{"version":3,"sources":["../src/entityConfiguration/createItWalletEntityConfiguration.ts","../src/jsonWeb/getUsedJsonWebKey.ts","../src/jwk/jwk.ts","../src/utils/encoding.ts","../src/entityStatement/itWalletEntityStatementClaims.ts","../src/metadata/itWalletMetadata.ts","../src/metadata/entity/itWalletFederationEntity.ts","../src/metadata/common.ts","../src/metadata/operator/utils/swap-validators.ts","../src/metadata/policy.ts","../src/metadata/operator/standard/add.ts","../src/metadata/operator/metadata-merge-strategy.ts","../src/metadata/operator/metadata-order-of-application.ts","../src/metadata/operator/utils/create-policy-operator-schema.ts","../src/metadata/operator/standard/default.ts","../src/metadata/operator/standard/essential.ts","../src/metadata/operator/standard/oneOf.ts","../src/metadata/operator/standard/subsetOf.ts","../src/metadata/operator/standard/supersetOf.ts","../src/metadata/operator/standard/value.ts","../src/utils/create-entity.ts","../src/metadata/entity/v1.0/ItWalletProvider.ts","../src/metadata/entity/v1.0/itWalletAuthorizationServer.ts","../src/metadata/entity/v1.0/itWalletCredentialIssuer.ts","../src/metadata/entity/v1.0/itWalletCredentialVerifier.ts","../src/metadata/entity/v1.3/itWalletAuthorizationServer.ts","../src/metadata/entity/v1.3/itWalletCredentialIssuer.ts","../src/metadata/entity/v1.3/itWalletCredentialVerifier.ts","../src/metadata/entity/v1.3/itWalletSolution.ts","../src/entityStatement/z-constraint.ts","../src/entityStatement/z-trustmark.ts","../src/entityConfiguration/itWalletEntityConfigurationClaims.ts","../src/entityConfiguration/z-entity-configuration-header.ts","../src/errors.ts","../src/trustChain/trust-chain.ts"],"sourcesContent":["import { parseWithErrorHandling } from \"@pagopa/io-wallet-utils\";\nimport { Buffer } from \"buffer\";\n\nimport type { SignCallback } from \"../utils/types\";\n\nimport { getUsedJsonWebKey } from \"../jsonWeb/getUsedJsonWebKey\";\nimport { base64ToBase64URL } from \"../utils/encoding\";\nimport {\n  ItWalletEntityConfigurationClaimsOptions,\n  itWalletEntityConfigurationClaimsSchema,\n} from \"./itWalletEntityConfigurationClaims\";\nimport {\n  EntityConfigurationHeaderOptions,\n  entityConfigurationHeaderSchema,\n} from \"./z-entity-configuration-header\";\n\nexport interface CreateEntityConfigurationOptions {\n  claims: ItWalletEntityConfigurationClaimsOptions;\n  header: EntityConfigurationHeaderOptions;\n  signJwtCallback: SignCallback;\n}\n\n/**\n * Creates a signed OpenID Federation entity configuration JWT.\n *\n * The signing callback is called with the JWK selected by `header.kid` from\n * `claims.jwks.keys` and the compact JWT signing input.\n *\n * @param options - Entity configuration creation options.\n * @param options.claims - Entity configuration claims to sign.\n * @param options.header - Entity configuration JWT header.\n * @param options.signJwtCallback - Callback used to sign the JWT input.\n * @returns Signed entity configuration JWT.\n * @throws {ValidationError} If header or payload validation fails.\n * @throws {Error} If the matching signing JWK cannot be selected or the JWT input cannot be created.\n */\nexport const createItWalletEntityConfiguration = async ({\n  claims,\n  header,\n  signJwtCallback,\n}: CreateEntityConfigurationOptions) => {\n  const validatedHeader = parseWithErrorHandling(\n    entityConfigurationHeaderSchema,\n    header,\n    \"invalid header claims provided\",\n  );\n  const validatedClaims = parseWithErrorHandling(\n    itWalletEntityConfigurationClaimsSchema,\n    claims,\n    \"invalid payload claims provided\",\n  );\n\n  const toBeSigned = createJwtSignableInput(header, claims);\n\n  const jwk = getUsedJsonWebKey(validatedHeader, validatedClaims);\n\n  const signature = await signJwtCallback({ jwk, toBeSigned });\n\n  return createJsonWebToken(header, claims, signature);\n};\n\nfunction createJsonWebToken(\n  header: Record<string, unknown>,\n  payload: Record<string, unknown>,\n  signature: Uint8Array,\n) {\n  const encodedHeader = base64ToBase64URL(\n    Buffer.from(JSON.stringify(header)).toString(\"base64\"),\n  );\n  const encodedPayload = base64ToBase64URL(\n    Buffer.from(JSON.stringify(payload)).toString(\"base64\"),\n  );\n\n  const encodedSignature = base64ToBase64URL(\n    Buffer.from(signature).toString(\"base64\"),\n  );\n\n  return `${encodedHeader}.${encodedPayload}.${encodedSignature}`;\n}\n\nfunction createJwtSignableInput(\n  header: Record<string, unknown>,\n  payload: Record<string, unknown>,\n) {\n  if (Object.keys(header).length === 0) {\n    throw new Error(\"Can not create JWT with an empty header\");\n  }\n\n  if (Object.keys(payload).length === 0) {\n    throw new Error(\"Can not create JWT with an empty payload\");\n  }\n\n  const encodedHeader = base64ToBase64URL(\n    Buffer.from(JSON.stringify(header)).toString(\"base64\"),\n  );\n  const encodedPayload = base64ToBase64URL(\n    Buffer.from(JSON.stringify(payload)).toString(\"base64\"),\n  );\n\n  const toBeSignedString = `${encodedHeader}.${encodedPayload}`;\n\n  return new Uint8Array(Buffer.from(toBeSignedString));\n}\n","import { parseWithErrorHandling } from \"@pagopa/io-wallet-utils\";\nimport z from \"zod\";\n\nimport { jsonWebKeySetSchema } from \"../jwk/jwk\";\n\nexport const getUsedJsonWebKey = (\n  header: Record<string, unknown>,\n  claims: Record<string, unknown>,\n) => {\n  const validatedHeader = parseWithErrorHandling(\n    z.looseObject({\n      kid: z.string(),\n    }),\n    header,\n    \"invalid header claims. Should contain a key id\",\n  );\n\n  const validatedClaims = parseWithErrorHandling(\n    z.looseObject({\n      jwks: jsonWebKeySetSchema,\n    }),\n    claims,\n    \"Invalid payload claims. Should contain a json web key set\",\n  );\n\n  // Get the key from the `claims.jwks` by the `header.kid`\n  const key = validatedClaims.jwks?.keys.find(\n    (key) => key.kid === validatedHeader.kid,\n  );\n\n  if (!key) {\n    throw new Error(\n      `key with id: '${header.kid}' could not be found in the claims`,\n    );\n  }\n\n  return key;\n};\n","import { z } from \"zod\";\n\nexport const jsonWebKeySchema = z.looseObject({\n  alg: z.string().optional(),\n  key_ops: z.array(z.string()).optional(),\n  kid: z.string(),\n  kty: z.string(),\n  use: z.string().optional(),\n  x5c: z.array(z.string()).nonempty().optional(),\n  x5t: z.string().optional(),\n  \"x5t#S256\": z.string().optional(),\n  x5u: z.string().optional(),\n});\n\nexport type JsonWebKey = z.input<typeof jsonWebKeySchema>;\n\nexport const jsonWebKeySetSchema = z.object({\n  keys: z.array(jsonWebKeySchema),\n});\n\nexport type jsonWebKeySet = z.infer<typeof jsonWebKeySetSchema>;\n","export function base64ToBase64URL(base64: string) {\n  return base64.replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=/g, \"\");\n}\n","import {\n  ItWalletSpecsVersion,\n  parseWithErrorHandling,\n} from \"@pagopa/io-wallet-utils\";\nimport { z } from \"zod\";\n\nimport { jsonWebKeySetSchema } from \"../jwk/jwk\";\nimport {\n  ItWalletMetadataByVersion,\n  isItWalletMetadataVersion,\n  itWalletMetadataSchema,\n  parseItWalletMetadataForVersion,\n} from \"../metadata/itWalletMetadata\";\nimport { metadataPolicySchema } from \"../metadata/policy\";\nimport { constraintSchema } from \"./z-constraint\";\nimport {\n  trustMarkIssuerSchema,\n  trustMarkOwnerSchema,\n  trustMarkSchema,\n} from \"./z-trustmark\";\n\nconst baseSchema = z.object({\n  authority_hints: z.array(z.url()).optional(),\n  constraints: constraintSchema.optional(),\n  crit: z.array(z.string()).optional(),\n  exp: z\n    .number()\n    .describe(\"Expiration time as a UNIX timestamp in seconds since epoch\"),\n  iat: z\n    .number()\n    .describe(\"Issued-at time as a UNIX timestamp in seconds since epoch\"),\n  iss: z.string(),\n  jwks: jsonWebKeySetSchema,\n  metadata: itWalletMetadataSchema.optional(),\n  metadata_policy: z\n    .record(z.string(), z.record(z.string(), metadataPolicySchema).optional())\n    .optional(),\n  metadata_policy_crit: z.array(z.string()).optional(),\n  source_endpoint: z.url().optional(),\n  sub: z.string(),\n  trust_mark_issuers: trustMarkIssuerSchema.optional(),\n  trust_mark_owners: trustMarkOwnerSchema.optional(),\n  trust_marks: z.array(trustMarkSchema).optional(),\n});\n\ntype BaseEntityStatementClaimsOptions = z.input<typeof baseSchema>;\n\ntype BaseEntityStatementClaims = z.output<typeof baseSchema>;\n\nconst entityStatementClaimsSchema = baseSchema.loose().refine(\n  (data) => {\n    const keyIds = data.jwks.keys.map((key) => key.kid);\n    const uniqueKeyIds = new Set(keyIds);\n    return uniqueKeyIds.size === keyIds.length;\n  },\n  {\n    message: \"keys include duplicate key ids\",\n    path: [\"jwks\", \"keys\"],\n  },\n);\n\n// The explicit type annotation here is necessary to avoid this node exceeds the maximum length the compiler will serialize.\nexport const itWalletEntityStatementClaimsSchema: z.ZodType<\n  BaseEntityStatementClaims,\n  BaseEntityStatementClaimsOptions\n> = entityStatementClaimsSchema;\n\nexport type ItWalletEntityStatementClaimsOptions = z.input<\n  typeof itWalletEntityStatementClaimsSchema\n>;\n\nexport type ItWalletEntityStatementClaims = z.output<\n  typeof itWalletEntityStatementClaimsSchema\n>;\n\ntype EntityStatementClaimsWithMetadata<TMetadata> = {\n  metadata?: TMetadata;\n} & Omit<ItWalletEntityStatementClaims, \"metadata\">;\n\nexport type ItWalletEntityStatementClaimsByVersion<\n  V extends ItWalletSpecsVersion,\n> = EntityStatementClaimsWithMetadata<ItWalletMetadataByVersion<V>>;\n\n/**\n * Checks whether entity statement claims match a specific IT-Wallet metadata version.\n *\n * Claims without a `metadata` member are considered compatible after base schema validation.\n *\n * @param claims - Entity statement claims to inspect.\n * @param version - IT-Wallet specification version to validate metadata against.\n * @returns True when the claims and optional metadata match the selected version.\n * @throws {ItWalletSpecsVersionError} If the version is unsupported.\n */\nexport function isItWalletEntityStatementClaimsVersion<\n  V extends ItWalletSpecsVersion,\n>(\n  claims: unknown,\n  version: V,\n): claims is ItWalletEntityStatementClaimsByVersion<V> {\n  const parsedClaims = itWalletEntityStatementClaimsSchema.safeParse(claims);\n\n  if (!parsedClaims.success) {\n    return false;\n  }\n\n  return (\n    parsedClaims.data.metadata === undefined ||\n    isItWalletMetadataVersion(parsedClaims.data.metadata, version)\n  );\n}\n\n/**\n * Parses entity statement claims and narrows the optional metadata by IT-Wallet version.\n *\n * @param claims - Entity statement claims to parse.\n * @param version - IT-Wallet specification version to validate metadata against.\n * @returns Entity statement claims with version-specific metadata.\n * @throws {ValidationError} If claims or metadata do not satisfy the selected schemas.\n * @throws {ItWalletSpecsVersionError} If the version is unsupported.\n */\nexport function parseItWalletEntityStatementClaimsForVersion<\n  V extends ItWalletSpecsVersion,\n>(claims: unknown, version: V): ItWalletEntityStatementClaimsByVersion<V> {\n  const parsedClaims = parseWithErrorHandling(\n    itWalletEntityStatementClaimsSchema,\n    claims,\n    \"invalid entity statement claims provided\",\n  );\n\n  if (parsedClaims.metadata === undefined) {\n    return parsedClaims as ItWalletEntityStatementClaimsByVersion<V>;\n  }\n\n  return {\n    ...parsedClaims,\n    metadata: parseItWalletMetadataForVersion(parsedClaims.metadata, version),\n  } as ItWalletEntityStatementClaimsByVersion<V>;\n}\n","import {\n  ItWalletSpecsVersion,\n  dispatchByVersion,\n  parseWithErrorHandling,\n} from \"@pagopa/io-wallet-utils\";\nimport { z } from \"zod\";\n\nimport {\n  itWalletFederationEntityIdentifier,\n  itWalletFederationEntityMetadata,\n} from \"./entity/itWalletFederationEntity\";\nimport {\n  itWalletProviderEntityIdentifier,\n  itWalletProviderEntityMetadata,\n} from \"./entity/v1.0/ItWalletProvider\";\nimport {\n  itWalletAuthorizationServerIdentifier,\n  itWalletAuthorizationServerMetadata,\n} from \"./entity/v1.0/itWalletAuthorizationServer\";\nimport {\n  itWalletCredentialIssuerIdentifier,\n  itWalletCredentialIssuerMetadata,\n} from \"./entity/v1.0/itWalletCredentialIssuer\";\nimport {\n  itWalletCredentialVerifierIdentifier,\n  itWalletCredentialVerifierMetadata,\n} from \"./entity/v1.0/itWalletCredentialVerifier\";\nimport {\n  itWalletAuthorizationServerIdentifier as itWalletAuthorizationServerIdentifierV1_3,\n  itWalletAuthorizationServerMetadata as itWalletAuthorizationServerMetadataV1_3,\n} from \"./entity/v1.3/itWalletAuthorizationServer\";\nimport {\n  itWalletCredentialIssuerIdentifier as itWalletCredentialIssuerIdentifierV1_3,\n  itWalletCredentialIssuerMetadata as itWalletCredentialIssuerMetadataV1_3,\n} from \"./entity/v1.3/itWalletCredentialIssuer\";\nimport {\n  itWalletCredentialVerifierIdentifier as itWalletCredentialVerifierIdentifierV1_3,\n  itWalletCredentialVerifierMetadata as itWalletCredentialVerifierMetadataV1_3,\n} from \"./entity/v1.3/itWalletCredentialVerifier\";\nimport {\n  itWalletSolutionEntityIdentifier as itWalletSolutionEntityIdentifierV1_3,\n  itWalletSolutionEntityMetadata as itWalletSolutionEntityMetadataV1_3,\n} from \"./entity/v1.3/itWalletSolution\";\n\n// v1.0 combined metadata\nexport const itWalletMetadataV1_0 = z.strictObject({\n  [itWalletAuthorizationServerIdentifier]:\n    itWalletAuthorizationServerMetadata.optional(),\n  [itWalletCredentialIssuerIdentifier]:\n    itWalletCredentialIssuerMetadata.optional(),\n  [itWalletCredentialVerifierIdentifier]:\n    itWalletCredentialVerifierMetadata.optional(),\n  [itWalletFederationEntityIdentifier]:\n    itWalletFederationEntityMetadata.optional(),\n  [itWalletProviderEntityIdentifier]: itWalletProviderEntityMetadata.optional(),\n});\n\n// v1.3 combined metadata (stubs re-export v1.0 schemas for some entities)\nexport const itWalletMetadataV1_3 = z.strictObject({\n  [itWalletAuthorizationServerIdentifierV1_3]:\n    itWalletAuthorizationServerMetadataV1_3.optional(),\n  [itWalletCredentialIssuerIdentifierV1_3]:\n    itWalletCredentialIssuerMetadataV1_3.optional(),\n  [itWalletCredentialVerifierIdentifierV1_3]:\n    itWalletCredentialVerifierMetadataV1_3.optional(),\n  [itWalletFederationEntityIdentifier]:\n    itWalletFederationEntityMetadata.optional(),\n  [itWalletSolutionEntityIdentifierV1_3]:\n    itWalletSolutionEntityMetadataV1_3.optional(),\n});\n\n// Union — used by entity statement / entity configuration claims\n// v1.3 is tried first so that v1.3-specific fields are preserved during parsing\nexport const itWalletMetadataSchema =\n  itWalletMetadataV1_3.or(itWalletMetadataV1_0);\n\nexport type ItWalletMetadataV1_0 = z.output<typeof itWalletMetadataV1_0>;\nexport type ItWalletMetadataV1_3 = z.output<typeof itWalletMetadataV1_3>;\nexport type ItWalletMetadata = ItWalletMetadataV1_0 | ItWalletMetadataV1_3;\n\nexport type ItWalletMetadataByVersion<V extends ItWalletSpecsVersion> =\n  V extends ItWalletSpecsVersion.V1_0\n    ? ItWalletMetadataV1_0\n    : V extends ItWalletSpecsVersion.V1_3 | ItWalletSpecsVersion.V1_4\n      ? ItWalletMetadataV1_3\n      : never;\n\n/**\n * Checks whether a metadata object matches the schema for a specific IT-Wallet version.\n *\n * @param metadata - Metadata object to inspect.\n * @param version - IT-Wallet specification version to validate against.\n * @returns True when the metadata satisfies the version-specific schema.\n * @throws {ItWalletSpecsVersionError} If the version is unsupported.\n */\nexport function isItWalletMetadataVersion<V extends ItWalletSpecsVersion>(\n  metadata: unknown,\n  version: V,\n): metadata is ItWalletMetadataByVersion<V> {\n  return dispatchByVersion(version, {\n    [ItWalletSpecsVersion.V1_0]: () =>\n      itWalletMetadataV1_0.safeParse(metadata).success,\n    [ItWalletSpecsVersion.V1_3]: () =>\n      itWalletMetadataV1_3.safeParse(metadata).success,\n    [ItWalletSpecsVersion.V1_4]: () =>\n      itWalletMetadataV1_3.safeParse(metadata).success,\n  });\n}\n\n/**\n * Parses metadata using the schema for a specific IT-Wallet version.\n *\n * @param metadata - Metadata object to parse.\n * @param version - IT-Wallet specification version to validate against.\n * @returns Version-specific IT-Wallet metadata.\n * @throws {ValidationError} If metadata does not satisfy the selected schema.\n * @throws {ItWalletSpecsVersionError} If the version is unsupported.\n */\nexport function parseItWalletMetadataForVersion<V extends ItWalletSpecsVersion>(\n  metadata: unknown,\n  version: V,\n): ItWalletMetadataByVersion<V> {\n  return dispatchByVersion<ItWalletMetadata>(version, {\n    [ItWalletSpecsVersion.V1_0]: () =>\n      parseWithErrorHandling(\n        itWalletMetadataV1_0,\n        metadata,\n        \"invalid v1.0 metadata provided\",\n      ),\n    [ItWalletSpecsVersion.V1_3]: () =>\n      parseWithErrorHandling(\n        itWalletMetadataV1_3,\n        metadata,\n        \"invalid v1.3 metadata provided\",\n      ),\n    [ItWalletSpecsVersion.V1_4]: () =>\n      parseWithErrorHandling(\n        itWalletMetadataV1_3,\n        metadata,\n        \"invalid v1.4 metadata provided\",\n      ),\n  }) as ItWalletMetadataByVersion<V>;\n}\n","import { z } from \"zod\";\n\nimport { jsonWebKeySetSchema } from \"../../jwk/jwk\";\nimport { createEntity } from \"../../utils/create-entity\";\n\nexport const federationEntityMetadata = createEntity({\n  additionalValidation: {\n    federation_fetch_endpoint: z.url().optional(),\n    federation_historical_keys_endpoint: z.url().optional(),\n    federation_list_endpoint: z.url().optional(),\n    federation_resolve_endpoint: z.url().optional(),\n    federation_trust_mark_endpoint: z.url().optional(),\n    federation_trust_mark_list_endpoint: z.url().optional(),\n    federation_trust_mark_status_endpoint: z.url().optional(),\n  },\n  identifier: \"federation_entity\",\n});\n\nexport type FederationEntityMetadata = z.input<\n  (typeof federationEntityMetadata)[\"schema\"]\n>;\n\n/**\n *\n * {@link https://italia.github.io/eid-wallet-it-docs/releases/1.1.0/en/trust.html#metadata-of-federation-entity-leaves}\n *\n */\nexport const itWalletFederationEntityMetadata = federationEntityMetadata.schema\n  .extend({\n    jwks: jsonWebKeySetSchema.optional(),\n    tos_uri: z.url().optional(),\n  })\n  .loose();\n\nexport type ItWalletFederationEntityMetadata = z.input<\n  typeof itWalletFederationEntityMetadata\n>;\n\nexport const itWalletFederationEntityIdentifier =\n  federationEntityMetadata.identifier;\n","import { z } from \"zod\";\n\nimport { jsonWebKeySetSchema } from \"../jwk/jwk\";\n\nexport const commonMetadataSchema = z.object({\n  contacts: z.array(z.string()).min(1).optional(),\n  homepage_uri: z.url().optional(),\n  jwks: jsonWebKeySetSchema.optional(),\n  jwks_uri: z.url().optional(),\n  logo_uri: z.url().optional(),\n  organization_name: z.string().optional(),\n  policy_uri: z.url().optional(),\n  signed_jwks_uri: z.url().optional(),\n});\n","import { z } from \"zod\";\n\n/**\n * Builds a schema with the same keys as the source object and a replacement validator for each key.\n *\n * @param schema - Source object schema whose keys are preserved.\n * @param newValidator - Validator assigned to every key in the returned schema.\n * @returns New Zod object schema with swapped field validators.\n */\nexport const swapValidators = <T extends z.ZodRawShape>(\n  schema: z.ZodObject<T>,\n  newValidator: z.ZodSchema,\n): z.ZodObject<Record<string, typeof newValidator>> =>\n  z.object(\n    Object.keys(schema.shape).reduce(\n      (acc, key) => {\n        acc[key as keyof typeof acc] = newValidator;\n        return acc;\n      },\n      {} as { [k in keyof T]: z.ZodSchema },\n    ),\n  );\n","import { z } from \"zod\";\n\nimport { addOperator } from \"./operator/standard/add\";\nimport { defaultOperator } from \"./operator/standard/default\";\nimport { essentialOperator } from \"./operator/standard/essential\";\nimport { oneOfOperator } from \"./operator/standard/oneOf\";\nimport { subsetOfOperator } from \"./operator/standard/subsetOf\";\nimport { supersetOfOperator } from \"./operator/standard/supersetOf\";\nimport { valueOperator } from \"./operator/standard/value\";\n\nexport const allSupportedPolicies = {\n  [addOperator.key]: addOperator,\n  [defaultOperator.key]: defaultOperator,\n  [essentialOperator.key]: essentialOperator,\n  [oneOfOperator.key]: oneOfOperator,\n  [subsetOfOperator.key]: subsetOfOperator,\n  [supersetOfOperator.key]: supersetOfOperator,\n  [valueOperator.key]: valueOperator,\n} as const;\n\nexport type SupportedPolicyKey = keyof typeof allSupportedPolicies;\n\n/**\n * Checks whether a policy key is supported by the SDK metadata policy implementation.\n *\n * @param key - Policy key to inspect.\n * @returns True when the key is one of the supported policy operators.\n */\nexport const isExistingPolicyKey = (key: string): key is SupportedPolicyKey =>\n  Object.hasOwn(allSupportedPolicies, key);\n\nexport const metadataPolicySchema = z\n  .object(\n    Object.entries(allSupportedPolicies).reduce(\n      (acc, [key, policy]) => ({ ...acc, [key]: policy.operatorSchema }),\n      {} as {\n        [key in keyof typeof allSupportedPolicies]: (typeof allSupportedPolicies)[key][\"operatorSchema\"];\n      },\n    ),\n  )\n  .and(z.record(z.string(), z.any()))\n  .superRefine((data, ctx) => {\n    const dataKeys = Object.keys(data);\n    const supportedDataKeys = dataKeys.filter(isExistingPolicyKey);\n\n    for (const dataKey of supportedDataKeys) {\n      const { operator } = allSupportedPolicies[dataKey];\n\n      if (\n        supportedDataKeys.some(\n          (key) =>\n            key !== operator.key && !operator.canBeCombinedWith.includes(key),\n        )\n      ) {\n        ctx.addIssue({\n          code: \"custom\",\n          message: `policy operator '${\n            operator.key\n          }' can only be combined with one of: [${operator.canBeCombinedWith.join(\n            \", \",\n          )}]. keys: [${Object.keys(data).join(\",\")}]`,\n        });\n      }\n    }\n  });\n\nexport type MetadataPolicyOperator = z.input<typeof metadataPolicySchema>;\n","import { z } from \"zod\";\n\nimport { MetadataMergeStrategy } from \"../metadata-merge-strategy\";\nimport { MetadataOrderOfApplication } from \"../metadata-order-of-application\";\nimport { createPolicyOperatorSchema } from \"../utils/create-policy-operator-schema\";\n\nexport const addOperator = createPolicyOperatorSchema({\n  canBeCombinedWith: [\"default\", \"subset_of\", \"superset_of\", \"essential\"],\n  key: \"add\",\n  mergeStrategy: MetadataMergeStrategy.Union,\n  operatorJsonValues: [\n    z.array(z.string()),\n    // TODO: See how we want to we handle the comparison of objects\n    // z.array(z.record(z.string().or(z.number()), z.unknown())),\n    z.array(z.number()),\n  ],\n  orderOfApplication: MetadataOrderOfApplication.AfterValue,\n  parameterJsonValues: [\n    z.array(z.string()),\n    // TODO: See how we want to we handle the comparison of objects\n    // z.array(z.record(z.string().or(z.number()), z.unknown())),\n    z.array(z.number()),\n  ],\n});\n","export enum MetadataMergeStrategy {\n  /**\n   *\n   * The result of merging the values of two these operators is the intersection of the operator values. If the intersection is empty, this MUST result in a policy error.\n   *\n   */\n  Intersection = 2,\n  /**\n   *\n   * Allowed only when the operator values are equal. If not, this MUST result in a policy error.\n   *\n   */\n  OperatorValuesEqual = 0,\n  /**\n   *\n   * If a Superior has specified essential=true, then a Subordinate MUST NOT change that. If a Superior has specified essential=false, then a Subordinate is allowed to change that to essential=true. If a Superior has not specified essential, then a Subordinate can set essential to true or false. If those conditions are not met, this MUST result in a policy error.\n   *\n   */\n  SuperiorFollowsIfTrue = 3,\n  /**\n   *\n   * The result of merging the values of two these operators is the union of the operator values.\n   *\n   */\n  Union = 1,\n}\n","/* eslint-disable perfectionist/sort-enums */\n\nexport enum MetadataOrderOfApplication {\n  First = 0,\n  AfterValue = 1,\n  AfterAdd = 2,\n  AfterDefault = 3,\n  AfterOneOf = 4,\n  AfterSubsetOf = 5,\n  Last = 6,\n}\n","import type { MetadataOperator } from \"../metadata-operator\";\n\n/**\n * Converts a metadata operator definition into the policy operator schema shape.\n *\n * @param operator - Metadata operator definition.\n * @returns Schema descriptor used by metadata policy validation and application.\n */\nexport const createPolicyOperatorSchema = <TKey extends string>(\n  operator: MetadataOperator<TKey>,\n) =>\n  ({\n    /**\n     * The key of the operator which is used to identify the operator\n     */\n    key: operator.key,\n    /**\n     * The merge strategy of the operator\n     */\n    mergeStrategy: operator.mergeStrategy,\n    /**\n     * The operator itself\n     */\n    operator: operator,\n    /**\n     * The schema for the operator itself so for essential it is only a boolean\n     */\n    operatorSchema: operator.operatorJsonValues\n      .reduce((acc, schema) => acc.or(schema))\n      .optional(),\n    /**\n     * The order of application of the operator\n     */\n    orderOfApplication: operator.orderOfApplication,\n    /**\n     * The schema for the parameter the operator can be applied to so when the policy is targeting federation_entity we can check if the policy can handle that property\n     */\n    parameterSchema: operator.parameterJsonValues\n      .reduce((acc, schema) => acc.or(schema))\n      .optional(),\n  }) as const;\n","import { z } from \"zod\";\n\nimport { MetadataMergeStrategy } from \"../metadata-merge-strategy\";\nimport { MetadataOrderOfApplication } from \"../metadata-order-of-application\";\nimport { createPolicyOperatorSchema } from \"../utils/create-policy-operator-schema\";\n\nexport const defaultOperator = createPolicyOperatorSchema({\n  canBeCombinedWith: [\"add\", \"one_of\", \"subset_of\", \"superset_of\", \"essential\"],\n  key: \"default\",\n  mergeStrategy: MetadataMergeStrategy.OperatorValuesEqual,\n  operatorJsonValues: [\n    z.string(),\n    z.number(),\n    z.boolean(),\n    z.record(z.string(), z.string().or(z.number())),\n    z.array(z.unknown()),\n  ],\n  orderOfApplication: MetadataOrderOfApplication.AfterAdd,\n  parameterJsonValues: [\n    z.string(),\n    z.number(),\n    z.boolean(),\n    z.record(z.string(), z.string().or(z.number())),\n    z.array(z.unknown()),\n  ],\n});\n","import { z } from \"zod\";\n\nimport { MetadataMergeStrategy } from \"../metadata-merge-strategy\";\nimport { MetadataOrderOfApplication } from \"../metadata-order-of-application\";\nimport { createPolicyOperatorSchema } from \"../utils/create-policy-operator-schema\";\n\nexport const essentialOperator = createPolicyOperatorSchema({\n  canBeCombinedWith: [\n    \"add\",\n    \"default\",\n    \"one_of\",\n    \"subset_of\",\n    \"superset_of\",\n    \"value\",\n  ],\n  key: \"essential\",\n  mergeStrategy: MetadataMergeStrategy.SuperiorFollowsIfTrue,\n  operatorJsonValues: [z.boolean()],\n  orderOfApplication: MetadataOrderOfApplication.Last,\n  parameterJsonValues: [\n    z.string(),\n    z.number(),\n    z.boolean(),\n    z.record(z.string(), z.union([z.string(), z.number()])),\n    z.unknown(),\n    z.array(z.unknown()),\n  ],\n});\n","import { z } from \"zod\";\n\nimport { MetadataMergeStrategy } from \"../metadata-merge-strategy\";\nimport { MetadataOrderOfApplication } from \"../metadata-order-of-application\";\nimport { createPolicyOperatorSchema } from \"../utils/create-policy-operator-schema\";\n\nexport const oneOfOperator = createPolicyOperatorSchema({\n  canBeCombinedWith: [\"default\", \"essential\"],\n  key: \"one_of\",\n  mergeStrategy: MetadataMergeStrategy.Intersection,\n  operatorJsonValues: [\n    z.array(z.string()),\n    // TODO: See how we want to we handle the comparison of objects\n    // z.array(z.record(z.string().or(z.number()), z.unknown())),\n    z.array(z.number()),\n  ],\n  orderOfApplication: MetadataOrderOfApplication.AfterDefault,\n  parameterJsonValues: [\n    z.string(),\n    // TODO: See how we want to we handle the comparison of objects\n    // z.record(z.string().or(z.number()), z.unknown()),\n    z.number(),\n  ],\n});\n","import { z } from \"zod\";\n\nimport { MetadataMergeStrategy } from \"../metadata-merge-strategy\";\nimport { MetadataOrderOfApplication } from \"../metadata-order-of-application\";\nimport { createPolicyOperatorSchema } from \"../utils/create-policy-operator-schema\";\n\nexport const subsetOfOperator = createPolicyOperatorSchema({\n  canBeCombinedWith: [\"add\", \"default\", \"superset_of\", \"essential\"],\n  key: \"subset_of\",\n  mergeStrategy: MetadataMergeStrategy.Intersection,\n  operatorJsonValues: [\n    z.array(z.string()),\n    // TODO: See how we want to we handle the comparison of objects\n    // z.array(z.record(z.string().or(z.number()), z.unknown())),\n    z.array(z.number()),\n  ],\n  orderOfApplication: MetadataOrderOfApplication.AfterOneOf,\n  parameterJsonValues: [\n    z.array(z.string()),\n    // TODO: See how we want to we handle the comparison of objects\n    // z.array(z.record(z.string().or(z.number()), z.unknown())),\n    z.array(z.number()),\n  ],\n});\n","import { z } from \"zod\";\n\nimport { MetadataMergeStrategy } from \"../metadata-merge-strategy\";\nimport { MetadataOrderOfApplication } from \"../metadata-order-of-application\";\nimport { createPolicyOperatorSchema } from \"../utils/create-policy-operator-schema\";\n\nexport const supersetOfOperator = createPolicyOperatorSchema({\n  canBeCombinedWith: [\"add\", \"default\", \"subset_of\", \"essential\"],\n  key: \"superset_of\",\n  mergeStrategy: MetadataMergeStrategy.Union,\n  operatorJsonValues: [\n    z.array(z.string()),\n    // TODO: See how we want to we handle the comparison of objects\n    // z.array(z.record(z.string().or(z.number()), z.unknown())),\n    z.array(z.number()),\n  ],\n  orderOfApplication: MetadataOrderOfApplication.AfterSubsetOf,\n  parameterJsonValues: [\n    z.array(z.string()),\n    // TODO: See how we want to we handle the comparison of objects\n    // z.array(z.record(z.string().or(z.number()), z.unknown())),\n    z.array(z.number()),\n  ],\n});\n","import { z } from \"zod\";\n\nimport { MetadataMergeStrategy } from \"../metadata-merge-strategy\";\nimport { MetadataOrderOfApplication } from \"../metadata-order-of-application\";\nimport { createPolicyOperatorSchema } from \"../utils/create-policy-operator-schema\";\n\nexport const valueOperator = createPolicyOperatorSchema({\n  canBeCombinedWith: [\"essential\"],\n  key: \"value\",\n  mergeStrategy: MetadataMergeStrategy.OperatorValuesEqual,\n  operatorJsonValues: [\n    z.string(),\n    z.number(),\n    z.boolean(),\n    z.record(z.string().or(z.number()), z.unknown()),\n    z.array(z.unknown()),\n    z.null(),\n  ],\n  orderOfApplication: MetadataOrderOfApplication.First,\n  parameterJsonValues: [\n    z.string(),\n    z.number(),\n    z.boolean(),\n    z.record(z.string(), z.string().or(z.number())),\n    z.array(z.unknown()),\n  ],\n});\n","import { z } from \"zod\";\n\nimport { commonMetadataSchema } from \"../metadata/common\";\nimport { swapValidators } from \"../metadata/operator/utils/swap-validators\";\nimport { metadataPolicySchema } from \"../metadata/policy\";\n\nexport const createEntity = <T extends string, S extends z.ZodRawShape>({\n  additionalValidation = {} as S,\n  identifier,\n  passThroughUnknownProperties = false,\n}: {\n  additionalValidation?: S;\n  identifier: T;\n  passThroughUnknownProperties?: boolean;\n}) => {\n  const schema = commonMetadataSchema.extend(additionalValidation);\n  return {\n    identifier,\n    policySchema: swapValidators(schema, metadataPolicySchema.optional()),\n    schema: passThroughUnknownProperties ? schema.loose() : schema,\n  };\n};\n","import { z } from \"zod\";\n\nimport { jsonWebKeySetSchema } from \"../../../jwk/jwk\";\n\n/**\n *\n * {@link https://italia.github.io/eid-wallet-it-docs/releases/1.1.0/en/wallet-provider-metadata.html}\n *\n */\nexport const itWalletProviderEntityMetadata = z.looseObject({\n  jwks: jsonWebKeySetSchema.optional(),\n  jwks_uri: z.url().optional(),\n  // -- 5.2.1 Extensions for JWK Sets in Entity Metadata\n  signed_jwks_uri: z.url().optional(),\n});\n\nexport type ItWalletProviderEntityMetadata = z.input<\n  typeof itWalletProviderEntityMetadata\n>;\n\nexport const itWalletProviderEntityIdentifier = \"wallet_provider\";\n","import { z } from \"zod\";\n\nimport { jsonWebKeySetSchema } from \"../../../jwk/jwk\";\n\n/**\n *\n * {@link https://italia.github.io/eid-wallet-it-docs/releases/1.1.0/en/credential-issuer-solution.html#metadata-for-oauth-authorization-server}\n *\n */\nexport const itWalletAuthorizationServerMetadata = z.looseObject({\n  acr_values_supported: z.array(z.string()),\n  authorization_endpoint: z.url(),\n  authorization_signing_alg_values_supported: z.array(z.string()),\n  client_registration_types_supported: z.array(\n    z.union([z.literal(\"automatic\"), z.literal(\"explicit\")]),\n  ),\n  code_challenge_methods_supported: z\n    .array(z.string())\n    .refine((arr) => arr.includes(\"S256\"), {\n      message:\n        \"The code_challenge_methods_supported array MUST include 'S256'.\",\n    }),\n  grant_types_supported: z\n    .array(z.string())\n    .refine((arr) => arr.includes(\"authorization_code\"), {\n      message:\n        \"The grant_types_supported array MUST include 'authorization_code'.\",\n    }),\n  issuer: z.url(),\n  jwks: jsonWebKeySetSchema,\n  pushed_authorization_request_endpoint: z.url(),\n  request_object_signing_alg_values_supported: z.array(z.string()),\n  require_signed_request_object: z.boolean().optional(),\n  response_modes_supported: z.array(\n    z.union([z.literal(\"query\"), z.literal(\"form_post.jwt\")]),\n  ),\n  response_types_supported: z\n    .array(z.string())\n    .refine((arr) => arr.includes(\"code\"), {\n      message: \"The response_types_supported array MUST include 'code'.\",\n    }),\n  scopes_supported: z.array(z.string()),\n  token_endpoint: z.url(),\n  token_endpoint_auth_methods_supported: z\n    .array(z.string())\n    .refine((arr) => arr.includes(\"attest_jwt_client_auth\"), {\n      message:\n        \"The token_endpoint_auth_methods_supported array MUST include 'attest_jwt_client_auth'.\",\n    }),\n  token_endpoint_auth_signing_alg_values_supported: z.array(z.string()),\n});\n\nexport type ItWalletAuthorizationServerMetadata = z.input<\n  typeof itWalletAuthorizationServerMetadata\n>;\n\nexport const itWalletAuthorizationServerIdentifier =\n  \"oauth_authorization_server\";\n","import { z } from \"zod\";\n\nimport { jsonWebKeySetSchema } from \"../../../jwk/jwk\";\n\n/**\n *\n * {@link https://italia.github.io/eid-wallet-it-docs/releases/1.1.0/en/credential-issuer-solution.html#metadata-for-openid-credential-issuer}\n *\n */\nexport type CredentialDisplayMetadata = z.infer<\n  typeof CredentialDisplayMetadata\n>;\nexport const CredentialDisplayMetadata = z.object({\n  locale: z.string(),\n  name: z.string(),\n});\n\nexport type ClaimsMetadata = z.infer<typeof ClaimsMetadata>;\nexport const ClaimsMetadata = z.object({\n  display: z.array(CredentialDisplayMetadata),\n  path: z.array(z.union([z.string(), z.number(), z.null()])),\n});\n\n// Metadata for a credential which is supported by an Issuer\nexport type SupportedCredentialMetadata = z.infer<\n  typeof SupportedCredentialMetadata\n>;\n\nexport const SupportedCredentialMetadata = z.intersection(\n  z.discriminatedUnion(\"format\", [\n    z.object({\n      credential_signing_alg_values_supported: z.array(z.string()),\n      format: z.literal(\"dc+sd-jwt\"),\n      vct: z.string(),\n    }),\n    z.object({\n      credential_signing_alg_values_supported: z.array(z.number().int()),\n      doctype: z.string(),\n      format: z.literal(\"mso_mdoc\"),\n    }),\n  ]),\n  z.object({\n    claims: z.array(ClaimsMetadata),\n    cryptographic_binding_methods_supported: z.array(z.string()),\n    display: z.array(CredentialDisplayMetadata),\n    proof_types_supported: z.object({\n      jwt: z.object({\n        proof_signing_alg_values_supported: z.array(z.string()),\n      }),\n    }),\n    scope: z.string(),\n  }),\n);\n\nexport const itWalletCredentialIssuerMetadata = z.looseObject({\n  authorization_servers: z.tuple([z.url()], z.url()).optional(),\n  batch_credential_issuance: z.object({\n    batch_size: z.number().int(),\n  }),\n  credential_configurations_supported: z.record(\n    z.string(),\n    SupportedCredentialMetadata,\n  ),\n  credential_endpoint: z.url(),\n  credential_hash_alg_supported: z.string(),\n  credential_issuer: z.url(),\n  deferred_credential_endpoint: z.url(),\n  display: z.array(CredentialDisplayMetadata),\n  evidence_supported: z\n    .array(z.string())\n    .refine((arr) => arr.includes(\"vouch\"), {\n      message: \"The evidence_supported array MUST include 'vouch'.\",\n    }),\n  jwks: jsonWebKeySetSchema,\n  nonce_endpoint: z.url(),\n  notification_endpoint: z.url(),\n  revocation_endpoint: z.url(),\n  status_assertion_endpoint: z.url(),\n  status_attestation_endpoint: z.url(),\n  trust_frameworks_supported: z.array(\n    z.union([\n      z.literal(\"it_cie\"),\n      z.literal(\"it_wallet\"),\n      z.literal(\"eudi_wallet\"),\n    ]),\n  ),\n});\n\nexport type ItWalletCredentialIssuerMetadata = z.input<\n  typeof itWalletCredentialIssuerMetadata\n>;\n\nexport const itWalletCredentialIssuerIdentifier = \"openid_credential_issuer\";\n","import { z } from \"zod\";\n\nimport { jsonWebKeySetSchema } from \"../../../jwk/jwk\";\n\n/**\n *\n * {@link https://italia.github.io/eid-wallet-it-docs/releases/1.1.0/en/relying-party-metadata.html}\n *\n */\nexport const itWalletCredentialVerifierMetadata = z.looseObject({\n  application_type: z.literal(\"web\"),\n  authorization_encrypted_response_alg: z.string(),\n  authorization_encrypted_response_enc: z.string(),\n  authorization_signed_response_alg: z.string().refine((v) => v !== \"none\", {\n    message: \"The authorization_signed_response_alg MUST not be 'none'.\",\n  }),\n  client_id: z.url(),\n  client_name: z.string(),\n  erasure_endpoint: z.url().optional(),\n  jwks: jsonWebKeySetSchema,\n  request_uris: z.array(z.url()),\n  response_uris: z.array(z.url()),\n  vp_formats: z.record(\n    z.string(),\n    z.object({\n      alg: z.array(z.string()).optional(),\n      \"sd-jwt_alg_values\": z.array(z.string()).optional(),\n    }),\n  ),\n});\n\nexport type ItWalletCredentialVerifierMetadata = z.input<\n  typeof itWalletCredentialVerifierMetadata\n>;\n\nexport const itWalletCredentialVerifierIdentifier =\n  \"openid_credential_verifier\";\n","import { z } from \"zod\";\n\nimport { jsonWebKeySetSchema } from \"../../../jwk/jwk\";\n\n/**\n *\n * {@link https://italia.github.io/eid-wallet-it-docs/releases/1.3.3/en/credential-issuer-solution.html#metadata-for-oauth-authorization-server}\n *\n */\nexport const itWalletAuthorizationServerMetadata = z.looseObject({\n  acr_values_supported: z.array(z.string()),\n  authorization_endpoint: z.url(),\n  authorization_signing_alg_values_supported: z.array(z.string()),\n  client_attestation_pop_signing_alg_values_supported: z\n    .array(z.string())\n    .min(1),\n  client_attestation_signing_alg_values_supported: z.array(z.string()).min(1),\n  client_registration_types_supported: z.array(\n    z.union([z.literal(\"automatic\"), z.literal(\"explicit\")]),\n  ),\n  code_challenge_methods_supported: z\n    .array(z.string())\n    .refine((arr) => arr.includes(\"S256\"), {\n      message:\n        \"The code_challenge_methods_supported array MUST include 'S256'.\",\n    }),\n  dpop_signing_alg_values_supported: z.array(z.string()).min(1),\n  grant_types_supported: z\n    .array(z.string())\n    .refine((arr) => arr.includes(\"authorization_code\"), {\n      message:\n        \"The grant_types_supported array MUST include 'authorization_code'.\",\n    }),\n  issuer: z.url(),\n  jwks: jsonWebKeySetSchema,\n  pushed_authorization_request_endpoint: z.url(),\n  request_object_signing_alg_values_supported: z.array(z.string()),\n  require_signed_request_object: z.literal(true),\n  response_types_supported: z\n    .array(z.string())\n    .refine((arr) => arr.includes(\"code\"), {\n      message: \"The response_types_supported array MUST include 'code'.\",\n    }),\n  scopes_supported: z.array(z.string()),\n  token_endpoint: z.url(),\n  token_endpoint_auth_methods_supported: z\n    .array(z.string())\n    .refine((arr) => arr.includes(\"attest_jwt_client_auth\"), {\n      message:\n        \"The token_endpoint_auth_methods_supported array MUST include 'attest_jwt_client_auth'.\",\n    }),\n  token_endpoint_auth_signing_alg_values_supported: z.array(z.string()),\n});\n\nexport type ItWalletAuthorizationServerMetadata = z.input<\n  typeof itWalletAuthorizationServerMetadata\n>;\n\nexport const itWalletAuthorizationServerIdentifier =\n  \"oauth_authorization_server\";\n","import { z } from \"zod\";\n\nimport { jsonWebKeySetSchema } from \"../../../jwk/jwk\";\n\n/**\n * Image metadata with integrity hash support\n * Follows IT Wallet v1.3 specification\n */\nexport type ImageMetadata = z.infer<typeof ImageMetadata>;\nexport const ImageMetadata = z.object({\n  alt_text: z.string().optional(),\n  uri: z.url(),\n  \"uri#integrity\": z.string().optional(),\n});\n\n/**\n * Enhanced credential display metadata\n * Supports background images, watermarks, and colors\n */\nexport type CredentialDisplayMetadata = z.infer<\n  typeof CredentialDisplayMetadata\n>;\n\nexport const CredentialDisplayMetadata = z.object({\n  background_color: z.string().optional(),\n  background_image: ImageMetadata.optional(),\n  description: z.string().optional(),\n  locale: z.string(),\n  logo: ImageMetadata.optional(),\n  name: z.string(),\n  watermark_image: ImageMetadata.optional(),\n});\n\n/**\n * Claim display metadata\n */\nexport type ClaimDisplayMetadata = z.infer<typeof ClaimDisplayMetadata>;\nexport const ClaimDisplayMetadata = z.object({\n  description: z.string().optional(),\n  locale: z.string(),\n  name: z.string(),\n});\n\n/**\n * Enhanced claims metadata with selective disclosure and mandatory flags\n */\nexport type ClaimsMetadata = z.infer<typeof ClaimsMetadata>;\nexport const ClaimsMetadata = z.object({\n  display: z.array(ClaimDisplayMetadata).optional(),\n  mandatory: z.boolean().optional(),\n  path: z.array(z.union([z.string(), z.number(), z.null()])),\n  sd: z.enum([\"always\", \"never\"]).optional(),\n});\n\n/**\n * Complete credential metadata structure\n * This is the new mandatory field in credential_configurations_supported\n */\nexport type CredentialMetadata = z.infer<typeof CredentialMetadata>;\nexport const CredentialMetadata = z.object({\n  claims: z.array(ClaimsMetadata).optional(),\n  display: z.array(CredentialDisplayMetadata).optional(),\n});\n\nexport const zKeyStorageLevel = z.enum([\n  \"iso_18045_high\",\n  \"iso_18045_moderate\",\n  \"iso_18045_enhanced-basic\",\n  \"iso_18045_basic\",\n]);\n\nexport type KeyStorageLevel = z.infer<typeof zKeyStorageLevel>;\n\nexport const zUserAuthenticationLevel = zKeyStorageLevel;\nexport type UserAuthenticationLevel = KeyStorageLevel;\n\n/**\n * Enhanced proof types support with optional key attestations\n * References OpenID4VCI Appendix F.1 and Section 12.2\n */\nexport type ProofTypesSupported = z.infer<typeof ProofTypesSupported>;\nexport const ProofTypesSupported = z.object({\n  jwt: z.object({\n    key_attestations_required: z\n      .object({\n        key_storage: z.array(zKeyStorageLevel).min(1).optional(),\n        user_authentication: z\n          .array(zUserAuthenticationLevel)\n          .min(1)\n          .optional(),\n      })\n      .optional(),\n    proof_signing_alg_values_supported: z.array(z.string()),\n  }),\n});\n\n/**\n * Authentic sources metadata linking to trusted data sources\n */\nexport type AuthenticSources = z.infer<typeof AuthenticSources>;\nexport const AuthenticSources = z.object({\n  dataset_id: z.string(),\n  entity_id: z.string(),\n});\n\n/**\n * Enhanced metadata for a credential supported by an Issuer\n * Includes new mandatory credential_metadata, schema_id, and authentic_sources\n */\nexport type SupportedCredentialMetadata = z.infer<\n  typeof SupportedCredentialMetadata\n>;\n\nexport const SupportedCredentialMetadata = z.intersection(\n  z.discriminatedUnion(\"format\", [\n    z.object({\n      credential_signing_alg_values_supported: z.array(z.string()),\n      format: z.literal(\"dc+sd-jwt\"),\n      vct: z.string(),\n    }),\n    z.object({\n      credential_signing_alg_values_supported: z.array(z.number().int()),\n      doctype: z.string(),\n      format: z.literal(\"mso_mdoc\"),\n    }),\n  ]),\n  z.object({\n    authentic_sources: AuthenticSources,\n    credential_metadata: CredentialMetadata,\n    cryptographic_binding_methods_supported: z.array(z.string()),\n    proof_types_supported: ProofTypesSupported,\n    schema_id: z.string(),\n    scope: z.string(),\n  }),\n);\n\n/**\n * IT Wallet Credential Issuer Metadata for v1.3 specification\n *\n * Changes from v1.0:\n * - REMOVED: revocation_endpoint, status_assertion_endpoint, credential_hash_alg_supported, evidence_supported\n * - ADDED: batch_credential_issuance, status_list_aggregation_endpoint\n * - MODIFIED: credential_configurations_supported now requires credential_metadata, schema_id, authentic_sources\n * - MODIFIED: proof_types_supported supports key_attestations_required\n *\n * {@link https://italia.github.io/eid-wallet-it-docs/releases/1.3.0/en/credential-issuer-solution.html#metadata-for-openid-credential-issuer}\n */\nexport const itWalletCredentialIssuerMetadata = z.looseObject({\n  authorization_servers: z.tuple([z.url()], z.url()).optional(),\n  batch_credential_issuance: z\n    .object({\n      batch_size: z.number().int().positive(),\n    })\n    .optional(),\n  credential_configurations_supported: z.record(\n    z.string(),\n    SupportedCredentialMetadata,\n  ),\n  credential_endpoint: z.url(),\n  credential_issuer: z.url(),\n  deferred_credential_endpoint: z.url().optional(),\n  display: z.array(CredentialDisplayMetadata).optional(),\n  jwks: jsonWebKeySetSchema,\n  nonce_endpoint: z.url().optional(),\n  notification_endpoint: z.url().optional(),\n  status_list_aggregation_endpoint: z.url().optional(),\n  trust_frameworks_supported: z.array(\n    z.union([\n      z.literal(\"eudi_wallet\"),\n      z.literal(\"it_cie\"),\n      z.literal(\"it_wallet\"),\n      z.literal(\"it_l2+document_proof\"),\n      /** @deprecated For backward compatibility only, will be removed in future versions. */\n      z.literal(\"it_spid\"),\n    ]),\n  ),\n});\n\nexport type ItWalletCredentialIssuerMetadata = z.input<\n  typeof itWalletCredentialIssuerMetadata\n>;\n\nexport const itWalletCredentialIssuerIdentifier = \"openid_credential_issuer\";\n","import { z } from \"zod\";\n\nimport { jsonWebKeySetSchema } from \"../../../jwk/jwk\";\n\n/**\n * IT Wallet Credential Verifier Metadata for OpenID Federation v1.3.3\n *\n * This schema defines the metadata structure for OpenID credential verifiers\n * (relying parties) in the Italian Wallet ecosystem, aligned with specification v1.3.3.\n *\n * Key changes from v1.0:\n * - Added `logo_uri` field (MIME type MUST be application/svg)\n * - Added `encrypted_response_enc_values_supported` for content encryption algorithms\n * - Renamed `vp_formats` to `vp_formats_supported`\n * - Enhanced VP formats structure with separate algorithm arrays:\n *   - For SD-JWT: `sd-jwt_alg_values` and `kb-jwt_alg_values`\n *   - For mso_mdoc: `issuerauth_alg_values` and `deviceauth_alg_values` (COSE algorithm numbers)\n * - Removed deprecated JARM fields: `authorization_signed_response_alg`,\n *   `authorization_encrypted_response_alg`, `authorization_encrypted_response_enc`\n *\n * @see {@link https://italia.github.io/eidas-it-wallet-docs/versioned_docs/version-1.3.3/en/relying-party-metadata.html}\n */\nexport const itWalletCredentialVerifierMetadata = z.looseObject({\n  application_type: z.literal(\"web\"),\n  client_id: z.url(),\n  client_name: z.string(),\n  encrypted_response_enc_values_supported: z.array(z.string()).min(1),\n  erasure_endpoint: z.url().optional(),\n  jwks: jsonWebKeySetSchema,\n  logo_uri: z.url(),\n  request_uris: z.array(z.url()),\n  response_uris: z.array(z.url()),\n  vp_formats_supported: z.record(\n    z.string(),\n    z.object({\n      alg: z.array(z.string()).optional(),\n      deviceauth_alg_values: z.array(z.number()).optional(),\n      issuerauth_alg_values: z.array(z.number()).optional(),\n      \"kb-jwt_alg_values\": z.array(z.string()).optional(),\n      \"sd-jwt_alg_values\": z.array(z.string()).optional(),\n    }),\n  ),\n});\n\nexport type ItWalletCredentialVerifierMetadata = z.input<\n  typeof itWalletCredentialVerifierMetadata\n>;\n\n/**\n * Re-export the identifier from v1.0 as it remains unchanged\n */\nexport { itWalletCredentialVerifierIdentifier } from \"../v1.0/itWalletCredentialVerifier\";\n","import { z } from \"zod\";\n\nimport { jsonWebKeySetSchema } from \"../../../jwk/jwk\";\n\nconst walletMetadataSchema = z.looseObject({\n  authorization_endpoint: z.url(),\n  client_id_prefixes_supported: z.array(\n    z.enum([\"openid_federation\", \"x509_hash\"]),\n  ),\n  credential_offer_endpoint: z.url(),\n  request_object_signing_alg_values_supported: z.array(z.string()),\n  response_modes_supported: z.array(z.literal(\"query\")).min(1),\n  response_types_supported: z.array(z.string()),\n  vp_formats_supported: z.record(z.string(), z.looseObject({})),\n  wallet_name: z.string(),\n});\n\nexport const itWalletSolutionEntityMetadata = z.looseObject({\n  jwks: jsonWebKeySetSchema.optional(),\n  jwks_uri: z.url().optional(),\n  // logo_uri MIME type MUST be application/svg per spec; validated at fetch-time\n  logo_uri: z.url(),\n  signed_jwks_uri: z.url().optional(),\n  wallet_metadata: walletMetadataSchema,\n});\n\nexport type ItWalletSolutionEntityMetadata = z.input<\n  typeof itWalletSolutionEntityMetadata\n>;\n\nexport const itWalletSolutionEntityIdentifier = \"wallet_solution\";\n","import { z } from \"zod\";\n\nexport const constraintSchema = z.object({\n  allowed_entity_types: z\n    .array(\n      z.string().refine((s) => s !== \"federation_entity\", {\n        message: `Value cannot be \"federation_entity\"`,\n      }),\n    )\n    .optional(),\n  max_path_length: z.number().optional(),\n  naming_constraints: z\n    .object({\n      excluded: z.array(z.string()).optional(),\n      permitted: z.array(z.string()).optional(),\n    })\n    .optional(),\n});\n\n/**\n *\n * {@link https://openid.net/specs/openid-federation-1_0.html#name-constraints | Constraints}\n *\n * Trust Anchors and Intermediate Entities MAY define constraining criteria that apply to their Subordinates. They are expressed in the constraints claim of a Subordinate Statement, as described in {@link https://openid.net/specs/openid-federation-1_0.html#entity-statement | Section 3}.\n *\n */\nexport type Constraint = z.input<typeof constraintSchema>;\n","import { z } from \"zod\";\n\nimport { jsonWebKeySetSchema } from \"../jwk/jwk\";\n\n/**\n * @example https://<federation_authority_domain>/trust_marks/<purpose>/<entity_type>\n */\nexport const trustMarkUrlSchema = z\n  .url()\n  .regex(/^https:\\/\\/[^/]+\\/trust_marks\\/[^/]+\\/[^/]+$/);\n\nexport const trustMarkSchema = z.object({\n  trust_mark: z.string(),\n  trust_mark_type: trustMarkUrlSchema,\n});\n\nexport type TrustMark = z.output<typeof trustMarkSchema>;\n\nexport const trustMarkIssuerSchema = z.record(z.string(), z.array(z.string()));\n\nexport type TrustMarkIssuer = z.input<typeof trustMarkIssuerSchema>;\n\nexport const trustMarkOwnerSchema = z.record(\n  z.string(),\n  z.object({\n    jwks: jsonWebKeySetSchema,\n    sub: z.string(),\n  }),\n);\n\nexport type TrustMarkOwner = z.input<typeof trustMarkOwnerSchema>;\n","import type { ItWalletSpecsVersion } from \"@pagopa/io-wallet-utils\";\nimport type { z } from \"zod\";\n\nimport {\n  ItWalletEntityStatementClaimsByVersion,\n  isItWalletEntityStatementClaimsVersion,\n  itWalletEntityStatementClaimsSchema,\n  parseItWalletEntityStatementClaimsForVersion,\n} from \"../entityStatement/itWalletEntityStatementClaims\";\n\nexport const itWalletEntityConfigurationClaimsSchema =\n  itWalletEntityStatementClaimsSchema;\n\nexport type ItWalletEntityConfigurationClaimsOptions = z.input<\n  typeof itWalletEntityConfigurationClaimsSchema\n>;\n\nexport type ItWalletEntityConfigurationClaims = z.output<\n  typeof itWalletEntityConfigurationClaimsSchema\n>;\n\nexport type ItWalletEntityConfigurationClaimsByVersion<\n  V extends ItWalletSpecsVersion,\n> = ItWalletEntityStatementClaimsByVersion<V>;\n\nexport const isItWalletEntityConfigurationClaimsVersion =\n  isItWalletEntityStatementClaimsVersion;\n\nexport const parseItWalletEntityConfigurationClaimsForVersion =\n  parseItWalletEntityStatementClaimsForVersion;\n","import { zItwSupportedSignatureAlg } from \"@pagopa/io-wallet-utils\";\nimport { z } from \"zod\";\n\nexport const entityConfigurationHeaderSchema = z.looseObject({\n  /* \n    For the moment the italian specification doesn't restrict algorithms\n    for signing the trust chain to a subset of the general accepted ones\n  */\n  alg: zItwSupportedSignatureAlg,\n  kid: z.string(),\n  typ: z.literal(\"entity-statement+jwt\"),\n});\n\nexport type EntityConfigurationHeaderOptions = z.input<\n  typeof entityConfigurationHeaderSchema\n>;\n\nexport type EntityConfigurationHeader = z.output<\n  typeof entityConfigurationHeaderSchema\n>;\n","/**\n * Generic error thrown during OID Federation operations\n */\nexport class OidFederationError extends Error {\n  readonly statusCode?: number;\n  constructor(\n    message: string,\n    options?: { statusCode?: number } & ErrorOptions,\n  ) {\n    super(message, options);\n    this.name = \"OidFederationError\";\n    this.statusCode = options?.statusCode;\n  }\n}\n\n/**\n * Error thrown when trust chain evaluation fails.\n * This includes signature verification failures, expiry checks,\n * structural inconsistencies, and trust anchor binding failures.\n */\nexport class TrustChainEvaluationError extends OidFederationError {\n  constructor(message: string, cause?: unknown) {\n    super(message, { cause });\n    this.name = \"TrustChainEvaluationError\";\n  }\n}\n","import {\n  CallbackContext,\n  Fetch,\n  HashAlgorithm,\n  HashCallback,\n  JwtSignerJwk,\n  UnexpectedStatusCodeError,\n  calculateJwkThumbprint,\n  createFetcher,\n  decodeJwt,\n  hasStatusOrThrow,\n} from \"@pagopa/io-wallet-utils\";\nimport z from \"zod\";\n\nimport { entityConfigurationHeaderSchema } from \"../entityConfiguration/z-entity-configuration-header\";\nimport { itWalletEntityStatementClaimsSchema } from \"../entityStatement/itWalletEntityStatementClaims\";\nimport { TrustChainEvaluationError } from \"../errors\";\nimport { jsonWebKeySchema } from \"../jwk/jwk\";\n\ninterface ChainEntry {\n  compact: string;\n  header: z.output<typeof entityConfigurationHeaderSchema>;\n  payload: z.output<typeof itWalletEntityStatementClaimsSchema>;\n}\n\nfunction decodeEntityStatement(jwt: string): ChainEntry {\n  const { header, payload } = decodeJwt({\n    headerSchema: entityConfigurationHeaderSchema,\n    jwt,\n    payloadSchema: itWalletEntityStatementClaimsSchema,\n  });\n  return { compact: jwt, header, payload };\n}\n\nfunction withHttpsEnforcement(fetcher: Fetch): Fetch {\n  return (input, init) => {\n    const url =\n      typeof input === \"string\"\n        ? input\n        : input instanceof URL\n          ? input.href\n          : input.url;\n    if (!url.startsWith(\"https://\")) {\n      throw new TrustChainEvaluationError(\n        `federation requests must use HTTPS, got \"${url}\"`,\n      );\n    }\n    return fetcher(input, init);\n  };\n}\n\nasync function fetchEntityConfigurationJwt(\n  entityUrl: string,\n  fetcher: Fetch,\n): Promise<string> {\n  const url = `${entityUrl}/.well-known/openid-federation`;\n  const response = await fetcher(url, {\n    headers: { Accept: \"application/entity-statement+jwt\" },\n  });\n  await hasStatusOrThrow(200, UnexpectedStatusCodeError)(response);\n  return response.text();\n}\n\ninterface VerifyCallbacks {\n  hash: HashCallback;\n  verifyJwt: VerifyJwtWithJwkCallback;\n}\n\nasync function verifyJwtWithKeySet(\n  jwt: Parameters<VerifyJwtCallback>[1],\n  kid: string,\n  keys: z.output<typeof jsonWebKeySchema>[],\n  ecKeys: undefined | z.output<typeof jsonWebKeySchema>[],\n  callbacks: VerifyCallbacks,\n): Promise<Awaited<ReturnType<VerifyJwtWithJwkCallback>>> {\n  const key = keys.find((k) => k.kid === kid);\n  if (!key) {\n    throw new TrustChainEvaluationError(\n      `signing key with kid \"${kid}\" not found`,\n    );\n  }\n\n  if (ecKeys) {\n    const ecKey = ecKeys.find((k) => k.kid === key.kid);\n    if (!ecKey) {\n      throw new TrustChainEvaluationError(\n        `signing key with kid \"${kid}\" not found in EC's declared keys`,\n      );\n    }\n    const [subThumbprint, ecThumbprint] = await Promise.all([\n      calculateJwkThumbprint({\n        hashAlgorithm: HashAlgorithm.Sha256,\n        hashCallback: callbacks.hash,\n        jwk: key as Parameters<typeof calculateJwkThumbprint>[0][\"jwk\"],\n      }),\n      calculateJwkThumbprint({\n        hashAlgorithm: HashAlgorithm.Sha256,\n        hashCallback: callbacks.hash,\n        jwk: ecKey as Parameters<typeof calculateJwkThumbprint>[0][\"jwk\"],\n      }),\n    ]);\n    if (subThumbprint !== ecThumbprint) {\n      throw new TrustChainEvaluationError(\n        `signing key with kid \"${kid}\" has mismatched key material between subordinate statement and entity configuration`,\n      );\n    }\n  }\n\n  if (key.alg && key.alg !== jwt.header.alg) {\n    throw new TrustChainEvaluationError(\n      `signing key ${kid}'s alg doesn't match its signed jwt counterpart. Key alg: ${key.alg}, Jwt alg: ${jwt.header.alg}`,\n    );\n  }\n\n  return callbacks.verifyJwt(\n    {\n      alg: jwt.header.alg,\n      method: \"jwk\",\n      publicJwk: key,\n    },\n    jwt,\n  );\n}\n\ntype ECSequence = [ChainEntry, ...ChainEntry[]];\n\nconst MAX_FEDERATION_DEPTH = 200;\n\nasync function fetchECSequence(\n  entityUrl: string,\n  trustAnchorUrls: [string, ...string[]] | undefined,\n  fetcher: Fetch,\n  visited = new Set<string>(),\n  depth = 0,\n): Promise<ECSequence> {\n  if (visited.has(entityUrl)) {\n    throw new TrustChainEvaluationError(\n      `cycle detected: \"${entityUrl}\" was already visited`,\n    );\n  }\n  if (depth >= MAX_FEDERATION_DEPTH) {\n    throw new TrustChainEvaluationError(\n      `maximum federation depth of ${MAX_FEDERATION_DEPTH} reached at \"${entityUrl}\"`,\n    );\n  }\n\n  visited.add(entityUrl);\n\n  const jwt = await fetchEntityConfigurationJwt(entityUrl, fetcher);\n  const entry = decodeEntityStatement(jwt);\n\n  if (trustAnchorUrls?.find((url) => url === entry.payload.iss)) {\n    return [entry];\n  }\n\n  const authorityHints = entry.payload.authority_hints ?? [];\n  if (!authorityHints.length) {\n    throw new TrustChainEvaluationError(\n      `entity config for \"${entityUrl}\" has no authority_hints`,\n    );\n  }\n\n  const reachedAnchor = authorityHints.find((h) =>\n    trustAnchorUrls?.includes(h),\n  );\n  if (reachedAnchor) {\n    const anchorJwt = await fetchEntityConfigurationJwt(reachedAnchor, fetcher);\n    return [entry, decodeEntityStatement(anchorJwt)];\n  }\n\n  let lastError: unknown;\n  for (const hint of authorityHints) {\n    try {\n      const restChain = await fetchECSequence(\n        hint,\n        trustAnchorUrls,\n        fetcher,\n        visited,\n        depth + 1,\n      );\n      return [entry, ...restChain];\n    } catch (error) {\n      lastError = error;\n    }\n  }\n  const lastErrorMessage =\n    lastError instanceof Error\n      ? lastError.message\n      : lastError !== undefined\n        ? String(lastError)\n        : \"unknown error\";\n  throw new TrustChainEvaluationError(\n    `no path to a trusted anchor found from \"${entityUrl}\" (last error: ${lastErrorMessage})`,\n  );\n}\n\nasync function verifyChainLinks(\n  chain: ECSequence,\n  ecs: ECSequence,\n  callbacks: VerifyCallbacks,\n): Promise<void> {\n  const linkVerifications = await Promise.all(\n    Array.from({ length: chain.length - 1 }, (_, i) => {\n      const statement = chain[i];\n      const superior = chain[i + 1];\n      const statementEc = ecs[i];\n      if (!statement || !superior || !statementEc) {\n        throw new TrustChainEvaluationError(\n          `invalid chain element at position ${i}`,\n        );\n      }\n      return verifyJwtWithKeySet(\n        statement,\n        statement.header.kid,\n        superior.payload.jwks.keys,\n        statementEc.payload.jwks.keys,\n        callbacks,\n      );\n    }),\n  );\n\n  for (const [i, { verified }] of linkVerifications.entries()) {\n    if (!verified) {\n      const statement = chain[i];\n      if (!statement) {\n        throw new TrustChainEvaluationError(\n          `invalid chain element at position ${i}`,\n        );\n      }\n      const elementType = i === 0 ? \"leaf EC\" : \"subordinate statement\";\n      throw new TrustChainEvaluationError(\n        `Error verifying signature for ${elementType} at position ${i} (iss=\"${statement.payload.iss}\", sub=\"${statement.payload.sub}\")`,\n      );\n    }\n  }\n}\n\nasync function buildTrustChain(\n  ecs: ECSequence,\n  fetcher: Fetch,\n  callbacks: VerifyCallbacks,\n): Promise<ECSequence> {\n  for (const ec of ecs) {\n    if (ec.payload.iss !== ec.payload.sub) {\n      throw new TrustChainEvaluationError(\n        `entity configuration iss \"${ec.payload.iss}\" does not match sub \"${ec.payload.sub}\"`,\n      );\n    }\n  }\n\n  if (ecs.length === 1) {\n    const leaf = ecs[0];\n    const { verified } = await verifyJwtWithKeySet(\n      leaf,\n      leaf.header.kid,\n      leaf.payload.jwks.keys,\n      undefined,\n      callbacks,\n    );\n    if (!verified) {\n      throw new TrustChainEvaluationError(\n        `Jwt verification failed for entity configuration ${leaf.payload.iss}`,\n      );\n    }\n    checkExpiry(ecs);\n    return ecs;\n  }\n\n  const ecVerifications = await Promise.all(\n    ecs\n      .slice(1)\n      .map((ec) =>\n        verifyJwtWithKeySet(\n          ec,\n          ec.header.kid,\n          ec.payload.jwks.keys,\n          undefined,\n          callbacks,\n        ),\n      ),\n  );\n\n  for (const [i, { verified }] of ecVerifications.entries()) {\n    if (!verified) {\n      const ec = ecs[i + 1];\n      throw new TrustChainEvaluationError(\n        `Jwt verification failed for entity configuration ${ec?.payload.iss ?? i + 1}`,\n      );\n    }\n  }\n\n  checkExpiry(ecs);\n\n  const subStmtEntries: (ChainEntry | undefined)[] = await Promise.all(\n    ecs.map(async (entry, idx) => {\n      if (idx === ecs.length - 1) return undefined;\n\n      const superior = ecs[idx + 1];\n      if (!superior) return undefined;\n\n      const fetchEndpoint =\n        superior.payload.metadata?.federation_entity?.federation_fetch_endpoint;\n      if (!fetchEndpoint) {\n        throw new TrustChainEvaluationError(\n          `superior entity at index ${idx + 1} has no federation_fetch_endpoint`,\n        );\n      }\n\n      const fetchUrl = `${fetchEndpoint}?sub=${encodeURIComponent(entry.payload.sub)}`;\n      const response = await fetcher(fetchUrl, {\n        headers: { Accept: \"application/entity-statement+jwt\" },\n      });\n      await hasStatusOrThrow(200, UnexpectedStatusCodeError)(response);\n\n      const subJwt = await response.text();\n      const subEntry = decodeEntityStatement(subJwt);\n\n      return subEntry;\n    }),\n  );\n\n  const subStmts = subStmtEntries.filter(\n    (e): e is ChainEntry => e !== undefined,\n  );\n  const lastEc = ecs[ecs.length - 1];\n  if (!lastEc) {\n    throw new TrustChainEvaluationError(\n      \"trust chain sequence has no last element\",\n    );\n  }\n  const chain: ECSequence = [ecs[0], ...subStmts, lastEc];\n\n  for (let i = 0; i < chain.length - 1; i++) {\n    const statement = chain[i];\n    const superior = chain[i + 1];\n    const statementEc = ecs[i];\n    if (!statement || !superior || !statementEc) {\n      throw new TrustChainEvaluationError(\n        `invalid chain element at position ${i}`,\n      );\n    }\n\n    // §3.2 point 6: the issuer of the subordinate statement must be listed\n    // in the subject entity's authority_hints.\n    const hints = statementEc.payload.authority_hints ?? [];\n    if (hints.length > 0 && !hints.includes(superior.payload.iss)) {\n      throw new TrustChainEvaluationError(\n        `\"${superior.payload.iss}\" is not listed in authority_hints of \"${statementEc.payload.sub}\"`,\n      );\n    }\n  }\n\n  checkMaxPathLength(chain);\n\n  await verifyChainLinks(chain, ecs, callbacks);\n\n  return chain;\n}\n\n// Allowed clock skew in seconds for iat/exp checks (§3.2 points 7–8).\nconst CLOCK_SKEW_SECONDS = 30;\n\nfunction checkExpiry(chain: ChainEntry[]): void {\n  const now = Math.floor(Date.now() / 1000);\n  for (let i = 0; i < chain.length; i++) {\n    const entry = chain[i];\n    if (!entry) {\n      throw new TrustChainEvaluationError(\n        `trust chain element at position ${i} is undefined`,\n      );\n    }\n    if ((entry.payload.exp ?? 0) < now - CLOCK_SKEW_SECONDS) {\n      throw new TrustChainEvaluationError(\n        `trust chain element at position ${i} has expired`,\n      );\n    }\n    if (entry.payload.iat > now + CLOCK_SKEW_SECONDS) {\n      throw new TrustChainEvaluationError(\n        `trust chain element at position ${i} has iat in the future`,\n      );\n    }\n  }\n}\n\nfunction checkMaxPathLength(chain: ChainEntry[]): void {\n  for (let i = 1; i < chain.length - 1; i++) {\n    const subStmt = chain[i];\n    const maxPath = subStmt?.payload.constraints?.max_path_length;\n    if (maxPath !== undefined) {\n      const remainingIntermediates = chain.length - 2 - i;\n      if (remainingIntermediates > maxPath) {\n        throw new TrustChainEvaluationError(\n          `chain exceeds max_path_length constraint at position ${i}: allowed ${maxPath} more intermediates, found ${remainingIntermediates}`,\n        );\n      }\n    }\n  }\n}\n\nfunction checkStructure(\n  chain: ChainEntry[],\n  trustAnchorUrls?: [string, ...string[]],\n): void {\n  const firstEntry = chain[0];\n  const lastEntry = chain[chain.length - 1];\n\n  if (firstEntry && firstEntry.payload.iss !== firstEntry.payload.sub) {\n    throw new TrustChainEvaluationError(\n      `leaf EC iss \"${firstEntry.payload.iss}\" does not match sub \"${firstEntry.payload.sub}\"`,\n    );\n  }\n  if (\n    lastEntry &&\n    lastEntry !== firstEntry &&\n    lastEntry.payload.iss !== lastEntry.payload.sub\n  ) {\n    throw new TrustChainEvaluationError(\n      `trust anchor EC iss \"${lastEntry.payload.iss}\" does not match sub \"${lastEntry.payload.sub}\"`,\n    );\n  }\n\n  if (chain.length > 1) {\n    if (!firstEntry || !chain[1]) {\n      throw new TrustChainEvaluationError(\"trust chain is malformed\");\n    }\n    if (firstEntry.payload.sub !== chain[1].payload.sub) {\n      throw new TrustChainEvaluationError(\n        \"leaf EC subject does not match first subordinate statement subject\",\n      );\n    }\n    for (let j = 1; j < chain.length - 1; j++) {\n      const current = chain[j];\n      const next = chain[j + 1];\n      if (!current || !next) {\n        throw new TrustChainEvaluationError(\n          `trust chain element at position ${j} is undefined`,\n        );\n      }\n      if (current.payload.iss !== next.payload.sub) {\n        throw new TrustChainEvaluationError(\n          `trust chain link broken at position ${j}`,\n        );\n      }\n    }\n  }\n\n  // WARNING: when trustAnchorUrls is not provided, any chain root is accepted\n  // without binding to a known trust anchor. Callers that omit this parameter\n  // must apply their own root-of-trust verification.\n  if (trustAnchorUrls?.length) {\n    if (!lastEntry)\n      throw new TrustChainEvaluationError(\"Trust chain root is not defined\");\n    if (!trustAnchorUrls.includes(lastEntry.payload.iss)) {\n      throw new TrustChainEvaluationError(\n        `trust chain root \"${lastEntry.payload.iss}\" is not a trusted anchor`,\n      );\n    }\n  }\n}\n\ntype VerifyJwtCallback = CallbackContext[\"verifyJwt\"];\n\n/**\n * A simplified JWT verification callback that accepts a concrete JWK.\n *\n * Using a plain JWK instead of the full `JwtSigner` union avoids a circular\n * dependency when trust-chain verification is itself invoked from inside a\n * `verifyJwt` callback (e.g. when resolving a federation trust chain to\n * obtain the signer's public key).\n */\nexport type VerifyJwtWithJwkCallback = (\n  jwtSigner: JwtSignerJwk,\n  jwt: Parameters<VerifyJwtCallback>[1],\n) => ReturnType<VerifyJwtCallback>;\n\nexport interface ValidateTrustChainOptions {\n  callbacks: {\n    /**\n     * Required for chains with intermediate entities (chains longer than two\n     * elements). Used to fetch each intermediate issuer's entity configuration\n     * for self-signature verification.\n     */\n    fetch: CallbackContext[\"fetch\"];\n    /**\n     * Required for hashing operations, used to compute JWK thumbprints when\n     * comparing key material across subordinate statements and entity\n     * configurations.\n     */\n    hash: HashCallback;\n    /**\n     * Required for verifying entity statement signatures.\n     */\n    verifyJwt: VerifyJwtWithJwkCallback;\n  };\n  /**\n   * Non-empty list of trusted trust anchor URLs. When provided, the chain root\n   * must be one of them. When omitted, any chain root is accepted without\n   * binding to a known trust anchor — callers are responsible for applying\n   * their own root-of-trust verification in that case.\n   */\n  trustAnchorUrls?: [string, ...string[]];\n}\n\n/**\n * Cryptographically validates a pre-built (inline) trust chain.\n *\n * Verifies every element's signature, checks `exp`, enforces structural\n * `iss`/`sub` consistency, and optionally binds the root to a known trust\n * anchor.\n *\n * The first element must be the leaf EC (self-signed). The last element must\n * be the trust anchor EC (self-signed). Intermediate elements are subordinate\n * statements; all but the last require `callbacks.fetch` to resolve the\n * intermediate issuer's EC for signature verification.\n *\n * Warning: When `options.trustAnchorUrls` is omitted, the chain root is\n * accepted unconditionally. Callers are responsible for applying their own\n * root-of-trust verification in that case.\n *\n * @param trustChain Array of compact JWTs forming the chain.\n * @param options Validation options including callbacks and trusted anchors.\n * @returns Resolves when the trust chain is valid.\n * @throws If any signature is invalid, any element is expired, structural links are broken, or the root is not a trusted anchor.\n */\nexport async function validateTrustChain(\n  trustChain: string[],\n  options: ValidateTrustChainOptions,\n): Promise<void> {\n  if (!trustChain[0]) throw new TrustChainEvaluationError(\"empty trust chain\");\n\n  const chain = trustChain.map(decodeEntityStatement);\n\n  checkExpiry(chain);\n\n  const leafEntry = chain[0];\n  if (!leafEntry)\n    throw new TrustChainEvaluationError(\"Leaf certificate is not defined\");\n  const anchorEntry = chain[chain.length - 1];\n  if (!anchorEntry)\n    throw new TrustChainEvaluationError(\n      \"Trust anchor certificate is not defined\",\n    );\n\n  const verifyCallbacks: VerifyCallbacks = {\n    hash: options.callbacks.hash,\n    verifyJwt: options.callbacks.verifyJwt,\n  };\n\n  const fetcher = withHttpsEnforcement(createFetcher(options.callbacks.fetch));\n\n  const subjectEcs: ChainEntry[] = new Array(chain.length - 1);\n  subjectEcs[0] = leafEntry;\n  if (chain.length >= 3) {\n    subjectEcs[chain.length - 2] = anchorEntry;\n  }\n\n  const intermediateIndices = Array.from(\n    { length: Math.max(0, chain.length - 3) },\n    (_, k) => k + 1,\n  );\n\n  const fetchedEcs = await Promise.all(\n    intermediateIndices.map(async (k) => {\n      const superior = chain[k];\n      if (!superior) {\n        throw new TrustChainEvaluationError(\n          `invalid chain element at position ${k}`,\n        );\n      }\n      const jwt = await fetchEntityConfigurationJwt(\n        superior.payload.iss,\n        fetcher,\n      );\n      const ec = decodeEntityStatement(jwt);\n      const { verified } = await verifyJwtWithKeySet(\n        ec,\n        ec.header.kid,\n        ec.payload.jwks.keys,\n        undefined,\n        verifyCallbacks,\n      );\n      if (!verified) {\n        throw new TrustChainEvaluationError(\n          `Error verifying self-signature of intermediate issuer EC for \"${superior.payload.iss}\"`,\n        );\n      }\n      checkExpiry([ec]);\n      return { ec, k };\n    }),\n  );\n\n  for (const { ec, k } of fetchedEcs) {\n    subjectEcs[k] = ec;\n  }\n\n  // §3.2 point 6: the issuer of the subordinate statement must be listed\n  // in the subject entity's authority_hints.\n  for (let i = 0; i < trustChain.length - 1; i++) {\n    const subEntry = chain[i];\n    const chainSuperior = chain[i + 1];\n    const subjectEc = subjectEcs[i];\n    if (!subEntry || !chainSuperior || !subjectEc) {\n      throw new TrustChainEvaluationError(\n        `invalid chain element at position ${i}`,\n      );\n    }\n    const hints = subjectEc.payload.authority_hints ?? [];\n    if (hints.length > 0 && !hints.includes(chainSuperior.payload.iss)) {\n      throw new TrustChainEvaluationError(\n        `\"${chainSuperior.payload.iss}\" is not listed in authority_hints of \"${subEntry.payload.sub}\"`,\n      );\n    }\n  }\n\n  const verificationCount = trustChain.length - 1;\n  const allVerifications = await Promise.all([\n    ...Array.from({ length: verificationCount }, (_, i) => {\n      const subEntry = chain[i];\n      const chainSuperior = chain[i + 1];\n      const subjectEc = subjectEcs[i];\n      if (!subEntry || !chainSuperior || !subjectEc) {\n        throw new TrustChainEvaluationError(\n          `invalid chain element at position ${i}`,\n        );\n      }\n      return verifyJwtWithKeySet(\n        subEntry,\n        subEntry.header.kid,\n        chainSuperior.payload.jwks.keys,\n        subjectEc.payload.jwks.keys,\n        verifyCallbacks,\n      );\n    }),\n    verifyJwtWithKeySet(\n      anchorEntry,\n      anchorEntry.header.kid,\n      anchorEntry.payload.jwks.keys,\n      undefined,\n      verifyCallbacks,\n    ),\n  ]);\n\n  for (let i = 0; i < verificationCount; i++) {\n    const result = allVerifications[i];\n    if (!result?.verified) {\n      throw new TrustChainEvaluationError(\n        `Verification of subordinate statement at step ${i} failed`,\n      );\n    }\n  }\n\n  const anchorVerification = allVerifications[verificationCount];\n  if (!anchorVerification?.verified) {\n    throw new TrustChainEvaluationError(\"Error verifying Trust Anchor EC\");\n  }\n\n  checkMaxPathLength(chain);\n\n  checkStructure(chain, options.trustAnchorUrls);\n}\n\nexport interface FetchAndValidateTrustChainOptions {\n  callbacks: {\n    /**\n     * Required for hashing operations, used to compute JWK thumbprints when\n     * comparing key material across subordinate statements and entity\n     * configurations.\n     */\n    hash: HashCallback;\n    verifyJwt: VerifyJwtWithJwkCallback;\n  } & Pick<CallbackContext, \"fetch\">;\n  /**\n   * Non-empty list of trusted trust anchor URLs. When provided, traversal\n   * stops as soon as one of these URLs is reached and the resolved chain root\n   * is verified against the list. When omitted, traversal follows\n   * `authority_hints` until no further hints exist (or a cycle / depth limit\n   * is hit), and any chain root is accepted — callers are responsible for\n   * applying their own root-of-trust verification in that case.\n   */\n  trustAnchorUrls?: [string, ...string[]];\n}\n\n/**\n * Fetches and validates a trust chain starting from a leaf entity.\n *\n * Traverses `authority_hints` upward from the leaf entity until a known\n * trust anchor is reached (or until no further hints exist), fetches every\n * entity configuration along the path and the corresponding subordinate\n * statements, verifies all signatures, and returns the assembled chain as an\n * array of compact JWTs.\n *\n * Warning: When `options.trustAnchorUrls` is omitted, the chain root is\n * accepted unconditionally. Callers are responsible for applying their own\n * root-of-trust verification in that case.\n *\n * @param entityUrl URL of the leaf entity.\n * @param options Options including fetch/verifyJwt callbacks and trusted anchors.\n * @returns Ordered array of compact JWTs forming the validated trust chain.\n * @throws If the chain cannot be built, any element is expired or invalid, or the root is not a trusted anchor.\n */\nexport async function fetchAndValidateTrustChain(\n  entityUrl: string,\n  options: FetchAndValidateTrustChainOptions,\n): Promise<string[]> {\n  const fetcher = withHttpsEnforcement(createFetcher(options.callbacks.fetch));\n\n  const ecs = await fetchECSequence(\n    entityUrl,\n    options.trustAnchorUrls,\n    fetcher,\n  );\n  const chain = await buildTrustChain(ecs, fetcher, {\n    hash: options.callbacks.hash,\n    verifyJwt: options.callbacks.verifyJwt,\n  });\n\n  checkExpiry(chain);\n  checkStructure(chain, options.trustAnchorUrls);\n\n  return chain.map((e) => e.compact);\n}\n"],"mappings":";AAAA,SAAS,0BAAAA,+BAA8B;AACvC,SAAS,cAAc;;;ACDvB,SAAS,8BAA8B;AACvC,OAAOC,QAAO;;;ACDd,SAAS,SAAS;AAEX,IAAM,mBAAmB,EAAE,YAAY;AAAA,EAC5C,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACtC,KAAK,EAAE,OAAO;AAAA,EACd,KAAK,EAAE,OAAO;AAAA,EACd,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7C,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,KAAK,EAAE,OAAO,EAAE,SAAS;AAC3B,CAAC;AAIM,IAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,MAAM,EAAE,MAAM,gBAAgB;AAChC,CAAC;;;ADbM,IAAM,oBAAoB,CAC/B,QACA,WACG;AACH,QAAM,kBAAkB;AAAA,IACtBC,GAAE,YAAY;AAAA,MACZ,KAAKA,GAAE,OAAO;AAAA,IAChB,CAAC;AAAA,IACD;AAAA,IACA;AAAA,EACF;AAEA,QAAM,kBAAkB;AAAA,IACtBA,GAAE,YAAY;AAAA,MACZ,MAAM;AAAA,IACR,CAAC;AAAA,IACD;AAAA,IACA;AAAA,EACF;AAGA,QAAM,MAAM,gBAAgB,MAAM,KAAK;AAAA,IACrC,CAACC,SAAQA,KAAI,QAAQ,gBAAgB;AAAA,EACvC;AAEA,MAAI,CAAC,KAAK;AACR,UAAM,IAAI;AAAA,MACR,iBAAiB,OAAO,GAAG;AAAA,IAC7B;AAAA,EACF;AAEA,SAAO;AACT;;;AErCO,SAAS,kBAAkB,QAAgB;AAChD,SAAO,OAAO,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,MAAM,EAAE;AACxE;;;ACFA;AAAA,EAEE,0BAAAC;AAAA,OACK;AACP,SAAS,KAAAC,WAAS;;;ACJlB;AAAA,EACE;AAAA,EACA;AAAA,EACA,0BAAAC;AAAA,OACK;AACP,SAAS,KAAAC,WAAS;;;ACLlB,SAAS,KAAAC,WAAS;;;ACAlB,SAAS,KAAAC,UAAS;AAIX,IAAM,uBAAuBC,GAAE,OAAO;AAAA,EAC3C,UAAUA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC9C,cAAcA,GAAE,IAAI,EAAE,SAAS;AAAA,EAC/B,MAAM,oBAAoB,SAAS;AAAA,EACnC,UAAUA,GAAE,IAAI,EAAE,SAAS;AAAA,EAC3B,UAAUA,GAAE,IAAI,EAAE,SAAS;AAAA,EAC3B,mBAAmBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACvC,YAAYA,GAAE,IAAI,EAAE,SAAS;AAAA,EAC7B,iBAAiBA,GAAE,IAAI,EAAE,SAAS;AACpC,CAAC;;;ACbD,SAAS,KAAAC,UAAS;AASX,IAAM,iBAAiB,CAC5B,QACA,iBAEAA,GAAE;AAAA,EACA,OAAO,KAAK,OAAO,KAAK,EAAE;AAAA,IACxB,CAAC,KAAK,QAAQ;AACZ,UAAI,GAAuB,IAAI;AAC/B,aAAO;AAAA,IACT;AAAA,IACA,CAAC;AAAA,EACH;AACF;;;ACrBF,SAAS,KAAAC,WAAS;;;ACAlB,SAAS,KAAAC,UAAS;;;ACAX,IAAK,wBAAL,kBAAKC,2BAAL;AAML,EAAAA,8CAAA,kBAAe,KAAf;AAMA,EAAAA,8CAAA,yBAAsB,KAAtB;AAMA,EAAAA,8CAAA,2BAAwB,KAAxB;AAMA,EAAAA,8CAAA,WAAQ,KAAR;AAxBU,SAAAA;AAAA,GAAA;;;ACEL,IAAK,6BAAL,kBAAKC,gCAAL;AACL,EAAAA,wDAAA,WAAQ,KAAR;AACA,EAAAA,wDAAA,gBAAa,KAAb;AACA,EAAAA,wDAAA,cAAW,KAAX;AACA,EAAAA,wDAAA,kBAAe,KAAf;AACA,EAAAA,wDAAA,gBAAa,KAAb;AACA,EAAAA,wDAAA,mBAAgB,KAAhB;AACA,EAAAA,wDAAA,UAAO,KAAP;AAPU,SAAAA;AAAA,GAAA;;;ACML,IAAM,6BAA6B,CACxC,cAEC;AAAA;AAAA;AAAA;AAAA,EAIC,KAAK,SAAS;AAAA;AAAA;AAAA;AAAA,EAId,eAAe,SAAS;AAAA;AAAA;AAAA;AAAA,EAIxB;AAAA;AAAA;AAAA;AAAA,EAIA,gBAAgB,SAAS,mBACtB,OAAO,CAAC,KAAK,WAAW,IAAI,GAAG,MAAM,CAAC,EACtC,SAAS;AAAA;AAAA;AAAA;AAAA,EAIZ,oBAAoB,SAAS;AAAA;AAAA;AAAA;AAAA,EAI7B,iBAAiB,SAAS,oBACvB,OAAO,CAAC,KAAK,WAAW,IAAI,GAAG,MAAM,CAAC,EACtC,SAAS;AACd;;;AHlCK,IAAM,cAAc,2BAA2B;AAAA,EACpD,mBAAmB,CAAC,WAAW,aAAa,eAAe,WAAW;AAAA,EACtE,KAAK;AAAA,EACL;AAAA,EACA,oBAAoB;AAAA,IAClBC,GAAE,MAAMA,GAAE,OAAO,CAAC;AAAA;AAAA;AAAA,IAGlBA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAAA,EACpB;AAAA,EACA;AAAA,EACA,qBAAqB;AAAA,IACnBA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAAA;AAAA;AAAA,IAGlBA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAAA,EACpB;AACF,CAAC;;;AIvBD,SAAS,KAAAC,UAAS;AAMX,IAAM,kBAAkB,2BAA2B;AAAA,EACxD,mBAAmB,CAAC,OAAO,UAAU,aAAa,eAAe,WAAW;AAAA,EAC5E,KAAK;AAAA,EACL;AAAA,EACA,oBAAoB;AAAA,IAClBC,GAAE,OAAO;AAAA,IACTA,GAAE,OAAO;AAAA,IACTA,GAAE,QAAQ;AAAA,IACVA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,OAAO,EAAE,GAAGA,GAAE,OAAO,CAAC,CAAC;AAAA,IAC9CA,GAAE,MAAMA,GAAE,QAAQ,CAAC;AAAA,EACrB;AAAA,EACA;AAAA,EACA,qBAAqB;AAAA,IACnBA,GAAE,OAAO;AAAA,IACTA,GAAE,OAAO;AAAA,IACTA,GAAE,QAAQ;AAAA,IACVA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,OAAO,EAAE,GAAGA,GAAE,OAAO,CAAC,CAAC;AAAA,IAC9CA,GAAE,MAAMA,GAAE,QAAQ,CAAC;AAAA,EACrB;AACF,CAAC;;;ACzBD,SAAS,KAAAC,UAAS;AAMX,IAAM,oBAAoB,2BAA2B;AAAA,EAC1D,mBAAmB;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,KAAK;AAAA,EACL;AAAA,EACA,oBAAoB,CAACC,GAAE,QAAQ,CAAC;AAAA,EAChC;AAAA,EACA,qBAAqB;AAAA,IACnBA,GAAE,OAAO;AAAA,IACTA,GAAE,OAAO;AAAA,IACTA,GAAE,QAAQ;AAAA,IACVA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,MAAM,CAACA,GAAE,OAAO,GAAGA,GAAE,OAAO,CAAC,CAAC,CAAC;AAAA,IACtDA,GAAE,QAAQ;AAAA,IACVA,GAAE,MAAMA,GAAE,QAAQ,CAAC;AAAA,EACrB;AACF,CAAC;;;AC3BD,SAAS,KAAAC,UAAS;AAMX,IAAM,gBAAgB,2BAA2B;AAAA,EACtD,mBAAmB,CAAC,WAAW,WAAW;AAAA,EAC1C,KAAK;AAAA,EACL;AAAA,EACA,oBAAoB;AAAA,IAClBC,GAAE,MAAMA,GAAE,OAAO,CAAC;AAAA;AAAA;AAAA,IAGlBA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAAA,EACpB;AAAA,EACA;AAAA,EACA,qBAAqB;AAAA,IACnBA,GAAE,OAAO;AAAA;AAAA;AAAA,IAGTA,GAAE,OAAO;AAAA,EACX;AACF,CAAC;;;ACvBD,SAAS,KAAAC,UAAS;AAMX,IAAM,mBAAmB,2BAA2B;AAAA,EACzD,mBAAmB,CAAC,OAAO,WAAW,eAAe,WAAW;AAAA,EAChE,KAAK;AAAA,EACL;AAAA,EACA,oBAAoB;AAAA,IAClBC,GAAE,MAAMA,GAAE,OAAO,CAAC;AAAA;AAAA;AAAA,IAGlBA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAAA,EACpB;AAAA,EACA;AAAA,EACA,qBAAqB;AAAA,IACnBA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAAA;AAAA;AAAA,IAGlBA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAAA,EACpB;AACF,CAAC;;;ACvBD,SAAS,KAAAC,WAAS;AAMX,IAAM,qBAAqB,2BAA2B;AAAA,EAC3D,mBAAmB,CAAC,OAAO,WAAW,aAAa,WAAW;AAAA,EAC9D,KAAK;AAAA,EACL;AAAA,EACA,oBAAoB;AAAA,IAClBC,IAAE,MAAMA,IAAE,OAAO,CAAC;AAAA;AAAA;AAAA,IAGlBA,IAAE,MAAMA,IAAE,OAAO,CAAC;AAAA,EACpB;AAAA,EACA;AAAA,EACA,qBAAqB;AAAA,IACnBA,IAAE,MAAMA,IAAE,OAAO,CAAC;AAAA;AAAA;AAAA,IAGlBA,IAAE,MAAMA,IAAE,OAAO,CAAC;AAAA,EACpB;AACF,CAAC;;;ACvBD,SAAS,KAAAC,WAAS;AAMX,IAAM,gBAAgB,2BAA2B;AAAA,EACtD,mBAAmB,CAAC,WAAW;AAAA,EAC/B,KAAK;AAAA,EACL;AAAA,EACA,oBAAoB;AAAA,IAClBC,IAAE,OAAO;AAAA,IACTA,IAAE,OAAO;AAAA,IACTA,IAAE,QAAQ;AAAA,IACVA,IAAE,OAAOA,IAAE,OAAO,EAAE,GAAGA,IAAE,OAAO,CAAC,GAAGA,IAAE,QAAQ,CAAC;AAAA,IAC/CA,IAAE,MAAMA,IAAE,QAAQ,CAAC;AAAA,IACnBA,IAAE,KAAK;AAAA,EACT;AAAA,EACA;AAAA,EACA,qBAAqB;AAAA,IACnBA,IAAE,OAAO;AAAA,IACTA,IAAE,OAAO;AAAA,IACTA,IAAE,QAAQ;AAAA,IACVA,IAAE,OAAOA,IAAE,OAAO,GAAGA,IAAE,OAAO,EAAE,GAAGA,IAAE,OAAO,CAAC,CAAC;AAAA,IAC9CA,IAAE,MAAMA,IAAE,QAAQ,CAAC;AAAA,EACrB;AACF,CAAC;;;AVhBM,IAAM,uBAAuB;AAAA,EAClC,CAAC,YAAY,GAAG,GAAG;AAAA,EACnB,CAAC,gBAAgB,GAAG,GAAG;AAAA,EACvB,CAAC,kBAAkB,GAAG,GAAG;AAAA,EACzB,CAAC,cAAc,GAAG,GAAG;AAAA,EACrB,CAAC,iBAAiB,GAAG,GAAG;AAAA,EACxB,CAAC,mBAAmB,GAAG,GAAG;AAAA,EAC1B,CAAC,cAAc,GAAG,GAAG;AACvB;AAUO,IAAM,sBAAsB,CAAC,QAClC,OAAO,OAAO,sBAAsB,GAAG;AAElC,IAAM,uBAAuBC,IACjC;AAAA,EACC,OAAO,QAAQ,oBAAoB,EAAE;AAAA,IACnC,CAAC,KAAK,CAAC,KAAK,MAAM,OAAO,EAAE,GAAG,KAAK,CAAC,GAAG,GAAG,OAAO,eAAe;AAAA,IAChE,CAAC;AAAA,EAGH;AACF,EACC,IAAIA,IAAE,OAAOA,IAAE,OAAO,GAAGA,IAAE,IAAI,CAAC,CAAC,EACjC,YAAY,CAAC,MAAM,QAAQ;AAC1B,QAAM,WAAW,OAAO,KAAK,IAAI;AACjC,QAAM,oBAAoB,SAAS,OAAO,mBAAmB;AAE7D,aAAW,WAAW,mBAAmB;AACvC,UAAM,EAAE,SAAS,IAAI,qBAAqB,OAAO;AAEjD,QACE,kBAAkB;AAAA,MAChB,CAAC,QACC,QAAQ,SAAS,OAAO,CAAC,SAAS,kBAAkB,SAAS,GAAG;AAAA,IACpE,GACA;AACA,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,SAAS,oBACP,SAAS,GACX,wCAAwC,SAAS,kBAAkB;AAAA,UACjE;AAAA,QACF,CAAC,aAAa,OAAO,KAAK,IAAI,EAAE,KAAK,GAAG,CAAC;AAAA,MAC3C,CAAC;AAAA,IACH;AAAA,EACF;AACF,CAAC;;;AW1DI,IAAM,eAAe,CAA4C;AAAA,EACtE,uBAAuB,CAAC;AAAA,EACxB;AAAA,EACA,+BAA+B;AACjC,MAIM;AACJ,QAAM,SAAS,qBAAqB,OAAO,oBAAoB;AAC/D,SAAO;AAAA,IACL;AAAA,IACA,cAAc,eAAe,QAAQ,qBAAqB,SAAS,CAAC;AAAA,IACpE,QAAQ,+BAA+B,OAAO,MAAM,IAAI;AAAA,EAC1D;AACF;;;AdhBO,IAAM,2BAA2B,aAAa;AAAA,EACnD,sBAAsB;AAAA,IACpB,2BAA2BC,IAAE,IAAI,EAAE,SAAS;AAAA,IAC5C,qCAAqCA,IAAE,IAAI,EAAE,SAAS;AAAA,IACtD,0BAA0BA,IAAE,IAAI,EAAE,SAAS;AAAA,IAC3C,6BAA6BA,IAAE,IAAI,EAAE,SAAS;AAAA,IAC9C,gCAAgCA,IAAE,IAAI,EAAE,SAAS;AAAA,IACjD,qCAAqCA,IAAE,IAAI,EAAE,SAAS;AAAA,IACtD,uCAAuCA,IAAE,IAAI,EAAE,SAAS;AAAA,EAC1D;AAAA,EACA,YAAY;AACd,CAAC;AAWM,IAAM,mCAAmC,yBAAyB,OACtE,OAAO;AAAA,EACN,MAAM,oBAAoB,SAAS;AAAA,EACnC,SAASA,IAAE,IAAI,EAAE,SAAS;AAC5B,CAAC,EACA,MAAM;AAMF,IAAM,qCACX,yBAAyB;;;AevC3B,SAAS,KAAAC,WAAS;AASX,IAAM,iCAAiCC,IAAE,YAAY;AAAA,EAC1D,MAAM,oBAAoB,SAAS;AAAA,EACnC,UAAUA,IAAE,IAAI,EAAE,SAAS;AAAA;AAAA,EAE3B,iBAAiBA,IAAE,IAAI,EAAE,SAAS;AACpC,CAAC;AAMM,IAAM,mCAAmC;;;ACpBhD,SAAS,KAAAC,WAAS;AASX,IAAM,sCAAsCC,IAAE,YAAY;AAAA,EAC/D,sBAAsBA,IAAE,MAAMA,IAAE,OAAO,CAAC;AAAA,EACxC,wBAAwBA,IAAE,IAAI;AAAA,EAC9B,4CAA4CA,IAAE,MAAMA,IAAE,OAAO,CAAC;AAAA,EAC9D,qCAAqCA,IAAE;AAAA,IACrCA,IAAE,MAAM,CAACA,IAAE,QAAQ,WAAW,GAAGA,IAAE,QAAQ,UAAU,CAAC,CAAC;AAAA,EACzD;AAAA,EACA,kCAAkCA,IAC/B,MAAMA,IAAE,OAAO,CAAC,EAChB,OAAO,CAAC,QAAQ,IAAI,SAAS,MAAM,GAAG;AAAA,IACrC,SACE;AAAA,EACJ,CAAC;AAAA,EACH,uBAAuBA,IACpB,MAAMA,IAAE,OAAO,CAAC,EAChB,OAAO,CAAC,QAAQ,IAAI,SAAS,oBAAoB,GAAG;AAAA,IACnD,SACE;AAAA,EACJ,CAAC;AAAA,EACH,QAAQA,IAAE,IAAI;AAAA,EACd,MAAM;AAAA,EACN,uCAAuCA,IAAE,IAAI;AAAA,EAC7C,6CAA6CA,IAAE,MAAMA,IAAE,OAAO,CAAC;AAAA,EAC/D,+BAA+BA,IAAE,QAAQ,EAAE,SAAS;AAAA,EACpD,0BAA0BA,IAAE;AAAA,IAC1BA,IAAE,MAAM,CAACA,IAAE,QAAQ,OAAO,GAAGA,IAAE,QAAQ,eAAe,CAAC,CAAC;AAAA,EAC1D;AAAA,EACA,0BAA0BA,IACvB,MAAMA,IAAE,OAAO,CAAC,EAChB,OAAO,CAAC,QAAQ,IAAI,SAAS,MAAM,GAAG;AAAA,IACrC,SAAS;AAAA,EACX,CAAC;AAAA,EACH,kBAAkBA,IAAE,MAAMA,IAAE,OAAO,CAAC;AAAA,EACpC,gBAAgBA,IAAE,IAAI;AAAA,EACtB,uCAAuCA,IACpC,MAAMA,IAAE,OAAO,CAAC,EAChB,OAAO,CAAC,QAAQ,IAAI,SAAS,wBAAwB,GAAG;AAAA,IACvD,SACE;AAAA,EACJ,CAAC;AAAA,EACH,kDAAkDA,IAAE,MAAMA,IAAE,OAAO,CAAC;AACtE,CAAC;AAMM,IAAM,wCACX;;;ACzDF,SAAS,KAAAC,WAAS;AAYX,IAAM,4BAA4BC,IAAE,OAAO;AAAA,EAChD,QAAQA,IAAE,OAAO;AAAA,EACjB,MAAMA,IAAE,OAAO;AACjB,CAAC;AAGM,IAAM,iBAAiBA,IAAE,OAAO;AAAA,EACrC,SAASA,IAAE,MAAM,yBAAyB;AAAA,EAC1C,MAAMA,IAAE,MAAMA,IAAE,MAAM,CAACA,IAAE,OAAO,GAAGA,IAAE,OAAO,GAAGA,IAAE,KAAK,CAAC,CAAC,CAAC;AAC3D,CAAC;AAOM,IAAM,8BAA8BA,IAAE;AAAA,EAC3CA,IAAE,mBAAmB,UAAU;AAAA,IAC7BA,IAAE,OAAO;AAAA,MACP,yCAAyCA,IAAE,MAAMA,IAAE,OAAO,CAAC;AAAA,MAC3D,QAAQA,IAAE,QAAQ,WAAW;AAAA,MAC7B,KAAKA,IAAE,OAAO;AAAA,IAChB,CAAC;AAAA,IACDA,IAAE,OAAO;AAAA,MACP,yCAAyCA,IAAE,MAAMA,IAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACjE,SAASA,IAAE,OAAO;AAAA,MAClB,QAAQA,IAAE,QAAQ,UAAU;AAAA,IAC9B,CAAC;AAAA,EACH,CAAC;AAAA,EACDA,IAAE,OAAO;AAAA,IACP,QAAQA,IAAE,MAAM,cAAc;AAAA,IAC9B,yCAAyCA,IAAE,MAAMA,IAAE,OAAO,CAAC;AAAA,IAC3D,SAASA,IAAE,MAAM,yBAAyB;AAAA,IAC1C,uBAAuBA,IAAE,OAAO;AAAA,MAC9B,KAAKA,IAAE,OAAO;AAAA,QACZ,oCAAoCA,IAAE,MAAMA,IAAE,OAAO,CAAC;AAAA,MACxD,CAAC;AAAA,IACH,CAAC;AAAA,IACD,OAAOA,IAAE,OAAO;AAAA,EAClB,CAAC;AACH;AAEO,IAAM,mCAAmCA,IAAE,YAAY;AAAA,EAC5D,uBAAuBA,IAAE,MAAM,CAACA,IAAE,IAAI,CAAC,GAAGA,IAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC5D,2BAA2BA,IAAE,OAAO;AAAA,IAClC,YAAYA,IAAE,OAAO,EAAE,IAAI;AAAA,EAC7B,CAAC;AAAA,EACD,qCAAqCA,IAAE;AAAA,IACrCA,IAAE,OAAO;AAAA,IACT;AAAA,EACF;AAAA,EACA,qBAAqBA,IAAE,IAAI;AAAA,EAC3B,+BAA+BA,IAAE,OAAO;AAAA,EACxC,mBAAmBA,IAAE,IAAI;AAAA,EACzB,8BAA8BA,IAAE,IAAI;AAAA,EACpC,SAASA,IAAE,MAAM,yBAAyB;AAAA,EAC1C,oBAAoBA,IACjB,MAAMA,IAAE,OAAO,CAAC,EAChB,OAAO,CAAC,QAAQ,IAAI,SAAS,OAAO,GAAG;AAAA,IACtC,SAAS;AAAA,EACX,CAAC;AAAA,EACH,MAAM;AAAA,EACN,gBAAgBA,IAAE,IAAI;AAAA,EACtB,uBAAuBA,IAAE,IAAI;AAAA,EAC7B,qBAAqBA,IAAE,IAAI;AAAA,EAC3B,2BAA2BA,IAAE,IAAI;AAAA,EACjC,6BAA6BA,IAAE,IAAI;AAAA,EACnC,4BAA4BA,IAAE;AAAA,IAC5BA,IAAE,MAAM;AAAA,MACNA,IAAE,QAAQ,QAAQ;AAAA,MAClBA,IAAE,QAAQ,WAAW;AAAA,MACrBA,IAAE,QAAQ,aAAa;AAAA,IACzB,CAAC;AAAA,EACH;AACF,CAAC;AAMM,IAAM,qCAAqC;;;AC5FlD,SAAS,KAAAC,WAAS;AASX,IAAM,qCAAqCC,IAAE,YAAY;AAAA,EAC9D,kBAAkBA,IAAE,QAAQ,KAAK;AAAA,EACjC,sCAAsCA,IAAE,OAAO;AAAA,EAC/C,sCAAsCA,IAAE,OAAO;AAAA,EAC/C,mCAAmCA,IAAE,OAAO,EAAE,OAAO,CAAC,MAAM,MAAM,QAAQ;AAAA,IACxE,SAAS;AAAA,EACX,CAAC;AAAA,EACD,WAAWA,IAAE,IAAI;AAAA,EACjB,aAAaA,IAAE,OAAO;AAAA,EACtB,kBAAkBA,IAAE,IAAI,EAAE,SAAS;AAAA,EACnC,MAAM;AAAA,EACN,cAAcA,IAAE,MAAMA,IAAE,IAAI,CAAC;AAAA,EAC7B,eAAeA,IAAE,MAAMA,IAAE,IAAI,CAAC;AAAA,EAC9B,YAAYA,IAAE;AAAA,IACZA,IAAE,OAAO;AAAA,IACTA,IAAE,OAAO;AAAA,MACP,KAAKA,IAAE,MAAMA,IAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MAClC,qBAAqBA,IAAE,MAAMA,IAAE,OAAO,CAAC,EAAE,SAAS;AAAA,IACpD,CAAC;AAAA,EACH;AACF,CAAC;AAMM,IAAM,uCACX;;;ACpCF,SAAS,KAAAC,WAAS;AASX,IAAMC,uCAAsCC,IAAE,YAAY;AAAA,EAC/D,sBAAsBA,IAAE,MAAMA,IAAE,OAAO,CAAC;AAAA,EACxC,wBAAwBA,IAAE,IAAI;AAAA,EAC9B,4CAA4CA,IAAE,MAAMA,IAAE,OAAO,CAAC;AAAA,EAC9D,qDAAqDA,IAClD,MAAMA,IAAE,OAAO,CAAC,EAChB,IAAI,CAAC;AAAA,EACR,iDAAiDA,IAAE,MAAMA,IAAE,OAAO,CAAC,EAAE,IAAI,CAAC;AAAA,EAC1E,qCAAqCA,IAAE;AAAA,IACrCA,IAAE,MAAM,CAACA,IAAE,QAAQ,WAAW,GAAGA,IAAE,QAAQ,UAAU,CAAC,CAAC;AAAA,EACzD;AAAA,EACA,kCAAkCA,IAC/B,MAAMA,IAAE,OAAO,CAAC,EAChB,OAAO,CAAC,QAAQ,IAAI,SAAS,MAAM,GAAG;AAAA,IACrC,SACE;AAAA,EACJ,CAAC;AAAA,EACH,mCAAmCA,IAAE,MAAMA,IAAE,OAAO,CAAC,EAAE,IAAI,CAAC;AAAA,EAC5D,uBAAuBA,IACpB,MAAMA,IAAE,OAAO,CAAC,EAChB,OAAO,CAAC,QAAQ,IAAI,SAAS,oBAAoB,GAAG;AAAA,IACnD,SACE;AAAA,EACJ,CAAC;AAAA,EACH,QAAQA,IAAE,IAAI;AAAA,EACd,MAAM;AAAA,EACN,uCAAuCA,IAAE,IAAI;AAAA,EAC7C,6CAA6CA,IAAE,MAAMA,IAAE,OAAO,CAAC;AAAA,EAC/D,+BAA+BA,IAAE,QAAQ,IAAI;AAAA,EAC7C,0BAA0BA,IACvB,MAAMA,IAAE,OAAO,CAAC,EAChB,OAAO,CAAC,QAAQ,IAAI,SAAS,MAAM,GAAG;AAAA,IACrC,SAAS;AAAA,EACX,CAAC;AAAA,EACH,kBAAkBA,IAAE,MAAMA,IAAE,OAAO,CAAC;AAAA,EACpC,gBAAgBA,IAAE,IAAI;AAAA,EACtB,uCAAuCA,IACpC,MAAMA,IAAE,OAAO,CAAC,EAChB,OAAO,CAAC,QAAQ,IAAI,SAAS,wBAAwB,GAAG;AAAA,IACvD,SACE;AAAA,EACJ,CAAC;AAAA,EACH,kDAAkDA,IAAE,MAAMA,IAAE,OAAO,CAAC;AACtE,CAAC;AAMM,IAAMC,yCACX;;;AC3DF,SAAS,KAAAC,WAAS;AASX,IAAM,gBAAgBC,IAAE,OAAO;AAAA,EACpC,UAAUA,IAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,KAAKA,IAAE,IAAI;AAAA,EACX,iBAAiBA,IAAE,OAAO,EAAE,SAAS;AACvC,CAAC;AAUM,IAAMC,6BAA4BD,IAAE,OAAO;AAAA,EAChD,kBAAkBA,IAAE,OAAO,EAAE,SAAS;AAAA,EACtC,kBAAkB,cAAc,SAAS;AAAA,EACzC,aAAaA,IAAE,OAAO,EAAE,SAAS;AAAA,EACjC,QAAQA,IAAE,OAAO;AAAA,EACjB,MAAM,cAAc,SAAS;AAAA,EAC7B,MAAMA,IAAE,OAAO;AAAA,EACf,iBAAiB,cAAc,SAAS;AAC1C,CAAC;AAMM,IAAM,uBAAuBA,IAAE,OAAO;AAAA,EAC3C,aAAaA,IAAE,OAAO,EAAE,SAAS;AAAA,EACjC,QAAQA,IAAE,OAAO;AAAA,EACjB,MAAMA,IAAE,OAAO;AACjB,CAAC;AAMM,IAAME,kBAAiBF,IAAE,OAAO;AAAA,EACrC,SAASA,IAAE,MAAM,oBAAoB,EAAE,SAAS;AAAA,EAChD,WAAWA,IAAE,QAAQ,EAAE,SAAS;AAAA,EAChC,MAAMA,IAAE,MAAMA,IAAE,MAAM,CAACA,IAAE,OAAO,GAAGA,IAAE,OAAO,GAAGA,IAAE,KAAK,CAAC,CAAC,CAAC;AAAA,EACzD,IAAIA,IAAE,KAAK,CAAC,UAAU,OAAO,CAAC,EAAE,SAAS;AAC3C,CAAC;AAOM,IAAM,qBAAqBA,IAAE,OAAO;AAAA,EACzC,QAAQA,IAAE,MAAME,eAAc,EAAE,SAAS;AAAA,EACzC,SAASF,IAAE,MAAMC,0BAAyB,EAAE,SAAS;AACvD,CAAC;AAEM,IAAM,mBAAmBD,IAAE,KAAK;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAIM,IAAM,2BAA2B;AAQjC,IAAM,sBAAsBA,IAAE,OAAO;AAAA,EAC1C,KAAKA,IAAE,OAAO;AAAA,IACZ,2BAA2BA,IACxB,OAAO;AAAA,MACN,aAAaA,IAAE,MAAM,gBAAgB,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MACvD,qBAAqBA,IAClB,MAAM,wBAAwB,EAC9B,IAAI,CAAC,EACL,SAAS;AAAA,IACd,CAAC,EACA,SAAS;AAAA,IACZ,oCAAoCA,IAAE,MAAMA,IAAE,OAAO,CAAC;AAAA,EACxD,CAAC;AACH,CAAC;AAMM,IAAM,mBAAmBA,IAAE,OAAO;AAAA,EACvC,YAAYA,IAAE,OAAO;AAAA,EACrB,WAAWA,IAAE,OAAO;AACtB,CAAC;AAUM,IAAMG,+BAA8BH,IAAE;AAAA,EAC3CA,IAAE,mBAAmB,UAAU;AAAA,IAC7BA,IAAE,OAAO;AAAA,MACP,yCAAyCA,IAAE,MAAMA,IAAE,OAAO,CAAC;AAAA,MAC3D,QAAQA,IAAE,QAAQ,WAAW;AAAA,MAC7B,KAAKA,IAAE,OAAO;AAAA,IAChB,CAAC;AAAA,IACDA,IAAE,OAAO;AAAA,MACP,yCAAyCA,IAAE,MAAMA,IAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACjE,SAASA,IAAE,OAAO;AAAA,MAClB,QAAQA,IAAE,QAAQ,UAAU;AAAA,IAC9B,CAAC;AAAA,EACH,CAAC;AAAA,EACDA,IAAE,OAAO;AAAA,IACP,mBAAmB;AAAA,IACnB,qBAAqB;AAAA,IACrB,yCAAyCA,IAAE,MAAMA,IAAE,OAAO,CAAC;AAAA,IAC3D,uBAAuB;AAAA,IACvB,WAAWA,IAAE,OAAO;AAAA,IACpB,OAAOA,IAAE,OAAO;AAAA,EAClB,CAAC;AACH;AAaO,IAAMI,oCAAmCJ,IAAE,YAAY;AAAA,EAC5D,uBAAuBA,IAAE,MAAM,CAACA,IAAE,IAAI,CAAC,GAAGA,IAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC5D,2BAA2BA,IACxB,OAAO;AAAA,IACN,YAAYA,IAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACxC,CAAC,EACA,SAAS;AAAA,EACZ,qCAAqCA,IAAE;AAAA,IACrCA,IAAE,OAAO;AAAA,IACTG;AAAA,EACF;AAAA,EACA,qBAAqBH,IAAE,IAAI;AAAA,EAC3B,mBAAmBA,IAAE,IAAI;AAAA,EACzB,8BAA8BA,IAAE,IAAI,EAAE,SAAS;AAAA,EAC/C,SAASA,IAAE,MAAMC,0BAAyB,EAAE,SAAS;AAAA,EACrD,MAAM;AAAA,EACN,gBAAgBD,IAAE,IAAI,EAAE,SAAS;AAAA,EACjC,uBAAuBA,IAAE,IAAI,EAAE,SAAS;AAAA,EACxC,kCAAkCA,IAAE,IAAI,EAAE,SAAS;AAAA,EACnD,4BAA4BA,IAAE;AAAA,IAC5BA,IAAE,MAAM;AAAA,MACNA,IAAE,QAAQ,aAAa;AAAA,MACvBA,IAAE,QAAQ,QAAQ;AAAA,MAClBA,IAAE,QAAQ,WAAW;AAAA,MACrBA,IAAE,QAAQ,sBAAsB;AAAA;AAAA,MAEhCA,IAAE,QAAQ,SAAS;AAAA,IACrB,CAAC;AAAA,EACH;AACF,CAAC;AAMM,IAAMK,sCAAqC;;;ACtLlD,SAAS,KAAAC,WAAS;AAsBX,IAAMC,sCAAqCC,IAAE,YAAY;AAAA,EAC9D,kBAAkBA,IAAE,QAAQ,KAAK;AAAA,EACjC,WAAWA,IAAE,IAAI;AAAA,EACjB,aAAaA,IAAE,OAAO;AAAA,EACtB,yCAAyCA,IAAE,MAAMA,IAAE,OAAO,CAAC,EAAE,IAAI,CAAC;AAAA,EAClE,kBAAkBA,IAAE,IAAI,EAAE,SAAS;AAAA,EACnC,MAAM;AAAA,EACN,UAAUA,IAAE,IAAI;AAAA,EAChB,cAAcA,IAAE,MAAMA,IAAE,IAAI,CAAC;AAAA,EAC7B,eAAeA,IAAE,MAAMA,IAAE,IAAI,CAAC;AAAA,EAC9B,sBAAsBA,IAAE;AAAA,IACtBA,IAAE,OAAO;AAAA,IACTA,IAAE,OAAO;AAAA,MACP,KAAKA,IAAE,MAAMA,IAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MAClC,uBAAuBA,IAAE,MAAMA,IAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MACpD,uBAAuBA,IAAE,MAAMA,IAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MACpD,qBAAqBA,IAAE,MAAMA,IAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MAClD,qBAAqBA,IAAE,MAAMA,IAAE,OAAO,CAAC,EAAE,SAAS;AAAA,IACpD,CAAC;AAAA,EACH;AACF,CAAC;;;AC1CD,SAAS,KAAAC,WAAS;AAIlB,IAAM,uBAAuBC,IAAE,YAAY;AAAA,EACzC,wBAAwBA,IAAE,IAAI;AAAA,EAC9B,8BAA8BA,IAAE;AAAA,IAC9BA,IAAE,KAAK,CAAC,qBAAqB,WAAW,CAAC;AAAA,EAC3C;AAAA,EACA,2BAA2BA,IAAE,IAAI;AAAA,EACjC,6CAA6CA,IAAE,MAAMA,IAAE,OAAO,CAAC;AAAA,EAC/D,0BAA0BA,IAAE,MAAMA,IAAE,QAAQ,OAAO,CAAC,EAAE,IAAI,CAAC;AAAA,EAC3D,0BAA0BA,IAAE,MAAMA,IAAE,OAAO,CAAC;AAAA,EAC5C,sBAAsBA,IAAE,OAAOA,IAAE,OAAO,GAAGA,IAAE,YAAY,CAAC,CAAC,CAAC;AAAA,EAC5D,aAAaA,IAAE,OAAO;AACxB,CAAC;AAEM,IAAM,iCAAiCA,IAAE,YAAY;AAAA,EAC1D,MAAM,oBAAoB,SAAS;AAAA,EACnC,UAAUA,IAAE,IAAI,EAAE,SAAS;AAAA;AAAA,EAE3B,UAAUA,IAAE,IAAI;AAAA,EAChB,iBAAiBA,IAAE,IAAI,EAAE,SAAS;AAAA,EAClC,iBAAiB;AACnB,CAAC;AAMM,IAAM,mCAAmC;;;AvBezC,IAAM,uBAAuBC,IAAE,aAAa;AAAA,EACjD,CAAC,qCAAqC,GACpC,oCAAoC,SAAS;AAAA,EAC/C,CAAC,kCAAkC,GACjC,iCAAiC,SAAS;AAAA,EAC5C,CAAC,oCAAoC,GACnC,mCAAmC,SAAS;AAAA,EAC9C,CAAC,kCAAkC,GACjC,iCAAiC,SAAS;AAAA,EAC5C,CAAC,gCAAgC,GAAG,+BAA+B,SAAS;AAC9E,CAAC;AAGM,IAAM,uBAAuBA,IAAE,aAAa;AAAA,EACjD,CAACC,sCAAyC,GACxCC,qCAAwC,SAAS;AAAA,EACnD,CAACC,mCAAsC,GACrCC,kCAAqC,SAAS;AAAA,EAChD,CAAC,oCAAwC,GACvCC,oCAAuC,SAAS;AAAA,EAClD,CAAC,kCAAkC,GACjC,iCAAiC,SAAS;AAAA,EAC5C,CAAC,gCAAoC,GACnC,+BAAmC,SAAS;AAChD,CAAC;AAIM,IAAM,yBACX,qBAAqB,GAAG,oBAAoB;AAqBvC,SAAS,0BACd,UACA,SAC0C;AAC1C,SAAO,kBAAkB,SAAS;AAAA,IAChC,CAAC,qBAAqB,IAAI,GAAG,MAC3B,qBAAqB,UAAU,QAAQ,EAAE;AAAA,IAC3C,CAAC,qBAAqB,IAAI,GAAG,MAC3B,qBAAqB,UAAU,QAAQ,EAAE;AAAA,IAC3C,CAAC,qBAAqB,IAAI,GAAG,MAC3B,qBAAqB,UAAU,QAAQ,EAAE;AAAA,EAC7C,CAAC;AACH;AAWO,SAAS,gCACd,UACA,SAC8B;AAC9B,SAAO,kBAAoC,SAAS;AAAA,IAClD,CAAC,qBAAqB,IAAI,GAAG,MAC3BC;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACF,CAAC,qBAAqB,IAAI,GAAG,MAC3BA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACF,CAAC,qBAAqB,IAAI,GAAG,MAC3BA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACJ,CAAC;AACH;;;AwB9IA,SAAS,KAAAC,WAAS;AAEX,IAAM,mBAAmBA,IAAE,OAAO;AAAA,EACvC,sBAAsBA,IACnB;AAAA,IACCA,IAAE,OAAO,EAAE,OAAO,CAAC,MAAM,MAAM,qBAAqB;AAAA,MAClD,SAAS;AAAA,IACX,CAAC;AAAA,EACH,EACC,SAAS;AAAA,EACZ,iBAAiBA,IAAE,OAAO,EAAE,SAAS;AAAA,EACrC,oBAAoBA,IACjB,OAAO;AAAA,IACN,UAAUA,IAAE,MAAMA,IAAE,OAAO,CAAC,EAAE,SAAS;AAAA,IACvC,WAAWA,IAAE,MAAMA,IAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EAC1C,CAAC,EACA,SAAS;AACd,CAAC;;;ACjBD,SAAS,KAAAC,WAAS;AAOX,IAAM,qBAAqBC,IAC/B,IAAI,EACJ,MAAM,8CAA8C;AAEhD,IAAM,kBAAkBA,IAAE,OAAO;AAAA,EACtC,YAAYA,IAAE,OAAO;AAAA,EACrB,iBAAiB;AACnB,CAAC;AAIM,IAAM,wBAAwBA,IAAE,OAAOA,IAAE,OAAO,GAAGA,IAAE,MAAMA,IAAE,OAAO,CAAC,CAAC;AAItE,IAAM,uBAAuBA,IAAE;AAAA,EACpCA,IAAE,OAAO;AAAA,EACTA,IAAE,OAAO;AAAA,IACP,MAAM;AAAA,IACN,KAAKA,IAAE,OAAO;AAAA,EAChB,CAAC;AACH;;;A1BPA,IAAM,aAAaC,IAAE,OAAO;AAAA,EAC1B,iBAAiBA,IAAE,MAAMA,IAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC3C,aAAa,iBAAiB,SAAS;AAAA,EACvC,MAAMA,IAAE,MAAMA,IAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACnC,KAAKA,IACF,OAAO,EACP,SAAS,4DAA4D;AAAA,EACxE,KAAKA,IACF,OAAO,EACP,SAAS,2DAA2D;AAAA,EACvE,KAAKA,IAAE,OAAO;AAAA,EACd,MAAM;AAAA,EACN,UAAU,uBAAuB,SAAS;AAAA,EAC1C,iBAAiBA,IACd,OAAOA,IAAE,OAAO,GAAGA,IAAE,OAAOA,IAAE,OAAO,GAAG,oBAAoB,EAAE,SAAS,CAAC,EACxE,SAAS;AAAA,EACZ,sBAAsBA,IAAE,MAAMA,IAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACnD,iBAAiBA,IAAE,IAAI,EAAE,SAAS;AAAA,EAClC,KAAKA,IAAE,OAAO;AAAA,EACd,oBAAoB,sBAAsB,SAAS;AAAA,EACnD,mBAAmB,qBAAqB,SAAS;AAAA,EACjD,aAAaA,IAAE,MAAM,eAAe,EAAE,SAAS;AACjD,CAAC;AAMD,IAAM,8BAA8B,WAAW,MAAM,EAAE;AAAA,EACrD,CAAC,SAAS;AACR,UAAM,SAAS,KAAK,KAAK,KAAK,IAAI,CAAC,QAAQ,IAAI,GAAG;AAClD,UAAM,eAAe,IAAI,IAAI,MAAM;AACnC,WAAO,aAAa,SAAS,OAAO;AAAA,EACtC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,MAAM,CAAC,QAAQ,MAAM;AAAA,EACvB;AACF;AAGO,IAAM,sCAGT;AA4BG,SAAS,uCAGd,QACA,SACqD;AACrD,QAAM,eAAe,oCAAoC,UAAU,MAAM;AAEzE,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO;AAAA,EACT;AAEA,SACE,aAAa,KAAK,aAAa,UAC/B,0BAA0B,aAAa,KAAK,UAAU,OAAO;AAEjE;AAWO,SAAS,6CAEd,QAAiB,SAAuD;AACxE,QAAM,eAAeC;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,MAAI,aAAa,aAAa,QAAW;AACvC,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,UAAU,gCAAgC,aAAa,UAAU,OAAO;AAAA,EAC1E;AACF;;;A2B/HO,IAAM,0CACX;AAcK,IAAM,6CACX;AAEK,IAAM,mDACX;;;AC7BF,SAAS,iCAAiC;AAC1C,SAAS,KAAAC,WAAS;AAEX,IAAM,kCAAkCA,IAAE,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA,EAK3D,KAAK;AAAA,EACL,KAAKA,IAAE,OAAO;AAAA,EACd,KAAKA,IAAE,QAAQ,sBAAsB;AACvC,CAAC;;;AhCyBM,IAAM,oCAAoC,OAAO;AAAA,EACtD;AAAA,EACA;AAAA,EACA;AACF,MAAwC;AACtC,QAAM,kBAAkBC;AAAA,IACtB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,kBAAkBA;AAAA,IACtB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,QAAM,aAAa,uBAAuB,QAAQ,MAAM;AAExD,QAAM,MAAM,kBAAkB,iBAAiB,eAAe;AAE9D,QAAM,YAAY,MAAM,gBAAgB,EAAE,KAAK,WAAW,CAAC;AAE3D,SAAO,mBAAmB,QAAQ,QAAQ,SAAS;AACrD;AAEA,SAAS,mBACP,QACA,SACA,WACA;AACA,QAAM,gBAAgB;AAAA,IACpB,OAAO,KAAK,KAAK,UAAU,MAAM,CAAC,EAAE,SAAS,QAAQ;AAAA,EACvD;AACA,QAAM,iBAAiB;AAAA,IACrB,OAAO,KAAK,KAAK,UAAU,OAAO,CAAC,EAAE,SAAS,QAAQ;AAAA,EACxD;AAEA,QAAM,mBAAmB;AAAA,IACvB,OAAO,KAAK,SAAS,EAAE,SAAS,QAAQ;AAAA,EAC1C;AAEA,SAAO,GAAG,aAAa,IAAI,cAAc,IAAI,gBAAgB;AAC/D;AAEA,SAAS,uBACP,QACA,SACA;AACA,MAAI,OAAO,KAAK,MAAM,EAAE,WAAW,GAAG;AACpC,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC3D;AAEA,MAAI,OAAO,KAAK,OAAO,EAAE,WAAW,GAAG;AACrC,UAAM,IAAI,MAAM,0CAA0C;AAAA,EAC5D;AAEA,QAAM,gBAAgB;AAAA,IACpB,OAAO,KAAK,KAAK,UAAU,MAAM,CAAC,EAAE,SAAS,QAAQ;AAAA,EACvD;AACA,QAAM,iBAAiB;AAAA,IACrB,OAAO,KAAK,KAAK,UAAU,OAAO,CAAC,EAAE,SAAS,QAAQ;AAAA,EACxD;AAEA,QAAM,mBAAmB,GAAG,aAAa,IAAI,cAAc;AAE3D,SAAO,IAAI,WAAW,OAAO,KAAK,gBAAgB,CAAC;AACrD;;;AiCnGO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EACnC;AAAA,EACT,YACE,SACA,SACA;AACA,UAAM,SAAS,OAAO;AACtB,SAAK,OAAO;AACZ,SAAK,aAAa,SAAS;AAAA,EAC7B;AACF;AAOO,IAAM,4BAAN,cAAwC,mBAAmB;AAAA,EAChE,YAAY,SAAiB,OAAiB;AAC5C,UAAM,SAAS,EAAE,MAAM,CAAC;AACxB,SAAK,OAAO;AAAA,EACd;AACF;;;ACzBA;AAAA,EAGE;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAcP,SAAS,sBAAsB,KAAyB;AACtD,QAAM,EAAE,QAAQ,QAAQ,IAAI,UAAU;AAAA,IACpC,cAAc;AAAA,IACd;AAAA,IACA,eAAe;AAAA,EACjB,CAAC;AACD,SAAO,EAAE,SAAS,KAAK,QAAQ,QAAQ;AACzC;AAEA,SAAS,qBAAqB,SAAuB;AACnD,SAAO,CAAC,OAAO,SAAS;AACtB,UAAM,MACJ,OAAO,UAAU,WACb,QACA,iBAAiB,MACf,MAAM,OACN,MAAM;AACd,QAAI,CAAC,IAAI,WAAW,UAAU,GAAG;AAC/B,YAAM,IAAI;AAAA,QACR,4CAA4C,GAAG;AAAA,MACjD;AAAA,IACF;AACA,WAAO,QAAQ,OAAO,IAAI;AAAA,EAC5B;AACF;AAEA,eAAe,4BACb,WACA,SACiB;AACjB,QAAM,MAAM,GAAG,SAAS;AACxB,QAAM,WAAW,MAAM,QAAQ,KAAK;AAAA,IAClC,SAAS,EAAE,QAAQ,mCAAmC;AAAA,EACxD,CAAC;AACD,QAAM,iBAAiB,KAAK,yBAAyB,EAAE,QAAQ;AAC/D,SAAO,SAAS,KAAK;AACvB;AAOA,eAAe,oBACb,KACA,KACA,MACA,QACA,WACwD;AACxD,QAAM,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,QAAQ,GAAG;AAC1C,MAAI,CAAC,KAAK;AACR,UAAM,IAAI;AAAA,MACR,yBAAyB,GAAG;AAAA,IAC9B;AAAA,EACF;AAEA,MAAI,QAAQ;AACV,UAAM,QAAQ,OAAO,KAAK,CAAC,MAAM,EAAE,QAAQ,IAAI,GAAG;AAClD,QAAI,CAAC,OAAO;AACV,YAAM,IAAI;AAAA,QACR,yBAAyB,GAAG;AAAA,MAC9B;AAAA,IACF;AACA,UAAM,CAAC,eAAe,YAAY,IAAI,MAAM,QAAQ,IAAI;AAAA,MACtD,uBAAuB;AAAA,QACrB,eAAe,cAAc;AAAA,QAC7B,cAAc,UAAU;AAAA,QACxB,KAAK;AAAA,MACP,CAAC;AAAA,MACD,uBAAuB;AAAA,QACrB,eAAe,cAAc;AAAA,QAC7B,cAAc,UAAU;AAAA,QACxB,KAAK;AAAA,MACP,CAAC;AAAA,IACH,CAAC;AACD,QAAI,kBAAkB,cAAc;AAClC,YAAM,IAAI;AAAA,QACR,yBAAyB,GAAG;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAEA,MAAI,IAAI,OAAO,IAAI,QAAQ,IAAI,OAAO,KAAK;AACzC,UAAM,IAAI;AAAA,MACR,eAAe,GAAG,6DAA6D,IAAI,GAAG,cAAc,IAAI,OAAO,GAAG;AAAA,IACpH;AAAA,EACF;AAEA,SAAO,UAAU;AAAA,IACf;AAAA,MACE,KAAK,IAAI,OAAO;AAAA,MAChB,QAAQ;AAAA,MACR,WAAW;AAAA,IACb;AAAA,IACA;AAAA,EACF;AACF;AAIA,IAAM,uBAAuB;AAE7B,eAAe,gBACb,WACA,iBACA,SACA,UAAU,oBAAI,IAAY,GAC1B,QAAQ,GACa;AACrB,MAAI,QAAQ,IAAI,SAAS,GAAG;AAC1B,UAAM,IAAI;AAAA,MACR,oBAAoB,SAAS;AAAA,IAC/B;AAAA,EACF;AACA,MAAI,SAAS,sBAAsB;AACjC,UAAM,IAAI;AAAA,MACR,+BAA+B,oBAAoB,gBAAgB,SAAS;AAAA,IAC9E;AAAA,EACF;AAEA,UAAQ,IAAI,SAAS;AAErB,QAAM,MAAM,MAAM,4BAA4B,WAAW,OAAO;AAChE,QAAM,QAAQ,sBAAsB,GAAG;AAEvC,MAAI,iBAAiB,KAAK,CAAC,QAAQ,QAAQ,MAAM,QAAQ,GAAG,GAAG;AAC7D,WAAO,CAAC,KAAK;AAAA,EACf;AAEA,QAAM,iBAAiB,MAAM,QAAQ,mBAAmB,CAAC;AACzD,MAAI,CAAC,eAAe,QAAQ;AAC1B,UAAM,IAAI;AAAA,MACR,sBAAsB,SAAS;AAAA,IACjC;AAAA,EACF;AAEA,QAAM,gBAAgB,eAAe;AAAA,IAAK,CAAC,MACzC,iBAAiB,SAAS,CAAC;AAAA,EAC7B;AACA,MAAI,eAAe;AACjB,UAAM,YAAY,MAAM,4BAA4B,eAAe,OAAO;AAC1E,WAAO,CAAC,OAAO,sBAAsB,SAAS,CAAC;AAAA,EACjD;AAEA,MAAI;AACJ,aAAW,QAAQ,gBAAgB;AACjC,QAAI;AACF,YAAM,YAAY,MAAM;AAAA,QACtB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,MACV;AACA,aAAO,CAAC,OAAO,GAAG,SAAS;AAAA,IAC7B,SAAS,OAAO;AACd,kBAAY;AAAA,IACd;AAAA,EACF;AACA,QAAM,mBACJ,qBAAqB,QACjB,UAAU,UACV,cAAc,SACZ,OAAO,SAAS,IAChB;AACR,QAAM,IAAI;AAAA,IACR,2CAA2C,SAAS,kBAAkB,gBAAgB;AAAA,EACxF;AACF;AAEA,eAAe,iBACb,OACA,KACA,WACe;AACf,QAAM,oBAAoB,MAAM,QAAQ;AAAA,IACtC,MAAM,KAAK,EAAE,QAAQ,MAAM,SAAS,EAAE,GAAG,CAAC,GAAG,MAAM;AACjD,YAAM,YAAY,MAAM,CAAC;AACzB,YAAM,WAAW,MAAM,IAAI,CAAC;AAC5B,YAAM,cAAc,IAAI,CAAC;AACzB,UAAI,CAAC,aAAa,CAAC,YAAY,CAAC,aAAa;AAC3C,cAAM,IAAI;AAAA,UACR,qCAAqC,CAAC;AAAA,QACxC;AAAA,MACF;AACA,aAAO;AAAA,QACL;AAAA,QACA,UAAU,OAAO;AAAA,QACjB,SAAS,QAAQ,KAAK;AAAA,QACtB,YAAY,QAAQ,KAAK;AAAA,QACzB;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAEA,aAAW,CAAC,GAAG,EAAE,SAAS,CAAC,KAAK,kBAAkB,QAAQ,GAAG;AAC3D,QAAI,CAAC,UAAU;AACb,YAAM,YAAY,MAAM,CAAC;AACzB,UAAI,CAAC,WAAW;AACd,cAAM,IAAI;AAAA,UACR,qCAAqC,CAAC;AAAA,QACxC;AAAA,MACF;AACA,YAAM,cAAc,MAAM,IAAI,YAAY;AAC1C,YAAM,IAAI;AAAA,QACR,iCAAiC,WAAW,gBAAgB,CAAC,UAAU,UAAU,QAAQ,GAAG,WAAW,UAAU,QAAQ,GAAG;AAAA,MAC9H;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAe,gBACb,KACA,SACA,WACqB;AACrB,aAAW,MAAM,KAAK;AACpB,QAAI,GAAG,QAAQ,QAAQ,GAAG,QAAQ,KAAK;AACrC,YAAM,IAAI;AAAA,QACR,6BAA6B,GAAG,QAAQ,GAAG,yBAAyB,GAAG,QAAQ,GAAG;AAAA,MACpF;AAAA,IACF;AAAA,EACF;AAEA,MAAI,IAAI,WAAW,GAAG;AACpB,UAAM,OAAO,IAAI,CAAC;AAClB,UAAM,EAAE,SAAS,IAAI,MAAM;AAAA,MACzB;AAAA,MACA,KAAK,OAAO;AAAA,MACZ,KAAK,QAAQ,KAAK;AAAA,MAClB;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,UAAU;AACb,YAAM,IAAI;AAAA,QACR,oDAAoD,KAAK,QAAQ,GAAG;AAAA,MACtE;AAAA,IACF;AACA,gBAAY,GAAG;AACf,WAAO;AAAA,EACT;AAEA,QAAM,kBAAkB,MAAM,QAAQ;AAAA,IACpC,IACG,MAAM,CAAC,EACP;AAAA,MAAI,CAAC,OACJ;AAAA,QACE;AAAA,QACA,GAAG,OAAO;AAAA,QACV,GAAG,QAAQ,KAAK;AAAA,QAChB;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACJ;AAEA,aAAW,CAAC,GAAG,EAAE,SAAS,CAAC,KAAK,gBAAgB,QAAQ,GAAG;AACzD,QAAI,CAAC,UAAU;AACb,YAAM,KAAK,IAAI,IAAI,CAAC;AACpB,YAAM,IAAI;AAAA,QACR,oDAAoD,IAAI,QAAQ,OAAO,IAAI,CAAC;AAAA,MAC9E;AAAA,IACF;AAAA,EACF;AAEA,cAAY,GAAG;AAEf,QAAM,iBAA6C,MAAM,QAAQ;AAAA,IAC/D,IAAI,IAAI,OAAO,OAAO,QAAQ;AAC5B,UAAI,QAAQ,IAAI,SAAS,EAAG,QAAO;AAEnC,YAAM,WAAW,IAAI,MAAM,CAAC;AAC5B,UAAI,CAAC,SAAU,QAAO;AAEtB,YAAM,gBACJ,SAAS,QAAQ,UAAU,mBAAmB;AAChD,UAAI,CAAC,eAAe;AAClB,cAAM,IAAI;AAAA,UACR,4BAA4B,MAAM,CAAC;AAAA,QACrC;AAAA,MACF;AAEA,YAAM,WAAW,GAAG,aAAa,QAAQ,mBAAmB,MAAM,QAAQ,GAAG,CAAC;AAC9E,YAAM,WAAW,MAAM,QAAQ,UAAU;AAAA,QACvC,SAAS,EAAE,QAAQ,mCAAmC;AAAA,MACxD,CAAC;AACD,YAAM,iBAAiB,KAAK,yBAAyB,EAAE,QAAQ;AAE/D,YAAM,SAAS,MAAM,SAAS,KAAK;AACnC,YAAM,WAAW,sBAAsB,MAAM;AAE7C,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AAEA,QAAM,WAAW,eAAe;AAAA,IAC9B,CAAC,MAAuB,MAAM;AAAA,EAChC;AACA,QAAM,SAAS,IAAI,IAAI,SAAS,CAAC;AACjC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,QAAoB,CAAC,IAAI,CAAC,GAAG,GAAG,UAAU,MAAM;AAEtD,WAAS,IAAI,GAAG,IAAI,MAAM,SAAS,GAAG,KAAK;AACzC,UAAM,YAAY,MAAM,CAAC;AACzB,UAAM,WAAW,MAAM,IAAI,CAAC;AAC5B,UAAM,cAAc,IAAI,CAAC;AACzB,QAAI,CAAC,aAAa,CAAC,YAAY,CAAC,aAAa;AAC3C,YAAM,IAAI;AAAA,QACR,qCAAqC,CAAC;AAAA,MACxC;AAAA,IACF;AAIA,UAAM,QAAQ,YAAY,QAAQ,mBAAmB,CAAC;AACtD,QAAI,MAAM,SAAS,KAAK,CAAC,MAAM,SAAS,SAAS,QAAQ,GAAG,GAAG;AAC7D,YAAM,IAAI;AAAA,QACR,IAAI,SAAS,QAAQ,GAAG,0CAA0C,YAAY,QAAQ,GAAG;AAAA,MAC3F;AAAA,IACF;AAAA,EACF;AAEA,qBAAmB,KAAK;AAExB,QAAM,iBAAiB,OAAO,KAAK,SAAS;AAE5C,SAAO;AACT;AAGA,IAAM,qBAAqB;AAE3B,SAAS,YAAY,OAA2B;AAC9C,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,UAAM,QAAQ,MAAM,CAAC;AACrB,QAAI,CAAC,OAAO;AACV,YAAM,IAAI;AAAA,QACR,mCAAmC,CAAC;AAAA,MACtC;AAAA,IACF;AACA,SAAK,MAAM,QAAQ,OAAO,KAAK,MAAM,oBAAoB;AACvD,YAAM,IAAI;AAAA,QACR,mCAAmC,CAAC;AAAA,MACtC;AAAA,IACF;AACA,QAAI,MAAM,QAAQ,MAAM,MAAM,oBAAoB;AAChD,YAAM,IAAI;AAAA,QACR,mCAAmC,CAAC;AAAA,MACtC;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,OAA2B;AACrD,WAAS,IAAI,GAAG,IAAI,MAAM,SAAS,GAAG,KAAK;AACzC,UAAM,UAAU,MAAM,CAAC;AACvB,UAAM,UAAU,SAAS,QAAQ,aAAa;AAC9C,QAAI,YAAY,QAAW;AACzB,YAAM,yBAAyB,MAAM,SAAS,IAAI;AAClD,UAAI,yBAAyB,SAAS;AACpC,cAAM,IAAI;AAAA,UACR,wDAAwD,CAAC,aAAa,OAAO,8BAA8B,sBAAsB;AAAA,QACnI;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,eACP,OACA,iBACM;AACN,QAAM,aAAa,MAAM,CAAC;AAC1B,QAAM,YAAY,MAAM,MAAM,SAAS,CAAC;AAExC,MAAI,cAAc,WAAW,QAAQ,QAAQ,WAAW,QAAQ,KAAK;AACnE,UAAM,IAAI;AAAA,MACR,gBAAgB,WAAW,QAAQ,GAAG,yBAAyB,WAAW,QAAQ,GAAG;AAAA,IACvF;AAAA,EACF;AACA,MACE,aACA,cAAc,cACd,UAAU,QAAQ,QAAQ,UAAU,QAAQ,KAC5C;AACA,UAAM,IAAI;AAAA,MACR,wBAAwB,UAAU,QAAQ,GAAG,yBAAyB,UAAU,QAAQ,GAAG;AAAA,IAC7F;AAAA,EACF;AAEA,MAAI,MAAM,SAAS,GAAG;AACpB,QAAI,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG;AAC5B,YAAM,IAAI,0BAA0B,0BAA0B;AAAA,IAChE;AACA,QAAI,WAAW,QAAQ,QAAQ,MAAM,CAAC,EAAE,QAAQ,KAAK;AACnD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,aAAS,IAAI,GAAG,IAAI,MAAM,SAAS,GAAG,KAAK;AACzC,YAAM,UAAU,MAAM,CAAC;AACvB,YAAM,OAAO,MAAM,IAAI,CAAC;AACxB,UAAI,CAAC,WAAW,CAAC,MAAM;AACrB,cAAM,IAAI;AAAA,UACR,mCAAmC,CAAC;AAAA,QACtC;AAAA,MACF;AACA,UAAI,QAAQ,QAAQ,QAAQ,KAAK,QAAQ,KAAK;AAC5C,cAAM,IAAI;AAAA,UACR,uCAAuC,CAAC;AAAA,QAC1C;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAKA,MAAI,iBAAiB,QAAQ;AAC3B,QAAI,CAAC;AACH,YAAM,IAAI,0BAA0B,iCAAiC;AACvE,QAAI,CAAC,gBAAgB,SAAS,UAAU,QAAQ,GAAG,GAAG;AACpD,YAAM,IAAI;AAAA,QACR,qBAAqB,UAAU,QAAQ,GAAG;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AACF;AAkEA,eAAsB,mBACpB,YACA,SACe;AACf,MAAI,CAAC,WAAW,CAAC,EAAG,OAAM,IAAI,0BAA0B,mBAAmB;AAE3E,QAAM,QAAQ,WAAW,IAAI,qBAAqB;AAElD,cAAY,KAAK;AAEjB,QAAM,YAAY,MAAM,CAAC;AACzB,MAAI,CAAC;AACH,UAAM,IAAI,0BAA0B,iCAAiC;AACvE,QAAM,cAAc,MAAM,MAAM,SAAS,CAAC;AAC1C,MAAI,CAAC;AACH,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAEF,QAAM,kBAAmC;AAAA,IACvC,MAAM,QAAQ,UAAU;AAAA,IACxB,WAAW,QAAQ,UAAU;AAAA,EAC/B;AAEA,QAAM,UAAU,qBAAqB,cAAc,QAAQ,UAAU,KAAK,CAAC;AAE3E,QAAM,aAA2B,IAAI,MAAM,MAAM,SAAS,CAAC;AAC3D,aAAW,CAAC,IAAI;AAChB,MAAI,MAAM,UAAU,GAAG;AACrB,eAAW,MAAM,SAAS,CAAC,IAAI;AAAA,EACjC;AAEA,QAAM,sBAAsB,MAAM;AAAA,IAChC,EAAE,QAAQ,KAAK,IAAI,GAAG,MAAM,SAAS,CAAC,EAAE;AAAA,IACxC,CAAC,GAAG,MAAM,IAAI;AAAA,EAChB;AAEA,QAAM,aAAa,MAAM,QAAQ;AAAA,IAC/B,oBAAoB,IAAI,OAAO,MAAM;AACnC,YAAM,WAAW,MAAM,CAAC;AACxB,UAAI,CAAC,UAAU;AACb,cAAM,IAAI;AAAA,UACR,qCAAqC,CAAC;AAAA,QACxC;AAAA,MACF;AACA,YAAM,MAAM,MAAM;AAAA,QAChB,SAAS,QAAQ;AAAA,QACjB;AAAA,MACF;AACA,YAAM,KAAK,sBAAsB,GAAG;AACpC,YAAM,EAAE,SAAS,IAAI,MAAM;AAAA,QACzB;AAAA,QACA,GAAG,OAAO;AAAA,QACV,GAAG,QAAQ,KAAK;AAAA,QAChB;AAAA,QACA;AAAA,MACF;AACA,UAAI,CAAC,UAAU;AACb,cAAM,IAAI;AAAA,UACR,iEAAiE,SAAS,QAAQ,GAAG;AAAA,QACvF;AAAA,MACF;AACA,kBAAY,CAAC,EAAE,CAAC;AAChB,aAAO,EAAE,IAAI,EAAE;AAAA,IACjB,CAAC;AAAA,EACH;AAEA,aAAW,EAAE,IAAI,EAAE,KAAK,YAAY;AAClC,eAAW,CAAC,IAAI;AAAA,EAClB;AAIA,WAAS,IAAI,GAAG,IAAI,WAAW,SAAS,GAAG,KAAK;AAC9C,UAAM,WAAW,MAAM,CAAC;AACxB,UAAM,gBAAgB,MAAM,IAAI,CAAC;AACjC,UAAM,YAAY,WAAW,CAAC;AAC9B,QAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,WAAW;AAC7C,YAAM,IAAI;AAAA,QACR,qCAAqC,CAAC;AAAA,MACxC;AAAA,IACF;AACA,UAAM,QAAQ,UAAU,QAAQ,mBAAmB,CAAC;AACpD,QAAI,MAAM,SAAS,KAAK,CAAC,MAAM,SAAS,cAAc,QAAQ,GAAG,GAAG;AAClE,YAAM,IAAI;AAAA,QACR,IAAI,cAAc,QAAQ,GAAG,0CAA0C,SAAS,QAAQ,GAAG;AAAA,MAC7F;AAAA,IACF;AAAA,EACF;AAEA,QAAM,oBAAoB,WAAW,SAAS;AAC9C,QAAM,mBAAmB,MAAM,QAAQ,IAAI;AAAA,IACzC,GAAG,MAAM,KAAK,EAAE,QAAQ,kBAAkB,GAAG,CAAC,GAAG,MAAM;AACrD,YAAM,WAAW,MAAM,CAAC;AACxB,YAAM,gBAAgB,MAAM,IAAI,CAAC;AACjC,YAAM,YAAY,WAAW,CAAC;AAC9B,UAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,WAAW;AAC7C,cAAM,IAAI;AAAA,UACR,qCAAqC,CAAC;AAAA,QACxC;AAAA,MACF;AACA,aAAO;AAAA,QACL;AAAA,QACA,SAAS,OAAO;AAAA,QAChB,cAAc,QAAQ,KAAK;AAAA,QAC3B,UAAU,QAAQ,KAAK;AAAA,QACvB;AAAA,MACF;AAAA,IACF,CAAC;AAAA,IACD;AAAA,MACE;AAAA,MACA,YAAY,OAAO;AAAA,MACnB,YAAY,QAAQ,KAAK;AAAA,MACzB;AAAA,MACA;AAAA,IACF;AAAA,EACF,CAAC;AAED,WAAS,IAAI,GAAG,IAAI,mBAAmB,KAAK;AAC1C,UAAM,SAAS,iBAAiB,CAAC;AACjC,QAAI,CAAC,QAAQ,UAAU;AACrB,YAAM,IAAI;AAAA,QACR,iDAAiD,CAAC;AAAA,MACpD;AAAA,IACF;AAAA,EACF;AAEA,QAAM,qBAAqB,iBAAiB,iBAAiB;AAC7D,MAAI,CAAC,oBAAoB,UAAU;AACjC,UAAM,IAAI,0BAA0B,iCAAiC;AAAA,EACvE;AAEA,qBAAmB,KAAK;AAExB,iBAAe,OAAO,QAAQ,eAAe;AAC/C;AAyCA,eAAsB,2BACpB,WACA,SACmB;AACnB,QAAM,UAAU,qBAAqB,cAAc,QAAQ,UAAU,KAAK,CAAC;AAE3E,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA,IACA,QAAQ;AAAA,IACR;AAAA,EACF;AACA,QAAM,QAAQ,MAAM,gBAAgB,KAAK,SAAS;AAAA,IAChD,MAAM,QAAQ,UAAU;AAAA,IACxB,WAAW,QAAQ,UAAU;AAAA,EAC/B,CAAC;AAED,cAAY,KAAK;AACjB,iBAAe,OAAO,QAAQ,eAAe;AAE7C,SAAO,MAAM,IAAI,CAAC,MAAM,EAAE,OAAO;AACnC;","names":["parseWithErrorHandling","z","z","key","parseWithErrorHandling","z","parseWithErrorHandling","z","z","z","z","z","z","z","MetadataMergeStrategy","MetadataOrderOfApplication","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","itWalletAuthorizationServerMetadata","z","itWalletAuthorizationServerIdentifier","z","z","CredentialDisplayMetadata","ClaimsMetadata","SupportedCredentialMetadata","itWalletCredentialIssuerMetadata","itWalletCredentialIssuerIdentifier","z","itWalletCredentialVerifierMetadata","z","z","z","z","itWalletAuthorizationServerIdentifier","itWalletAuthorizationServerMetadata","itWalletCredentialIssuerIdentifier","itWalletCredentialIssuerMetadata","itWalletCredentialVerifierMetadata","parseWithErrorHandling","z","z","z","z","parseWithErrorHandling","z","parseWithErrorHandling"]}