),\n\t\trequire_request_uri_registration: z.boolean().optional(),\n\t\top_policy_uri: z.string().url().optional(),\n\t\top_tos_uri: z.string().url().optional(),\n\t\t// Session Management / Logout\n\t\tend_session_endpoint: z.string().url().optional(),\n\t\tfrontchannel_logout_supported: z.boolean().optional(),\n\t\tfrontchannel_logout_session_supported: z.boolean().optional(),\n\t\tbackchannel_logout_supported: z.boolean().optional(),\n\t\tbackchannel_logout_session_supported: z.boolean().optional(),\n\t\t// CIBA (OpenID Connect CIBA Core 1.0)\n\t\tbackchannel_token_delivery_modes_supported: z.array(z.string()).optional(),\n\t\tbackchannel_authentication_endpoint: z.string().url().optional(),\n\t\tbackchannel_user_code_parameter_supported: z.boolean().optional(),\n\t\t...CommonInformationalMetadataShape,\n\t\t// Federation-specific (OpenID Federation 1.0 Section 5.1)\n\t\tclient_registration_types_supported: z.array(z.string()).optional(),\n\t\tfederation_registration_endpoint: httpsUrlNoFragment.optional(),\n\t\tsigned_jwks_uri: httpsUrlNoFragment.optional(),\n\t\torganization_identifier: z.string().optional(),\n\t})\n\t.superRefine((meta, ctx) => {\n\t\t// issuer must use https and have no query/fragment (RFC 8414 Section 2)\n\t\ttry {\n\t\t\tconst u = new URL(meta.issuer);\n\t\t\tif (u.protocol !== \"https:\") {\n\t\t\t\tctx.addIssue({\n\t\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\t\tmessage: \"issuer URL must use https scheme\",\n\t\t\t\t\tpath: [\"issuer\"],\n\t\t\t\t});\n\t\t\t}\n\t\t\tif (u.hash || u.search) {\n\t\t\t\tctx.addIssue({\n\t\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\t\tmessage: \"issuer URL must not contain query or fragment components\",\n\t\t\t\t\tpath: [\"issuer\"],\n\t\t\t\t});\n\t\t\t}\n\t\t} catch {\n\t\t\tctx.addIssue({\n\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\tmessage: \"issuer must be a valid URL\",\n\t\t\t\tpath: [\"issuer\"],\n\t\t\t});\n\t\t}\n\n\t\t// federation_registration_endpoint required when 'explicit' registration is supported\n\t\tif (\n\t\t\tmeta.client_registration_types_supported?.includes(\"explicit\") &&\n\t\t\t!meta.federation_registration_endpoint\n\t\t) {\n\t\t\tctx.addIssue({\n\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\tmessage:\n\t\t\t\t\t\"federation_registration_endpoint is REQUIRED when client_registration_types_supported includes 'explicit'\",\n\t\t\t\tpath: [\"federation_registration_endpoint\"],\n\t\t\t});\n\t\t}\n\t});\n\ntype OpenIDRelyingPartyResponseOnlyFields = {\n\treadonly [K in (typeof OPENID_RP_REGISTRATION_RESPONSE_FIELDS)[number]]?: never;\n};\nexport type OpenIDRelyingPartyMetadata = z.infer &\n\tOpenIDRelyingPartyResponseOnlyFields;\nexport type OpenIDRelyingPartyRegistrationResponseMetadata = z.infer<\n\ttypeof OpenIDRelyingPartyRegistrationResponseMetadataSchema\n>;\nexport type OpenIDProviderMetadata = z.infer;\n\n// ---------------------------------------------------------------------------\n// 3. OAuth 2.0 Authorization Server (RFC 8414 + Federation 1.0)\n// ---------------------------------------------------------------------------\n\n/**\n * Typed OAuth 2.0 Authorization Server metadata schema.\n * Validates parameters from RFC 8414 (Section 2), extension RFCs\n * (RFC 7636 PKCE, RFC 8628 Device Auth, RFC 9126 PAR, RFC 9207 Issuer ID,\n * RFC 9449 DPoP), and OpenID Federation 1.0 Section 5.1.3 extensions.\n */\nexport const OAuthAuthorizationServerMetadataSchema = z\n\t.looseObject({\n\t\tissuer: z.string().url(),\n\t\tauthorization_endpoint: z.string().url().optional(),\n\t\ttoken_endpoint: z.string().url().optional(),\n\t\tjwks_uri: httpsUrlNoFragment.optional(),\n\t\tjwks: JWKSetSchema.optional(),\n\t\tregistration_endpoint: httpsUrlNoFragment.optional(),\n\t\tscopes_supported: z.array(z.string()).optional(),\n\t\tresponse_types_supported: z.array(z.string()),\n\t\tresponse_modes_supported: z.array(z.string()).optional(),\n\t\tgrant_types_supported: z.array(z.string()).optional(),\n\t\ttoken_endpoint_auth_methods_supported: z.array(z.string()).optional(),\n\t\ttoken_endpoint_auth_signing_alg_values_supported: z.array(z.string()).optional(),\n\t\tservice_documentation: z.string().url().optional(),\n\t\tui_locales_supported: z.array(z.string()).optional(),\n\t\top_policy_uri: z.string().url().optional(),\n\t\top_tos_uri: z.string().url().optional(),\n\t\t// Revocation (RFC 7009)\n\t\trevocation_endpoint: z.string().url().optional(),\n\t\trevocation_endpoint_auth_methods_supported: z.array(z.string()).optional(),\n\t\trevocation_endpoint_auth_signing_alg_values_supported: z.array(z.string()).optional(),\n\t\t// Introspection (RFC 7662)\n\t\tintrospection_endpoint: z.string().url().optional(),\n\t\tintrospection_endpoint_auth_methods_supported: z.array(z.string()).optional(),\n\t\tintrospection_endpoint_auth_signing_alg_values_supported: z.array(z.string()).optional(),\n\t\t// PKCE (RFC 7636)\n\t\tcode_challenge_methods_supported: z.array(z.string()).optional(),\n\t\t// Device Authorization (RFC 8628)\n\t\tdevice_authorization_endpoint: z.string().url().optional(),\n\t\t// PAR (RFC 9126)\n\t\tpushed_authorization_request_endpoint: z.string().url().optional(),\n\t\trequire_pushed_authorization_requests: z.boolean().optional(),\n\t\t// DPoP (RFC 9449)\n\t\tdpop_signing_alg_values_supported: z.array(z.string()).optional(),\n\t\t// Issuer Identification (RFC 9207)\n\t\tauthorization_response_iss_parameter_supported: z.boolean().optional(),\n\t\t...CommonInformationalMetadataShape,\n\t\t// Federation-specific (OpenID Federation 1.0 Section 5.1.3)\n\t\tclient_registration_types_supported: z.array(z.string()).optional(),\n\t\tfederation_registration_endpoint: httpsUrlNoFragment.optional(),\n\t\tsigned_jwks_uri: httpsUrlNoFragment.optional(),\n\t\torganization_identifier: z.string().optional(),\n\t})\n\t.superRefine((meta, ctx) => {\n\t\ttry {\n\t\t\tconst u = new URL(meta.issuer);\n\t\t\tif (u.protocol !== \"https:\") {\n\t\t\t\tctx.addIssue({\n\t\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\t\tmessage: \"issuer URL must use https scheme\",\n\t\t\t\t\tpath: [\"issuer\"],\n\t\t\t\t});\n\t\t\t}\n\t\t\tif (u.hash || u.search) {\n\t\t\t\tctx.addIssue({\n\t\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\t\tmessage: \"issuer URL must not contain query or fragment components\",\n\t\t\t\t\tpath: [\"issuer\"],\n\t\t\t\t});\n\t\t\t}\n\t\t} catch {\n\t\t\tctx.addIssue({\n\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\tmessage: \"issuer must be a valid URL\",\n\t\t\t\tpath: [\"issuer\"],\n\t\t\t});\n\t\t}\n\n\t\tif (\n\t\t\tmeta.client_registration_types_supported?.includes(\"explicit\") &&\n\t\t\t!meta.federation_registration_endpoint\n\t\t) {\n\t\t\tctx.addIssue({\n\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\tmessage:\n\t\t\t\t\t\"federation_registration_endpoint is REQUIRED when client_registration_types_supported includes 'explicit'\",\n\t\t\t\tpath: [\"federation_registration_endpoint\"],\n\t\t\t});\n\t\t}\n\t});\n\nexport type OAuthAuthorizationServerMetadata = z.infer<\n\ttypeof OAuthAuthorizationServerMetadataSchema\n>;\n\n// ---------------------------------------------------------------------------\n// 4. OAuth 2.0 Client (RFC 7591 + Federation 1.0)\n// ---------------------------------------------------------------------------\n\n/**\n * Typed OAuth 2.0 Client metadata schema.\n * Validates parameters from RFC 7591 (OAuth 2.0 Dynamic Client Registration)\n * and OpenID Federation 1.0 Section 5.1.4 extensions.\n */\nexport const OAuthClientMetadataSchema = z.looseObject({\n\tredirect_uris: z.array(z.string().url()).optional(),\n\ttoken_endpoint_auth_method: z.string().optional(),\n\ttoken_endpoint_auth_signing_alg: z.string().optional(),\n\tgrant_types: z.array(z.string()).optional(),\n\tresponse_types: z.array(z.string()).optional(),\n\tclient_name: z.string().optional(),\n\tclient_uri: z.string().url().optional(),\n\tscope: z.string().optional(),\n\ttos_uri: z.string().url().optional(),\n\t...CommonInformationalMetadataShape,\n\tjwks_uri: httpsUrlNoFragment.optional(),\n\tjwks: JWKSetSchema.optional(),\n\tsoftware_id: z.string().optional(),\n\tsoftware_version: z.string().optional(),\n\t// Federation-specific (OpenID Federation 1.0 Section 5.1.4)\n\tclient_registration_types: z.array(z.string()).optional(),\n\tsigned_jwks_uri: httpsUrlNoFragment.optional(),\n\torganization_identifier: z.string().optional(),\n});\n\nexport type OAuthClientMetadata = z.infer;\n\n// ---------------------------------------------------------------------------\n// 5. OAuth 2.0 Protected Resource (RFC 9728 + Federation 1.0)\n// ---------------------------------------------------------------------------\n\n/**\n * Typed OAuth 2.0 Protected Resource metadata schema.\n * Validates parameters from RFC 9728 (OAuth 2.0 Protected Resource Metadata)\n * and OpenID Federation 1.0 Section 5.1.5 extensions.\n */\nexport const OAuthResourceMetadataSchema = z.looseObject({\n\tresource: z.string().url(),\n\tauthorization_servers: z.array(z.string().url()).optional(),\n\tbearer_methods_supported: z.array(z.enum([\"header\", \"body\", \"query\"])).optional(),\n\tresource_signing_alg_values_supported: z.array(z.string()).optional(),\n\tdpop_signing_alg_values_supported: z.array(z.string()).optional(),\n\tscopes_supported: z.array(z.string()).optional(),\n\tjwks_uri: httpsUrlNoFragment.optional(),\n\tjwks: JWKSetSchema.optional(),\n\t...CommonInformationalMetadataShape,\n\t// Federation-specific (OpenID Federation 1.0 Section 5.2)\n\tsigned_jwks_uri: httpsUrlNoFragment.optional(),\n\torganization_identifier: z.string().optional(),\n});\n\nexport type OAuthResourceMetadata = z.infer;\n\n// ---------------------------------------------------------------------------\n// Combined Federation OIDC Metadata Schema\n// ---------------------------------------------------------------------------\n\n/**\n * Extended federation metadata schema with strict validation for all entity types.\n * Ensures that each metadata block conforms to its authoritative specification\n * (not just `z.record()`).\n */\nexport const OIDCFederationMetadataSchema = FederationMetadataSchema.pipe(\n\tz.looseObject({\n\t\tfederation_entity: FederationEntityMetadataSchema.optional(),\n\t\topenid_relying_party: OpenIDRelyingPartyMetadataSchema.optional(),\n\t\topenid_provider: OpenIDProviderMetadataSchema.optional(),\n\t\toauth_authorization_server: OAuthAuthorizationServerMetadataSchema.optional(),\n\t\toauth_client: OAuthClientMetadataSchema.optional(),\n\t\toauth_resource: OAuthResourceMetadataSchema.optional(),\n\t}),\n);\n\nexport type OIDCFederationMetadata = FederationMetadata & {\n\treadonly federation_entity?: z.infer;\n\treadonly openid_relying_party?: OpenIDRelyingPartyMetadata;\n\treadonly openid_provider?: OpenIDProviderMetadata;\n\treadonly oauth_authorization_server?: OAuthAuthorizationServerMetadata;\n\treadonly oauth_client?: OAuthClientMetadata;\n\treadonly oauth_resource?: OAuthResourceMetadata;\n};\n\n/**\n * Parse and validate metadata with OIDC-strict validation.\n */\nexport function validateOIDCMetadata(raw: unknown): OIDCFederationMetadata {\n\treturn OIDCFederationMetadataSchema.parse(raw) as OIDCFederationMetadata;\n}\n","// @oidfed/oidc — OIDC/OAuth2 protocol layer for OpenID Federation\n\n// Re-export common core types\nexport type {\n\tEntityId,\n\tFederationError,\n\tFederationOptions,\n\tResult,\n\tTrustAnchorSet,\n} from \"@oidfed/core\";\n\n// Client authentication\nexport type { ClientAssertionOptions } from \"./client-auth/assertion.js\";\n\n// Protocol keys\nexport {\n\ttype ProtocolSigningKeyProvider,\n\tStaticProtocolSigningKeyProvider,\n} from \"./protocol-keys.js\";\n\n// Registration types\nexport { OIDCRegistrationAdapter } from \"./registration/adapter.js\";\nexport type {\n\tRegistrationProtocolAdapter,\n\tRegistrationProtocolAdapterContext,\n} from \"./registration/adapter-types.js\";\nexport type {\n\tAutomaticRegistrationConfig,\n\tAutomaticRegistrationResult,\n\tRequestDelivery,\n} from \"./registration/automatic.js\";\nexport type {\n\tExplicitRegistrationConfig,\n\tExplicitRegistrationResult,\n} from \"./registration/explicit.js\";\nexport type { ExplicitRegistrationHandlerConfig } from \"./registration/handler.js\";\nexport type {\n\tProcessAutomaticRegistrationOptions,\n\tProcessedRegistration,\n} from \"./registration/process-automatic.js\";\nexport type { ProcessExplicitRegistrationOptions } from \"./registration/process-explicit.js\";\nexport type {\n\tAutomaticRegistrationContext,\n\tValidatedRequestObject,\n\tValidatedRequestObjectResult,\n} from \"./registration/types.js\";\n\n// Roles composition\nexport {\n\ttype CreateAuthorizationRequestOptions,\n\tOAuthAuthorizationServerRole,\n\ttype OAuthAuthorizationServerRoleConfig,\n\tOAuthClientRole,\n\ttype OAuthClientRoleConfig,\n\tOAuthResourceRole,\n\ttype OAuthResourceRoleConfig,\n\tOidcProviderRole,\n\ttype OidcProviderRoleConfig,\n\tOidcRelyingPartyRole,\n\ttype OidcRelyingPartyRoleConfig,\n} from \"./roles.js\";\n\n// Schemas & Types\nexport type {\n\tExplicitRegistrationRequestPayload,\n\tExplicitRegistrationResponsePayload,\n} from \"./schemas/explicit-registration.js\";\nexport type {\n\tOAuthAuthorizationServerMetadata,\n\tOAuthClientMetadata,\n\tOAuthResourceMetadata,\n\tOIDCFederationMetadata,\n\tOpenIDProviderMetadata,\n\tOpenIDRelyingPartyMetadata,\n\tOpenIDRelyingPartyRegistrationResponseMetadata,\n} from \"./schemas/metadata.js\";\n","import type { JwtSigner } from \"@oidfed/core\";\n\nexport interface ProtocolSigningKeyProvider {\n\tgetRequestObjectSigner(): Promise;\n\tgetClientAssertionSigner?(): Promise;\n}\n\nexport class StaticProtocolSigningKeyProvider implements ProtocolSigningKeyProvider {\n\tprivate readonly requestObjectSigner: JwtSigner;\n\tprivate readonly clientAssertionSigner: JwtSigner | undefined;\n\n\tconstructor(options: { requestObjectSigner: JwtSigner; clientAssertionSigner?: JwtSigner }) {\n\t\tthis.requestObjectSigner = options.requestObjectSigner;\n\t\tthis.clientAssertionSigner = options.clientAssertionSigner;\n\t}\n\n\tasync getRequestObjectSigner(): Promise {\n\t\treturn this.requestObjectSigner;\n\t}\n\n\tasync getClientAssertionSigner(): Promise {\n\t\treturn this.clientAssertionSigner ?? this.requestObjectSigner;\n\t}\n}\n","import {\n\terr,\n\ttype FederationError,\n\tFederationErrorCode,\n\tfederationError,\n\tok,\n\ttype Result,\n\ttype ValidatedTrustChain,\n} from \"@oidfed/core\";\nimport { OpenIDRelyingPartyMetadataSchema } from \"../schemas/metadata.js\";\nimport type { RegistrationProtocolAdapter } from \"./adapter-types.js\";\n\n/**\n * OIDC-specific registration protocol adapter.\n *\n * Validates `openid_relying_party` metadata against the OIDC RP metadata schema\n * and enriches the registration response with `client_id`.\n *\n * Implements the `RegistrationProtocolAdapter` interface from `./adapter-types.js`.\n */\nexport class OIDCRegistrationAdapter implements RegistrationProtocolAdapter {\n\tvalidateClientMetadata(\n\t\traw: Record,\n\t): Result, FederationError> {\n\t\tconst rpMeta = raw.openid_relying_party;\n\t\tif (!rpMeta || typeof rpMeta !== \"object\") {\n\t\t\t// Intentional pass-through: non-RP entities (e.g. AS, OP) may not carry\n\t\t\t// openid_relying_party metadata. The OP-side process-explicit handler\n\t\t\t// enforces its presence before this adapter is invoked (SEC-2).\n\t\t\treturn ok(raw);\n\t\t}\n\n\t\tconst parsed = OpenIDRelyingPartyMetadataSchema.safeParse(rpMeta);\n\t\tif (!parsed.success) {\n\t\t\treturn err(\n\t\t\t\tfederationError(\n\t\t\t\t\tFederationErrorCode.InvalidMetadata,\n\t\t\t\t\t`Invalid openid_relying_party metadata: ${parsed.error.message}`,\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\n\t\treturn ok(raw);\n\t}\n\n\tenrichResponseMetadata(\n\t\trpMeta: Record,\n\t\ttrustChain: ValidatedTrustChain,\n\t): Record {\n\t\tconst enriched = { ...rpMeta };\n\t\tif (!enriched.client_id) {\n\t\t\tenriched.client_id = trustChain.entityId;\n\t\t}\n\t\treturn enriched;\n\t}\n}\n","import type {\n\tDiscoveryResult,\n\tEntityContext,\n\tEntityId,\n\tEntityRole,\n\tFederationError,\n\tFederationOptions,\n\tJWKSet,\n\tReplayStore,\n\tResult,\n\tTrustAnchorSet,\n} from \"@oidfed/core\";\nimport { discoverEntity, err, FederationErrorCode, federationError } from \"@oidfed/core\";\nimport type { ClientAssertionOptions } from \"./client-auth/assertion.js\";\nimport { createClientAssertion } from \"./client-auth/assertion.js\";\nimport type { ProtocolSigningKeyProvider } from \"./protocol-keys.js\";\nimport type { RegistrationProtocolAdapter } from \"./registration/adapter-types.js\";\nimport {\n\ttype AutomaticRegistrationResult,\n\tautomaticRegistration,\n\ttype RequestDelivery,\n} from \"./registration/automatic.js\";\nimport { type ExplicitRegistrationResult, explicitRegistration } from \"./registration/explicit.js\";\nimport { createExplicitRegistrationHandler } from \"./registration/handler.js\";\nimport { assertNonEmptyTrustAnchors } from \"./registration/helpers.js\";\nimport {\n\ttype ProcessAutomaticRegistrationOptions,\n\ttype ProcessedRegistration,\n\tprocessAutomaticRegistration,\n} from \"./registration/process-automatic.js\";\n\nexport interface OidcRelyingPartyRoleConfig {\n\treadonly protocolKeyProvider: ProtocolSigningKeyProvider;\n\treadonly metadata?: Record;\n\treadonly requestObjectTtlSeconds?: number;\n\treadonly includePeerTrustChain?: boolean;\n\treadonly requestDelivery?: RequestDelivery;\n\treadonly requestUri?: string;\n\treadonly trustAnchors?: TrustAnchorSet;\n\treadonly authorityHints?: readonly EntityId[];\n}\n\nexport interface CreateAuthorizationRequestOptions extends FederationOptions {\n\treadonly requestDelivery?: RequestDelivery;\n\treadonly requestUri?: string;\n\treadonly includePeerTrustChain?: boolean;\n\treadonly requestObjectTtlSeconds?: number;\n\treadonly trustAnchors?: TrustAnchorSet;\n}\n\nexport class OidcRelyingPartyRole implements EntityRole {\n\tstatic createClientAssertion = createClientAssertion;\n\n\tpublic readonly type = \"openid_relying_party\";\n\tpublic readonly metadata: Record;\n\tprivate context?: EntityContext;\n\n\tconstructor(public readonly config: OidcRelyingPartyRoleConfig) {\n\t\tthis.metadata = config.metadata ?? {};\n\t}\n\n\tinitialize(context: EntityContext): void {\n\t\tthis.context = context;\n\t}\n\n\tasync createClientAssertion(audience: string, options?: ClientAssertionOptions): Promise {\n\t\tif (!this.context) {\n\t\t\tthrow new Error(\"Role has not been initialized.\");\n\t\t}\n\t\tconst signer = this.config.protocolKeyProvider.getClientAssertionSigner\n\t\t\t? await this.config.protocolKeyProvider.getClientAssertionSigner()\n\t\t\t: await this.config.protocolKeyProvider.getRequestObjectSigner();\n\n\t\treturn createClientAssertion(\n\t\t\tthis.context.entityId as EntityId,\n\t\t\taudience,\n\t\t\tsigner,\n\t\t\toptions ?? this.context.options,\n\t\t);\n\t}\n\n\tasync automaticallyRegister(\n\t\tparams: {\n\t\t\treadonly opEntityId: string;\n\t\t\treadonly redirect_uri: string;\n\t\t\treadonly scope?: string;\n\t\t\treadonly state?: string;\n\t\t\treadonly nonce?: string;\n\t\t\treadonly requestDelivery?: RequestDelivery;\n\t\t\treadonly requestUri?: string;\n\t\t},\n\t\toptions?: CreateAuthorizationRequestOptions,\n\t): Promise> {\n\t\tif (!this.context) {\n\t\t\tthrow new Error(\n\t\t\t\t\"Role has not been initialized. Ensure it is passed to an Entity constructor.\",\n\t\t\t);\n\t\t}\n\t\tconst trustAnchors =\n\t\t\toptions?.trustAnchors ?? this.config.trustAnchors ?? this.context.trustAnchors;\n\t\tif (!trustAnchors) {\n\t\t\tthrow new Error(\"No trustAnchors configured. Set them in config, options, or context.\");\n\t\t}\n\t\tconst opEntityId = params.opEntityId as EntityId;\n\t\tconst discoveryResult = await discoverEntity(\n\t\t\topEntityId,\n\t\t\ttrustAnchors,\n\t\t\toptions ?? this.context.options,\n\t\t);\n\t\tif (!discoveryResult.ok) {\n\t\t\treturn err(discoveryResult.error);\n\t\t}\n\n\t\tconst authzRequestParams: Record = {\n\t\t\tclient_id: this.context.entityId,\n\t\t\tresponse_type: \"code\",\n\t\t\tredirect_uri: params.redirect_uri,\n\t\t\t...(params.scope ? { scope: params.scope } : {}),\n\t\t\t...(params.state ? { state: params.state } : {}),\n\t\t\t...(params.nonce ? { nonce: params.nonce } : {}),\n\t\t};\n\n\t\tconst overrideConfig = {\n\t\t\t...this.config,\n\t\t\t...(params.requestDelivery ? { requestDelivery: params.requestDelivery } : {}),\n\t\t\t...(options?.requestDelivery ? { requestDelivery: options.requestDelivery } : {}),\n\t\t\t...(params.requestUri ? { requestUri: params.requestUri } : {}),\n\t\t\t...(options?.requestUri ? { requestUri: options.requestUri } : {}),\n\t\t\t...(options?.includePeerTrustChain !== undefined\n\t\t\t\t? { includePeerTrustChain: options.includePeerTrustChain }\n\t\t\t\t: {}),\n\t\t\t...(options?.requestObjectTtlSeconds !== undefined\n\t\t\t\t? { requestObjectTtlSeconds: options.requestObjectTtlSeconds }\n\t\t\t\t: {}),\n\t\t};\n\n\t\tconst rpConfig = {\n\t\t\tentityId: this.context.entityId as EntityId,\n\t\t\tprotocolKeyProvider: overrideConfig.protocolKeyProvider,\n\t\t\tauthorityHints: (this.context.authorityHints ??\n\t\t\t\tthis.config.authorityHints ??\n\t\t\t\t[]) as readonly [EntityId, ...EntityId[]],\n\t\t\tmetadata: {\n\t\t\t\t[this.type]: this.metadata,\n\t\t\t},\n\t\t\t...(overrideConfig.requestObjectTtlSeconds !== undefined\n\t\t\t\t? { requestObjectTtlSeconds: overrideConfig.requestObjectTtlSeconds }\n\t\t\t\t: {}),\n\t\t\t...(overrideConfig.includePeerTrustChain !== undefined\n\t\t\t\t? { includePeerTrustChain: overrideConfig.includePeerTrustChain }\n\t\t\t\t: {}),\n\t\t\t...(overrideConfig.requestDelivery !== undefined\n\t\t\t\t? { requestDelivery: overrideConfig.requestDelivery }\n\t\t\t\t: {}),\n\t\t\t...(overrideConfig.requestUri !== undefined ? { requestUri: overrideConfig.requestUri } : {}),\n\t\t};\n\n\t\treturn automaticRegistration(\n\t\t\tdiscoveryResult.value,\n\t\t\trpConfig,\n\t\t\tauthzRequestParams,\n\t\t\ttrustAnchors,\n\t\t\toptions ?? this.context.options,\n\t\t);\n\t}\n\n\tasync explicitlyRegister(\n\t\topEntityId: string,\n\t\toptions?: FederationOptions & { readonly trustAnchors?: TrustAnchorSet },\n\t): Promise> {\n\t\tif (!this.context) {\n\t\t\tthrow new Error(\n\t\t\t\t\"Role has not been initialized. Ensure it is passed to an Entity constructor.\",\n\t\t\t);\n\t\t}\n\t\tconst trustAnchors =\n\t\t\toptions?.trustAnchors ?? this.config.trustAnchors ?? this.context.trustAnchors;\n\t\tif (!trustAnchors) {\n\t\t\tthrow new Error(\"No trustAnchors configured. Set them in config, options, or context.\");\n\t\t}\n\t\tconst discoveryResult = await discoverEntity(\n\t\t\topEntityId as EntityId,\n\t\t\ttrustAnchors,\n\t\t\toptions ?? this.context.options,\n\t\t);\n\t\tif (!discoveryResult.ok) {\n\t\t\treturn err(discoveryResult.error);\n\t\t}\n\n\t\tconst rpConfig = {\n\t\t\tentityId: this.context.entityId as EntityId,\n\t\t\tkeyProvider: this.context.keyProvider,\n\t\t\tauthorityHints: (this.context.authorityHints ??\n\t\t\t\tthis.config.authorityHints ??\n\t\t\t\t[]) as readonly [EntityId, ...EntityId[]],\n\t\t\tmetadata: {\n\t\t\t\t[this.type]: this.metadata,\n\t\t\t},\n\t\t\t...(this.config.includePeerTrustChain !== undefined\n\t\t\t\t? { includePeerTrustChain: this.config.includePeerTrustChain }\n\t\t\t\t: {}),\n\t\t};\n\n\t\treturn explicitRegistration(\n\t\t\tdiscoveryResult.value,\n\t\t\trpConfig,\n\t\t\ttrustAnchors,\n\t\t\toptions ?? this.context.options,\n\t\t);\n\t}\n\n\tasync createAuthorizationRequest(\n\t\tdiscovery: DiscoveryResult,\n\t\tauthzRequestParams: Record,\n\t\ttrustAnchors: TrustAnchorSet,\n\t\toptions?: CreateAuthorizationRequestOptions,\n\t): Promise> {\n\t\tif (!this.context) {\n\t\t\tthrow new Error(\n\t\t\t\t\"Role has not been initialized. Ensure it is passed to an Entity constructor.\",\n\t\t\t);\n\t\t}\n\t\tconst overrideConfig = {\n\t\t\t...this.config,\n\t\t\t...(options?.requestDelivery ? { requestDelivery: options.requestDelivery } : {}),\n\t\t};\n\t\tconst rpConfig = {\n\t\t\tentityId: this.context.entityId as EntityId,\n\t\t\tprotocolKeyProvider: overrideConfig.protocolKeyProvider,\n\t\t\tauthorityHints: (this.context.authorityHints ??\n\t\t\t\tthis.config.authorityHints ??\n\t\t\t\t[]) as readonly [EntityId, ...EntityId[]],\n\t\t\tmetadata: {\n\t\t\t\t[this.type]: this.metadata,\n\t\t\t},\n\t\t\t...(overrideConfig.requestObjectTtlSeconds !== undefined\n\t\t\t\t? { requestObjectTtlSeconds: overrideConfig.requestObjectTtlSeconds }\n\t\t\t\t: {}),\n\t\t\t...(overrideConfig.includePeerTrustChain !== undefined\n\t\t\t\t? { includePeerTrustChain: overrideConfig.includePeerTrustChain }\n\t\t\t\t: {}),\n\t\t\t...(overrideConfig.requestDelivery !== undefined\n\t\t\t\t? { requestDelivery: overrideConfig.requestDelivery }\n\t\t\t\t: {}),\n\t\t\t...(overrideConfig.requestUri !== undefined ? { requestUri: overrideConfig.requestUri } : {}),\n\t\t};\n\t\treturn automaticRegistration(\n\t\t\tdiscovery,\n\t\t\trpConfig,\n\t\t\tauthzRequestParams,\n\t\t\toptions?.trustAnchors ?? trustAnchors,\n\t\t\toptions ?? this.context.options,\n\t\t);\n\t}\n}\n\nexport interface OidcProviderRoleConfig {\n\treadonly registrationPath?: string;\n\treadonly metadata?: Record;\n\treadonly trustAnchors?: TrustAnchorSet;\n\treadonly registrationResponseTtlSeconds?: number;\n\treadonly registrationProtocolAdapter?: RegistrationProtocolAdapter;\n\treadonly generateClientSecret?: (sub: EntityId) => Promise;\n\t/** Late pre-commit hook called after validation and response preparation, before `onRegistration`. */\n\treadonly onRegistrationInvalidation?: (sub: EntityId) => Promise;\n\treadonly replayStore?: ReplayStore;\n\treadonly onRegistration?: (\n\t\tsub: EntityId,\n\t\tclientMetadata: Record,\n\t\tclientSecret?: string,\n\t) => Promise;\n}\n\nexport class OidcProviderRole implements EntityRole {\n\tpublic readonly type = \"openid_provider\";\n\tpublic readonly metadata: Record = {};\n\tpublic readonly routes = new Map Promise>();\n\tprivate context?: EntityContext;\n\n\tconstructor(public readonly config: OidcProviderRoleConfig) {\n\t\tthis.metadata = config.metadata ?? {};\n\t}\n\n\tinitialize(context: EntityContext): void {\n\t\tthis.context = context;\n\t\tconst registrationPath = this.config.registrationPath ?? \"/registration\";\n\t\tconst registrationUrl = new URL(registrationPath, context.entityId).toString();\n\t\tconst trustAnchors = assertNonEmptyTrustAnchors(\n\t\t\tthis.config.trustAnchors ?? context.trustAnchors,\n\t\t);\n\n\t\tthis.metadata.federation_registration_endpoint = registrationUrl;\n\n\t\tconst handler = createExplicitRegistrationHandler({\n\t\t\topEntityId: context.entityId as EntityId,\n\t\t\tkeyProvider: context.keyProvider,\n\t\t\ttrustAnchors,\n\t\t\t...(this.config.registrationResponseTtlSeconds !== undefined\n\t\t\t\t? { registrationResponseTtlSeconds: this.config.registrationResponseTtlSeconds }\n\t\t\t\t: {}),\n\t\t\t...(this.config.registrationProtocolAdapter !== undefined\n\t\t\t\t? { registrationProtocolAdapter: this.config.registrationProtocolAdapter }\n\t\t\t\t: {}),\n\t\t\t...(this.config.generateClientSecret !== undefined\n\t\t\t\t? { generateClientSecret: this.config.generateClientSecret }\n\t\t\t\t: {}),\n\t\t\t...(this.config.onRegistrationInvalidation !== undefined\n\t\t\t\t? { onRegistrationInvalidation: this.config.onRegistrationInvalidation }\n\t\t\t\t: {}),\n\t\t\t...(this.config.onRegistration !== undefined\n\t\t\t\t? { onRegistration: this.config.onRegistration }\n\t\t\t\t: {}),\n\t\t\t...(context.options !== undefined ? { options: context.options } : {}),\n\t\t});\n\n\t\tthis.routes.set(registrationPath, handler);\n\t}\n\n\tasync processAutomaticRegistration(\n\t\trequestObjectJwt: string,\n\t\toptions?: Omit,\n\t): Promise> {\n\t\tif (!this.context) {\n\t\t\tthrow new Error(\"Provider role is not initialized.\");\n\t\t}\n\t\tconst replayStore = this.config.replayStore;\n\t\tif (!replayStore) {\n\t\t\tthrow new Error(\"replayStore is required to process automatic registration.\");\n\t\t}\n\t\tconst trustAnchors = assertNonEmptyTrustAnchors(\n\t\t\tthis.config.trustAnchors ?? this.context.trustAnchors,\n\t\t);\n\t\tconst result = await processAutomaticRegistration(requestObjectJwt, trustAnchors, {\n\t\t\topEntityId: this.context.entityId as EntityId,\n\t\t\treplayStore,\n\t\t\t...options,\n\t\t});\n\n\t\tif (!result.ok) return result;\n\n\t\tif (this.config.registrationProtocolAdapter?.validateClientMetadata) {\n\t\t\tconst validationResult = await this.config.registrationProtocolAdapter.validateClientMetadata(\n\t\t\t\tresult.value.resolvedRpMetadata,\n\t\t\t);\n\t\t\tif (!validationResult.ok) {\n\t\t\t\treturn err(\n\t\t\t\t\tfederationError(FederationErrorCode.InvalidMetadata, validationResult.error.description),\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\tif (this.config.onRegistration) {\n\t\t\tconst federationJwks = result.value.trustChain.statements[0]?.payload.jwks;\n\t\t\tconst jwks = result.value.resolvedRpMetadata.jwks ?? federationJwks ?? { keys: [] };\n\t\t\tawait this.config.onRegistration(result.value.rpEntityId, {\n\t\t\t\t...result.value.resolvedRpMetadata,\n\t\t\t\tjwks,\n\t\t\t});\n\t\t}\n\n\t\treturn result;\n\t}\n\n\tasync processExplicitRegistration(request: Request): Promise {\n\t\tconst registrationPath = this.config.registrationPath ?? \"/registration\";\n\t\tconst handler = this.routes.get(registrationPath);\n\t\tif (!handler) {\n\t\t\tthrow new Error(\"Explicit registration handler is not mounted.\");\n\t\t}\n\t\treturn handler(request);\n\t}\n}\n\nexport interface OAuthClientRoleConfig {\n\treadonly protocolKeyProvider: ProtocolSigningKeyProvider;\n\treadonly metadata?: Record;\n\treadonly requestObjectTtlSeconds?: number;\n\treadonly includePeerTrustChain?: boolean;\n\treadonly requestDelivery?: RequestDelivery;\n\treadonly requestUri?: string;\n}\n\nexport class OAuthClientRole implements EntityRole {\n\tstatic createClientAssertion = createClientAssertion;\n\n\tpublic readonly type = \"oauth_client\";\n\tpublic readonly metadata: Record;\n\tprivate context?: EntityContext;\n\n\tconstructor(public readonly config: OAuthClientRoleConfig) {\n\t\tthis.metadata = config.metadata ?? {};\n\t}\n\n\tinitialize(context: EntityContext): void {\n\t\tthis.context = context;\n\t}\n\n\tasync createAuthorizationRequest(\n\t\tdiscovery: DiscoveryResult,\n\t\tauthzRequestParams: Record,\n\t\ttrustAnchors: TrustAnchorSet,\n\t\toptions?: FederationOptions,\n\t): Promise> {\n\t\tif (!this.context) {\n\t\t\tthrow new Error(\n\t\t\t\t\"Role has not been initialized. Ensure it is passed to an Entity constructor.\",\n\t\t\t);\n\t\t}\n\t\tconst rpConfig = {\n\t\t\tentityId: this.context.entityId as EntityId,\n\t\t\tprotocolKeyProvider: this.config.protocolKeyProvider,\n\t\t\tauthorityHints: (this.context.authorityHints ?? []) as readonly [EntityId, ...EntityId[]],\n\t\t\tmetadata: {\n\t\t\t\t[this.type]: this.metadata,\n\t\t\t},\n\t\t\t...(this.config.requestObjectTtlSeconds !== undefined\n\t\t\t\t? { requestObjectTtlSeconds: this.config.requestObjectTtlSeconds }\n\t\t\t\t: {}),\n\t\t\t...(this.config.includePeerTrustChain !== undefined\n\t\t\t\t? { includePeerTrustChain: this.config.includePeerTrustChain }\n\t\t\t\t: {}),\n\t\t\t...(this.config.requestDelivery !== undefined\n\t\t\t\t? { requestDelivery: this.config.requestDelivery }\n\t\t\t\t: {}),\n\t\t\t...(this.config.requestUri !== undefined ? { requestUri: this.config.requestUri } : {}),\n\t\t};\n\t\treturn automaticRegistration(\n\t\t\tdiscovery,\n\t\t\trpConfig,\n\t\t\tauthzRequestParams,\n\t\t\ttrustAnchors,\n\t\t\toptions ?? this.context.options,\n\t\t);\n\t}\n}\n\nexport interface OAuthAuthorizationServerRoleConfig {\n\treadonly registrationPath?: string;\n\treadonly metadata?: Record;\n\treadonly trustAnchors?: TrustAnchorSet;\n\treadonly registrationResponseTtlSeconds?: number;\n\treadonly registrationProtocolAdapter?: RegistrationProtocolAdapter;\n\treadonly generateClientSecret?: (sub: EntityId) => Promise;\n\t/** Late pre-commit hook called after validation and response preparation. */\n\treadonly onRegistrationInvalidation?: (sub: EntityId) => Promise;\n}\n\nexport class OAuthAuthorizationServerRole implements EntityRole {\n\tpublic readonly type = \"oauth_authorization_server\";\n\tpublic readonly metadata: Record = {};\n\tpublic readonly routes = new Map Promise>();\n\n\tconstructor(public readonly config: OAuthAuthorizationServerRoleConfig) {\n\t\tthis.metadata = config.metadata ?? {};\n\t}\n\n\tinitialize(context: EntityContext): void {\n\t\tconst registrationPath = this.config.registrationPath ?? \"/registration\";\n\t\tconst registrationUrl = new URL(registrationPath, context.entityId).toString();\n\t\tconst trustAnchors = assertNonEmptyTrustAnchors(\n\t\t\tthis.config.trustAnchors ?? context.trustAnchors,\n\t\t);\n\n\t\tthis.metadata.federation_registration_endpoint = registrationUrl;\n\n\t\tconst handler = createExplicitRegistrationHandler({\n\t\t\topEntityId: context.entityId as EntityId,\n\t\t\tkeyProvider: context.keyProvider,\n\t\t\ttrustAnchors,\n\t\t\t...(this.config.registrationResponseTtlSeconds !== undefined\n\t\t\t\t? { registrationResponseTtlSeconds: this.config.registrationResponseTtlSeconds }\n\t\t\t\t: {}),\n\t\t\t...(this.config.registrationProtocolAdapter !== undefined\n\t\t\t\t? { registrationProtocolAdapter: this.config.registrationProtocolAdapter }\n\t\t\t\t: {}),\n\t\t\t...(this.config.generateClientSecret !== undefined\n\t\t\t\t? { generateClientSecret: this.config.generateClientSecret }\n\t\t\t\t: {}),\n\t\t\t...(this.config.onRegistrationInvalidation !== undefined\n\t\t\t\t? { onRegistrationInvalidation: this.config.onRegistrationInvalidation }\n\t\t\t\t: {}),\n\t\t\t...(context.options !== undefined ? { options: context.options } : {}),\n\t\t});\n\n\t\tthis.routes.set(registrationPath, handler);\n\t}\n}\n\nexport interface OAuthResourceRoleConfig {\n\treadonly metadata?: Record;\n\treadonly jwks?: JWKSet;\n}\n\nexport class OAuthResourceRole implements EntityRole {\n\tpublic readonly type = \"oauth_resource\";\n\tpublic readonly metadata: Record = {};\n\tpublic readonly routes = new Map Promise>();\n\n\tconstructor(public readonly config: OAuthResourceRoleConfig) {\n\t\tthis.metadata = config.metadata ?? {};\n\t\tif (config.jwks) {\n\t\t\tthis.metadata.jwks = config.jwks;\n\t\t}\n\t}\n\n\tinitialize(_context: EntityContext): void {}\n}\n","import {\n\ttype Clock,\n\tDEFAULT_CLIENT_ASSERTION_TTL_SECONDS,\n\ttype JwtSigner,\n\tnowSeconds,\n\tsignEntityStatement,\n} from \"@oidfed/core\";\n\nexport interface ClientAssertionOptions {\n\treadonly expiresInSeconds?: number;\n\t/** NumericDate clock used for iat and exp. */\n\treadonly clock?: Clock;\n}\n\n/**\n * Create a client assertion JWT for `private_key_jwt` authentication.\n *\n * This is an OIDC/OAuth2-specific concept used when the RP authenticates\n * to the OP's token endpoint using a signed JWT assertion.\n */\nexport async function createClientAssertion(\n\tclientId: string,\n\taudience: string,\n\tsigner: JwtSigner,\n\toptions?: ClientAssertionOptions,\n): Promise {\n\tconst expiresIn = options?.expiresInSeconds ?? DEFAULT_CLIENT_ASSERTION_TTL_SECONDS;\n\tconst now = nowSeconds(options?.clock);\n\n\tconst payload: Record = {\n\t\tiss: clientId,\n\t\tsub: clientId,\n\t\taud: audience,\n\t\tjti: crypto.randomUUID(),\n\t\tiat: now,\n\t\texp: now + expiresIn,\n\t};\n\n\t// signEntityStatement is a generic JWT signer despite its name\n\treturn signEntityStatement(payload, signer, {\n\t\ttyp: \"JWT\",\n\t});\n}\n","/** RP-side automatic registration: builds a signed Request Object with embedded trust chain. */\nimport {\n\tDEFAULT_REQUEST_OBJECT_TTL_SECONDS,\n\ttype DiscoveryResult,\n\ttype EntityId,\n\terr,\n\tFederationErrorCode,\n\ttype FederationOptions,\n\tfederationError,\n\tInternalErrorCode,\n\ttype JwtSigner,\n\tnowSeconds,\n\tok,\n\ttype Result,\n\tresolveTrustChainForAnchor,\n\tsignEntityStatement,\n\ttype TrustAnchorSet,\n\ttype ValidatedTrustChain,\n} from \"@oidfed/core\";\nimport { createClientAssertion } from \"../client-auth/assertion.js\";\nimport { ClientRegistrationType, RequestObjectTyp } from \"../constants.js\";\nimport type { ProtocolSigningKeyProvider } from \"../protocol-keys.js\";\nimport { getRegistrationTypes, selectSharedRegistrationTrustChains } from \"./helpers.js\";\n\nconst CLIENT_ASSERTION_TYPE = \"urn:ietf:params:oauth:client-assertion-type:jwt-bearer\";\n\nexport type RequestDelivery = \"query\" | \"form_post\" | \"request_uri\" | \"par\";\n\n/** Reserved claims that authzRequestParams MUST NOT overwrite. */\nconst RESERVED_REQUEST_OBJECT_CLAIMS = new Set([\n\t\"iss\",\n\t\"client_id\",\n\t\"aud\",\n\t\"jti\",\n\t\"iat\",\n\t\"exp\",\n\t\"sub\",\n\t\"registration\",\n]);\n\nexport interface AutomaticRegistrationConfig {\n\treadonly entityId: EntityId;\n\treadonly protocolKeyProvider: ProtocolSigningKeyProvider;\n\treadonly authorityHints: readonly [EntityId, ...EntityId[]];\n\treadonly metadata: Record>;\n\t/** TTL for the Request Object JWT in seconds (default: 300). */\n\treadonly requestObjectTtlSeconds?: number;\n\t/**\n\t * When true, attach the peer_trust_chain JWS header — a Trust Chain for\n\t * the OP that ends at the same Trust Anchor as the RP chain. Disabled by\n\t * default; set to true only when the RP wants the OP to use the\n\t * metadata/policy values from the RP-built peer chain (for the\n\t * Federation/Metadata Integrity properties). The library throws if the\n\t * peer chain to the shared Trust Anchor cannot be built.\n\t */\n\treadonly includePeerTrustChain?: boolean;\n\t/**\n\t * Selects how the signed Request Object reaches the OP's authorization\n\t * endpoint. Defaults to `\"form_post\"` — the safest choice for Request\n\t * Objects that carry an embedded `trust_chain` (the JWT can easily exceed\n\t * the practical URL/header length limits of HTTP intermediaries).\n\t *\n\t * Pass `\"query\"` to preserve the historical 0.3.x GET-query behavior.\n\t */\n\treadonly requestDelivery?: RequestDelivery;\n\t/**\n\t * For `requestDelivery: \"request_uri\"`: the publicly-reachable URL at\n\t * which the RP will host the signed Request Object JWT. REQUIRED in that\n\t * mode and ignored otherwise. The library does NOT host the JWT — the\n\t * caller must serve the returned `requestObjectJwt` at this URL with\n\t * Content-Type `application/oauth-authz-req+jwt`, typically with a short\n\t * TTL and single-use semantics.\n\t */\n\treadonly requestUri?: string;\n}\n\ninterface AutomaticRegistrationResultBase {\n\treadonly requestObjectJwt: string;\n\treadonly trustChain: ValidatedTrustChain;\n\treadonly trustChainExpiresAt: number;\n}\n\n/**\n * Discriminated union over `delivery`. Each variant carries exactly the\n * additional fields the caller needs to dispatch the Request Object.\n */\nexport type AutomaticRegistrationResult =\n\t| (AutomaticRegistrationResultBase & {\n\t\t\treadonly delivery: \"query\";\n\t\t\t/** Full authorization-endpoint URL with `?request=…&client_id=…`. Redirect the user-agent here. */\n\t\t\treadonly authorizationUrl: string;\n\t })\n\t| (AutomaticRegistrationResultBase & {\n\t\t\treadonly delivery: \"form_post\";\n\t\t\t/** Bare authorization-endpoint URL. POST `formParams` here. */\n\t\t\treadonly authorizationEndpoint: string;\n\t\t\t/** Form fields to submit as `application/x-www-form-urlencoded` body. */\n\t\t\treadonly formParams: Record;\n\t })\n\t| (AutomaticRegistrationResultBase & {\n\t\t\treadonly delivery: \"request_uri\";\n\t\t\t/** Echoes the caller-supplied URI; cache the `requestObjectJwt` under this URL. */\n\t\t\treadonly requestUri: string;\n\t\t\t/** Full authorization-endpoint URL with `?request_uri=…&client_id=…`. Redirect the user-agent here. */\n\t\t\treadonly authorizationUrl: string;\n\t })\n\t| (AutomaticRegistrationResultBase & {\n\t\t\treadonly delivery: \"par\";\n\t\t\t/** PAR endpoint URL the library POSTed to. */\n\t\t\treadonly pushedAuthorizationRequestEndpoint: string;\n\t\t\t/** Full authorization-endpoint URL with `?request_uri=urn:…&client_id=…`. Redirect the user-agent here. */\n\t\t\treadonly authorizationUrl: string;\n\t\t\t/** The `urn:`-style request URI returned by the PAR endpoint. */\n\t\t\treadonly parRequestUri: string;\n\t\t\t/** Absolute expiration time (seconds since epoch) computed from the PAR `expires_in` response. */\n\t\t\treadonly parExpiresAt: number;\n\t });\n\n/**\n * RP-side automatic registration: build a Request Object JWT and authorization URL.\n *\n * Accepts a `DiscoveryResult` (from `discoverEntity()`) to ensure the OP\n * has been validated through the federation before registration.\n */\nexport async function automaticRegistration(\n\tdiscovery: DiscoveryResult,\n\trpConfig: AutomaticRegistrationConfig,\n\tauthzRequestParams: Record,\n\ttrustAnchors: TrustAnchorSet,\n\toptions?: FederationOptions,\n): Promise> {\n\tconst sharedChains = await selectSharedRegistrationTrustChains(\n\t\trpConfig.entityId,\n\t\tdiscovery.entityId as EntityId,\n\t\tdiscovery.trustChain,\n\t\ttrustAnchors,\n\t\toptions,\n\t);\n\tif (!sharedChains.ok) return err(sharedChains.error);\n\n\tconst opMeta = sharedChains.value.opChain.resolvedMetadata.openid_provider as\n\t\t| Record\n\t\t| undefined;\n\tconst registrationTypes = getRegistrationTypes(opMeta);\n\tif (!registrationTypes.includes(ClientRegistrationType.Automatic)) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidRequest,\n\t\t\t\t\"OP does not support automatic registration\",\n\t\t\t),\n\t\t);\n\t}\n\n\tconst authorizationEndpoint = opMeta?.authorization_endpoint as string | undefined;\n\tif (!authorizationEndpoint) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidMetadata,\n\t\t\t\t\"OP has no authorization_endpoint in openid_provider metadata\",\n\t\t\t),\n\t\t);\n\t}\n\n\tconst requestObjectSigner = await rpConfig.protocolKeyProvider.getRequestObjectSigner();\n\tconst assertSignerResult = assertOidcSignerPublished(\n\t\trpConfig.metadata,\n\t\trequestObjectSigner,\n\t\t\"Request Object\",\n\t);\n\tif (!assertSignerResult.ok) {\n\t\treturn assertSignerResult;\n\t}\n\tconst now = nowSeconds(options?.clock);\n\n\tconst selectedChain = [...sharedChains.value.rpChainStatements];\n\tconst selectedTrustAnchorId = sharedChains.value.trustAnchorId;\n\n\t// Reserved claims must not be overwritten by caller-supplied params\n\tconst filteredParams: Record = {};\n\tfor (const [key, value] of Object.entries(authzRequestParams)) {\n\t\tif (!RESERVED_REQUEST_OBJECT_CLAIMS.has(key)) {\n\t\t\tfilteredParams[key] = value;\n\t\t}\n\t}\n\n\t// sub intentionally omitted — forbidden in automatic registration Request Objects\n\tconst payload: Record = {\n\t\tiss: rpConfig.entityId,\n\t\tclient_id: rpConfig.entityId,\n\t\taud: discovery.entityId,\n\t\tjti: crypto.randomUUID(),\n\t\tiat: now,\n\t\texp: now + (rpConfig.requestObjectTtlSeconds ?? DEFAULT_REQUEST_OBJECT_TTL_SECONDS),\n\t\t...filteredParams,\n\t};\n\n\tconst extraHeaders: Record = {};\n\tif (selectedChain.length > 0) {\n\t\textraHeaders.trust_chain = selectedChain;\n\t}\n\n\tif (rpConfig.includePeerTrustChain) {\n\t\tif (!selectedTrustAnchorId) {\n\t\t\treturn err(\n\t\t\t\tfederationError(\n\t\t\t\t\tInternalErrorCode.TrustAnchorUnknown,\n\t\t\t\t\t\"includePeerTrustChain requires a selected RP Trust Anchor; no valid RP chain was built\",\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t\tconst peerChainResult = await resolveTrustChainForAnchor(\n\t\t\tdiscovery.entityId as EntityId,\n\t\t\tselectedTrustAnchorId,\n\t\t\ttrustAnchors,\n\t\t\toptions,\n\t\t);\n\t\tif (!peerChainResult.ok) {\n\t\t\treturn err(\n\t\t\t\tfederationError(\n\t\t\t\t\tInternalErrorCode.TrustChainInvalid,\n\t\t\t\t\t`includePeerTrustChain: cannot build peer Trust Chain for ${discovery.entityId} ending at ${selectedTrustAnchorId}: ${peerChainResult.error.description}`,\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t\textraHeaders.peer_trust_chain = peerChainResult.value;\n\t}\n\n\tconst requestObjectJwt = await signEntityStatement(payload, requestObjectSigner, {\n\t\ttyp: RequestObjectTyp,\n\t\t...(Object.keys(extraHeaders).length > 0 ? { extraHeaders } : {}),\n\t});\n\n\tconst base: AutomaticRegistrationResultBase = {\n\t\trequestObjectJwt,\n\t\ttrustChain: sharedChains.value.opChain,\n\t\ttrustChainExpiresAt: sharedChains.value.opChain.expiresAt,\n\t};\n\n\tconst delivery: RequestDelivery = rpConfig.requestDelivery ?? \"form_post\";\n\tconst clientIdStr = rpConfig.entityId as string;\n\n\tswitch (delivery) {\n\t\tcase \"query\":\n\t\t\treturn ok({\n\t\t\t\t...base,\n\t\t\t\tdelivery: \"query\",\n\t\t\t\tauthorizationUrl: buildAuthorizationUrl(authorizationEndpoint, {\n\t\t\t\t\trequest: requestObjectJwt,\n\t\t\t\t\tclient_id: clientIdStr,\n\t\t\t\t}),\n\t\t\t});\n\n\t\tcase \"form_post\":\n\t\t\treturn ok({\n\t\t\t\t...base,\n\t\t\t\tdelivery: \"form_post\",\n\t\t\t\tauthorizationEndpoint,\n\t\t\t\tformParams: {\n\t\t\t\t\trequest: requestObjectJwt,\n\t\t\t\t\tclient_id: clientIdStr,\n\t\t\t\t},\n\t\t\t});\n\n\t\tcase \"request_uri\": {\n\t\t\tif (opMeta?.request_uri_parameter_supported === false) {\n\t\t\t\treturn err(\n\t\t\t\t\tfederationError(\n\t\t\t\t\t\tFederationErrorCode.InvalidRequest,\n\t\t\t\t\t\t\"requestDelivery 'request_uri' requires the OP to support the request_uri parameter\",\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst hostedUri = rpConfig.requestUri;\n\t\t\tif (!hostedUri) {\n\t\t\t\treturn err(\n\t\t\t\t\tfederationError(\n\t\t\t\t\t\tFederationErrorCode.InvalidRequest,\n\t\t\t\t\t\t\"requestDelivery 'request_uri' requires rpConfig.requestUri to be set to the URL at which the RP will host the Request Object JWT\",\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (!hostedUri.startsWith(\"https://\")) {\n\t\t\t\treturn err(\n\t\t\t\t\tfederationError(\n\t\t\t\t\t\tFederationErrorCode.InvalidRequest,\n\t\t\t\t\t\t\"rpConfig.requestUri must be an https:// URL\",\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t}\n\t\t\treturn ok({\n\t\t\t\t...base,\n\t\t\t\tdelivery: \"request_uri\",\n\t\t\t\trequestUri: hostedUri,\n\t\t\t\tauthorizationUrl: buildAuthorizationUrl(authorizationEndpoint, {\n\t\t\t\t\trequest_uri: hostedUri,\n\t\t\t\t\tclient_id: clientIdStr,\n\t\t\t\t}),\n\t\t\t});\n\t\t}\n\n\t\tcase \"par\": {\n\t\t\tconst parEndpoint = opMeta?.pushed_authorization_request_endpoint as string | undefined;\n\t\t\tif (!parEndpoint) {\n\t\t\t\treturn err(\n\t\t\t\t\tfederationError(\n\t\t\t\t\t\tFederationErrorCode.InvalidRequest,\n\t\t\t\t\t\t\"requestDelivery 'par' requires the OP to advertise pushed_authorization_request_endpoint in its openid_provider metadata\",\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst httpClient = options?.httpClient ?? fetch;\n\t\t\tconst clientAssertionSigner = rpConfig.protocolKeyProvider.getClientAssertionSigner\n\t\t\t\t? await rpConfig.protocolKeyProvider.getClientAssertionSigner()\n\t\t\t\t: requestObjectSigner;\n\n\t\t\tconst assertAssertionSignerResult = assertOidcSignerPublished(\n\t\t\t\trpConfig.metadata,\n\t\t\t\tclientAssertionSigner,\n\t\t\t\t\"client assertion\",\n\t\t\t);\n\t\t\tif (!assertAssertionSignerResult.ok) {\n\t\t\t\treturn err(assertAssertionSignerResult.error);\n\t\t\t}\n\n\t\t\t// Client assertion audience is the OP's Entity Identifier under the\n\t\t\t// federation profile of PAR + automatic registration — not the PAR\n\t\t\t// endpoint URL.\n\t\t\tconst clientAssertion = await createClientAssertion(\n\t\t\t\trpConfig.entityId as string,\n\t\t\t\tdiscovery.entityId as string,\n\t\t\t\tclientAssertionSigner,\n\t\t\t\t{\n\t\t\t\t\texpiresInSeconds: 60,\n\t\t\t\t\t...(options?.clock ? { clock: options.clock } : {}),\n\t\t\t\t},\n\t\t\t);\n\t\t\tconst formBody = new URLSearchParams({\n\t\t\t\trequest: requestObjectJwt,\n\t\t\t\tclient_id: clientIdStr,\n\t\t\t\tclient_assertion_type: CLIENT_ASSERTION_TYPE,\n\t\t\t\tclient_assertion: clientAssertion,\n\t\t\t}).toString();\n\t\t\tconst response = await httpClient(parEndpoint, {\n\t\t\t\tmethod: \"POST\",\n\t\t\t\theaders: {\n\t\t\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\t\t\tAccept: \"application/json\",\n\t\t\t\t},\n\t\t\t\tbody: formBody,\n\t\t\t});\n\t\t\tif (response.status !== 201 && response.status !== 200) {\n\t\t\t\treturn err(\n\t\t\t\t\tfederationError(\n\t\t\t\t\t\tInternalErrorCode.Network,\n\t\t\t\t\t\t`PAR request failed (HTTP ${response.status})`,\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst parPayload = (await response.json()) as Record;\n\t\t\tconst parRequestUri = parPayload.request_uri;\n\t\t\tconst expiresIn = parPayload.expires_in;\n\t\t\tif (typeof parRequestUri !== \"string\" || !parRequestUri.startsWith(\"urn:\")) {\n\t\t\t\treturn err(\n\t\t\t\t\tfederationError(InternalErrorCode.Network, \"PAR response missing or invalid request_uri\"),\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (typeof expiresIn !== \"number\" || expiresIn <= 0) {\n\t\t\t\treturn err(\n\t\t\t\t\tfederationError(InternalErrorCode.Network, \"PAR response missing or invalid expires_in\"),\n\t\t\t\t);\n\t\t\t}\n\t\t\treturn ok({\n\t\t\t\t...base,\n\t\t\t\tdelivery: \"par\",\n\t\t\t\tpushedAuthorizationRequestEndpoint: parEndpoint,\n\t\t\t\tauthorizationUrl: buildAuthorizationUrl(authorizationEndpoint, {\n\t\t\t\t\trequest_uri: parRequestUri,\n\t\t\t\t\tclient_id: clientIdStr,\n\t\t\t\t}),\n\t\t\t\tparRequestUri,\n\t\t\t\tparExpiresAt: nowSeconds(options?.clock) + expiresIn,\n\t\t\t});\n\t\t}\n\t}\n}\n\nfunction buildAuthorizationUrl(endpoint: string, params: Record): string {\n\tconst url = new URL(endpoint);\n\tfor (const [key, value] of Object.entries(params)) {\n\t\turl.searchParams.set(key, value);\n\t}\n\treturn url.toString();\n}\n\nfunction assertOidcSignerPublished(\n\tmetadata: Record>,\n\tsigner: JwtSigner,\n\tpurpose: string,\n): Result {\n\tconst type = metadata.openid_relying_party ? \"openid_relying_party\" : \"oauth_client\";\n\tconst rpMetadata = metadata[type];\n\tif (!rpMetadata) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidRequest,\n\t\t\t\t\"metadata.openid_relying_party or metadata.oauth_client is required for automatic registration\",\n\t\t\t),\n\t\t);\n\t}\n\n\tconst inlineJwks = rpMetadata.jwks as { keys?: Array<{ kid?: unknown }> } | undefined;\n\tconst hasInlineJwks = inlineJwks !== undefined;\n\tconst hasUriPublication =\n\t\ttypeof rpMetadata.jwks_uri === \"string\" || typeof rpMetadata.signed_jwks_uri === \"string\";\n\n\tif (hasInlineJwks) {\n\t\tconst keys = inlineJwks.keys;\n\t\tif (!Array.isArray(keys)) {\n\t\t\treturn err(\n\t\t\t\tfederationError(\n\t\t\t\t\tFederationErrorCode.InvalidRequest,\n\t\t\t\t\t`metadata.${type}.jwks must be a JWK Set`,\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t\tif (!keys.some((key) => key.kid === signer.kid)) {\n\t\t\treturn err(\n\t\t\t\tfederationError(\n\t\t\t\t\tFederationErrorCode.InvalidRequest,\n\t\t\t\t\t`OIDC ${purpose} signer kid '${signer.kid}' is not published in metadata.${type}.jwks`,\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t\treturn ok(undefined);\n\t}\n\n\tif (!hasUriPublication) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidRequest,\n\t\t\t\t`metadata.${type} must publish OIDC protocol keys with jwks, jwks_uri, or signed_jwks_uri`,\n\t\t\t),\n\t\t);\n\t}\n\n\treturn ok(undefined);\n}\n","/**\n * Error codes for OIDC-specific federation registration errors.\n * These error codes are used in authorization error responses.\n *\n * These errors should only be returned in PAR responses, not in redirected\n * authorization error responses, to avoid leaking federation internals to the User-Agent.\n */\nexport const OIDCRegistrationErrorCode = {\n\tInvalidTrustAnchor: \"invalid_trust_anchor\",\n\tInvalidTrustChain: \"invalid_trust_chain\",\n\tInvalidMetadata: \"invalid_metadata\",\n} as const;\nexport type OIDCRegistrationErrorCode =\n\t(typeof OIDCRegistrationErrorCode)[keyof typeof OIDCRegistrationErrorCode];\n\n/** JWT `typ` header value for OAuth 2.0 Authorization Request Objects */\nexport const RequestObjectTyp = \"oauth-authz-req+jwt\" as const;\n\n/** Client registration types advertised by an OP in `client_registration_types_supported`. */\nexport const ClientRegistrationType = {\n\tAutomatic: \"automatic\",\n\tExplicit: \"explicit\",\n} as const;\nexport type ClientRegistrationType =\n\t(typeof ClientRegistrationType)[keyof typeof ClientRegistrationType];\n\n/** JWT `typ` header value for an explicit-registration response. */\nexport const OIDC_JWT_TYP_EXPLICIT_REGISTRATION_RESPONSE = \"explicit-registration-response+jwt\";\n\n/** HTTP `Content-Type` value for an explicit-registration response. */\nexport const OIDC_MEDIA_TYPE_EXPLICIT_REGISTRATION_RESPONSE =\n\t\"application/explicit-registration-response+jwt\";\n","import {\n\ttype EntityId,\n\tentityId,\n\terr,\n\ttype FederationError,\n\tFederationErrorCode,\n\ttype FederationOptions,\n\tfederationError,\n\tok,\n\ttype Result,\n\tresolveTrustChains,\n\tshortestChain,\n\ttype TrustAnchorSet,\n\ttype ValidatedTrustChain,\n\tvalidateTrustChain,\n} from \"@oidfed/core\";\n\n/** Extracts `client_registration_types_supported` from OP metadata. */\nexport function getRegistrationTypes(opMeta: Record | undefined): string[] {\n\treturn (opMeta?.client_registration_types_supported as string[] | undefined) ?? [];\n}\n\nconst REQUIRED_TRUST_ANCHORS_MESSAGE =\n\t\"OP-side registration requires a non-empty Trust Anchor set.\";\n\ntype TrustAnchorConfig = TrustAnchorSet extends ReadonlyMap ? Config : never;\n\nexport function parseTrustChainJsonBody(body: string): Result {\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(body);\n\t} catch {\n\t\treturn err(\n\t\t\tfederationError(FederationErrorCode.InvalidRequest, \"Invalid trust-chain+json body\"),\n\t\t);\n\t}\n\n\tif (\n\t\t!Array.isArray(parsed) ||\n\t\tparsed.length === 0 ||\n\t\t!parsed.every((statement) => typeof statement === \"string\")\n\t) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidRequest,\n\t\t\t\t\"trust-chain+json must be a non-empty array of JWT strings\",\n\t\t\t),\n\t\t);\n\t}\n\n\treturn ok(parsed);\n}\n\nexport function requireNonEmptyTrustAnchors(\n\ttrustAnchors: TrustAnchorSet | undefined,\n): Result {\n\tif (!trustAnchors || trustAnchors.size === 0) {\n\t\treturn err(\n\t\t\tfederationError(FederationErrorCode.InvalidTrustChain, REQUIRED_TRUST_ANCHORS_MESSAGE),\n\t\t);\n\t}\n\tconst normalized = new Map();\n\tfor (const [anchorId, config] of trustAnchors) {\n\t\ttry {\n\t\t\tnormalized.set(entityId(anchorId), config);\n\t\t} catch (cause) {\n\t\t\treturn err(\n\t\t\t\tfederationError(\n\t\t\t\t\tFederationErrorCode.InvalidTrustChain,\n\t\t\t\t\t`Invalid Trust Anchor entity ID '${anchorId}'.`,\n\t\t\t\t\tcause,\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t}\n\treturn ok(normalized);\n}\n\nexport function assertNonEmptyTrustAnchors(\n\ttrustAnchors: TrustAnchorSet | undefined,\n): TrustAnchorSet {\n\tconst result = requireNonEmptyTrustAnchors(trustAnchors);\n\tif (!result.ok) {\n\t\tthrow new Error(result.error.description);\n\t}\n\treturn result.value;\n}\n\nexport async function validateSuppliedTrustChain(\n\tchain: readonly string[] | undefined,\n\ttrustAnchors: TrustAnchorSet,\n\toptions: FederationOptions & {\n\t\treadonly expectedSubject: EntityId;\n\t\treadonly label: string;\n\t\treadonly explicitRegistrationAudience?: EntityId;\n\t},\n): Promise> {\n\tif (!Array.isArray(chain) || chain.length === 0 || !chain.every((s) => typeof s === \"string\")) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidTrustChain,\n\t\t\t\t`${options.label} must be a non-empty array of JWT strings`,\n\t\t\t),\n\t\t);\n\t}\n\n\tconst validation = await validateTrustChain(chain, trustAnchors, {\n\t\t...options,\n\t\tverboseErrors: true,\n\t\t...(options.explicitRegistrationAudience !== undefined\n\t\t\t? { explicitRegistrationAudience: options.explicitRegistrationAudience }\n\t\t\t: {}),\n\t});\n\tif (!validation.valid) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidTrustChain,\n\t\t\t\t`${options.label} validation failed: ${validation.errors[0]?.message ?? \"unknown error\"}`,\n\t\t\t),\n\t\t);\n\t}\n\n\tif (validation.chain.entityId !== options.expectedSubject) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidTrustChain,\n\t\t\t\t`${options.label} subject '${validation.chain.entityId}' does not match expected subject '${options.expectedSubject}'`,\n\t\t\t),\n\t\t);\n\t}\n\n\treturn ok(validation.chain);\n}\n\ntype ValidRegistrationChain = {\n\treadonly statements: readonly string[];\n\treadonly chain: ValidatedTrustChain;\n};\n\nexport interface SharedRegistrationTrustChains {\n\treadonly rpChainStatements: readonly string[];\n\treadonly rpChain: ValidatedTrustChain;\n\treadonly opChain: ValidatedTrustChain;\n\treadonly trustAnchorId: EntityId;\n}\n\nfunction shortestRegistrationChain(\n\tchains: readonly ValidRegistrationChain[],\n): ValidRegistrationChain {\n\tconst selected = chains\n\t\t.slice()\n\t\t.sort((a, b) => a.chain.statements.length - b.chain.statements.length)[0];\n\tif (!selected) throw new Error(\"No registration trust chains available\");\n\treturn selected;\n}\n\nasync function resolveValidRegistrationChains(\n\tsubject: EntityId,\n\ttrustAnchors: TrustAnchorSet,\n\toptions: FederationOptions | undefined,\n\tlabel: string,\n): Promise> {\n\tconst chainResult = await resolveTrustChains(subject, trustAnchors, options);\n\n\tif (chainResult.chains.length === 0) {\n\t\tconst errorMsgs = chainResult.errors.map((e) => e.description).join(\"; \");\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidTrustChain,\n\t\t\t\t`Failed to resolve trust chain for ${label}: ${errorMsgs || \"no chains found\"}`,\n\t\t\t),\n\t\t);\n\t}\n\n\tconst validChains: ValidRegistrationChain[] = [];\n\tfor (const chain of chainResult.chains) {\n\t\tconst validation = await validateTrustChain(chain.statements, trustAnchors, options);\n\t\tif (validation.valid) {\n\t\t\tvalidChains.push({ statements: chain.statements, chain: validation.chain });\n\t\t}\n\t}\n\n\tif (validChains.length === 0) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidTrustChain,\n\t\t\t\t`No valid trust chains found for ${label}`,\n\t\t\t),\n\t\t);\n\t}\n\n\treturn ok(validChains);\n}\n\nexport async function selectSharedRegistrationTrustChains(\n\trpEntityId: EntityId,\n\topEntityId: EntityId,\n\tpreferredOpChain: ValidatedTrustChain,\n\ttrustAnchors: TrustAnchorSet,\n\toptions?: FederationOptions,\n): Promise> {\n\tconst rpChainsResult = await resolveValidRegistrationChains(\n\t\trpEntityId,\n\t\ttrustAnchors,\n\t\toptions,\n\t\t\"RP\",\n\t);\n\tif (!rpChainsResult.ok) return rpChainsResult;\n\n\tconst preferredRpChains = rpChainsResult.value.filter(\n\t\t(candidate) => candidate.chain.trustAnchorId === preferredOpChain.trustAnchorId,\n\t);\n\tif (preferredRpChains.length > 0) {\n\t\tconst rpChain = shortestRegistrationChain(preferredRpChains);\n\t\treturn ok({\n\t\t\trpChainStatements: rpChain.statements,\n\t\t\trpChain: rpChain.chain,\n\t\t\topChain: preferredOpChain,\n\t\t\ttrustAnchorId: preferredOpChain.trustAnchorId,\n\t\t});\n\t}\n\n\tconst opChainsResult = await resolveValidRegistrationChains(\n\t\topEntityId,\n\t\ttrustAnchors,\n\t\toptions,\n\t\t\"OP\",\n\t);\n\tif (!opChainsResult.ok) return opChainsResult;\n\n\tfor (const rpChain of rpChainsResult.value) {\n\t\tconst matchingOpChains = opChainsResult.value.filter(\n\t\t\t(candidate) => candidate.chain.trustAnchorId === rpChain.chain.trustAnchorId,\n\t\t);\n\t\tif (matchingOpChains.length > 0) {\n\t\t\tconst opChain = shortestRegistrationChain(matchingOpChains);\n\t\t\treturn ok({\n\t\t\t\trpChainStatements: rpChain.statements,\n\t\t\t\trpChain: rpChain.chain,\n\t\t\t\topChain: opChain.chain,\n\t\t\t\ttrustAnchorId: rpChain.chain.trustAnchorId,\n\t\t\t});\n\t\t}\n\t}\n\n\treturn err(\n\t\tfederationError(\n\t\t\tFederationErrorCode.InvalidTrustAnchor,\n\t\t\t\"No shared Trust Anchor between RP and OP\",\n\t\t),\n\t);\n}\n\n/**\n * Resolve trust chains for an entity and return the shortest valid chain.\n *\n * Shared by automatic and explicit registration flows.\n */\nexport async function resolveAndValidateBestChain(\n\trpEntityId: EntityId,\n\ttrustAnchors: TrustAnchorSet,\n\toptions: FederationOptions,\n): Promise> {\n\tconst chainResult = await resolveTrustChains(rpEntityId, trustAnchors, options);\n\n\tif (chainResult.chains.length === 0) {\n\t\tconst errorMsgs = chainResult.errors.map((e) => e.description).join(\"; \");\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidTrustChain,\n\t\t\t\t`Failed to resolve trust chain for RP: ${errorMsgs || \"no chains found\"}`,\n\t\t\t),\n\t\t);\n\t}\n\n\tconst validChains: ValidatedTrustChain[] = [];\n\tfor (const chain of chainResult.chains) {\n\t\tconst result = await validateTrustChain(chain.statements, trustAnchors, options);\n\t\tif (result.valid) {\n\t\t\tvalidChains.push(result.chain);\n\t\t}\n\t}\n\n\tif (validChains.length === 0) {\n\t\treturn err(\n\t\t\tfederationError(FederationErrorCode.InvalidTrustChain, \"No valid trust chains found for RP\"),\n\t\t);\n\t}\n\n\treturn ok(shortestChain(validChains));\n}\n","import {\n\tDEFAULT_ENTITY_STATEMENT_TTL_SECONDS,\n\ttype DiscoveryResult,\n\tdecodeEntityStatement,\n\ttype EntityId,\n\terr,\n\tFederationErrorCode,\n\ttype FederationKeyProvider,\n\ttype FederationOptions,\n\tfederationError,\n\tInternalErrorCode,\n\tisExactContentType,\n\tJwtTyp,\n\tMediaType,\n\tnowSeconds,\n\tok,\n\ttype ParsedEntityStatement,\n\ttype Result,\n\tresolveTrustChainForAnchor,\n\tsignEntityStatement,\n\ttype TrustAnchorSet,\n\tvalidateFederationKeySet,\n\tverifyEntityStatement,\n} from \"@oidfed/core\";\nimport {\n\tClientRegistrationType,\n\tOIDC_JWT_TYP_EXPLICIT_REGISTRATION_RESPONSE,\n\tOIDC_MEDIA_TYPE_EXPLICIT_REGISTRATION_RESPONSE,\n} from \"../constants.js\";\nimport { OpenIDRelyingPartyRegistrationResponseMetadataSchema } from \"../schemas/metadata.js\";\nimport { getRegistrationTypes, selectSharedRegistrationTrustChains } from \"./helpers.js\";\n\nexport interface ExplicitRegistrationConfig {\n\treadonly entityId: EntityId;\n\treadonly keyProvider: FederationKeyProvider;\n\treadonly authorityHints: readonly [EntityId, ...EntityId[]];\n\treadonly metadata: Record>;\n\treadonly entityConfigurationTtlSeconds?: number;\n\treadonly trustMarks?: ReadonlyArray>;\n\t/**\n\t * When true, attach the peer_trust_chain JWS header — a Trust Chain for\n\t * the OP that ends at the same Trust Anchor as the RP chain. Disabled by\n\t * default; set to true only when the RP wants the OP to use the\n\t * metadata/policy values from the RP-built peer chain (Federation /\n\t * Metadata Integrity properties). The library throws if the peer chain\n\t * to the shared Trust Anchor cannot be built. The current emit path\n\t * always sends an Entity Configuration JWT body (never a Trust-Chain\n\t * JSON body), so the mutual-exclusion rule between peer_trust_chain\n\t * and Trust-Chain-JSON request body is structurally satisfied here;\n\t * do NOT add a Trust-Chain-JSON body shape without also refusing this\n\t * option in that branch.\n\t */\n\treadonly includePeerTrustChain?: boolean;\n}\n\nexport interface ExplicitRegistrationResult {\n\treadonly registrationStatement: ParsedEntityStatement;\n\treadonly clientId: string;\n\treadonly clientSecret?: string;\n\treadonly expiresAt: number;\n\treadonly registeredMetadata: Readonly>;\n\t/** Trust chain expiration — RP must not use the registration past this time. */\n\treadonly trustChainExpiresAt: number;\n}\n\n/**\n * RP-side explicit registration: POST Entity Configuration to OP's\n * federation_registration_endpoint and process the response.\n *\n * Accepts a `DiscoveryResult` (from `discoverEntity()`) to ensure the OP\n * has been validated through the federation before registration.\n */\nexport async function explicitRegistration(\n\tdiscovery: DiscoveryResult,\n\trpConfig: ExplicitRegistrationConfig,\n\ttrustAnchors: TrustAnchorSet,\n\toptions?: FederationOptions,\n): Promise> {\n\tconst sharedChains = await selectSharedRegistrationTrustChains(\n\t\trpConfig.entityId,\n\t\tdiscovery.entityId as EntityId,\n\t\tdiscovery.trustChain,\n\t\ttrustAnchors,\n\t\toptions,\n\t);\n\tif (!sharedChains.ok) return err(sharedChains.error);\n\n\tconst opMeta = sharedChains.value.opChain.resolvedMetadata.openid_provider as\n\t\t| Record\n\t\t| undefined;\n\tconst registrationTypes = getRegistrationTypes(opMeta);\n\tif (!registrationTypes.includes(ClientRegistrationType.Explicit)) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidRequest,\n\t\t\t\t\"OP does not support explicit registration\",\n\t\t\t),\n\t\t);\n\t}\n\n\tconst registrationEndpoint = opMeta?.federation_registration_endpoint as string | undefined;\n\tif (!registrationEndpoint) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidMetadata,\n\t\t\t\t\"OP has no federation_registration_endpoint in openid_provider metadata\",\n\t\t\t),\n\t\t);\n\t}\n\n\tconst selectedTrustAnchorId = sharedChains.value.trustAnchorId;\n\tconst authorityHints = rpConfig.authorityHints;\n\n\tconst keySet = await rpConfig.keyProvider.getFederationKeySet();\n\tvalidateFederationKeySet(keySet);\n\tconst now = nowSeconds(options?.clock);\n\tconst ttl = rpConfig.entityConfigurationTtlSeconds ?? DEFAULT_ENTITY_STATEMENT_TTL_SECONDS;\n\tconst rpChainStatements = [...sharedChains.value.rpChainStatements];\n\n\tconst ecPayload: Record = {\n\t\tiss: rpConfig.entityId,\n\t\tsub: rpConfig.entityId,\n\t\taud: discovery.entityId,\n\t\tiat: now,\n\t\texp: now + ttl,\n\t\tjwks: keySet.jwks,\n\t\tauthority_hints: authorityHints,\n\t\tmetadata: rpConfig.metadata,\n\t};\n\n\tif (rpConfig.trustMarks && rpConfig.trustMarks.length > 0) {\n\t\tecPayload.trust_marks = rpConfig.trustMarks;\n\t}\n\n\tconst extraHeaders: Record = {};\n\tif (rpChainStatements.length > 0) {\n\t\textraHeaders.trust_chain = rpChainStatements;\n\t}\n\n\tif (rpConfig.includePeerTrustChain) {\n\t\tif (!selectedTrustAnchorId) {\n\t\t\treturn err(\n\t\t\t\tfederationError(\n\t\t\t\t\tInternalErrorCode.TrustAnchorUnknown,\n\t\t\t\t\t\"includePeerTrustChain requires a selected RP Trust Anchor; no valid RP chain was built\",\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t\tconst peerChainResult = await resolveTrustChainForAnchor(\n\t\t\tdiscovery.entityId as EntityId,\n\t\t\tselectedTrustAnchorId,\n\t\t\ttrustAnchors,\n\t\t\toptions,\n\t\t);\n\t\tif (!peerChainResult.ok) {\n\t\t\treturn err(\n\t\t\t\tfederationError(\n\t\t\t\t\tInternalErrorCode.TrustChainInvalid,\n\t\t\t\t\t`includePeerTrustChain: cannot build peer Trust Chain for ${discovery.entityId} ending at ${selectedTrustAnchorId}: ${peerChainResult.error.description}`,\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t\textraHeaders.peer_trust_chain = peerChainResult.value;\n\t}\n\n\tconst ecJwt = await signEntityStatement(ecPayload, keySet.signer, {\n\t\ttyp: JwtTyp.EntityStatement,\n\t\t...(Object.keys(extraHeaders).length > 0 ? { extraHeaders } : {}),\n\t});\n\n\tconst httpClient = options?.httpClient ?? fetch;\n\tconst request = new Request(registrationEndpoint, {\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": MediaType.EntityStatement,\n\t\t},\n\t\tbody: ecJwt,\n\t});\n\n\tconst response = await httpClient(request);\n\tif (response.status !== 200) {\n\t\t// Intentionally omit response body to avoid leaking OP internals\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tInternalErrorCode.Network,\n\t\t\t\t`Explicit registration failed (HTTP ${response.status})`,\n\t\t\t),\n\t\t);\n\t}\n\n\tconst responseContentType = response.headers.get(\"Content-Type\");\n\tif (!isExactContentType(responseContentType, OIDC_MEDIA_TYPE_EXPLICIT_REGISTRATION_RESPONSE)) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidRequest,\n\t\t\t\t`Explicit registration response Content-Type must be '${OIDC_MEDIA_TYPE_EXPLICIT_REGISTRATION_RESPONSE}'`,\n\t\t\t),\n\t\t);\n\t}\n\n\tconst responseJwt = await response.text();\n\n\t// Verify using the subordinate statement's JWKS (not the self-signed EC)\n\t// because the OP's signing key authority comes from its superior in the chain.\n\t// The subordinate statement about the OP is the one where sub === OP entity ID and iss !== sub.\n\t// In a properly-ordered chain [leaf_EC, sub_stmt_from_superior, ..., TA_EC],\n\t// this is always opStatements[1] for the OP's chain.\n\tconst opStatements = sharedChains.value.opChain.statements;\n\tconst subordinateStmt =\n\t\topStatements.length > 1\n\t\t\t? (opStatements[1] as (typeof opStatements)[0])\n\t\t\t: (opStatements[0] as (typeof opStatements)[0]);\n\tconst opJwks = subordinateStmt.payload.jwks;\n\n\tif (!opJwks) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tInternalErrorCode.TrustChainInvalid,\n\t\t\t\t\"OP trust chain has no JWKS — cannot verify registration response signature\",\n\t\t\t),\n\t\t);\n\t}\n\n\tconst verifyResult = await verifyEntityStatement(responseJwt, opJwks, {\n\t\texpectedTyp: OIDC_JWT_TYP_EXPLICIT_REGISTRATION_RESPONSE,\n\t\t...(options?.clock ? { clock: options.clock } : {}),\n\t\t...(options?.clockSkewSeconds !== undefined\n\t\t\t? { clockSkewSeconds: options.clockSkewSeconds }\n\t\t\t: {}),\n\t});\n\tif (!verifyResult.ok) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tInternalErrorCode.SignatureInvalid,\n\t\t\t\t\"Registration response signature verification failed\",\n\t\t\t),\n\t\t);\n\t}\n\n\tconst decoded = decodeEntityStatement(responseJwt);\n\tif (!decoded.ok) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tInternalErrorCode.TrustChainInvalid,\n\t\t\t\t\"Failed to decode registration response\",\n\t\t\t),\n\t\t);\n\t}\n\n\tif (decoded.value.header.typ !== OIDC_JWT_TYP_EXPLICIT_REGISTRATION_RESPONSE) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidRequest,\n\t\t\t\t`Invalid response typ: expected '${OIDC_JWT_TYP_EXPLICIT_REGISTRATION_RESPONSE}'`,\n\t\t\t),\n\t\t);\n\t}\n\n\tconst responsePayload = decoded.value.payload as Record;\n\n\tif (responsePayload.iss !== (discovery.entityId as string)) {\n\t\treturn err(\n\t\t\tfederationError(FederationErrorCode.InvalidIssuer, \"Response iss does not match OP\"),\n\t\t);\n\t}\n\n\tif (responsePayload.sub === undefined) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidSubject,\n\t\t\t\t\"Registration response missing required 'sub' claim\",\n\t\t\t),\n\t\t);\n\t}\n\n\tif (responsePayload.sub !== (rpConfig.entityId as string)) {\n\t\treturn err(\n\t\t\tfederationError(FederationErrorCode.InvalidSubject, \"Response sub does not match RP\"),\n\t\t);\n\t}\n\n\tif (responsePayload.aud !== (rpConfig.entityId as string)) {\n\t\treturn err(\n\t\t\tfederationError(FederationErrorCode.InvalidSubject, \"Response aud does not match RP\"),\n\t\t);\n\t}\n\n\t// iat and exp are REQUIRED in the registration response\n\tconst responseExp = responsePayload.exp as number | undefined;\n\tif (responseExp === undefined) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidRequest,\n\t\t\t\t\"Registration response missing required 'exp' claim\",\n\t\t\t),\n\t\t);\n\t}\n\tconst responseNow = nowSeconds(options?.clock);\n\tif (responseNow >= responseExp) {\n\t\treturn err(federationError(InternalErrorCode.Expired, \"Registration response has expired\"));\n\t}\n\n\tif (responsePayload.iat === undefined) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidRequest,\n\t\t\t\t\"Registration response missing required 'iat' claim\",\n\t\t\t),\n\t\t);\n\t}\n\n\tconst trustAnchor = responsePayload.trust_anchor as string | undefined;\n\tif (!trustAnchor || !trustAnchors.has(trustAnchor as EntityId)) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidTrustAnchor,\n\t\t\t\t\"Response trust_anchor is not in configured trust anchors\",\n\t\t\t),\n\t\t);\n\t}\n\n\tif (trustAnchor !== (selectedTrustAnchorId as string)) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidTrustAnchor,\n\t\t\t\t\"Response trust_anchor does not match OP trust chain root\",\n\t\t\t),\n\t\t);\n\t}\n\n\t// The response must name the Trust Anchor selected for both RP and OP chains.\n\n\tconst responseAuthorityHints = responsePayload.authority_hints as string[] | undefined;\n\tif (!Array.isArray(responseAuthorityHints) || responseAuthorityHints.length !== 1) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidMetadata,\n\t\t\t\t\"Response authority_hints MUST be a single-element array\",\n\t\t\t),\n\t\t);\n\t}\n\tfor (const hint of responseAuthorityHints) {\n\t\tif (typeof hint !== \"string\") {\n\t\t\treturn err(\n\t\t\t\tfederationError(\n\t\t\t\t\tFederationErrorCode.InvalidMetadata,\n\t\t\t\t\t\"Response authority_hints contains non-string value\",\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t}\n\tconst expectedAuthorityHint = expectedRegistrationAuthorityHint(\n\t\tsharedChains.value.rpChain,\n\t\tselectedTrustAnchorId,\n\t);\n\tif (responseAuthorityHints[0] !== expectedAuthorityHint) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidMetadata,\n\t\t\t\t\"Response authority_hints does not match selected RP trust chain\",\n\t\t\t),\n\t\t);\n\t}\n\n\tif (responseExp > sharedChains.value.rpChain.expiresAt) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidRequest,\n\t\t\t\t\"Registration response exp exceeds selected RP trust chain expiry\",\n\t\t\t),\n\t\t);\n\t}\n\n\tconst responseMeta = responsePayload.metadata as\n\t\t| Record>\n\t\t| undefined;\n\tif (!responseMeta || typeof responseMeta !== \"object\") {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidMetadata,\n\t\t\t\t\"Registration response missing required 'metadata' claim\",\n\t\t\t),\n\t\t);\n\t}\n\tconst requestedTypes = new Set(Object.keys(rpConfig.metadata));\n\tconst responseTypes = new Set(Object.keys(responseMeta));\n\tfor (const requestedType of requestedTypes) {\n\t\tif (!responseTypes.has(requestedType)) {\n\t\t\treturn err(\n\t\t\t\tfederationError(\n\t\t\t\t\tFederationErrorCode.InvalidMetadata,\n\t\t\t\t\t\"Response metadata missing requested entity type\",\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t}\n\tfor (const responseType of responseTypes) {\n\t\tif (!requestedTypes.has(responseType)) {\n\t\t\treturn err(\n\t\t\t\tfederationError(\n\t\t\t\t\tFederationErrorCode.InvalidMetadata,\n\t\t\t\t\t\"Response metadata contains unrequested entity type\",\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t}\n\n\tif (responsePayload.client_secret !== undefined) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidMetadata,\n\t\t\t\t\"Registration response client_secret MUST be under metadata.openid_relying_party\",\n\t\t\t),\n\t\t);\n\t}\n\n\tconst registeredMetadata = responseMeta.openid_relying_party;\n\tif (\n\t\t!registeredMetadata ||\n\t\ttypeof registeredMetadata !== \"object\" ||\n\t\tArray.isArray(registeredMetadata)\n\t) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidMetadata,\n\t\t\t\t\"Registration response metadata MUST contain openid_relying_party\",\n\t\t\t),\n\t\t);\n\t}\n\n\tconst registeredMetadataResult =\n\t\tOpenIDRelyingPartyRegistrationResponseMetadataSchema.safeParse(registeredMetadata);\n\tif (!registeredMetadataResult.success) {\n\t\tconst issuePaths = registeredMetadataResult.error.issues.map((issue) => issue.path.join(\".\"));\n\t\tif (issuePaths.some((path) => path === \"client_id\")) {\n\t\t\treturn err(\n\t\t\t\tfederationError(\n\t\t\t\t\tFederationErrorCode.InvalidMetadata,\n\t\t\t\t\t\"Registration response metadata.openid_relying_party.client_id is required\",\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t\tif (issuePaths.some((path) => path === \"client_secret\")) {\n\t\t\treturn err(\n\t\t\t\tfederationError(\n\t\t\t\t\tFederationErrorCode.InvalidMetadata,\n\t\t\t\t\t\"Registration response metadata.openid_relying_party.client_secret MUST be a string\",\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidMetadata,\n\t\t\t\t\"Registration response metadata.openid_relying_party is invalid\",\n\t\t\t),\n\t\t);\n\t}\n\n\tconst clientId = registeredMetadataResult.data.client_id;\n\tconst clientSecret = registeredMetadataResult.data.client_secret;\n\tconst clientSecretExpiresAt = registeredMetadataResult.data.client_secret_expires_at;\n\tif (clientSecret !== undefined && clientSecretExpiresAt !== undefined) {\n\t\tif (clientSecretExpiresAt < responseExp) {\n\t\t\treturn err(\n\t\t\t\tfederationError(\n\t\t\t\t\tFederationErrorCode.InvalidMetadata,\n\t\t\t\t\t\"Registration response client_secret_expires_at must not be earlier than response exp\",\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t}\n\n\tif (\n\t\tresponsePayload.jwks !== undefined &&\n\t\tJSON.stringify(responsePayload.jwks) !== JSON.stringify(keySet.jwks)\n\t) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidMetadata,\n\t\t\t\t\"Response jwks MUST be a verbatim copy of the request Entity Configuration jwks\",\n\t\t\t),\n\t\t);\n\t}\n\n\t// RP must not use the registration past trust chain expiry\n\tconst trustChainExpiresAt = sharedChains.value.rpChain.expiresAt;\n\n\tconst result: ExplicitRegistrationResult = {\n\t\tregistrationStatement: decoded.value,\n\t\tclientId,\n\t\texpiresAt: responsePayload.exp as number,\n\t\tregisteredMetadata,\n\t\ttrustChainExpiresAt,\n\t};\n\tif (clientSecret !== undefined) {\n\t\treturn ok({ ...result, clientSecret });\n\t}\n\treturn ok(result);\n}\n\nfunction expectedRegistrationAuthorityHint(\n\trpChain: { readonly statements: readonly { readonly payload: Record }[] },\n\ttrustAnchorId: EntityId,\n): string {\n\tconst superiorStatement = rpChain.statements[1];\n\tif (!superiorStatement) return trustAnchorId as string;\n\treturn superiorStatement.payload.iss as string;\n}\n","/** OP-side explicit registration endpoint handler (self-contained, no authority dep). */\nimport {\n\tDEFAULT_ENTITY_STATEMENT_TTL_SECONDS,\n\tDEFAULT_MAX_REQUEST_BODY_BYTES,\n\tdecodeEntityStatement,\n\ttype EntityId,\n\tentityId,\n\terrorResponse,\n\tFederationErrorCode,\n\ttype FederationKeyProvider,\n\ttype FederationOptions,\n\tisExactContentType,\n\tJwtTyp,\n\tjwtResponse,\n\tMediaType,\n\tnowSeconds,\n\treadBodyWithLimit,\n\trequireMethod,\n\tsignEntityStatement,\n\ttype TrustAnchorSet,\n\ttype ValidatedTrustChain,\n\tverifyEntityStatement,\n} from \"@oidfed/core\";\nimport {\n\tOIDC_JWT_TYP_EXPLICIT_REGISTRATION_RESPONSE,\n\tOIDC_MEDIA_TYPE_EXPLICIT_REGISTRATION_RESPONSE,\n} from \"../constants.js\";\nimport {\n\tExplicitRegistrationRequestPayloadSchema,\n\tExplicitRegistrationResponsePayloadSchema,\n} from \"../schemas/explicit-registration.js\";\nimport { OpenIDRelyingPartyMetadataSchema } from \"../schemas/metadata.js\";\nimport type { RegistrationProtocolAdapter } from \"./adapter-types.js\";\nimport {\n\tassertNonEmptyTrustAnchors,\n\tparseTrustChainJsonBody,\n\tresolveAndValidateBestChain,\n\tvalidateSuppliedTrustChain,\n} from \"./helpers.js\";\n\n/** OIDC default values applied when the RP omits standard fields. */\nconst OIDC_METADATA_DEFAULTS: Record = {\n\tresponse_types: [\"code\"],\n\tgrant_types: [\"authorization_code\"],\n\ttoken_endpoint_auth_method: \"client_secret_basic\",\n};\nconst REGISTRATION_MANAGEMENT_METADATA_FIELDS = [\n\t\"registration_access_token\",\n\t\"registration_client_uri\",\n] as const;\n\nexport interface ExplicitRegistrationHandlerConfig {\n\t/** The OP's Entity Identifier — used as the aud check target and as the issuer of the response. */\n\treadonly opEntityId: EntityId;\n\t/** Federation-only signing key provider used for the signed registration response. */\n\treadonly keyProvider: FederationKeyProvider;\n\t/** Non-empty trust anchors required for RP trust chain resolution. */\n\treadonly trustAnchors: TrustAnchorSet;\n\t/** TTL in seconds for the registration response JWT. Capped to chain expiry when a chain is resolved. */\n\treadonly registrationResponseTtlSeconds?: number;\n\t/** Optional protocol-specific adapter for metadata validation/enrichment. */\n\treadonly registrationProtocolAdapter?: RegistrationProtocolAdapter;\n\t/** Optional generator producing a client_secret embedded in the response. Returning undefined omits the field. */\n\treadonly generateClientSecret?: (sub: EntityId) => Promise;\n\t/** Optional late pre-commit hook fired after response preparation and before `onRegistration`. */\n\treadonly onRegistrationInvalidation?: (sub: EntityId) => Promise;\n\t/** Optional callback fired when dynamic registration completes successfully. */\n\treadonly onRegistration?: (\n\t\tsub: EntityId,\n\t\tclientMetadata: Record,\n\t\tclientSecret?: string,\n\t) => Promise;\n\t/** Federation-wide options (httpClient, clock, etc.). */\n\treadonly options?: FederationOptions;\n}\n\n/**\n * Build the OP-side `/federation_registration` endpoint handler.\n *\n * The handler validates an Explicit Registration Request (signed Entity Configuration\n * JWT body OR JSON Trust Chain body), resolves the RP's trust chain, optionally runs\n * a protocol-specific adapter, and returns a signed Explicit Registration Response.\n */\nexport function createExplicitRegistrationHandler(\n\tconfig: ExplicitRegistrationHandlerConfig,\n): (request: Request) => Promise {\n\tconst trustAnchors = assertNonEmptyTrustAnchors(config.trustAnchors);\n\n\treturn async (request: Request) => {\n\t\tconst methodError = requireMethod(request, \"POST\");\n\t\tif (methodError) return methodError;\n\n\t\tconst contentType = request.headers.get(\"Content-Type\");\n\t\tconst isEntityStatementBody = isExactContentType(contentType, MediaType.EntityStatement);\n\t\tconst isTrustChainBody = isExactContentType(contentType, MediaType.TrustChain);\n\t\tif (!isEntityStatementBody && !isTrustChainBody) {\n\t\t\treturn errorResponse(\n\t\t\t\t400,\n\t\t\t\t\"invalid_request\",\n\t\t\t\t\"Content-Type must be exactly application/entity-statement+jwt or application/trust-chain+json\",\n\t\t\t);\n\t\t}\n\n\t\tconst read = await readBodyWithLimit(request, DEFAULT_MAX_REQUEST_BODY_BYTES);\n\t\tif (!read.ok) return errorResponse(413, \"invalid_request\", \"Request body too large\");\n\t\tconst body = read.text;\n\t\tif (!body) return errorResponse(400, \"invalid_request\", \"Missing request body\");\n\n\t\tlet ecJwt: string;\n\t\tlet suppliedBodyTrustChain: readonly string[] | undefined;\n\t\tif (isTrustChainBody) {\n\t\t\tconst parseResult = parseTrustChainJsonBody(body);\n\t\t\tif (!parseResult.ok) {\n\t\t\t\treturn errorResponse(400, parseResult.error.code, parseResult.error.description);\n\t\t\t}\n\t\t\tsuppliedBodyTrustChain = parseResult.value;\n\t\t\tecJwt = suppliedBodyTrustChain[0] as string;\n\t\t} else {\n\t\t\tecJwt = body;\n\t\t}\n\n\t\tconst decoded = decodeEntityStatement(ecJwt);\n\t\tif (!decoded.ok) {\n\t\t\treturn errorResponse(400, \"invalid_request\", \"Failed to decode request JWT\");\n\t\t}\n\n\t\tconst header = decoded.value.header;\n\t\tconst payload = decoded.value.payload as Record;\n\n\t\tif (header.typ !== JwtTyp.EntityStatement) {\n\t\t\treturn errorResponse(\n\t\t\t\t400,\n\t\t\t\t\"invalid_request\",\n\t\t\t\t`Invalid typ header: expected '${JwtTyp.EntityStatement}'`,\n\t\t\t);\n\t\t}\n\n\t\tconst parseResult = ExplicitRegistrationRequestPayloadSchema.safeParse(payload);\n\t\tif (!parseResult.success) {\n\t\t\treturn errorResponse(400, \"invalid_request\", \"Invalid registration request payload\");\n\t\t}\n\n\t\tconst reqPayload = parseResult.data;\n\n\t\tconst rpMetadataResult = OpenIDRelyingPartyMetadataSchema.safeParse(\n\t\t\treqPayload.metadata.openid_relying_party,\n\t\t);\n\t\tif (!rpMetadataResult.success) {\n\t\t\treturn errorResponse(\n\t\t\t\t400,\n\t\t\t\tFederationErrorCode.InvalidMetadata,\n\t\t\t\t\"RP metadata does not comply with the OpenID Connect Relying Party metadata schema\",\n\t\t\t);\n\t\t}\n\n\t\tconst aud = reqPayload.aud;\n\t\tif (aud !== config.opEntityId) {\n\t\t\treturn errorResponse(400, \"invalid_request\", \"aud MUST match the OP's Entity ID\");\n\t\t}\n\n\t\tconst selfVerify = await verifyEntityStatement(ecJwt, reqPayload.jwks, {\n\t\t\t...(config.options?.clock ? { clock: config.options.clock } : {}),\n\t\t\t...(config.options?.clockSkewSeconds !== undefined\n\t\t\t\t? { clockSkewSeconds: config.options.clockSkewSeconds }\n\t\t\t\t: {}),\n\t\t});\n\t\tif (!selfVerify.ok) {\n\t\t\treturn errorResponse(\n\t\t\t\t400,\n\t\t\t\t\"invalid_request\",\n\t\t\t\t\"Request JWT self-signature verification failed\",\n\t\t\t);\n\t\t}\n\n\t\tif (reqPayload.sub !== reqPayload.iss) {\n\t\t\treturn errorResponse(400, \"invalid_request\", \"RP Entity Configuration iss MUST equal sub\");\n\t\t}\n\n\t\tconst trustChainHeader = header.trust_chain as string[] | undefined;\n\t\tif (trustChainHeader && trustChainHeader.length > 0) {\n\t\t\tconst firstEntry = trustChainHeader[0] as string;\n\t\t\tconst firstDecoded = decodeEntityStatement(firstEntry);\n\t\t\tif (!firstDecoded.ok) {\n\t\t\t\treturn errorResponse(\n\t\t\t\t\t400,\n\t\t\t\t\tFederationErrorCode.InvalidTrustChain,\n\t\t\t\t\t\"Failed to decode first entry of trust_chain header\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst firstPayload = firstDecoded.value.payload as Record;\n\t\t\tif (firstPayload.iss !== reqPayload.sub || firstPayload.sub !== reqPayload.sub) {\n\t\t\t\treturn errorResponse(\n\t\t\t\t\t400,\n\t\t\t\t\tFederationErrorCode.InvalidTrustChain,\n\t\t\t\t\t\"First entry of trust_chain header MUST be the subject's Entity Configuration\",\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\tconst peerTrustChainHeader = header.peer_trust_chain as string[] | undefined;\n\n\t\t// peer_trust_chain MUST NOT appear when the request body is a Trust Chain.\n\t\tif (isTrustChainBody && peerTrustChainHeader !== undefined) {\n\t\t\treturn errorResponse(\n\t\t\t\t400,\n\t\t\t\t\"invalid_request\",\n\t\t\t\t\"peer_trust_chain MUST NOT be used when the request body is a Trust Chain\",\n\t\t\t);\n\t\t}\n\n\t\tif (peerTrustChainHeader && peerTrustChainHeader.length > 0) {\n\t\t\tconst peerFirstDecoded = decodeEntityStatement(peerTrustChainHeader[0] as string);\n\t\t\tif (!peerFirstDecoded.ok) {\n\t\t\t\treturn errorResponse(\n\t\t\t\t\t400,\n\t\t\t\t\tFederationErrorCode.InvalidTrustChain,\n\t\t\t\t\t\"Failed to decode first entry of peer_trust_chain header\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst peerFirstPayload = peerFirstDecoded.value.payload as Record;\n\t\t\tif (\n\t\t\t\tpeerFirstPayload.iss !== config.opEntityId ||\n\t\t\t\tpeerFirstPayload.sub !== config.opEntityId\n\t\t\t) {\n\t\t\t\treturn errorResponse(\n\t\t\t\t\t400,\n\t\t\t\t\tFederationErrorCode.InvalidTrustChain,\n\t\t\t\t\t\"First entry of peer_trust_chain header MUST be the OP's Entity Configuration\",\n\t\t\t\t);\n\t\t\t}\n\n\t\t\t// When both headers are present, both Trust Chains MUST end at the same TA.\n\t\t\t// Compare the headers directly (independent of any validation fallback below).\n\t\t\tif (trustChainHeader && trustChainHeader.length > 0) {\n\t\t\t\tconst rpHeaderLastDecoded = decodeEntityStatement(\n\t\t\t\t\ttrustChainHeader[trustChainHeader.length - 1] as string,\n\t\t\t\t);\n\t\t\t\tconst peerHeaderLastDecoded = decodeEntityStatement(\n\t\t\t\t\tpeerTrustChainHeader[peerTrustChainHeader.length - 1] as string,\n\t\t\t\t);\n\t\t\t\tif (!rpHeaderLastDecoded.ok || !peerHeaderLastDecoded.ok) {\n\t\t\t\t\treturn errorResponse(\n\t\t\t\t\t\t400,\n\t\t\t\t\t\tFederationErrorCode.InvalidTrustChain,\n\t\t\t\t\t\t\"Failed to decode last entry of trust_chain or peer_trust_chain header\",\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tconst rpHeaderTaId = (rpHeaderLastDecoded.value.payload as Record).iss as\n\t\t\t\t\t| string\n\t\t\t\t\t| undefined;\n\t\t\t\tconst peerHeaderTaId = (peerHeaderLastDecoded.value.payload as Record)\n\t\t\t\t\t.iss as string | undefined;\n\t\t\t\tif (rpHeaderTaId !== peerHeaderTaId) {\n\t\t\t\t\treturn errorResponse(\n\t\t\t\t\t\t400,\n\t\t\t\t\t\tFederationErrorCode.InvalidTrustChain,\n\t\t\t\t\t\t`peer_trust_chain Trust Anchor ('${peerHeaderTaId}') does not match trust_chain Trust Anchor ('${rpHeaderTaId}')`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tconst rpEntityId = entityId(reqPayload.sub);\n\t\tlet bestChain: ValidatedTrustChain | undefined;\n\n\t\tif (suppliedBodyTrustChain !== undefined) {\n\t\t\tconst bodyValidation = await validateSuppliedTrustChain(\n\t\t\t\tsuppliedBodyTrustChain,\n\t\t\t\ttrustAnchors,\n\t\t\t\t{\n\t\t\t\t\t...config.options,\n\t\t\t\t\texpectedSubject: rpEntityId,\n\t\t\t\t\texplicitRegistrationAudience: config.opEntityId,\n\t\t\t\t\tlabel: \"trust-chain+json\",\n\t\t\t\t},\n\t\t\t);\n\t\t\tif (!bodyValidation.ok) {\n\t\t\t\treturn errorResponse(400, bodyValidation.error.code, bodyValidation.error.description);\n\t\t\t}\n\t\t\tbestChain = bodyValidation.value;\n\t\t} else if (trustChainHeader !== undefined) {\n\t\t\tconst headerValidation = await validateSuppliedTrustChain(trustChainHeader, trustAnchors, {\n\t\t\t\t...config.options,\n\t\t\t\texpectedSubject: rpEntityId,\n\t\t\t\texplicitRegistrationAudience: config.opEntityId,\n\t\t\t\tlabel: \"trust_chain\",\n\t\t\t});\n\t\t\tif (!headerValidation.ok) {\n\t\t\t\treturn errorResponse(400, headerValidation.error.code, headerValidation.error.description);\n\t\t\t}\n\t\t\tbestChain = headerValidation.value;\n\t\t} else {\n\t\t\tconst chainResult = await resolveAndValidateBestChain(\n\t\t\t\trpEntityId,\n\t\t\t\ttrustAnchors,\n\t\t\t\tconfig.options ?? {},\n\t\t\t);\n\t\t\tif (!chainResult.ok) {\n\t\t\t\treturn errorResponse(403, chainResult.error.code, chainResult.error.description);\n\t\t\t}\n\t\t\tbestChain = chainResult.value;\n\t\t}\n\n\t\tlet peerResolvedOpMetadata: Readonly> | undefined;\n\t\tif (peerTrustChainHeader && peerTrustChainHeader.length > 0) {\n\t\t\tconst peerValidation = await validateSuppliedTrustChain(peerTrustChainHeader, trustAnchors, {\n\t\t\t\t...config.options,\n\t\t\t\texpectedSubject: config.opEntityId,\n\t\t\t\tlabel: \"peer_trust_chain\",\n\t\t\t});\n\t\t\tif (!peerValidation.ok) {\n\t\t\t\treturn errorResponse(\n\t\t\t\t\t400,\n\t\t\t\t\tFederationErrorCode.InvalidTrustChain,\n\t\t\t\t\tpeerValidation.error.description,\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (peerValidation.value.trustAnchorId !== bestChain.trustAnchorId) {\n\t\t\t\treturn errorResponse(\n\t\t\t\t\t400,\n\t\t\t\t\tFederationErrorCode.InvalidTrustChain,\n\t\t\t\t\t`peer_trust_chain Trust Anchor ('${peerValidation.value.trustAnchorId}') does not match selected RP Trust Anchor ('${bestChain.trustAnchorId}')`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tpeerResolvedOpMetadata = peerValidation.value.resolvedMetadata.openid_provider ?? {};\n\t\t}\n\n\t\tconst adapterContext =\n\t\t\tpeerResolvedOpMetadata !== undefined ? { peerResolvedOpMetadata } : undefined;\n\n\t\tlet validatedMetadata: Record | undefined;\n\t\tif (config.registrationProtocolAdapter && reqPayload.metadata) {\n\t\t\tconst metadataRecord = reqPayload.metadata as Record;\n\t\t\tconst adapterResult = config.registrationProtocolAdapter.validateClientMetadata(\n\t\t\t\tmetadataRecord,\n\t\t\t\tadapterContext,\n\t\t\t);\n\t\t\tif (!adapterResult.ok) {\n\t\t\t\treturn errorResponse(400, adapterResult.error.code, adapterResult.error.description);\n\t\t\t}\n\t\t\tvalidatedMetadata = adapterResult.value;\n\t\t}\n\n\t\tconst keySet = await config.keyProvider.getFederationKeySet();\n\t\tconst now = nowSeconds(config.options?.clock);\n\n\t\tconst trustAnchorId = bestChain.trustAnchorId as string;\n\n\t\tconst configuredTtl =\n\t\t\tconfig.registrationResponseTtlSeconds ?? DEFAULT_ENTITY_STATEMENT_TTL_SECONDS;\n\t\tlet registrationExp = now + configuredTtl;\n\t\tif (bestChain) {\n\t\t\tconst chainExp = bestChain.expiresAt;\n\t\t\tif (chainExp < registrationExp) {\n\t\t\t\tregistrationExp = chainExp;\n\t\t\t}\n\t\t}\n\n\t\tlet rpImmediateSuperior: string | undefined;\n\t\tif (bestChain && bestChain.statements.length > 1) {\n\t\t\tconst superiorStmt = bestChain.statements[1] as (typeof bestChain.statements)[0];\n\t\t\trpImmediateSuperior = superiorStmt.payload.iss as string;\n\t\t}\n\n\t\tconst responsePayload: Record = {\n\t\t\tiss: config.opEntityId,\n\t\t\tsub: reqPayload.sub,\n\t\t\taud: reqPayload.sub,\n\t\t\tiat: now,\n\t\t\texp: registrationExp,\n\t\t\ttrust_anchor: trustAnchorId,\n\t\t\tauthority_hints: rpImmediateSuperior ? [rpImmediateSuperior] : [trustAnchorId],\n\t\t};\n\n\t\tconst metadataForResponse = validatedMetadata ?? reqPayload.metadata;\n\t\tif (metadataForResponse) {\n\t\t\tconst responseMetadata = { ...(metadataForResponse as Record) };\n\t\t\tconst sourceRpMeta = (responseMetadata.openid_relying_party ?? {}) as Record;\n\t\t\tlet rpMeta: Record;\n\t\t\tif (config.registrationProtocolAdapter && bestChain) {\n\t\t\t\trpMeta = config.registrationProtocolAdapter.enrichResponseMetadata(\n\t\t\t\t\tsourceRpMeta,\n\t\t\t\t\tbestChain,\n\t\t\t\t\tadapterContext,\n\t\t\t\t);\n\t\t\t} else {\n\t\t\t\trpMeta = { ...sourceRpMeta };\n\t\t\t}\n\n\t\t\tif (!rpMeta.client_id) {\n\t\t\t\trpMeta.client_id = reqPayload.sub;\n\t\t\t}\n\n\t\t\tfor (const [key, defaultValue] of Object.entries(OIDC_METADATA_DEFAULTS)) {\n\t\t\t\tif (!(key in rpMeta)) {\n\t\t\t\t\trpMeta[key] = defaultValue;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tresponseMetadata.openid_relying_party = rpMeta;\n\t\t\tresponsePayload.metadata = responseMetadata;\n\t\t} else {\n\t\t\tresponsePayload.metadata = {\n\t\t\t\topenid_relying_party: {\n\t\t\t\t\tclient_id: reqPayload.sub,\n\t\t\t\t\t...OIDC_METADATA_DEFAULTS,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\tif (config.generateClientSecret) {\n\t\t\tconst clientSecret = await config.generateClientSecret(rpEntityId);\n\t\t\tif (clientSecret) {\n\t\t\t\tconst metadataRecord = responsePayload.metadata as Record;\n\t\t\t\tconst rpMeta = (metadataRecord.openid_relying_party ?? {}) as Record;\n\t\t\t\trpMeta.client_secret = clientSecret;\n\t\t\t\tmetadataRecord.openid_relying_party = rpMeta;\n\t\t\t\tresponsePayload.metadata = metadataRecord;\n\t\t\t}\n\t\t}\n\t\tconst metadataRecord = responsePayload.metadata as Record;\n\t\tconst rpMeta = (metadataRecord.openid_relying_party ?? {}) as Record;\n\t\tmetadataRecord.openid_relying_party = stripRegistrationManagementFields(rpMeta);\n\t\tresponsePayload.metadata = metadataRecord;\n\n\t\tconst responseValidation = ExplicitRegistrationResponsePayloadSchema.safeParse(responsePayload);\n\t\tif (!responseValidation.success) {\n\t\t\treturn errorResponse(\n\t\t\t\t500,\n\t\t\t\tFederationErrorCode.ServerError,\n\t\t\t\t\"Registration response metadata preparation failed\",\n\t\t\t);\n\t\t}\n\n\t\tconst responseJwt = await signEntityStatement(responsePayload, keySet.signer, {\n\t\t\ttyp: OIDC_JWT_TYP_EXPLICIT_REGISTRATION_RESPONSE,\n\t\t});\n\n\t\tif (config.onRegistrationInvalidation) {\n\t\t\ttry {\n\t\t\t\tawait config.onRegistrationInvalidation(rpEntityId);\n\t\t\t} catch {\n\t\t\t\treturn errorResponse(500, FederationErrorCode.ServerError, \"Registration hook failed\");\n\t\t\t}\n\t\t}\n\n\t\tif (config.onRegistration) {\n\t\t\tconst metadataRecord = responsePayload.metadata as Record;\n\t\t\tconst clientMetadata = (metadataRecord?.openid_relying_party ?? {}) as Record<\n\t\t\t\tstring,\n\t\t\t\tunknown\n\t\t\t>;\n\t\t\tconst clientSecret =\n\t\t\t\ttypeof clientMetadata.client_secret === \"string\" ? clientMetadata.client_secret : undefined;\n\t\t\ttry {\n\t\t\t\tawait config.onRegistration(rpEntityId, clientMetadata, clientSecret);\n\t\t\t} catch {\n\t\t\t\treturn errorResponse(500, FederationErrorCode.ServerError, \"Registration hook failed\");\n\t\t\t}\n\t\t}\n\n\t\treturn jwtResponse(responseJwt, OIDC_MEDIA_TYPE_EXPLICIT_REGISTRATION_RESPONSE);\n\t};\n}\n\nfunction stripRegistrationManagementFields(\n\tmetadata: Record,\n): Record {\n\tconst scrubbed = { ...metadata };\n\tfor (const field of REGISTRATION_MANAGEMENT_METADATA_FIELDS) {\n\t\tdelete scrubbed[field];\n\t}\n\treturn scrubbed;\n}\n","/** Zod schemas for explicit-registration request and response payloads. */\nimport {\n\tEntityIdSchema,\n\tFederationMetadataSchema,\n\tJWKSetSchema,\n\tTrustMarkRefSchema,\n} from \"@oidfed/core\";\nimport { z } from \"zod\";\nimport { OpenIDRelyingPartyRegistrationResponseMetadataSchema } from \"./metadata.js\";\n\n/** Explicit registration request payload. */\nexport const ExplicitRegistrationRequestPayloadSchema = z\n\t.looseObject({\n\t\tiss: EntityIdSchema,\n\t\tsub: EntityIdSchema,\n\t\taud: z.string(),\n\t\tiat: z.number().int().positive(),\n\t\texp: z.number().int().positive(),\n\t\tjwks: JWKSetSchema,\n\t\tauthority_hints: z.array(EntityIdSchema).min(1),\n\t\tmetadata: FederationMetadataSchema,\n\t\ttrust_marks: z.array(TrustMarkRefSchema).optional(),\n\t})\n\t.refine((obj) => obj.exp > obj.iat, {\n\t\tmessage: \"exp must be after iat\",\n\t\tpath: [\"exp\"],\n\t})\n\t.refine((obj) => obj.iss === obj.sub, {\n\t\tmessage: \"Registration request must be self-signed (iss === sub)\",\n\t})\n\t.refine(\n\t\t(obj) => {\n\t\t\tconst meta = obj.metadata as Record | undefined;\n\t\t\treturn meta !== undefined && \"openid_relying_party\" in meta;\n\t\t},\n\t\t{\n\t\t\tmessage: \"Explicit registration request metadata MUST contain 'openid_relying_party'\",\n\t\t\tpath: [\"metadata\"],\n\t\t},\n\t);\n\nconst ExplicitRegistrationResponseMetadataSchema = z\n\t.record(z.string(), z.record(z.string(), z.unknown()))\n\t.superRefine((metadata, ctx) => {\n\t\tconst result = OpenIDRelyingPartyRegistrationResponseMetadataSchema.safeParse(\n\t\t\tmetadata.openid_relying_party,\n\t\t);\n\t\tif (!result.success) {\n\t\t\tctx.addIssue({\n\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\tmessage: \"metadata.openid_relying_party must be valid registration response metadata\",\n\t\t\t\tpath: [\"openid_relying_party\"],\n\t\t\t});\n\t\t}\n\t});\n\n/** Explicit registration response payload. */\nexport const ExplicitRegistrationResponsePayloadSchema = z\n\t.looseObject({\n\t\tiss: EntityIdSchema,\n\t\tsub: EntityIdSchema,\n\t\taud: z.string(),\n\t\tiat: z.number().int().positive(),\n\t\texp: z.number().int().positive(),\n\t\tmetadata: ExplicitRegistrationResponseMetadataSchema,\n\t\ttrust_anchor: EntityIdSchema,\n\t\tauthority_hints: z.array(EntityIdSchema).length(1),\n\t})\n\t.refine((obj) => obj.exp > obj.iat, {\n\t\tmessage: \"exp must be after iat\",\n\t\tpath: [\"exp\"],\n\t})\n\t.refine((obj) => !(\"client_secret\" in obj), {\n\t\tmessage: \"client_secret MUST be nested under metadata.openid_relying_party\",\n\t\tpath: [\"client_secret\"],\n\t})\n\t.superRefine((obj, ctx) => {\n\t\tconst rpMetadata = obj.metadata.openid_relying_party as Record | undefined;\n\t\tif (\n\t\t\ttypeof rpMetadata?.client_secret === \"string\" &&\n\t\t\ttypeof rpMetadata.client_secret_expires_at === \"number\" &&\n\t\t\trpMetadata.client_secret_expires_at < obj.exp\n\t\t) {\n\t\t\tctx.addIssue({\n\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\tmessage: \"client_secret_expires_at must not be earlier than exp\",\n\t\t\t\tpath: [\"metadata\", \"openid_relying_party\", \"client_secret_expires_at\"],\n\t\t\t});\n\t\t}\n\t});\n\nexport type ExplicitRegistrationRequestPayload = z.infer<\n\ttypeof ExplicitRegistrationRequestPayloadSchema\n>;\nexport type ExplicitRegistrationResponsePayload = z.infer<\n\ttypeof ExplicitRegistrationResponsePayloadSchema\n>;\n","import {\n\ttype EntityId,\n\terr,\n\ttype FederationError,\n\tFederationErrorCode,\n\ttype FederationOptions,\n\tfederationError,\n\tInternalErrorCode,\n\tok,\n\ttype ReplayStore,\n\ttype Result,\n\tresolveEntityKeys,\n\ttype TrustAnchorSet,\n\ttype ValidatedTrustChain,\n\tverifyEntityStatement,\n} from \"@oidfed/core\";\nimport { RequestObjectTyp } from \"../constants.js\";\nimport {\n\trequireNonEmptyTrustAnchors,\n\tresolveAndValidateBestChain,\n\tvalidateSuppliedTrustChain,\n} from \"./helpers.js\";\nimport { validateAutomaticRegistrationRequest } from \"./validate-request-object.js\";\n\nexport interface ProcessedRegistration {\n\treadonly rpEntityId: EntityId;\n\treadonly resolvedRpMetadata: Readonly>;\n\treadonly trustChain: ValidatedTrustChain;\n\t/**\n\t * When the Request Object carried a `peer_trust_chain` JWS header, the\n\t * OP's resolved metadata as derived from the RP-supplied peer chain.\n\t * Integrators may use these RP-chosen values when creating the client\n\t * registration; the library validates structural integrity but does not\n\t * auto-apply the values.\n\t */\n\treadonly peerResolvedOpMetadata?: Readonly>;\n}\n\nexport interface ProcessAutomaticRegistrationOptions extends FederationOptions {\n\t/** The OP's own Entity Identifier — REQUIRED to prevent cross-OP replay via `aud` validation. */\n\topEntityId: EntityId;\n\t/** Atomic replay protection required for one-time Request Object processing. */\n\treplayStore: ReplayStore;\n}\n\n/**\n * OP-side processing of an automatic registration Request Object.\n *\n * Validates the Request Object JWT claims, resolves the RP's trust chain,\n * verifies the JWT signature, and extracts resolved RP metadata.\n */\nexport async function processAutomaticRegistration(\n\trequestObjectJwt: string,\n\ttrustAnchors: TrustAnchorSet | undefined,\n\toptions: ProcessAutomaticRegistrationOptions,\n): Promise> {\n\tconst trustAnchorsResult = requireNonEmptyTrustAnchors(trustAnchors);\n\tif (!trustAnchorsResult.ok) return trustAnchorsResult;\n\tconst configuredTrustAnchors = trustAnchorsResult.value;\n\n\tconst validated = validateAutomaticRegistrationRequest(requestObjectJwt, {\n\t\topEntityId: options.opEntityId,\n\t\t...(options.clockSkewSeconds !== undefined\n\t\t\t? { clockSkewSeconds: options.clockSkewSeconds }\n\t\t\t: {}),\n\t\t...(options.clock ? { clock: options.clock } : {}),\n\t});\n\tif (!validated.ok) return validated;\n\n\tconst rpEntityId = validated.value.rpEntityId;\n\tconst bestChainResult =\n\t\tvalidated.value.trustChainHeader !== undefined\n\t\t\t? await validateSuppliedTrustChain(validated.value.trustChainHeader, configuredTrustAnchors, {\n\t\t\t\t\t...options,\n\t\t\t\t\texpectedSubject: rpEntityId,\n\t\t\t\t\tlabel: \"trust_chain\",\n\t\t\t\t})\n\t\t\t: await resolveAndValidateBestChain(rpEntityId, configuredTrustAnchors, options);\n\tif (!bestChainResult.ok) return bestChainResult;\n\tconst bestChain = bestChainResult.value;\n\n\ttype LeafStatement = (typeof bestChain.statements)[0];\n\ttype LeafFederationJwks = NonNullable;\n\tconst leafStatement = bestChain.statements[0] as LeafStatement & {\n\t\tpayload: LeafStatement[\"payload\"] & { jwks: LeafFederationJwks };\n\t};\n\tconst federationJwks = leafStatement.payload.jwks;\n\n\tconst resolvedRpMetadata = bestChain.resolvedMetadata.openid_relying_party ?? {};\n\tconst protocolKeysResult = await resolveEntityKeys(resolvedRpMetadata, federationJwks, options);\n\tif (!protocolKeysResult.ok) return protocolKeysResult;\n\n\tconst verifyResult = await verifyEntityStatement(\n\t\trequestObjectJwt,\n\t\t{ keys: protocolKeysResult.value.keys },\n\t\t{\n\t\t\texpectedTyp: RequestObjectTyp,\n\t\t\t...(options.clock ? { clock: options.clock } : {}),\n\t\t\t...(options.clockSkewSeconds !== undefined\n\t\t\t\t? { clockSkewSeconds: options.clockSkewSeconds }\n\t\t\t\t: {}),\n\t\t},\n\t);\n\tif (!verifyResult.ok) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tInternalErrorCode.SignatureInvalid,\n\t\t\t\t\"Request Object signature verification failed\",\n\t\t\t),\n\t\t);\n\t}\n\n\tif (Object.keys(resolvedRpMetadata).length > 0) {\n\t\tconst { OpenIDRelyingPartyMetadataSchema } = await import(\"../schemas/metadata.js\");\n\t\tconst metaParsed = OpenIDRelyingPartyMetadataSchema.safeParse(resolvedRpMetadata);\n\t\tif (!metaParsed.success) {\n\t\t\treturn err(\n\t\t\t\tfederationError(\n\t\t\t\t\tFederationErrorCode.InvalidMetadata,\n\t\t\t\t\t\"RP metadata does not comply with the OpenID Connect Relying Party metadata schema\",\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t}\n\n\tlet peerResolvedOpMetadata: Readonly> | undefined;\n\tconst peerHeader = validated.value.peerTrustChainHeader;\n\tif (peerHeader && peerHeader.length > 0) {\n\t\tconst peerValidation = await validateSuppliedTrustChain(peerHeader, configuredTrustAnchors, {\n\t\t\t...options,\n\t\t\texpectedSubject: options.opEntityId,\n\t\t\tlabel: \"peer_trust_chain\",\n\t\t});\n\t\tif (!peerValidation.ok) {\n\t\t\treturn err(peerValidation.error);\n\t\t}\n\t\tif (peerValidation.value.trustAnchorId !== bestChain.trustAnchorId) {\n\t\t\treturn err(\n\t\t\t\tfederationError(\n\t\t\t\t\tFederationErrorCode.InvalidTrustChain,\n\t\t\t\t\t`peer_trust_chain Trust Anchor ('${peerValidation.value.trustAnchorId}') does not match selected RP Trust Anchor ('${bestChain.trustAnchorId}')`,\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t\tpeerResolvedOpMetadata = peerValidation.value.resolvedMetadata.openid_provider ?? {};\n\t}\n\n\ttry {\n\t\tconst accepted = await options.replayStore.useJti({\n\t\t\tissuer: rpEntityId,\n\t\t\taudience: options.opEntityId,\n\t\t\tjti: validated.value.jti,\n\t\t\texpiresAt: validated.value.exp,\n\t\t});\n\t\tif (!accepted) {\n\t\t\treturn err(\n\t\t\t\tfederationError(\n\t\t\t\t\tFederationErrorCode.InvalidRequest,\n\t\t\t\t\t\"Request Object JTI has already been used (replay detected)\",\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t} catch (error) {\n\t\toptions.logger?.error(\"Failed to claim Request Object JTI\", { error });\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.ServerError,\n\t\t\t\t\"Request Object replay protection is unavailable\",\n\t\t\t),\n\t\t);\n\t}\n\n\treturn ok({\n\t\trpEntityId,\n\t\tresolvedRpMetadata,\n\t\ttrustChain: bestChain,\n\t\t...(peerResolvedOpMetadata !== undefined ? { peerResolvedOpMetadata } : {}),\n\t});\n}\n","/** OP-side pre-validation of automatic registration Request Objects (structure only, no signature check). */\nimport {\n\tDEFAULT_CLOCK_SKEW_SECONDS,\n\tdecodeEntityStatement,\n\ttype EntityId,\n\terr,\n\tFederationErrorCode,\n\tfederationError,\n\tisValidEntityId,\n\tnowSeconds,\n\tok,\n} from \"@oidfed/core\";\nimport { RequestObjectTyp } from \"../constants.js\";\nimport type {\n\tAutomaticRegistrationContext,\n\tValidatedRequestObject,\n\tValidatedRequestObjectResult,\n} from \"./types.js\";\n\n/**\n * Validate an incoming Authorization Request Object JWT for automatic registration.\n *\n * Federation-layer validation:\n * - `typ` MUST be `oauth-authz-req+jwt`\n * - `sub` MUST NOT be present\n * - `client_id` REQUIRED and MUST equal `iss`\n * - `aud` MUST be the OP's Entity Identifier (single string)\n * - `exp` MUST be present and not expired\n * - `jti` MUST be present\n * - `registration` MUST NOT be present\n * - If `trust_chain` header present, first entry must be subject's EC\n *\n * Does NOT verify the JWT signature — that requires resolving the RP's trust chain\n * and is done separately by the OP after this validation step.\n */\nexport function validateAutomaticRegistrationRequest(\n\trequestObjectJwt: string,\n\tcontext: AutomaticRegistrationContext,\n): ValidatedRequestObjectResult {\n\tconst decoded = decodeEntityStatement(requestObjectJwt);\n\tif (!decoded.ok) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidRequest,\n\t\t\t\t`Failed to decode Request Object: ${decoded.error.description}`,\n\t\t\t),\n\t\t);\n\t}\n\n\tconst { header, payload } = decoded.value;\n\tconst claims = payload as Record;\n\n\tif (header.typ !== RequestObjectTyp) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidRequest,\n\t\t\t\t`Invalid typ header: expected '${RequestObjectTyp}', got '${String(header.typ)}'`,\n\t\t\t),\n\t\t);\n\t}\n\n\tif (claims.sub !== undefined) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidRequest,\n\t\t\t\t\"Request Object MUST NOT contain 'sub' claim\",\n\t\t\t),\n\t\t);\n\t}\n\n\tconst clientId = claims.client_id as string | undefined;\n\tif (!clientId) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidRequest,\n\t\t\t\t\"Request Object missing required 'client_id' claim\",\n\t\t\t),\n\t\t);\n\t}\n\tif (!isValidEntityId(clientId)) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidRequest,\n\t\t\t\t\"Request Object 'client_id' MUST be an Entity Identifier\",\n\t\t\t),\n\t\t);\n\t}\n\n\tconst iss = claims.iss as string | undefined;\n\tif (iss !== clientId) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidRequest,\n\t\t\t\t`Request Object 'iss' ('${String(iss)}') MUST equal 'client_id' ('${clientId}')`,\n\t\t\t),\n\t\t);\n\t}\n\n\t// aud must be a single string, not an array\n\tconst aud = claims.aud;\n\tif (Array.isArray(aud)) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidRequest,\n\t\t\t\t\"Request Object 'aud' MUST be a single string, not an array\",\n\t\t\t),\n\t\t);\n\t}\n\tif (aud !== (context.opEntityId as string)) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidRequest,\n\t\t\t\t`Request Object 'aud' ('${String(aud)}') does not match OP Entity Identifier ('${context.opEntityId}')`,\n\t\t\t),\n\t\t);\n\t}\n\n\tconst exp = claims.exp as number | undefined;\n\tif (exp === undefined) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidRequest,\n\t\t\t\t\"Request Object missing required 'exp' claim\",\n\t\t\t),\n\t\t);\n\t}\n\tconst clockSkew = context.clockSkewSeconds ?? DEFAULT_CLOCK_SKEW_SECONDS;\n\tconst now = nowSeconds(context.clock);\n\tif (now - clockSkew >= exp) {\n\t\treturn err(federationError(FederationErrorCode.InvalidRequest, \"Request Object has expired\"));\n\t}\n\n\tconst jti = claims.jti as string | undefined;\n\tif (!jti) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidRequest,\n\t\t\t\t\"Request Object missing required 'jti' claim\",\n\t\t\t),\n\t\t);\n\t}\n\n\tif (claims.registration !== undefined) {\n\t\treturn err(\n\t\t\tfederationError(\n\t\t\t\tFederationErrorCode.InvalidRequest,\n\t\t\t\t\"Request Object MUST NOT contain 'registration' claim\",\n\t\t\t),\n\t\t);\n\t}\n\n\tconst trustChainHeader = header.trust_chain as string[] | undefined;\n\tif (trustChainHeader && trustChainHeader.length > 0) {\n\t\tconst firstEntry = trustChainHeader[0] as string;\n\t\tconst firstDecoded = decodeEntityStatement(firstEntry);\n\t\tif (!firstDecoded.ok) {\n\t\t\treturn err(\n\t\t\t\tfederationError(\n\t\t\t\t\tFederationErrorCode.InvalidTrustChain,\n\t\t\t\t\t\"Failed to decode first entry of trust_chain header\",\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t\tconst firstPayload = firstDecoded.value.payload as Record;\n\t\tif (firstPayload.iss !== clientId || firstPayload.sub !== clientId) {\n\t\t\treturn err(\n\t\t\t\tfederationError(\n\t\t\t\t\tFederationErrorCode.InvalidTrustChain,\n\t\t\t\t\t\"First entry of trust_chain header MUST be the subject's Entity Configuration\",\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t}\n\n\tconst peerTrustChainHeader = header.peer_trust_chain as string[] | undefined;\n\tif (peerTrustChainHeader && peerTrustChainHeader.length > 0) {\n\t\tconst peerFirstEntry = peerTrustChainHeader[0] as string;\n\t\tconst peerFirstDecoded = decodeEntityStatement(peerFirstEntry);\n\t\tif (!peerFirstDecoded.ok) {\n\t\t\treturn err(\n\t\t\t\tfederationError(\n\t\t\t\t\tFederationErrorCode.InvalidTrustChain,\n\t\t\t\t\t\"Failed to decode first entry of peer_trust_chain header\",\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t\tconst peerFirstPayload = peerFirstDecoded.value.payload as Record;\n\t\tif (\n\t\t\tpeerFirstPayload.iss !== context.opEntityId ||\n\t\t\tpeerFirstPayload.sub !== context.opEntityId\n\t\t) {\n\t\t\treturn err(\n\t\t\t\tfederationError(\n\t\t\t\t\tFederationErrorCode.InvalidTrustChain,\n\t\t\t\t\t\"First entry of peer_trust_chain header MUST be the OP's Entity Configuration\",\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\n\t\t// Same-Trust-Anchor invariant when both chains are present.\n\t\tif (trustChainHeader && trustChainHeader.length > 0) {\n\t\t\tconst rpLastEntry = trustChainHeader[trustChainHeader.length - 1] as string;\n\t\t\tconst peerLastEntry = peerTrustChainHeader[peerTrustChainHeader.length - 1] as string;\n\t\t\tconst rpLastDecoded = decodeEntityStatement(rpLastEntry);\n\t\t\tconst peerLastDecoded = decodeEntityStatement(peerLastEntry);\n\t\t\tif (!rpLastDecoded.ok || !peerLastDecoded.ok) {\n\t\t\t\treturn err(\n\t\t\t\t\tfederationError(\n\t\t\t\t\t\tFederationErrorCode.InvalidTrustChain,\n\t\t\t\t\t\t\"Failed to decode last entry of trust_chain or peer_trust_chain header\",\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst rpTaId = trustChainTrailingAnchorId(rpLastDecoded.value.payload);\n\t\t\tconst peerTaId = trustChainTrailingAnchorId(peerLastDecoded.value.payload);\n\t\t\tif (rpTaId !== peerTaId) {\n\t\t\t\treturn err(\n\t\t\t\t\tfederationError(\n\t\t\t\t\t\tFederationErrorCode.InvalidTrustChain,\n\t\t\t\t\t\t`peer_trust_chain Trust Anchor ('${peerTaId}') does not match trust_chain Trust Anchor ('${rpTaId}')`,\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t}\n\n\tconst validated: ValidatedRequestObject = {\n\t\trpEntityId: clientId as EntityId,\n\t\topEntityId: context.opEntityId as string,\n\t\texp,\n\t\tjti,\n\t\t...(claims.iat !== undefined ? { iat: claims.iat as number } : {}),\n\t\tclaims,\n\t\t...(trustChainHeader ? { trustChainHeader } : {}),\n\t\t...(peerTrustChainHeader ? { peerTrustChainHeader } : {}),\n\t};\n\n\treturn ok(validated);\n}\n\n/** Returns the Trust Anchor Entity Identifier from the trailing element of a Trust Chain. */\nfunction trustChainTrailingAnchorId(payload: Record): string | undefined {\n\t// Final element MAY be the TA's own EC (iss === sub) or a TA-signed Subordinate Statement\n\t// (iss is the TA, sub is the immediate subordinate).\n\tconst iss = payload.iss as string | undefined;\n\treturn iss;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA+bO,SAAS,qBAAqB,KAAsC;AAC1E,SAAO,6BAA6B,MAAM,GAAG;AAC9C;AAjcA,IAWA,aAMA,YAOM,oBAYA,qBAEA,kCAsBA,iCA+CA,wCAOO,kCAmBA,sDAkBA,8BAwHA,wCA+FA,2BAgCA,6BA0BA;AAxab;AAAA;AAAA;AAWA,kBAKO;AACP,iBAAkB;AAOlB,IAAM,qBAAqB,aAAE,IAAI,EAAE;AAAA,MAClC,CAAC,QAAQ;AACR,YAAI;AACH,gBAAM,IAAI,IAAI,IAAI,GAAG;AACrB,iBAAO,EAAE,aAAa,YAAY,CAAC,EAAE;AAAA,QACtC,QAAQ;AACP,iBAAO;AAAA,QACR;AAAA,MACD;AAAA,MACA,EAAE,SAAS,4DAA4D;AAAA,IACxE;AAEA,IAAM,sBAAsB,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,IAAI,CAAC;AAErD,IAAM,mCAAmC;AAAA,MACxC,mBAAmB,aAAE,OAAO,EAAE,SAAS;AAAA,MACvC,cAAc,aAAE,OAAO,EAAE,SAAS;AAAA,MAClC,aAAa,aAAE,OAAO,EAAE,SAAS;AAAA,MACjC,UAAU,oBAAoB,SAAS;AAAA,MACvC,UAAU,oBAAoB,SAAS;AAAA,MACvC,UAAU,aAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,MACpC,YAAY,aAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,MACtC,iBAAiB,aAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,MAC3C,kBAAkB,aAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IAC7C;AAYA,IAAM,kCAAkC;AAAA;AAAA,MAEvC,eAAe,aAAE,MAAM,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MAClD,gBAAgB,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MAC7C,aAAa,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MAC1C,kBAAkB,aAAE,KAAK,CAAC,OAAO,QAAQ,CAAC,EAAE,SAAS;AAAA,MACrD,aAAa,aAAE,OAAO,EAAE,SAAS;AAAA,MACjC,YAAY,aAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,MACtC,SAAS,aAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,MACnC,GAAG;AAAA,MACH,UAAU,mBAAmB,SAAS;AAAA,MACtC,MAAM,yBAAa,SAAS;AAAA,MAC5B,uBAAuB,aAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,MACjD,cAAc,aAAE,KAAK,CAAC,UAAU,UAAU,CAAC,EAAE,SAAS;AAAA;AAAA,MAEtD,8BAA8B,aAAE,OAAO,EAAE,SAAS;AAAA,MAClD,iCAAiC,aAAE,OAAO,EAAE,SAAS;AAAA,MACrD,iCAAiC,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,MAErD,8BAA8B,aAAE,OAAO,EAAE,SAAS;AAAA,MAClD,iCAAiC,aAAE,OAAO,EAAE,SAAS;AAAA,MACrD,iCAAiC,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,MAErD,4BAA4B,aAAE,OAAO,EAAE,SAAS;AAAA,MAChD,+BAA+B,aAAE,OAAO,EAAE,SAAS;AAAA,MACnD,+BAA+B,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,MAEnD,4BAA4B,aAAE,OAAO,EAAE,SAAS;AAAA,MAChD,iCAAiC,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,MAErD,iBAAiB,aAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,MACzD,mBAAmB,aAAE,QAAQ,EAAE,SAAS;AAAA,MACxC,oBAAoB,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MACjD,oBAAoB,aAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,MAC9C,2BAA2B,aAAE,MAAM,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA,MAE9D,iCAAiC,aAAE,OAAO,EAAE,SAAS;AAAA,MACrD,0CAA0C,aAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,MACpE,gDAAgD,aAAE,OAAO,EAAE,SAAS;AAAA,MACpE,iCAAiC,aAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,MAEtD,2BAA2B,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MACxD,iBAAiB,mBAAmB,SAAS;AAAA,MAC7C,yBAAyB,aAAE,OAAO,EAAE,SAAS;AAAA,MAC7C,OAAO,aAAE,OAAO,EAAE,SAAS;AAAA,IAC5B;AAEA,IAAM,yCAAyC;AAAA,MAC9C;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACD;AAEO,IAAM,mCAAmC,aAC9C,YAAY,+BAA+B,EAC3C,YAAY,CAAC,MAAM,QAAQ;AAC3B,iBAAW,SAAS,wCAAwC;AAC3D,YAAI,OAAO,OAAO,MAAM,KAAK,GAAG;AAC/B,cAAI,SAAS;AAAA,YACZ,MAAM,aAAE,aAAa;AAAA,YACrB,SAAS,GAAG,KAAK;AAAA,YACjB,MAAM,CAAC,KAAK;AAAA,UACb,CAAC;AAAA,QACF;AAAA,MACD;AAAA,IACD,CAAC;AAOK,IAAM,uDAAuD,aAAE,YAAY;AAAA,MACjF,GAAG;AAAA,MACH,WAAW,aAAE,OAAO;AAAA,MACpB,eAAe,aAAE,OAAO,EAAE,SAAS;AAAA,MACnC,qBAAqB,aAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,MAC7D,0BAA0B,aAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,IACnE,CAAC;AAYM,IAAM,+BAA+B,aAC1C,YAAY;AAAA,MACZ,QAAQ,aAAE,OAAO,EAAE,IAAI;AAAA,MACvB,wBAAwB,aAAE,OAAO,EAAE,IAAI;AAAA,MACvC,gBAAgB,aAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,MAC1C,mBAAmB,aAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,MAC7C,UAAU,mBAAmB,SAAS;AAAA,MACtC,MAAM,yBAAa,SAAS;AAAA,MAC5B,uBAAuB,mBAAmB,SAAS;AAAA,MACnD,kBAAkB,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MAC/C,0BAA0B,aAAE,MAAM,aAAE,OAAO,CAAC;AAAA,MAC5C,0BAA0B,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MACvD,uBAAuB,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MACpD,sBAAsB,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MACnD,yBAAyB,aAAE,MAAM,aAAE,OAAO,CAAC;AAAA;AAAA,MAE3C,uCAAuC,aAAE,MAAM,aAAE,OAAO,CAAC;AAAA,MACzD,0CAA0C,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MACvE,0CAA0C,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,MAEvE,uCAAuC,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MACpE,0CAA0C,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MACvE,0CAA0C,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,MAEvE,6CAA6C,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MAC1E,gDAAgD,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MAC7E,gDAAgD,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,MAE7E,uCAAuC,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MACpE,kDAAkD,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,MAE/E,0BAA0B,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MACvD,uBAAuB,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MACpD,kBAAkB,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MAC/C,uBAAuB,aAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,MACjD,0BAA0B,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MACvD,sBAAsB,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MACnD,4BAA4B,aAAE,QAAQ,EAAE,SAAS;AAAA,MACjD,6BAA6B,aAAE,QAAQ,EAAE,SAAS;AAAA,MAClD,iCAAiC,aAAE,QAAQ,EAAE,SAAS;AAAA,MACtD,kCAAkC,aAAE,QAAQ,EAAE,SAAS;AAAA,MACvD,eAAe,aAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,MACzC,YAAY,aAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA,MAEtC,sBAAsB,aAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,MAChD,+BAA+B,aAAE,QAAQ,EAAE,SAAS;AAAA,MACpD,uCAAuC,aAAE,QAAQ,EAAE,SAAS;AAAA,MAC5D,8BAA8B,aAAE,QAAQ,EAAE,SAAS;AAAA,MACnD,sCAAsC,aAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,MAE3D,4CAA4C,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MACzE,qCAAqC,aAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,MAC/D,2CAA2C,aAAE,QAAQ,EAAE,SAAS;AAAA,MAChE,GAAG;AAAA;AAAA,MAEH,qCAAqC,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MAClE,kCAAkC,mBAAmB,SAAS;AAAA,MAC9D,iBAAiB,mBAAmB,SAAS;AAAA,MAC7C,yBAAyB,aAAE,OAAO,EAAE,SAAS;AAAA,IAC9C,CAAC,EACA,YAAY,CAAC,MAAM,QAAQ;AAE3B,UAAI;AACH,cAAM,IAAI,IAAI,IAAI,KAAK,MAAM;AAC7B,YAAI,EAAE,aAAa,UAAU;AAC5B,cAAI,SAAS;AAAA,YACZ,MAAM,aAAE,aAAa;AAAA,YACrB,SAAS;AAAA,YACT,MAAM,CAAC,QAAQ;AAAA,UAChB,CAAC;AAAA,QACF;AACA,YAAI,EAAE,QAAQ,EAAE,QAAQ;AACvB,cAAI,SAAS;AAAA,YACZ,MAAM,aAAE,aAAa;AAAA,YACrB,SAAS;AAAA,YACT,MAAM,CAAC,QAAQ;AAAA,UAChB,CAAC;AAAA,QACF;AAAA,MACD,QAAQ;AACP,YAAI,SAAS;AAAA,UACZ,MAAM,aAAE,aAAa;AAAA,UACrB,SAAS;AAAA,UACT,MAAM,CAAC,QAAQ;AAAA,QAChB,CAAC;AAAA,MACF;AAGA,UACC,KAAK,qCAAqC,SAAS,UAAU,KAC7D,CAAC,KAAK,kCACL;AACD,YAAI,SAAS;AAAA,UACZ,MAAM,aAAE,aAAa;AAAA,UACrB,SACC;AAAA,UACD,MAAM,CAAC,kCAAkC;AAAA,QAC1C,CAAC;AAAA,MACF;AAAA,IACD,CAAC;AAsBK,IAAM,yCAAyC,aACpD,YAAY;AAAA,MACZ,QAAQ,aAAE,OAAO,EAAE,IAAI;AAAA,MACvB,wBAAwB,aAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,MAClD,gBAAgB,aAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,MAC1C,UAAU,mBAAmB,SAAS;AAAA,MACtC,MAAM,yBAAa,SAAS;AAAA,MAC5B,uBAAuB,mBAAmB,SAAS;AAAA,MACnD,kBAAkB,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MAC/C,0BAA0B,aAAE,MAAM,aAAE,OAAO,CAAC;AAAA,MAC5C,0BAA0B,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MACvD,uBAAuB,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MACpD,uCAAuC,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MACpE,kDAAkD,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MAC/E,uBAAuB,aAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,MACjD,sBAAsB,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MACnD,eAAe,aAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,MACzC,YAAY,aAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA,MAEtC,qBAAqB,aAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,MAC/C,4CAA4C,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MACzE,uDAAuD,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,MAEpF,wBAAwB,aAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,MAClD,+CAA+C,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MAC5E,0DAA0D,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,MAEvF,kCAAkC,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,MAE/D,+BAA+B,aAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA,MAEzD,uCAAuC,aAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,MACjE,uCAAuC,aAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,MAE5D,mCAAmC,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,MAEhE,gDAAgD,aAAE,QAAQ,EAAE,SAAS;AAAA,MACrE,GAAG;AAAA;AAAA,MAEH,qCAAqC,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MAClE,kCAAkC,mBAAmB,SAAS;AAAA,MAC9D,iBAAiB,mBAAmB,SAAS;AAAA,MAC7C,yBAAyB,aAAE,OAAO,EAAE,SAAS;AAAA,IAC9C,CAAC,EACA,YAAY,CAAC,MAAM,QAAQ;AAC3B,UAAI;AACH,cAAM,IAAI,IAAI,IAAI,KAAK,MAAM;AAC7B,YAAI,EAAE,aAAa,UAAU;AAC5B,cAAI,SAAS;AAAA,YACZ,MAAM,aAAE,aAAa;AAAA,YACrB,SAAS;AAAA,YACT,MAAM,CAAC,QAAQ;AAAA,UAChB,CAAC;AAAA,QACF;AACA,YAAI,EAAE,QAAQ,EAAE,QAAQ;AACvB,cAAI,SAAS;AAAA,YACZ,MAAM,aAAE,aAAa;AAAA,YACrB,SAAS;AAAA,YACT,MAAM,CAAC,QAAQ;AAAA,UAChB,CAAC;AAAA,QACF;AAAA,MACD,QAAQ;AACP,YAAI,SAAS;AAAA,UACZ,MAAM,aAAE,aAAa;AAAA,UACrB,SAAS;AAAA,UACT,MAAM,CAAC,QAAQ;AAAA,QAChB,CAAC;AAAA,MACF;AAEA,UACC,KAAK,qCAAqC,SAAS,UAAU,KAC7D,CAAC,KAAK,kCACL;AACD,YAAI,SAAS;AAAA,UACZ,MAAM,aAAE,aAAa;AAAA,UACrB,SACC;AAAA,UACD,MAAM,CAAC,kCAAkC;AAAA,QAC1C,CAAC;AAAA,MACF;AAAA,IACD,CAAC;AAeK,IAAM,4BAA4B,aAAE,YAAY;AAAA,MACtD,eAAe,aAAE,MAAM,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MAClD,4BAA4B,aAAE,OAAO,EAAE,SAAS;AAAA,MAChD,iCAAiC,aAAE,OAAO,EAAE,SAAS;AAAA,MACrD,aAAa,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MAC1C,gBAAgB,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MAC7C,aAAa,aAAE,OAAO,EAAE,SAAS;AAAA,MACjC,YAAY,aAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,MACtC,OAAO,aAAE,OAAO,EAAE,SAAS;AAAA,MAC3B,SAAS,aAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,MACnC,GAAG;AAAA,MACH,UAAU,mBAAmB,SAAS;AAAA,MACtC,MAAM,yBAAa,SAAS;AAAA,MAC5B,aAAa,aAAE,OAAO,EAAE,SAAS;AAAA,MACjC,kBAAkB,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,MAEtC,2BAA2B,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MACxD,iBAAiB,mBAAmB,SAAS;AAAA,MAC7C,yBAAyB,aAAE,OAAO,EAAE,SAAS;AAAA,IAC9C,CAAC;AAaM,IAAM,8BAA8B,aAAE,YAAY;AAAA,MACxD,UAAU,aAAE,OAAO,EAAE,IAAI;AAAA,MACzB,uBAAuB,aAAE,MAAM,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MAC1D,0BAA0B,aAAE,MAAM,aAAE,KAAK,CAAC,UAAU,QAAQ,OAAO,CAAC,CAAC,EAAE,SAAS;AAAA,MAChF,uCAAuC,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MACpE,mCAAmC,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MAChE,kBAAkB,aAAE,MAAM,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MAC/C,UAAU,mBAAmB,SAAS;AAAA,MACtC,MAAM,yBAAa,SAAS;AAAA,MAC5B,GAAG;AAAA;AAAA,MAEH,iBAAiB,mBAAmB,SAAS;AAAA,MAC7C,yBAAyB,aAAE,OAAO,EAAE,SAAS;AAAA,IAC9C,CAAC;AAaM,IAAM,+BAA+B,qCAAyB;AAAA,MACpE,aAAE,YAAY;AAAA,QACb,mBAAmB,2CAA+B,SAAS;AAAA,QAC3D,sBAAsB,iCAAiC,SAAS;AAAA,QAChE,iBAAiB,6BAA6B,SAAS;AAAA,QACvD,4BAA4B,uCAAuC,SAAS;AAAA,QAC5E,cAAc,0BAA0B,SAAS;AAAA,QACjD,gBAAgB,4BAA4B,SAAS;AAAA,MACtD,CAAC;AAAA,IACF;AAAA;AAAA;;;ACjbA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACOO,IAAM,mCAAN,MAA6E;AAAA,EAClE;AAAA,EACA;AAAA,EAEjB,YAAY,SAAgF;AAC3F,SAAK,sBAAsB,QAAQ;AACnC,SAAK,wBAAwB,QAAQ;AAAA,EACtC;AAAA,EAEA,MAAM,yBAA6C;AAClD,WAAO,KAAK;AAAA,EACb;AAAA,EAEA,MAAM,2BAA+C;AACpD,WAAO,KAAK,yBAAyB,KAAK;AAAA,EAC3C;AACD;;;ACvBA,IAAAA,eAQO;AACP;AAWO,IAAM,0BAAN,MAAqE;AAAA,EAC3E,uBACC,KACmD;AACnD,UAAM,SAAS,IAAI;AACnB,QAAI,CAAC,UAAU,OAAO,WAAW,UAAU;AAI1C,iBAAO,iBAAG,GAAG;AAAA,IACd;AAEA,UAAM,SAAS,iCAAiC,UAAU,MAAM;AAChE,QAAI,CAAC,OAAO,SAAS;AACpB,iBAAO;AAAA,YACN;AAAA,UACC,iCAAoB;AAAA,UACpB,0CAA0C,OAAO,MAAM,OAAO;AAAA,QAC/D;AAAA,MACD;AAAA,IACD;AAEA,eAAO,iBAAG,GAAG;AAAA,EACd;AAAA,EAEA,uBACC,QACA,YAC0B;AAC1B,UAAM,WAAW,EAAE,GAAG,OAAO;AAC7B,QAAI,CAAC,SAAS,WAAW;AACxB,eAAS,YAAY,WAAW;AAAA,IACjC;AACA,WAAO;AAAA,EACR;AACD;;;AC3CA,IAAAC,gBAA0E;;;ACZ1E,IAAAC,eAMO;AAcP,eAAsB,sBACrB,UACA,UACA,QACA,SACkB;AAClB,QAAM,YAAY,SAAS,oBAAoB;AAC/C,QAAM,UAAM,yBAAW,SAAS,KAAK;AAErC,QAAM,UAAmC;AAAA,IACxC,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK,OAAO,WAAW;AAAA,IACvB,KAAK;AAAA,IACL,KAAK,MAAM;AAAA,EACZ;AAGA,aAAO,kCAAoB,SAAS,QAAQ;AAAA,IAC3C,KAAK;AAAA,EACN,CAAC;AACF;;;ACzCA,IAAAC,eAiBO;;;ACFA,IAAM,mBAAmB;AAGzB,IAAM,yBAAyB;AAAA,EACrC,WAAW;AAAA,EACX,UAAU;AACX;AAKO,IAAM,8CAA8C;AAGpD,IAAM,iDACZ;;;AC/BD,IAAAC,eAeO;AAGA,SAAS,qBAAqB,QAAuD;AAC3F,SAAQ,QAAQ,uCAAgE,CAAC;AAClF;AAEA,IAAM,iCACL;AAIM,SAAS,wBAAwB,MAA0D;AACjG,MAAI;AACJ,MAAI;AACH,aAAS,KAAK,MAAM,IAAI;AAAA,EACzB,QAAQ;AACP,eAAO;AAAA,UACN,8BAAgB,iCAAoB,gBAAgB,+BAA+B;AAAA,IACpF;AAAA,EACD;AAEA,MACC,CAAC,MAAM,QAAQ,MAAM,KACrB,OAAO,WAAW,KAClB,CAAC,OAAO,MAAM,CAAC,cAAc,OAAO,cAAc,QAAQ,GACzD;AACD,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAEA,aAAO,iBAAG,MAAM;AACjB;AAEO,SAAS,4BACf,cAC0C;AAC1C,MAAI,CAAC,gBAAgB,aAAa,SAAS,GAAG;AAC7C,eAAO;AAAA,UACN,8BAAgB,iCAAoB,mBAAmB,8BAA8B;AAAA,IACtF;AAAA,EACD;AACA,QAAM,aAAa,oBAAI,IAA+B;AACtD,aAAW,CAAC,UAAU,MAAM,KAAK,cAAc;AAC9C,QAAI;AACH,iBAAW,QAAI,uBAAS,QAAQ,GAAG,MAAM;AAAA,IAC1C,SAAS,OAAO;AACf,iBAAO;AAAA,YACN;AAAA,UACC,iCAAoB;AAAA,UACpB,mCAAmC,QAAQ;AAAA,UAC3C;AAAA,QACD;AAAA,MACD;AAAA,IACD;AAAA,EACD;AACA,aAAO,iBAAG,UAAU;AACrB;AAEO,SAAS,2BACf,cACiB;AACjB,QAAM,SAAS,4BAA4B,YAAY;AACvD,MAAI,CAAC,OAAO,IAAI;AACf,UAAM,IAAI,MAAM,OAAO,MAAM,WAAW;AAAA,EACzC;AACA,SAAO,OAAO;AACf;AAEA,eAAsB,2BACrB,OACA,cACA,SAKwD;AACxD,MAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW,KAAK,CAAC,MAAM,MAAM,CAAC,MAAM,OAAO,MAAM,QAAQ,GAAG;AAC9F,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB,GAAG,QAAQ,KAAK;AAAA,MACjB;AAAA,IACD;AAAA,EACD;AAEA,QAAM,aAAa,UAAM,iCAAmB,OAAO,cAAc;AAAA,IAChE,GAAG;AAAA,IACH,eAAe;AAAA,IACf,GAAI,QAAQ,iCAAiC,SAC1C,EAAE,8BAA8B,QAAQ,6BAA6B,IACrE,CAAC;AAAA,EACL,CAAC;AACD,MAAI,CAAC,WAAW,OAAO;AACtB,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB,GAAG,QAAQ,KAAK,uBAAuB,WAAW,OAAO,CAAC,GAAG,WAAW,eAAe;AAAA,MACxF;AAAA,IACD;AAAA,EACD;AAEA,MAAI,WAAW,MAAM,aAAa,QAAQ,iBAAiB;AAC1D,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB,GAAG,QAAQ,KAAK,aAAa,WAAW,MAAM,QAAQ,sCAAsC,QAAQ,eAAe;AAAA,MACpH;AAAA,IACD;AAAA,EACD;AAEA,aAAO,iBAAG,WAAW,KAAK;AAC3B;AAcA,SAAS,0BACR,QACyB;AACzB,QAAM,WAAW,OACf,MAAM,EACN,KAAK,CAAC,GAAG,MAAM,EAAE,MAAM,WAAW,SAAS,EAAE,MAAM,WAAW,MAAM,EAAE,CAAC;AACzE,MAAI,CAAC,SAAU,OAAM,IAAI,MAAM,wCAAwC;AACvE,SAAO;AACR;AAEA,eAAe,+BACd,SACA,cACA,SACA,OACsE;AACtE,QAAM,cAAc,UAAM,iCAAmB,SAAS,cAAc,OAAO;AAE3E,MAAI,YAAY,OAAO,WAAW,GAAG;AACpC,UAAM,YAAY,YAAY,OAAO,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,IAAI;AACxE,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB,qCAAqC,KAAK,KAAK,aAAa,iBAAiB;AAAA,MAC9E;AAAA,IACD;AAAA,EACD;AAEA,QAAM,cAAwC,CAAC;AAC/C,aAAW,SAAS,YAAY,QAAQ;AACvC,UAAM,aAAa,UAAM,iCAAmB,MAAM,YAAY,cAAc,OAAO;AACnF,QAAI,WAAW,OAAO;AACrB,kBAAY,KAAK,EAAE,YAAY,MAAM,YAAY,OAAO,WAAW,MAAM,CAAC;AAAA,IAC3E;AAAA,EACD;AAEA,MAAI,YAAY,WAAW,GAAG;AAC7B,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB,mCAAmC,KAAK;AAAA,MACzC;AAAA,IACD;AAAA,EACD;AAEA,aAAO,iBAAG,WAAW;AACtB;AAEA,eAAsB,oCACrB,YACA,YACA,kBACA,cACA,SACkE;AAClE,QAAM,iBAAiB,MAAM;AAAA,IAC5B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD;AACA,MAAI,CAAC,eAAe,GAAI,QAAO;AAE/B,QAAM,oBAAoB,eAAe,MAAM;AAAA,IAC9C,CAAC,cAAc,UAAU,MAAM,kBAAkB,iBAAiB;AAAA,EACnE;AACA,MAAI,kBAAkB,SAAS,GAAG;AACjC,UAAM,UAAU,0BAA0B,iBAAiB;AAC3D,eAAO,iBAAG;AAAA,MACT,mBAAmB,QAAQ;AAAA,MAC3B,SAAS,QAAQ;AAAA,MACjB,SAAS;AAAA,MACT,eAAe,iBAAiB;AAAA,IACjC,CAAC;AAAA,EACF;AAEA,QAAM,iBAAiB,MAAM;AAAA,IAC5B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD;AACA,MAAI,CAAC,eAAe,GAAI,QAAO;AAE/B,aAAW,WAAW,eAAe,OAAO;AAC3C,UAAM,mBAAmB,eAAe,MAAM;AAAA,MAC7C,CAAC,cAAc,UAAU,MAAM,kBAAkB,QAAQ,MAAM;AAAA,IAChE;AACA,QAAI,iBAAiB,SAAS,GAAG;AAChC,YAAM,UAAU,0BAA0B,gBAAgB;AAC1D,iBAAO,iBAAG;AAAA,QACT,mBAAmB,QAAQ;AAAA,QAC3B,SAAS,QAAQ;AAAA,QACjB,SAAS,QAAQ;AAAA,QACjB,eAAe,QAAQ,MAAM;AAAA,MAC9B,CAAC;AAAA,IACF;AAAA,EACD;AAEA,aAAO;AAAA,QACN;AAAA,MACC,iCAAoB;AAAA,MACpB;AAAA,IACD;AAAA,EACD;AACD;AAOA,eAAsB,4BACrB,YACA,cACA,SACwD;AACxD,QAAM,cAAc,UAAM,iCAAmB,YAAY,cAAc,OAAO;AAE9E,MAAI,YAAY,OAAO,WAAW,GAAG;AACpC,UAAM,YAAY,YAAY,OAAO,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,IAAI;AACxE,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB,yCAAyC,aAAa,iBAAiB;AAAA,MACxE;AAAA,IACD;AAAA,EACD;AAEA,QAAM,cAAqC,CAAC;AAC5C,aAAW,SAAS,YAAY,QAAQ;AACvC,UAAM,SAAS,UAAM,iCAAmB,MAAM,YAAY,cAAc,OAAO;AAC/E,QAAI,OAAO,OAAO;AACjB,kBAAY,KAAK,OAAO,KAAK;AAAA,IAC9B;AAAA,EACD;AAEA,MAAI,YAAY,WAAW,GAAG;AAC7B,eAAO;AAAA,UACN,8BAAgB,iCAAoB,mBAAmB,oCAAoC;AAAA,IAC5F;AAAA,EACD;AAEA,aAAO,qBAAG,4BAAc,WAAW,CAAC;AACrC;;;AF1QA,IAAM,wBAAwB;AAK9B,IAAM,iCAAiC,oBAAI,IAAI;AAAA,EAC9C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD,CAAC;AAsFD,eAAsB,sBACrB,WACA,UACA,oBACA,cACA,SAC+C;AAC/C,QAAM,eAAe,MAAM;AAAA,IAC1B,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV;AAAA,IACA;AAAA,EACD;AACA,MAAI,CAAC,aAAa,GAAI,YAAO,kBAAI,aAAa,KAAK;AAEnD,QAAM,SAAS,aAAa,MAAM,QAAQ,iBAAiB;AAG3D,QAAM,oBAAoB,qBAAqB,MAAM;AACrD,MAAI,CAAC,kBAAkB,SAAS,uBAAuB,SAAS,GAAG;AAClE,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAEA,QAAM,wBAAwB,QAAQ;AACtC,MAAI,CAAC,uBAAuB;AAC3B,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAEA,QAAM,sBAAsB,MAAM,SAAS,oBAAoB,uBAAuB;AACtF,QAAM,qBAAqB;AAAA,IAC1B,SAAS;AAAA,IACT;AAAA,IACA;AAAA,EACD;AACA,MAAI,CAAC,mBAAmB,IAAI;AAC3B,WAAO;AAAA,EACR;AACA,QAAM,UAAM,yBAAW,SAAS,KAAK;AAErC,QAAM,gBAAgB,CAAC,GAAG,aAAa,MAAM,iBAAiB;AAC9D,QAAM,wBAAwB,aAAa,MAAM;AAGjD,QAAM,iBAAyC,CAAC;AAChD,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,kBAAkB,GAAG;AAC9D,QAAI,CAAC,+BAA+B,IAAI,GAAG,GAAG;AAC7C,qBAAe,GAAG,IAAI;AAAA,IACvB;AAAA,EACD;AAGA,QAAM,UAAmC;AAAA,IACxC,KAAK,SAAS;AAAA,IACd,WAAW,SAAS;AAAA,IACpB,KAAK,UAAU;AAAA,IACf,KAAK,OAAO,WAAW;AAAA,IACvB,KAAK;AAAA,IACL,KAAK,OAAO,SAAS,2BAA2B;AAAA,IAChD,GAAG;AAAA,EACJ;AAEA,QAAM,eAAwC,CAAC;AAC/C,MAAI,cAAc,SAAS,GAAG;AAC7B,iBAAa,cAAc;AAAA,EAC5B;AAEA,MAAI,SAAS,uBAAuB;AACnC,QAAI,CAAC,uBAAuB;AAC3B,iBAAO;AAAA,YACN;AAAA,UACC,+BAAkB;AAAA,UAClB;AAAA,QACD;AAAA,MACD;AAAA,IACD;AACA,UAAM,kBAAkB,UAAM;AAAA,MAC7B,UAAU;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,IACD;AACA,QAAI,CAAC,gBAAgB,IAAI;AACxB,iBAAO;AAAA,YACN;AAAA,UACC,+BAAkB;AAAA,UAClB,4DAA4D,UAAU,QAAQ,cAAc,qBAAqB,KAAK,gBAAgB,MAAM,WAAW;AAAA,QACxJ;AAAA,MACD;AAAA,IACD;AACA,iBAAa,mBAAmB,gBAAgB;AAAA,EACjD;AAEA,QAAM,mBAAmB,UAAM,kCAAoB,SAAS,qBAAqB;AAAA,IAChF,KAAK;AAAA,IACL,GAAI,OAAO,KAAK,YAAY,EAAE,SAAS,IAAI,EAAE,aAAa,IAAI,CAAC;AAAA,EAChE,CAAC;AAED,QAAM,OAAwC;AAAA,IAC7C;AAAA,IACA,YAAY,aAAa,MAAM;AAAA,IAC/B,qBAAqB,aAAa,MAAM,QAAQ;AAAA,EACjD;AAEA,QAAM,WAA4B,SAAS,mBAAmB;AAC9D,QAAM,cAAc,SAAS;AAE7B,UAAQ,UAAU;AAAA,IACjB,KAAK;AACJ,iBAAO,iBAAG;AAAA,QACT,GAAG;AAAA,QACH,UAAU;AAAA,QACV,kBAAkB,sBAAsB,uBAAuB;AAAA,UAC9D,SAAS;AAAA,UACT,WAAW;AAAA,QACZ,CAAC;AAAA,MACF,CAAC;AAAA,IAEF,KAAK;AACJ,iBAAO,iBAAG;AAAA,QACT,GAAG;AAAA,QACH,UAAU;AAAA,QACV;AAAA,QACA,YAAY;AAAA,UACX,SAAS;AAAA,UACT,WAAW;AAAA,QACZ;AAAA,MACD,CAAC;AAAA,IAEF,KAAK,eAAe;AACnB,UAAI,QAAQ,oCAAoC,OAAO;AACtD,mBAAO;AAAA,cACN;AAAA,YACC,iCAAoB;AAAA,YACpB;AAAA,UACD;AAAA,QACD;AAAA,MACD;AACA,YAAM,YAAY,SAAS;AAC3B,UAAI,CAAC,WAAW;AACf,mBAAO;AAAA,cACN;AAAA,YACC,iCAAoB;AAAA,YACpB;AAAA,UACD;AAAA,QACD;AAAA,MACD;AACA,UAAI,CAAC,UAAU,WAAW,UAAU,GAAG;AACtC,mBAAO;AAAA,cACN;AAAA,YACC,iCAAoB;AAAA,YACpB;AAAA,UACD;AAAA,QACD;AAAA,MACD;AACA,iBAAO,iBAAG;AAAA,QACT,GAAG;AAAA,QACH,UAAU;AAAA,QACV,YAAY;AAAA,QACZ,kBAAkB,sBAAsB,uBAAuB;AAAA,UAC9D,aAAa;AAAA,UACb,WAAW;AAAA,QACZ,CAAC;AAAA,MACF,CAAC;AAAA,IACF;AAAA,IAEA,KAAK,OAAO;AACX,YAAM,cAAc,QAAQ;AAC5B,UAAI,CAAC,aAAa;AACjB,mBAAO;AAAA,cACN;AAAA,YACC,iCAAoB;AAAA,YACpB;AAAA,UACD;AAAA,QACD;AAAA,MACD;AACA,YAAM,aAAa,SAAS,cAAc;AAC1C,YAAM,wBAAwB,SAAS,oBAAoB,2BACxD,MAAM,SAAS,oBAAoB,yBAAyB,IAC5D;AAEH,YAAM,8BAA8B;AAAA,QACnC,SAAS;AAAA,QACT;AAAA,QACA;AAAA,MACD;AACA,UAAI,CAAC,4BAA4B,IAAI;AACpC,mBAAO,kBAAI,4BAA4B,KAAK;AAAA,MAC7C;AAKA,YAAM,kBAAkB,MAAM;AAAA,QAC7B,SAAS;AAAA,QACT,UAAU;AAAA,QACV;AAAA,QACA;AAAA,UACC,kBAAkB;AAAA,UAClB,GAAI,SAAS,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,QAClD;AAAA,MACD;AACA,YAAM,WAAW,IAAI,gBAAgB;AAAA,QACpC,SAAS;AAAA,QACT,WAAW;AAAA,QACX,uBAAuB;AAAA,QACvB,kBAAkB;AAAA,MACnB,CAAC,EAAE,SAAS;AACZ,YAAM,WAAW,MAAM,WAAW,aAAa;AAAA,QAC9C,QAAQ;AAAA,QACR,SAAS;AAAA,UACR,gBAAgB;AAAA,UAChB,QAAQ;AAAA,QACT;AAAA,QACA,MAAM;AAAA,MACP,CAAC;AACD,UAAI,SAAS,WAAW,OAAO,SAAS,WAAW,KAAK;AACvD,mBAAO;AAAA,cACN;AAAA,YACC,+BAAkB;AAAA,YAClB,4BAA4B,SAAS,MAAM;AAAA,UAC5C;AAAA,QACD;AAAA,MACD;AACA,YAAM,aAAc,MAAM,SAAS,KAAK;AACxC,YAAM,gBAAgB,WAAW;AACjC,YAAM,YAAY,WAAW;AAC7B,UAAI,OAAO,kBAAkB,YAAY,CAAC,cAAc,WAAW,MAAM,GAAG;AAC3E,mBAAO;AAAA,cACN,8BAAgB,+BAAkB,SAAS,6CAA6C;AAAA,QACzF;AAAA,MACD;AACA,UAAI,OAAO,cAAc,YAAY,aAAa,GAAG;AACpD,mBAAO;AAAA,cACN,8BAAgB,+BAAkB,SAAS,4CAA4C;AAAA,QACxF;AAAA,MACD;AACA,iBAAO,iBAAG;AAAA,QACT,GAAG;AAAA,QACH,UAAU;AAAA,QACV,oCAAoC;AAAA,QACpC,kBAAkB,sBAAsB,uBAAuB;AAAA,UAC9D,aAAa;AAAA,UACb,WAAW;AAAA,QACZ,CAAC;AAAA,QACD;AAAA,QACA,kBAAc,yBAAW,SAAS,KAAK,IAAI;AAAA,MAC5C,CAAC;AAAA,IACF;AAAA,EACD;AACD;AAEA,SAAS,sBAAsB,UAAkB,QAAwC;AACxF,QAAM,MAAM,IAAI,IAAI,QAAQ;AAC5B,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AAClD,QAAI,aAAa,IAAI,KAAK,KAAK;AAAA,EAChC;AACA,SAAO,IAAI,SAAS;AACrB;AAEA,SAAS,0BACR,UACA,QACA,SACe;AACf,QAAM,OAAO,SAAS,uBAAuB,yBAAyB;AACtE,QAAM,aAAa,SAAS,IAAI;AAChC,MAAI,CAAC,YAAY;AAChB,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAEA,QAAM,aAAa,WAAW;AAC9B,QAAM,gBAAgB,eAAe;AACrC,QAAM,oBACL,OAAO,WAAW,aAAa,YAAY,OAAO,WAAW,oBAAoB;AAElF,MAAI,eAAe;AAClB,UAAM,OAAO,WAAW;AACxB,QAAI,CAAC,MAAM,QAAQ,IAAI,GAAG;AACzB,iBAAO;AAAA,YACN;AAAA,UACC,iCAAoB;AAAA,UACpB,YAAY,IAAI;AAAA,QACjB;AAAA,MACD;AAAA,IACD;AACA,QAAI,CAAC,KAAK,KAAK,CAAC,QAAQ,IAAI,QAAQ,OAAO,GAAG,GAAG;AAChD,iBAAO;AAAA,YACN;AAAA,UACC,iCAAoB;AAAA,UACpB,QAAQ,OAAO,gBAAgB,OAAO,GAAG,kCAAkC,IAAI;AAAA,QAChF;AAAA,MACD;AAAA,IACD;AACA,eAAO,iBAAG,MAAS;AAAA,EACpB;AAEA,MAAI,CAAC,mBAAmB;AACvB,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB,YAAY,IAAI;AAAA,MACjB;AAAA,IACD;AAAA,EACD;AAEA,aAAO,iBAAG,MAAS;AACpB;;;AG9bA,IAAAC,eAuBO;AAMP;AA2CA,eAAsB,qBACrB,WACA,UACA,cACA,SAC8C;AAC9C,QAAM,eAAe,MAAM;AAAA,IAC1B,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV;AAAA,IACA;AAAA,EACD;AACA,MAAI,CAAC,aAAa,GAAI,YAAO,kBAAI,aAAa,KAAK;AAEnD,QAAM,SAAS,aAAa,MAAM,QAAQ,iBAAiB;AAG3D,QAAM,oBAAoB,qBAAqB,MAAM;AACrD,MAAI,CAAC,kBAAkB,SAAS,uBAAuB,QAAQ,GAAG;AACjE,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAEA,QAAM,uBAAuB,QAAQ;AACrC,MAAI,CAAC,sBAAsB;AAC1B,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAEA,QAAM,wBAAwB,aAAa,MAAM;AACjD,QAAM,iBAAiB,SAAS;AAEhC,QAAM,SAAS,MAAM,SAAS,YAAY,oBAAoB;AAC9D,6CAAyB,MAAM;AAC/B,QAAM,UAAM,yBAAW,SAAS,KAAK;AACrC,QAAM,MAAM,SAAS,iCAAiC;AACtD,QAAM,oBAAoB,CAAC,GAAG,aAAa,MAAM,iBAAiB;AAElE,QAAM,YAAqC;AAAA,IAC1C,KAAK,SAAS;AAAA,IACd,KAAK,SAAS;AAAA,IACd,KAAK,UAAU;AAAA,IACf,KAAK;AAAA,IACL,KAAK,MAAM;AAAA,IACX,MAAM,OAAO;AAAA,IACb,iBAAiB;AAAA,IACjB,UAAU,SAAS;AAAA,EACpB;AAEA,MAAI,SAAS,cAAc,SAAS,WAAW,SAAS,GAAG;AAC1D,cAAU,cAAc,SAAS;AAAA,EAClC;AAEA,QAAM,eAAwC,CAAC;AAC/C,MAAI,kBAAkB,SAAS,GAAG;AACjC,iBAAa,cAAc;AAAA,EAC5B;AAEA,MAAI,SAAS,uBAAuB;AACnC,QAAI,CAAC,uBAAuB;AAC3B,iBAAO;AAAA,YACN;AAAA,UACC,+BAAkB;AAAA,UAClB;AAAA,QACD;AAAA,MACD;AAAA,IACD;AACA,UAAM,kBAAkB,UAAM;AAAA,MAC7B,UAAU;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,IACD;AACA,QAAI,CAAC,gBAAgB,IAAI;AACxB,iBAAO;AAAA,YACN;AAAA,UACC,+BAAkB;AAAA,UAClB,4DAA4D,UAAU,QAAQ,cAAc,qBAAqB,KAAK,gBAAgB,MAAM,WAAW;AAAA,QACxJ;AAAA,MACD;AAAA,IACD;AACA,iBAAa,mBAAmB,gBAAgB;AAAA,EACjD;AAEA,QAAM,QAAQ,UAAM,kCAAoB,WAAW,OAAO,QAAQ;AAAA,IACjE,KAAK,oBAAO;AAAA,IACZ,GAAI,OAAO,KAAK,YAAY,EAAE,SAAS,IAAI,EAAE,aAAa,IAAI,CAAC;AAAA,EAChE,CAAC;AAED,QAAM,aAAa,SAAS,cAAc;AAC1C,QAAM,UAAU,IAAI,QAAQ,sBAAsB;AAAA,IACjD,QAAQ;AAAA,IACR,SAAS;AAAA,MACR,gBAAgB,uBAAU;AAAA,IAC3B;AAAA,IACA,MAAM;AAAA,EACP,CAAC;AAED,QAAM,WAAW,MAAM,WAAW,OAAO;AACzC,MAAI,SAAS,WAAW,KAAK;AAE5B,eAAO;AAAA,UACN;AAAA,QACC,+BAAkB;AAAA,QAClB,sCAAsC,SAAS,MAAM;AAAA,MACtD;AAAA,IACD;AAAA,EACD;AAEA,QAAM,sBAAsB,SAAS,QAAQ,IAAI,cAAc;AAC/D,MAAI,KAAC,iCAAmB,qBAAqB,8CAA8C,GAAG;AAC7F,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB,wDAAwD,8CAA8C;AAAA,MACvG;AAAA,IACD;AAAA,EACD;AAEA,QAAM,cAAc,MAAM,SAAS,KAAK;AAOxC,QAAM,eAAe,aAAa,MAAM,QAAQ;AAChD,QAAM,kBACL,aAAa,SAAS,IAClB,aAAa,CAAC,IACd,aAAa,CAAC;AACnB,QAAM,SAAS,gBAAgB,QAAQ;AAEvC,MAAI,CAAC,QAAQ;AACZ,eAAO;AAAA,UACN;AAAA,QACC,+BAAkB;AAAA,QAClB;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAEA,QAAM,eAAe,UAAM,oCAAsB,aAAa,QAAQ;AAAA,IACrE,aAAa;AAAA,IACb,GAAI,SAAS,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,IACjD,GAAI,SAAS,qBAAqB,SAC/B,EAAE,kBAAkB,QAAQ,iBAAiB,IAC7C,CAAC;AAAA,EACL,CAAC;AACD,MAAI,CAAC,aAAa,IAAI;AACrB,eAAO;AAAA,UACN;AAAA,QACC,+BAAkB;AAAA,QAClB;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAEA,QAAM,cAAU,oCAAsB,WAAW;AACjD,MAAI,CAAC,QAAQ,IAAI;AAChB,eAAO;AAAA,UACN;AAAA,QACC,+BAAkB;AAAA,QAClB;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAEA,MAAI,QAAQ,MAAM,OAAO,QAAQ,6CAA6C;AAC7E,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB,mCAAmC,2CAA2C;AAAA,MAC/E;AAAA,IACD;AAAA,EACD;AAEA,QAAM,kBAAkB,QAAQ,MAAM;AAEtC,MAAI,gBAAgB,QAAS,UAAU,UAAqB;AAC3D,eAAO;AAAA,UACN,8BAAgB,iCAAoB,eAAe,gCAAgC;AAAA,IACpF;AAAA,EACD;AAEA,MAAI,gBAAgB,QAAQ,QAAW;AACtC,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAEA,MAAI,gBAAgB,QAAS,SAAS,UAAqB;AAC1D,eAAO;AAAA,UACN,8BAAgB,iCAAoB,gBAAgB,gCAAgC;AAAA,IACrF;AAAA,EACD;AAEA,MAAI,gBAAgB,QAAS,SAAS,UAAqB;AAC1D,eAAO;AAAA,UACN,8BAAgB,iCAAoB,gBAAgB,gCAAgC;AAAA,IACrF;AAAA,EACD;AAGA,QAAM,cAAc,gBAAgB;AACpC,MAAI,gBAAgB,QAAW;AAC9B,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB;AAAA,MACD;AAAA,IACD;AAAA,EACD;AACA,QAAM,kBAAc,yBAAW,SAAS,KAAK;AAC7C,MAAI,eAAe,aAAa;AAC/B,eAAO,sBAAI,8BAAgB,+BAAkB,SAAS,mCAAmC,CAAC;AAAA,EAC3F;AAEA,MAAI,gBAAgB,QAAQ,QAAW;AACtC,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAEA,QAAM,cAAc,gBAAgB;AACpC,MAAI,CAAC,eAAe,CAAC,aAAa,IAAI,WAAuB,GAAG;AAC/D,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAEA,MAAI,gBAAiB,uBAAkC;AACtD,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAIA,QAAM,yBAAyB,gBAAgB;AAC/C,MAAI,CAAC,MAAM,QAAQ,sBAAsB,KAAK,uBAAuB,WAAW,GAAG;AAClF,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB;AAAA,MACD;AAAA,IACD;AAAA,EACD;AACA,aAAW,QAAQ,wBAAwB;AAC1C,QAAI,OAAO,SAAS,UAAU;AAC7B,iBAAO;AAAA,YACN;AAAA,UACC,iCAAoB;AAAA,UACpB;AAAA,QACD;AAAA,MACD;AAAA,IACD;AAAA,EACD;AACA,QAAM,wBAAwB;AAAA,IAC7B,aAAa,MAAM;AAAA,IACnB;AAAA,EACD;AACA,MAAI,uBAAuB,CAAC,MAAM,uBAAuB;AACxD,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAEA,MAAI,cAAc,aAAa,MAAM,QAAQ,WAAW;AACvD,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAEA,QAAM,eAAe,gBAAgB;AAGrC,MAAI,CAAC,gBAAgB,OAAO,iBAAiB,UAAU;AACtD,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB;AAAA,MACD;AAAA,IACD;AAAA,EACD;AACA,QAAM,iBAAiB,IAAI,IAAI,OAAO,KAAK,SAAS,QAAQ,CAAC;AAC7D,QAAM,gBAAgB,IAAI,IAAI,OAAO,KAAK,YAAY,CAAC;AACvD,aAAW,iBAAiB,gBAAgB;AAC3C,QAAI,CAAC,cAAc,IAAI,aAAa,GAAG;AACtC,iBAAO;AAAA,YACN;AAAA,UACC,iCAAoB;AAAA,UACpB;AAAA,QACD;AAAA,MACD;AAAA,IACD;AAAA,EACD;AACA,aAAW,gBAAgB,eAAe;AACzC,QAAI,CAAC,eAAe,IAAI,YAAY,GAAG;AACtC,iBAAO;AAAA,YACN;AAAA,UACC,iCAAoB;AAAA,UACpB;AAAA,QACD;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAEA,MAAI,gBAAgB,kBAAkB,QAAW;AAChD,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAEA,QAAM,qBAAqB,aAAa;AACxC,MACC,CAAC,sBACD,OAAO,uBAAuB,YAC9B,MAAM,QAAQ,kBAAkB,GAC/B;AACD,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAEA,QAAM,2BACL,qDAAqD,UAAU,kBAAkB;AAClF,MAAI,CAAC,yBAAyB,SAAS;AACtC,UAAM,aAAa,yBAAyB,MAAM,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK,KAAK,GAAG,CAAC;AAC5F,QAAI,WAAW,KAAK,CAAC,SAAS,SAAS,WAAW,GAAG;AACpD,iBAAO;AAAA,YACN;AAAA,UACC,iCAAoB;AAAA,UACpB;AAAA,QACD;AAAA,MACD;AAAA,IACD;AACA,QAAI,WAAW,KAAK,CAAC,SAAS,SAAS,eAAe,GAAG;AACxD,iBAAO;AAAA,YACN;AAAA,UACC,iCAAoB;AAAA,UACpB;AAAA,QACD;AAAA,MACD;AAAA,IACD;AACA,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAEA,QAAM,WAAW,yBAAyB,KAAK;AAC/C,QAAM,eAAe,yBAAyB,KAAK;AACnD,QAAM,wBAAwB,yBAAyB,KAAK;AAC5D,MAAI,iBAAiB,UAAa,0BAA0B,QAAW;AACtE,QAAI,wBAAwB,aAAa;AACxC,iBAAO;AAAA,YACN;AAAA,UACC,iCAAoB;AAAA,UACpB;AAAA,QACD;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAEA,MACC,gBAAgB,SAAS,UACzB,KAAK,UAAU,gBAAgB,IAAI,MAAM,KAAK,UAAU,OAAO,IAAI,GAClE;AACD,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAGA,QAAM,sBAAsB,aAAa,MAAM,QAAQ;AAEvD,QAAM,SAAqC;AAAA,IAC1C,uBAAuB,QAAQ;AAAA,IAC/B;AAAA,IACA,WAAW,gBAAgB;AAAA,IAC3B;AAAA,IACA;AAAA,EACD;AACA,MAAI,iBAAiB,QAAW;AAC/B,eAAO,iBAAG,EAAE,GAAG,QAAQ,aAAa,CAAC;AAAA,EACtC;AACA,aAAO,iBAAG,MAAM;AACjB;AAEA,SAAS,kCACR,SACA,eACS;AACT,QAAM,oBAAoB,QAAQ,WAAW,CAAC;AAC9C,MAAI,CAAC,kBAAmB,QAAO;AAC/B,SAAO,kBAAkB,QAAQ;AAClC;;;AC1fA,IAAAC,eAqBO;;;ACrBP,IAAAC,eAKO;AACP,IAAAC,cAAkB;AAClB;AAGO,IAAM,2CAA2C,cACtD,YAAY;AAAA,EACZ,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK,cAAE,OAAO;AAAA,EACd,KAAK,cAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/B,KAAK,cAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/B,MAAM;AAAA,EACN,iBAAiB,cAAE,MAAM,2BAAc,EAAE,IAAI,CAAC;AAAA,EAC9C,UAAU;AAAA,EACV,aAAa,cAAE,MAAM,+BAAkB,EAAE,SAAS;AACnD,CAAC,EACA,OAAO,CAAC,QAAQ,IAAI,MAAM,IAAI,KAAK;AAAA,EACnC,SAAS;AAAA,EACT,MAAM,CAAC,KAAK;AACb,CAAC,EACA,OAAO,CAAC,QAAQ,IAAI,QAAQ,IAAI,KAAK;AAAA,EACrC,SAAS;AACV,CAAC,EACA;AAAA,EACA,CAAC,QAAQ;AACR,UAAM,OAAO,IAAI;AACjB,WAAO,SAAS,UAAa,0BAA0B;AAAA,EACxD;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM,CAAC,UAAU;AAAA,EAClB;AACD;AAED,IAAM,6CAA6C,cACjD,OAAO,cAAE,OAAO,GAAG,cAAE,OAAO,cAAE,OAAO,GAAG,cAAE,QAAQ,CAAC,CAAC,EACpD,YAAY,CAAC,UAAU,QAAQ;AAC/B,QAAM,SAAS,qDAAqD;AAAA,IACnE,SAAS;AAAA,EACV;AACA,MAAI,CAAC,OAAO,SAAS;AACpB,QAAI,SAAS;AAAA,MACZ,MAAM,cAAE,aAAa;AAAA,MACrB,SAAS;AAAA,MACT,MAAM,CAAC,sBAAsB;AAAA,IAC9B,CAAC;AAAA,EACF;AACD,CAAC;AAGK,IAAM,4CAA4C,cACvD,YAAY;AAAA,EACZ,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK,cAAE,OAAO;AAAA,EACd,KAAK,cAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/B,KAAK,cAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/B,UAAU;AAAA,EACV,cAAc;AAAA,EACd,iBAAiB,cAAE,MAAM,2BAAc,EAAE,OAAO,CAAC;AAClD,CAAC,EACA,OAAO,CAAC,QAAQ,IAAI,MAAM,IAAI,KAAK;AAAA,EACnC,SAAS;AAAA,EACT,MAAM,CAAC,KAAK;AACb,CAAC,EACA,OAAO,CAAC,QAAQ,EAAE,mBAAmB,MAAM;AAAA,EAC3C,SAAS;AAAA,EACT,MAAM,CAAC,eAAe;AACvB,CAAC,EACA,YAAY,CAAC,KAAK,QAAQ;AAC1B,QAAM,aAAa,IAAI,SAAS;AAChC,MACC,OAAO,YAAY,kBAAkB,YACrC,OAAO,WAAW,6BAA6B,YAC/C,WAAW,2BAA2B,IAAI,KACzC;AACD,QAAI,SAAS;AAAA,MACZ,MAAM,cAAE,aAAa;AAAA,MACrB,SAAS;AAAA,MACT,MAAM,CAAC,YAAY,wBAAwB,0BAA0B;AAAA,IACtE,CAAC;AAAA,EACF;AACD,CAAC;;;AD1DF;AAUA,IAAM,yBAAkD;AAAA,EACvD,gBAAgB,CAAC,MAAM;AAAA,EACvB,aAAa,CAAC,oBAAoB;AAAA,EAClC,4BAA4B;AAC7B;AACA,IAAM,0CAA0C;AAAA,EAC/C;AAAA,EACA;AACD;AAkCO,SAAS,kCACf,QAC0C;AAC1C,QAAM,eAAe,2BAA2B,OAAO,YAAY;AAEnE,SAAO,OAAO,YAAqB;AAClC,UAAM,kBAAc,4BAAc,SAAS,MAAM;AACjD,QAAI,YAAa,QAAO;AAExB,UAAM,cAAc,QAAQ,QAAQ,IAAI,cAAc;AACtD,UAAM,4BAAwB,iCAAmB,aAAa,uBAAU,eAAe;AACvF,UAAM,uBAAmB,iCAAmB,aAAa,uBAAU,UAAU;AAC7E,QAAI,CAAC,yBAAyB,CAAC,kBAAkB;AAChD,iBAAO;AAAA,QACN;AAAA,QACA;AAAA,QACA;AAAA,MACD;AAAA,IACD;AAEA,UAAM,OAAO,UAAM,gCAAkB,SAAS,2CAA8B;AAC5E,QAAI,CAAC,KAAK,GAAI,YAAO,4BAAc,KAAK,mBAAmB,wBAAwB;AACnF,UAAM,OAAO,KAAK;AAClB,QAAI,CAAC,KAAM,YAAO,4BAAc,KAAK,mBAAmB,sBAAsB;AAE9E,QAAI;AACJ,QAAI;AACJ,QAAI,kBAAkB;AACrB,YAAMC,eAAc,wBAAwB,IAAI;AAChD,UAAI,CAACA,aAAY,IAAI;AACpB,mBAAO,4BAAc,KAAKA,aAAY,MAAM,MAAMA,aAAY,MAAM,WAAW;AAAA,MAChF;AACA,+BAAyBA,aAAY;AACrC,cAAQ,uBAAuB,CAAC;AAAA,IACjC,OAAO;AACN,cAAQ;AAAA,IACT;AAEA,UAAM,cAAU,oCAAsB,KAAK;AAC3C,QAAI,CAAC,QAAQ,IAAI;AAChB,iBAAO,4BAAc,KAAK,mBAAmB,8BAA8B;AAAA,IAC5E;AAEA,UAAM,SAAS,QAAQ,MAAM;AAC7B,UAAM,UAAU,QAAQ,MAAM;AAE9B,QAAI,OAAO,QAAQ,oBAAO,iBAAiB;AAC1C,iBAAO;AAAA,QACN;AAAA,QACA;AAAA,QACA,iCAAiC,oBAAO,eAAe;AAAA,MACxD;AAAA,IACD;AAEA,UAAM,cAAc,yCAAyC,UAAU,OAAO;AAC9E,QAAI,CAAC,YAAY,SAAS;AACzB,iBAAO,4BAAc,KAAK,mBAAmB,sCAAsC;AAAA,IACpF;AAEA,UAAM,aAAa,YAAY;AAE/B,UAAM,mBAAmB,iCAAiC;AAAA,MACzD,WAAW,SAAS;AAAA,IACrB;AACA,QAAI,CAAC,iBAAiB,SAAS;AAC9B,iBAAO;AAAA,QACN;AAAA,QACA,iCAAoB;AAAA,QACpB;AAAA,MACD;AAAA,IACD;AAEA,UAAM,MAAM,WAAW;AACvB,QAAI,QAAQ,OAAO,YAAY;AAC9B,iBAAO,4BAAc,KAAK,mBAAmB,mCAAmC;AAAA,IACjF;AAEA,UAAM,aAAa,UAAM,oCAAsB,OAAO,WAAW,MAAM;AAAA,MACtE,GAAI,OAAO,SAAS,QAAQ,EAAE,OAAO,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,MAC/D,GAAI,OAAO,SAAS,qBAAqB,SACtC,EAAE,kBAAkB,OAAO,QAAQ,iBAAiB,IACpD,CAAC;AAAA,IACL,CAAC;AACD,QAAI,CAAC,WAAW,IAAI;AACnB,iBAAO;AAAA,QACN;AAAA,QACA;AAAA,QACA;AAAA,MACD;AAAA,IACD;AAEA,QAAI,WAAW,QAAQ,WAAW,KAAK;AACtC,iBAAO,4BAAc,KAAK,mBAAmB,4CAA4C;AAAA,IAC1F;AAEA,UAAM,mBAAmB,OAAO;AAChC,QAAI,oBAAoB,iBAAiB,SAAS,GAAG;AACpD,YAAM,aAAa,iBAAiB,CAAC;AACrC,YAAM,mBAAe,oCAAsB,UAAU;AACrD,UAAI,CAAC,aAAa,IAAI;AACrB,mBAAO;AAAA,UACN;AAAA,UACA,iCAAoB;AAAA,UACpB;AAAA,QACD;AAAA,MACD;AACA,YAAM,eAAe,aAAa,MAAM;AACxC,UAAI,aAAa,QAAQ,WAAW,OAAO,aAAa,QAAQ,WAAW,KAAK;AAC/E,mBAAO;AAAA,UACN;AAAA,UACA,iCAAoB;AAAA,UACpB;AAAA,QACD;AAAA,MACD;AAAA,IACD;AAEA,UAAM,uBAAuB,OAAO;AAGpC,QAAI,oBAAoB,yBAAyB,QAAW;AAC3D,iBAAO;AAAA,QACN;AAAA,QACA;AAAA,QACA;AAAA,MACD;AAAA,IACD;AAEA,QAAI,wBAAwB,qBAAqB,SAAS,GAAG;AAC5D,YAAM,uBAAmB,oCAAsB,qBAAqB,CAAC,CAAW;AAChF,UAAI,CAAC,iBAAiB,IAAI;AACzB,mBAAO;AAAA,UACN;AAAA,UACA,iCAAoB;AAAA,UACpB;AAAA,QACD;AAAA,MACD;AACA,YAAM,mBAAmB,iBAAiB,MAAM;AAChD,UACC,iBAAiB,QAAQ,OAAO,cAChC,iBAAiB,QAAQ,OAAO,YAC/B;AACD,mBAAO;AAAA,UACN;AAAA,UACA,iCAAoB;AAAA,UACpB;AAAA,QACD;AAAA,MACD;AAIA,UAAI,oBAAoB,iBAAiB,SAAS,GAAG;AACpD,cAAM,0BAAsB;AAAA,UAC3B,iBAAiB,iBAAiB,SAAS,CAAC;AAAA,QAC7C;AACA,cAAM,4BAAwB;AAAA,UAC7B,qBAAqB,qBAAqB,SAAS,CAAC;AAAA,QACrD;AACA,YAAI,CAAC,oBAAoB,MAAM,CAAC,sBAAsB,IAAI;AACzD,qBAAO;AAAA,YACN;AAAA,YACA,iCAAoB;AAAA,YACpB;AAAA,UACD;AAAA,QACD;AACA,cAAM,eAAgB,oBAAoB,MAAM,QAAoC;AAGpF,cAAM,iBAAkB,sBAAsB,MAAM,QAClD;AACF,YAAI,iBAAiB,gBAAgB;AACpC,qBAAO;AAAA,YACN;AAAA,YACA,iCAAoB;AAAA,YACpB,mCAAmC,cAAc,gDAAgD,YAAY;AAAA,UAC9G;AAAA,QACD;AAAA,MACD;AAAA,IACD;AAEA,UAAM,iBAAa,uBAAS,WAAW,GAAG;AAC1C,QAAI;AAEJ,QAAI,2BAA2B,QAAW;AACzC,YAAM,iBAAiB,MAAM;AAAA,QAC5B;AAAA,QACA;AAAA,QACA;AAAA,UACC,GAAG,OAAO;AAAA,UACV,iBAAiB;AAAA,UACjB,8BAA8B,OAAO;AAAA,UACrC,OAAO;AAAA,QACR;AAAA,MACD;AACA,UAAI,CAAC,eAAe,IAAI;AACvB,mBAAO,4BAAc,KAAK,eAAe,MAAM,MAAM,eAAe,MAAM,WAAW;AAAA,MACtF;AACA,kBAAY,eAAe;AAAA,IAC5B,WAAW,qBAAqB,QAAW;AAC1C,YAAM,mBAAmB,MAAM,2BAA2B,kBAAkB,cAAc;AAAA,QACzF,GAAG,OAAO;AAAA,QACV,iBAAiB;AAAA,QACjB,8BAA8B,OAAO;AAAA,QACrC,OAAO;AAAA,MACR,CAAC;AACD,UAAI,CAAC,iBAAiB,IAAI;AACzB,mBAAO,4BAAc,KAAK,iBAAiB,MAAM,MAAM,iBAAiB,MAAM,WAAW;AAAA,MAC1F;AACA,kBAAY,iBAAiB;AAAA,IAC9B,OAAO;AACN,YAAM,cAAc,MAAM;AAAA,QACzB;AAAA,QACA;AAAA,QACA,OAAO,WAAW,CAAC;AAAA,MACpB;AACA,UAAI,CAAC,YAAY,IAAI;AACpB,mBAAO,4BAAc,KAAK,YAAY,MAAM,MAAM,YAAY,MAAM,WAAW;AAAA,MAChF;AACA,kBAAY,YAAY;AAAA,IACzB;AAEA,QAAI;AACJ,QAAI,wBAAwB,qBAAqB,SAAS,GAAG;AAC5D,YAAM,iBAAiB,MAAM,2BAA2B,sBAAsB,cAAc;AAAA,QAC3F,GAAG,OAAO;AAAA,QACV,iBAAiB,OAAO;AAAA,QACxB,OAAO;AAAA,MACR,CAAC;AACD,UAAI,CAAC,eAAe,IAAI;AACvB,mBAAO;AAAA,UACN;AAAA,UACA,iCAAoB;AAAA,UACpB,eAAe,MAAM;AAAA,QACtB;AAAA,MACD;AACA,UAAI,eAAe,MAAM,kBAAkB,UAAU,eAAe;AACnE,mBAAO;AAAA,UACN;AAAA,UACA,iCAAoB;AAAA,UACpB,mCAAmC,eAAe,MAAM,aAAa,gDAAgD,UAAU,aAAa;AAAA,QAC7I;AAAA,MACD;AACA,+BAAyB,eAAe,MAAM,iBAAiB,mBAAmB,CAAC;AAAA,IACpF;AAEA,UAAM,iBACL,2BAA2B,SAAY,EAAE,uBAAuB,IAAI;AAErE,QAAI;AACJ,QAAI,OAAO,+BAA+B,WAAW,UAAU;AAC9D,YAAMC,kBAAiB,WAAW;AAClC,YAAM,gBAAgB,OAAO,4BAA4B;AAAA,QACxDA;AAAA,QACA;AAAA,MACD;AACA,UAAI,CAAC,cAAc,IAAI;AACtB,mBAAO,4BAAc,KAAK,cAAc,MAAM,MAAM,cAAc,MAAM,WAAW;AAAA,MACpF;AACA,0BAAoB,cAAc;AAAA,IACnC;AAEA,UAAM,SAAS,MAAM,OAAO,YAAY,oBAAoB;AAC5D,UAAM,UAAM,yBAAW,OAAO,SAAS,KAAK;AAE5C,UAAM,gBAAgB,UAAU;AAEhC,UAAM,gBACL,OAAO,kCAAkC;AAC1C,QAAI,kBAAkB,MAAM;AAC5B,QAAI,WAAW;AACd,YAAM,WAAW,UAAU;AAC3B,UAAI,WAAW,iBAAiB;AAC/B,0BAAkB;AAAA,MACnB;AAAA,IACD;AAEA,QAAI;AACJ,QAAI,aAAa,UAAU,WAAW,SAAS,GAAG;AACjD,YAAM,eAAe,UAAU,WAAW,CAAC;AAC3C,4BAAsB,aAAa,QAAQ;AAAA,IAC5C;AAEA,UAAM,kBAA2C;AAAA,MAChD,KAAK,OAAO;AAAA,MACZ,KAAK,WAAW;AAAA,MAChB,KAAK,WAAW;AAAA,MAChB,KAAK;AAAA,MACL,KAAK;AAAA,MACL,cAAc;AAAA,MACd,iBAAiB,sBAAsB,CAAC,mBAAmB,IAAI,CAAC,aAAa;AAAA,IAC9E;AAEA,UAAM,sBAAsB,qBAAqB,WAAW;AAC5D,QAAI,qBAAqB;AACxB,YAAM,mBAAmB,EAAE,GAAI,oBAAgD;AAC/E,YAAM,eAAgB,iBAAiB,wBAAwB,CAAC;AAChE,UAAIC;AACJ,UAAI,OAAO,+BAA+B,WAAW;AACpD,QAAAA,UAAS,OAAO,4BAA4B;AAAA,UAC3C;AAAA,UACA;AAAA,UACA;AAAA,QACD;AAAA,MACD,OAAO;AACN,QAAAA,UAAS,EAAE,GAAG,aAAa;AAAA,MAC5B;AAEA,UAAI,CAACA,QAAO,WAAW;AACtB,QAAAA,QAAO,YAAY,WAAW;AAAA,MAC/B;AAEA,iBAAW,CAAC,KAAK,YAAY,KAAK,OAAO,QAAQ,sBAAsB,GAAG;AACzE,YAAI,EAAE,OAAOA,UAAS;AACrB,UAAAA,QAAO,GAAG,IAAI;AAAA,QACf;AAAA,MACD;AAEA,uBAAiB,uBAAuBA;AACxC,sBAAgB,WAAW;AAAA,IAC5B,OAAO;AACN,sBAAgB,WAAW;AAAA,QAC1B,sBAAsB;AAAA,UACrB,WAAW,WAAW;AAAA,UACtB,GAAG;AAAA,QACJ;AAAA,MACD;AAAA,IACD;AAEA,QAAI,OAAO,sBAAsB;AAChC,YAAM,eAAe,MAAM,OAAO,qBAAqB,UAAU;AACjE,UAAI,cAAc;AACjB,cAAMD,kBAAiB,gBAAgB;AACvC,cAAMC,UAAUD,gBAAe,wBAAwB,CAAC;AACxD,QAAAC,QAAO,gBAAgB;AACvB,QAAAD,gBAAe,uBAAuBC;AACtC,wBAAgB,WAAWD;AAAA,MAC5B;AAAA,IACD;AACA,UAAM,iBAAiB,gBAAgB;AACvC,UAAM,SAAU,eAAe,wBAAwB,CAAC;AACxD,mBAAe,uBAAuB,kCAAkC,MAAM;AAC9E,oBAAgB,WAAW;AAE3B,UAAM,qBAAqB,0CAA0C,UAAU,eAAe;AAC9F,QAAI,CAAC,mBAAmB,SAAS;AAChC,iBAAO;AAAA,QACN;AAAA,QACA,iCAAoB;AAAA,QACpB;AAAA,MACD;AAAA,IACD;AAEA,UAAM,cAAc,UAAM,kCAAoB,iBAAiB,OAAO,QAAQ;AAAA,MAC7E,KAAK;AAAA,IACN,CAAC;AAED,QAAI,OAAO,4BAA4B;AACtC,UAAI;AACH,cAAM,OAAO,2BAA2B,UAAU;AAAA,MACnD,QAAQ;AACP,mBAAO,4BAAc,KAAK,iCAAoB,aAAa,0BAA0B;AAAA,MACtF;AAAA,IACD;AAEA,QAAI,OAAO,gBAAgB;AAC1B,YAAMA,kBAAiB,gBAAgB;AACvC,YAAM,iBAAkBA,iBAAgB,wBAAwB,CAAC;AAIjE,YAAM,eACL,OAAO,eAAe,kBAAkB,WAAW,eAAe,gBAAgB;AACnF,UAAI;AACH,cAAM,OAAO,eAAe,YAAY,gBAAgB,YAAY;AAAA,MACrE,QAAQ;AACP,mBAAO,4BAAc,KAAK,iCAAoB,aAAa,0BAA0B;AAAA,MACtF;AAAA,IACD;AAEA,eAAO,0BAAY,aAAa,8CAA8C;AAAA,EAC/E;AACD;AAEA,SAAS,kCACR,UAC0B;AAC1B,QAAM,WAAW,EAAE,GAAG,SAAS;AAC/B,aAAW,SAAS,yCAAyC;AAC5D,WAAO,SAAS,KAAK;AAAA,EACtB;AACA,SAAO;AACR;;;AEzdA,IAAAE,gBAeO;;;ACdP,IAAAC,eAUO;AAwBA,SAAS,qCACf,kBACA,SAC+B;AAC/B,QAAM,cAAU,oCAAsB,gBAAgB;AACtD,MAAI,CAAC,QAAQ,IAAI;AAChB,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB,oCAAoC,QAAQ,MAAM,WAAW;AAAA,MAC9D;AAAA,IACD;AAAA,EACD;AAEA,QAAM,EAAE,QAAQ,QAAQ,IAAI,QAAQ;AACpC,QAAM,SAAS;AAEf,MAAI,OAAO,QAAQ,kBAAkB;AACpC,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB,iCAAiC,gBAAgB,WAAW,OAAO,OAAO,GAAG,CAAC;AAAA,MAC/E;AAAA,IACD;AAAA,EACD;AAEA,MAAI,OAAO,QAAQ,QAAW;AAC7B,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAEA,QAAM,WAAW,OAAO;AACxB,MAAI,CAAC,UAAU;AACd,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB;AAAA,MACD;AAAA,IACD;AAAA,EACD;AACA,MAAI,KAAC,8BAAgB,QAAQ,GAAG;AAC/B,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAEA,QAAM,MAAM,OAAO;AACnB,MAAI,QAAQ,UAAU;AACrB,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB,0BAA0B,OAAO,GAAG,CAAC,+BAA+B,QAAQ;AAAA,MAC7E;AAAA,IACD;AAAA,EACD;AAGA,QAAM,MAAM,OAAO;AACnB,MAAI,MAAM,QAAQ,GAAG,GAAG;AACvB,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB;AAAA,MACD;AAAA,IACD;AAAA,EACD;AACA,MAAI,QAAS,QAAQ,YAAuB;AAC3C,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB,0BAA0B,OAAO,GAAG,CAAC,4CAA4C,QAAQ,UAAU;AAAA,MACpG;AAAA,IACD;AAAA,EACD;AAEA,QAAM,MAAM,OAAO;AACnB,MAAI,QAAQ,QAAW;AACtB,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB;AAAA,MACD;AAAA,IACD;AAAA,EACD;AACA,QAAM,YAAY,QAAQ,oBAAoB;AAC9C,QAAM,UAAM,yBAAW,QAAQ,KAAK;AACpC,MAAI,MAAM,aAAa,KAAK;AAC3B,eAAO,sBAAI,8BAAgB,iCAAoB,gBAAgB,4BAA4B,CAAC;AAAA,EAC7F;AAEA,QAAM,MAAM,OAAO;AACnB,MAAI,CAAC,KAAK;AACT,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAEA,MAAI,OAAO,iBAAiB,QAAW;AACtC,eAAO;AAAA,UACN;AAAA,QACC,iCAAoB;AAAA,QACpB;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAEA,QAAM,mBAAmB,OAAO;AAChC,MAAI,oBAAoB,iBAAiB,SAAS,GAAG;AACpD,UAAM,aAAa,iBAAiB,CAAC;AACrC,UAAM,mBAAe,oCAAsB,UAAU;AACrD,QAAI,CAAC,aAAa,IAAI;AACrB,iBAAO;AAAA,YACN;AAAA,UACC,iCAAoB;AAAA,UACpB;AAAA,QACD;AAAA,MACD;AAAA,IACD;AACA,UAAM,eAAe,aAAa,MAAM;AACxC,QAAI,aAAa,QAAQ,YAAY,aAAa,QAAQ,UAAU;AACnE,iBAAO;AAAA,YACN;AAAA,UACC,iCAAoB;AAAA,UACpB;AAAA,QACD;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAEA,QAAM,uBAAuB,OAAO;AACpC,MAAI,wBAAwB,qBAAqB,SAAS,GAAG;AAC5D,UAAM,iBAAiB,qBAAqB,CAAC;AAC7C,UAAM,uBAAmB,oCAAsB,cAAc;AAC7D,QAAI,CAAC,iBAAiB,IAAI;AACzB,iBAAO;AAAA,YACN;AAAA,UACC,iCAAoB;AAAA,UACpB;AAAA,QACD;AAAA,MACD;AAAA,IACD;AACA,UAAM,mBAAmB,iBAAiB,MAAM;AAChD,QACC,iBAAiB,QAAQ,QAAQ,cACjC,iBAAiB,QAAQ,QAAQ,YAChC;AACD,iBAAO;AAAA,YACN;AAAA,UACC,iCAAoB;AAAA,UACpB;AAAA,QACD;AAAA,MACD;AAAA,IACD;AAGA,QAAI,oBAAoB,iBAAiB,SAAS,GAAG;AACpD,YAAM,cAAc,iBAAiB,iBAAiB,SAAS,CAAC;AAChE,YAAM,gBAAgB,qBAAqB,qBAAqB,SAAS,CAAC;AAC1E,YAAM,oBAAgB,oCAAsB,WAAW;AACvD,YAAM,sBAAkB,oCAAsB,aAAa;AAC3D,UAAI,CAAC,cAAc,MAAM,CAAC,gBAAgB,IAAI;AAC7C,mBAAO;AAAA,cACN;AAAA,YACC,iCAAoB;AAAA,YACpB;AAAA,UACD;AAAA,QACD;AAAA,MACD;AACA,YAAM,SAAS,2BAA2B,cAAc,MAAM,OAAO;AACrE,YAAM,WAAW,2BAA2B,gBAAgB,MAAM,OAAO;AACzE,UAAI,WAAW,UAAU;AACxB,mBAAO;AAAA,cACN;AAAA,YACC,iCAAoB;AAAA,YACpB,mCAAmC,QAAQ,gDAAgD,MAAM;AAAA,UAClG;AAAA,QACD;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAEA,QAAM,YAAoC;AAAA,IACzC,YAAY;AAAA,IACZ,YAAY,QAAQ;AAAA,IACpB;AAAA,IACA;AAAA,IACA,GAAI,OAAO,QAAQ,SAAY,EAAE,KAAK,OAAO,IAAc,IAAI,CAAC;AAAA,IAChE;AAAA,IACA,GAAI,mBAAmB,EAAE,iBAAiB,IAAI,CAAC;AAAA,IAC/C,GAAI,uBAAuB,EAAE,qBAAqB,IAAI,CAAC;AAAA,EACxD;AAEA,aAAO,iBAAG,SAAS;AACpB;AAGA,SAAS,2BAA2B,SAAsD;AAGzF,QAAM,MAAM,QAAQ;AACpB,SAAO;AACR;;;ADnMA,eAAsB,6BACrB,kBACA,cACA,SAC0D;AAC1D,QAAM,qBAAqB,4BAA4B,YAAY;AACnE,MAAI,CAAC,mBAAmB,GAAI,QAAO;AACnC,QAAM,yBAAyB,mBAAmB;AAElD,QAAM,YAAY,qCAAqC,kBAAkB;AAAA,IACxE,YAAY,QAAQ;AAAA,IACpB,GAAI,QAAQ,qBAAqB,SAC9B,EAAE,kBAAkB,QAAQ,iBAAiB,IAC7C,CAAC;AAAA,IACJ,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,EACjD,CAAC;AACD,MAAI,CAAC,UAAU,GAAI,QAAO;AAE1B,QAAM,aAAa,UAAU,MAAM;AACnC,QAAM,kBACL,UAAU,MAAM,qBAAqB,SAClC,MAAM,2BAA2B,UAAU,MAAM,kBAAkB,wBAAwB;AAAA,IAC3F,GAAG;AAAA,IACH,iBAAiB;AAAA,IACjB,OAAO;AAAA,EACR,CAAC,IACA,MAAM,4BAA4B,YAAY,wBAAwB,OAAO;AACjF,MAAI,CAAC,gBAAgB,GAAI,QAAO;AAChC,QAAM,YAAY,gBAAgB;AAIlC,QAAM,gBAAgB,UAAU,WAAW,CAAC;AAG5C,QAAM,iBAAiB,cAAc,QAAQ;AAE7C,QAAM,qBAAqB,UAAU,iBAAiB,wBAAwB,CAAC;AAC/E,QAAM,qBAAqB,UAAM,iCAAkB,oBAAoB,gBAAgB,OAAO;AAC9F,MAAI,CAAC,mBAAmB,GAAI,QAAO;AAEnC,QAAM,eAAe,UAAM;AAAA,IAC1B;AAAA,IACA,EAAE,MAAM,mBAAmB,MAAM,KAAK;AAAA,IACtC;AAAA,MACC,aAAa;AAAA,MACb,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,MAChD,GAAI,QAAQ,qBAAqB,SAC9B,EAAE,kBAAkB,QAAQ,iBAAiB,IAC7C,CAAC;AAAA,IACL;AAAA,EACD;AACA,MAAI,CAAC,aAAa,IAAI;AACrB,eAAO;AAAA,UACN;AAAA,QACC,gCAAkB;AAAA,QAClB;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAEA,MAAI,OAAO,KAAK,kBAAkB,EAAE,SAAS,GAAG;AAC/C,UAAM,EAAE,kCAAAC,kCAAiC,IAAI,MAAM;AACnD,UAAM,aAAaA,kCAAiC,UAAU,kBAAkB;AAChF,QAAI,CAAC,WAAW,SAAS;AACxB,iBAAO;AAAA,YACN;AAAA,UACC,kCAAoB;AAAA,UACpB;AAAA,QACD;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAEA,MAAI;AACJ,QAAM,aAAa,UAAU,MAAM;AACnC,MAAI,cAAc,WAAW,SAAS,GAAG;AACxC,UAAM,iBAAiB,MAAM,2BAA2B,YAAY,wBAAwB;AAAA,MAC3F,GAAG;AAAA,MACH,iBAAiB,QAAQ;AAAA,MACzB,OAAO;AAAA,IACR,CAAC;AACD,QAAI,CAAC,eAAe,IAAI;AACvB,iBAAO,mBAAI,eAAe,KAAK;AAAA,IAChC;AACA,QAAI,eAAe,MAAM,kBAAkB,UAAU,eAAe;AACnE,iBAAO;AAAA,YACN;AAAA,UACC,kCAAoB;AAAA,UACpB,mCAAmC,eAAe,MAAM,aAAa,gDAAgD,UAAU,aAAa;AAAA,QAC7I;AAAA,MACD;AAAA,IACD;AACA,6BAAyB,eAAe,MAAM,iBAAiB,mBAAmB,CAAC;AAAA,EACpF;AAEA,MAAI;AACH,UAAM,WAAW,MAAM,QAAQ,YAAY,OAAO;AAAA,MACjD,QAAQ;AAAA,MACR,UAAU,QAAQ;AAAA,MAClB,KAAK,UAAU,MAAM;AAAA,MACrB,WAAW,UAAU,MAAM;AAAA,IAC5B,CAAC;AACD,QAAI,CAAC,UAAU;AACd,iBAAO;AAAA,YACN;AAAA,UACC,kCAAoB;AAAA,UACpB;AAAA,QACD;AAAA,MACD;AAAA,IACD;AAAA,EACD,SAAS,OAAO;AACf,YAAQ,QAAQ,MAAM,sCAAsC,EAAE,MAAM,CAAC;AACrE,eAAO;AAAA,UACN;AAAA,QACC,kCAAoB;AAAA,QACpB;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAEA,aAAO,kBAAG;AAAA,IACT;AAAA,IACA;AAAA,IACA,YAAY;AAAA,IACZ,GAAI,2BAA2B,SAAY,EAAE,uBAAuB,IAAI,CAAC;AAAA,EAC1E,CAAC;AACF;;;ARhIO,IAAM,uBAAN,MAAiD;AAAA,EAOvD,YAA4B,QAAoC;AAApC;AAC3B,SAAK,WAAW,OAAO,YAAY,CAAC;AAAA,EACrC;AAAA,EAF4B;AAAA,EAN5B,OAAO,wBAAwB;AAAA,EAEf,OAAO;AAAA,EACP;AAAA,EACR;AAAA,EAMR,WAAW,SAA8B;AACxC,SAAK,UAAU;AAAA,EAChB;AAAA,EAEA,MAAM,sBAAsB,UAAkB,SAAmD;AAChG,QAAI,CAAC,KAAK,SAAS;AAClB,YAAM,IAAI,MAAM,gCAAgC;AAAA,IACjD;AACA,UAAM,SAAS,KAAK,OAAO,oBAAoB,2BAC5C,MAAM,KAAK,OAAO,oBAAoB,yBAAyB,IAC/D,MAAM,KAAK,OAAO,oBAAoB,uBAAuB;AAEhE,WAAO;AAAA,MACN,KAAK,QAAQ;AAAA,MACb;AAAA,MACA;AAAA,MACA,WAAW,KAAK,QAAQ;AAAA,IACzB;AAAA,EACD;AAAA,EAEA,MAAM,sBACL,QASA,SAC+C;AAC/C,QAAI,CAAC,KAAK,SAAS;AAClB,YAAM,IAAI;AAAA,QACT;AAAA,MACD;AAAA,IACD;AACA,UAAM,eACL,SAAS,gBAAgB,KAAK,OAAO,gBAAgB,KAAK,QAAQ;AACnE,QAAI,CAAC,cAAc;AAClB,YAAM,IAAI,MAAM,sEAAsE;AAAA,IACvF;AACA,UAAM,aAAa,OAAO;AAC1B,UAAM,kBAAkB,UAAM;AAAA,MAC7B;AAAA,MACA;AAAA,MACA,WAAW,KAAK,QAAQ;AAAA,IACzB;AACA,QAAI,CAAC,gBAAgB,IAAI;AACxB,iBAAO,mBAAI,gBAAgB,KAAK;AAAA,IACjC;AAEA,UAAM,qBAA6C;AAAA,MAClD,WAAW,KAAK,QAAQ;AAAA,MACxB,eAAe;AAAA,MACf,cAAc,OAAO;AAAA,MACrB,GAAI,OAAO,QAAQ,EAAE,OAAO,OAAO,MAAM,IAAI,CAAC;AAAA,MAC9C,GAAI,OAAO,QAAQ,EAAE,OAAO,OAAO,MAAM,IAAI,CAAC;AAAA,MAC9C,GAAI,OAAO,QAAQ,EAAE,OAAO,OAAO,MAAM,IAAI,CAAC;AAAA,IAC/C;AAEA,UAAM,iBAAiB;AAAA,MACtB,GAAG,KAAK;AAAA,MACR,GAAI,OAAO,kBAAkB,EAAE,iBAAiB,OAAO,gBAAgB,IAAI,CAAC;AAAA,MAC5E,GAAI,SAAS,kBAAkB,EAAE,iBAAiB,QAAQ,gBAAgB,IAAI,CAAC;AAAA,MAC/E,GAAI,OAAO,aAAa,EAAE,YAAY,OAAO,WAAW,IAAI,CAAC;AAAA,MAC7D,GAAI,SAAS,aAAa,EAAE,YAAY,QAAQ,WAAW,IAAI,CAAC;AAAA,MAChE,GAAI,SAAS,0BAA0B,SACpC,EAAE,uBAAuB,QAAQ,sBAAsB,IACvD,CAAC;AAAA,MACJ,GAAI,SAAS,4BAA4B,SACtC,EAAE,yBAAyB,QAAQ,wBAAwB,IAC3D,CAAC;AAAA,IACL;AAEA,UAAM,WAAW;AAAA,MAChB,UAAU,KAAK,QAAQ;AAAA,MACvB,qBAAqB,eAAe;AAAA,MACpC,gBAAiB,KAAK,QAAQ,kBAC7B,KAAK,OAAO,kBACZ,CAAC;AAAA,MACF,UAAU;AAAA,QACT,CAAC,KAAK,IAAI,GAAG,KAAK;AAAA,MACnB;AAAA,MACA,GAAI,eAAe,4BAA4B,SAC5C,EAAE,yBAAyB,eAAe,wBAAwB,IAClE,CAAC;AAAA,MACJ,GAAI,eAAe,0BAA0B,SAC1C,EAAE,uBAAuB,eAAe,sBAAsB,IAC9D,CAAC;AAAA,MACJ,GAAI,eAAe,oBAAoB,SACpC,EAAE,iBAAiB,eAAe,gBAAgB,IAClD,CAAC;AAAA,MACJ,GAAI,eAAe,eAAe,SAAY,EAAE,YAAY,eAAe,WAAW,IAAI,CAAC;AAAA,IAC5F;AAEA,WAAO;AAAA,MACN,gBAAgB;AAAA,MAChB;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW,KAAK,QAAQ;AAAA,IACzB;AAAA,EACD;AAAA,EAEA,MAAM,mBACL,YACA,SAC8C;AAC9C,QAAI,CAAC,KAAK,SAAS;AAClB,YAAM,IAAI;AAAA,QACT;AAAA,MACD;AAAA,IACD;AACA,UAAM,eACL,SAAS,gBAAgB,KAAK,OAAO,gBAAgB,KAAK,QAAQ;AACnE,QAAI,CAAC,cAAc;AAClB,YAAM,IAAI,MAAM,sEAAsE;AAAA,IACvF;AACA,UAAM,kBAAkB,UAAM;AAAA,MAC7B;AAAA,MACA;AAAA,MACA,WAAW,KAAK,QAAQ;AAAA,IACzB;AACA,QAAI,CAAC,gBAAgB,IAAI;AACxB,iBAAO,mBAAI,gBAAgB,KAAK;AAAA,IACjC;AAEA,UAAM,WAAW;AAAA,MAChB,UAAU,KAAK,QAAQ;AAAA,MACvB,aAAa,KAAK,QAAQ;AAAA,MAC1B,gBAAiB,KAAK,QAAQ,kBAC7B,KAAK,OAAO,kBACZ,CAAC;AAAA,MACF,UAAU;AAAA,QACT,CAAC,KAAK,IAAI,GAAG,KAAK;AAAA,MACnB;AAAA,MACA,GAAI,KAAK,OAAO,0BAA0B,SACvC,EAAE,uBAAuB,KAAK,OAAO,sBAAsB,IAC3D,CAAC;AAAA,IACL;AAEA,WAAO;AAAA,MACN,gBAAgB;AAAA,MAChB;AAAA,MACA;AAAA,MACA,WAAW,KAAK,QAAQ;AAAA,IACzB;AAAA,EACD;AAAA,EAEA,MAAM,2BACL,WACA,oBACA,cACA,SAC+C;AAC/C,QAAI,CAAC,KAAK,SAAS;AAClB,YAAM,IAAI;AAAA,QACT;AAAA,MACD;AAAA,IACD;AACA,UAAM,iBAAiB;AAAA,MACtB,GAAG,KAAK;AAAA,MACR,GAAI,SAAS,kBAAkB,EAAE,iBAAiB,QAAQ,gBAAgB,IAAI,CAAC;AAAA,IAChF;AACA,UAAM,WAAW;AAAA,MAChB,UAAU,KAAK,QAAQ;AAAA,MACvB,qBAAqB,eAAe;AAAA,MACpC,gBAAiB,KAAK,QAAQ,kBAC7B,KAAK,OAAO,kBACZ,CAAC;AAAA,MACF,UAAU;AAAA,QACT,CAAC,KAAK,IAAI,GAAG,KAAK;AAAA,MACnB;AAAA,MACA,GAAI,eAAe,4BAA4B,SAC5C,EAAE,yBAAyB,eAAe,wBAAwB,IAClE,CAAC;AAAA,MACJ,GAAI,eAAe,0BAA0B,SAC1C,EAAE,uBAAuB,eAAe,sBAAsB,IAC9D,CAAC;AAAA,MACJ,GAAI,eAAe,oBAAoB,SACpC,EAAE,iBAAiB,eAAe,gBAAgB,IAClD,CAAC;AAAA,MACJ,GAAI,eAAe,eAAe,SAAY,EAAE,YAAY,eAAe,WAAW,IAAI,CAAC;AAAA,IAC5F;AACA,WAAO;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS,gBAAgB;AAAA,MACzB,WAAW,KAAK,QAAQ;AAAA,IACzB;AAAA,EACD;AACD;AAmBO,IAAM,mBAAN,MAA6C;AAAA,EAMnD,YAA4B,QAAgC;AAAhC;AAC3B,SAAK,WAAW,OAAO,YAAY,CAAC;AAAA,EACrC;AAAA,EAF4B;AAAA,EALZ,OAAO;AAAA,EACP,WAAoC,CAAC;AAAA,EACrC,SAAS,oBAAI,IAAqD;AAAA,EAC1E;AAAA,EAMR,WAAW,SAA8B;AACxC,SAAK,UAAU;AACf,UAAM,mBAAmB,KAAK,OAAO,oBAAoB;AACzD,UAAM,kBAAkB,IAAI,IAAI,kBAAkB,QAAQ,QAAQ,EAAE,SAAS;AAC7E,UAAM,eAAe;AAAA,MACpB,KAAK,OAAO,gBAAgB,QAAQ;AAAA,IACrC;AAEA,SAAK,SAAS,mCAAmC;AAEjD,UAAM,UAAU,kCAAkC;AAAA,MACjD,YAAY,QAAQ;AAAA,MACpB,aAAa,QAAQ;AAAA,MACrB;AAAA,MACA,GAAI,KAAK,OAAO,mCAAmC,SAChD,EAAE,gCAAgC,KAAK,OAAO,+BAA+B,IAC7E,CAAC;AAAA,MACJ,GAAI,KAAK,OAAO,gCAAgC,SAC7C,EAAE,6BAA6B,KAAK,OAAO,4BAA4B,IACvE,CAAC;AAAA,MACJ,GAAI,KAAK,OAAO,yBAAyB,SACtC,EAAE,sBAAsB,KAAK,OAAO,qBAAqB,IACzD,CAAC;AAAA,MACJ,GAAI,KAAK,OAAO,+BAA+B,SAC5C,EAAE,4BAA4B,KAAK,OAAO,2BAA2B,IACrE,CAAC;AAAA,MACJ,GAAI,KAAK,OAAO,mBAAmB,SAChC,EAAE,gBAAgB,KAAK,OAAO,eAAe,IAC7C,CAAC;AAAA,MACJ,GAAI,QAAQ,YAAY,SAAY,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;AAAA,IACrE,CAAC;AAED,SAAK,OAAO,IAAI,kBAAkB,OAAO;AAAA,EAC1C;AAAA,EAEA,MAAM,6BACL,kBACA,SAC0D;AAC1D,QAAI,CAAC,KAAK,SAAS;AAClB,YAAM,IAAI,MAAM,mCAAmC;AAAA,IACpD;AACA,UAAM,cAAc,KAAK,OAAO;AAChC,QAAI,CAAC,aAAa;AACjB,YAAM,IAAI,MAAM,4DAA4D;AAAA,IAC7E;AACA,UAAM,eAAe;AAAA,MACpB,KAAK,OAAO,gBAAgB,KAAK,QAAQ;AAAA,IAC1C;AACA,UAAM,SAAS,MAAM,6BAA6B,kBAAkB,cAAc;AAAA,MACjF,YAAY,KAAK,QAAQ;AAAA,MACzB;AAAA,MACA,GAAG;AAAA,IACJ,CAAC;AAED,QAAI,CAAC,OAAO,GAAI,QAAO;AAEvB,QAAI,KAAK,OAAO,6BAA6B,wBAAwB;AACpE,YAAM,mBAAmB,MAAM,KAAK,OAAO,4BAA4B;AAAA,QACtE,OAAO,MAAM;AAAA,MACd;AACA,UAAI,CAAC,iBAAiB,IAAI;AACzB,mBAAO;AAAA,cACN,+BAAgB,kCAAoB,iBAAiB,iBAAiB,MAAM,WAAW;AAAA,QACxF;AAAA,MACD;AAAA,IACD;AAEA,QAAI,KAAK,OAAO,gBAAgB;AAC/B,YAAM,iBAAiB,OAAO,MAAM,WAAW,WAAW,CAAC,GAAG,QAAQ;AACtE,YAAM,OAAO,OAAO,MAAM,mBAAmB,QAAQ,kBAAkB,EAAE,MAAM,CAAC,EAAE;AAClF,YAAM,KAAK,OAAO,eAAe,OAAO,MAAM,YAAY;AAAA,QACzD,GAAG,OAAO,MAAM;AAAA,QAChB;AAAA,MACD,CAAC;AAAA,IACF;AAEA,WAAO;AAAA,EACR;AAAA,EAEA,MAAM,4BAA4B,SAAqC;AACtE,UAAM,mBAAmB,KAAK,OAAO,oBAAoB;AACzD,UAAM,UAAU,KAAK,OAAO,IAAI,gBAAgB;AAChD,QAAI,CAAC,SAAS;AACb,YAAM,IAAI,MAAM,+CAA+C;AAAA,IAChE;AACA,WAAO,QAAQ,OAAO;AAAA,EACvB;AACD;AAWO,IAAM,kBAAN,MAA4C;AAAA,EAOlD,YAA4B,QAA+B;AAA/B;AAC3B,SAAK,WAAW,OAAO,YAAY,CAAC;AAAA,EACrC;AAAA,EAF4B;AAAA,EAN5B,OAAO,wBAAwB;AAAA,EAEf,OAAO;AAAA,EACP;AAAA,EACR;AAAA,EAMR,WAAW,SAA8B;AACxC,SAAK,UAAU;AAAA,EAChB;AAAA,EAEA,MAAM,2BACL,WACA,oBACA,cACA,SAC+C;AAC/C,QAAI,CAAC,KAAK,SAAS;AAClB,YAAM,IAAI;AAAA,QACT;AAAA,MACD;AAAA,IACD;AACA,UAAM,WAAW;AAAA,MAChB,UAAU,KAAK,QAAQ;AAAA,MACvB,qBAAqB,KAAK,OAAO;AAAA,MACjC,gBAAiB,KAAK,QAAQ,kBAAkB,CAAC;AAAA,MACjD,UAAU;AAAA,QACT,CAAC,KAAK,IAAI,GAAG,KAAK;AAAA,MACnB;AAAA,MACA,GAAI,KAAK,OAAO,4BAA4B,SACzC,EAAE,yBAAyB,KAAK,OAAO,wBAAwB,IAC/D,CAAC;AAAA,MACJ,GAAI,KAAK,OAAO,0BAA0B,SACvC,EAAE,uBAAuB,KAAK,OAAO,sBAAsB,IAC3D,CAAC;AAAA,MACJ,GAAI,KAAK,OAAO,oBAAoB,SACjC,EAAE,iBAAiB,KAAK,OAAO,gBAAgB,IAC/C,CAAC;AAAA,MACJ,GAAI,KAAK,OAAO,eAAe,SAAY,EAAE,YAAY,KAAK,OAAO,WAAW,IAAI,CAAC;AAAA,IACtF;AACA,WAAO;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW,KAAK,QAAQ;AAAA,IACzB;AAAA,EACD;AACD;AAaO,IAAM,+BAAN,MAAyD;AAAA,EAK/D,YAA4B,QAA4C;AAA5C;AAC3B,SAAK,WAAW,OAAO,YAAY,CAAC;AAAA,EACrC;AAAA,EAF4B;AAAA,EAJZ,OAAO;AAAA,EACP,WAAoC,CAAC;AAAA,EACrC,SAAS,oBAAI,IAAqD;AAAA,EAMlF,WAAW,SAA8B;AACxC,UAAM,mBAAmB,KAAK,OAAO,oBAAoB;AACzD,UAAM,kBAAkB,IAAI,IAAI,kBAAkB,QAAQ,QAAQ,EAAE,SAAS;AAC7E,UAAM,eAAe;AAAA,MACpB,KAAK,OAAO,gBAAgB,QAAQ;AAAA,IACrC;AAEA,SAAK,SAAS,mCAAmC;AAEjD,UAAM,UAAU,kCAAkC;AAAA,MACjD,YAAY,QAAQ;AAAA,MACpB,aAAa,QAAQ;AAAA,MACrB;AAAA,MACA,GAAI,KAAK,OAAO,mCAAmC,SAChD,EAAE,gCAAgC,KAAK,OAAO,+BAA+B,IAC7E,CAAC;AAAA,MACJ,GAAI,KAAK,OAAO,gCAAgC,SAC7C,EAAE,6BAA6B,KAAK,OAAO,4BAA4B,IACvE,CAAC;AAAA,MACJ,GAAI,KAAK,OAAO,yBAAyB,SACtC,EAAE,sBAAsB,KAAK,OAAO,qBAAqB,IACzD,CAAC;AAAA,MACJ,GAAI,KAAK,OAAO,+BAA+B,SAC5C,EAAE,4BAA4B,KAAK,OAAO,2BAA2B,IACrE,CAAC;AAAA,MACJ,GAAI,QAAQ,YAAY,SAAY,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;AAAA,IACrE,CAAC;AAED,SAAK,OAAO,IAAI,kBAAkB,OAAO;AAAA,EAC1C;AACD;AAOO,IAAM,oBAAN,MAA8C;AAAA,EAKpD,YAA4B,QAAiC;AAAjC;AAC3B,SAAK,WAAW,OAAO,YAAY,CAAC;AACpC,QAAI,OAAO,MAAM;AAChB,WAAK,SAAS,OAAO,OAAO;AAAA,IAC7B;AAAA,EACD;AAAA,EAL4B;AAAA,EAJZ,OAAO;AAAA,EACP,WAAoC,CAAC;AAAA,EACrC,SAAS,oBAAI,IAAqD;AAAA,EASlF,WAAW,UAA+B;AAAA,EAAC;AAC5C;","names":["import_core","import_core","import_core","import_core","import_core","import_core","import_core","import_core","import_zod","parseResult","metadataRecord","rpMeta","import_core","import_core","OpenIDRelyingPartyMetadataSchema"]}