{"version":3,"sources":["../src/index.ts","../src/functions.ts","../src/digest-methods.ts","../src/jwk-jcs.ts","../src/types/key-util-types.ts","../src/conversion.ts"],"sourcesContent":["/**\n * Provides `did:jwk` {@link @veramo/did-provider-jwk#JwkDIDProvider | identifier provider }\n * for the {@link @veramo/did-manager#DIDManager}\n *\n * @packageDocumentation\n */\nexport * from './functions'\nexport * from './conversion'\nexport * from './jwk-jcs'\nexport * from './types'\nexport * from './digest-methods'\n","import { randomBytes } from '@ethersproject/random'\n// Do not change these require statements to imports before we change to ESM. Breaks external CJS packages depending on this module\nimport { bls12_381 } from '@noble/curves/bls12-381'\nimport { ed25519 } from '@noble/curves/ed25519'\nimport { p256 } from '@noble/curves/p256'\nimport { p384 } from '@noble/curves/p384'\nimport { p521 } from '@noble/curves/p521'\nimport { secp256k1 } from '@noble/curves/secp256k1'\nimport { sha256, sha384, sha512 } from '@noble/hashes/sha2'\nimport {\n  cryptoSubtleImportRSAKey,\n  generateRSAKeyAsPEM,\n  hexToBase64,\n  hexToPEM,\n  PEMToJwk,\n  privateKeyHexFromPEM,\n} from '@sphereon/ssi-sdk-ext.x509-utils'\nimport { JoseCurve, JoseSignatureAlgorithm, type JWK, JwkKeyType, Loggers } from '@sphereon/ssi-types'\nimport { generateKeyPair as generateSigningKeyPair } from '@stablelib/ed25519'\nimport type { IAgentContext, IKey, IKeyManager, ManagedKeyInfo, MinimalImportableKey } from '@veramo/core'\nimport debug from 'debug'\n\nimport type { JsonWebKey } from 'did-resolver'\nimport elliptic from 'elliptic'\nimport * as rsa from 'micro-rsa-dsa-dh/rsa.js'\n\n// @ts-ignore\nimport { Crypto } from 'node'\n// @ts-ignore\nimport * as u8a from 'uint8arrays'\nimport { digestMethodParams } from './digest-methods'\nimport { validateJwk } from './jwk-jcs'\nimport {\n  ENC_KEY_ALGS,\n  type IImportProvidedOrGeneratedKeyArgs,\n  JwkKeyUse,\n  type KeyTypeFromCryptographicSuiteArgs,\n  SIG_KEY_ALGS,\n  type SignatureAlgorithmFromKeyArgs,\n  type SignatureAlgorithmFromKeyTypeArgs,\n  type TKeyType,\n} from './types'\n\nconst { fromString, toString } = u8a\n\nexport const logger = Loggers.DEFAULT.get('sphereon:key-utils')\n\n/**\n * Function that returns the provided KMS name or the default KMS name if none is provided.\n * The default KMS is either explicitly defined during agent construction, or the first KMS available in the system\n * @param context\n * @param kms. Optional KMS to use. If provided will be the returned name. Otherwise the default KMS will be returned\n */\nexport const getKms = async (context: IAgentContext<any>, kms?: string): Promise<string> => {\n  if (kms) {\n    return kms\n  }\n  if (!context.agent.availableMethods().includes('keyManagerGetDefaultKeyManagementSystem')) {\n    throw Error('Cannot determine default KMS if not provided and a non Sphereon Key Manager is being used')\n  }\n  return context.agent.keyManagerGetDefaultKeyManagementSystem()\n}\n\n/**\n * Generates a random Private Hex Key for the specified key type\n * @param type The key type\n * @return The private key in Hex form\n */\nexport const generatePrivateKeyHex = async (type: TKeyType): Promise<string> => {\n  switch (type) {\n    case 'Ed25519': {\n      const keyPairEd25519 = generateSigningKeyPair()\n      return toString(keyPairEd25519.secretKey, 'base16')\n    }\n    // The Secp256 types use the same method to generate the key\n    case 'Secp256r1':\n    case 'Secp256k1': {\n      const privateBytes = randomBytes(32)\n      return toString(privateBytes, 'base16')\n    }\n    case 'RSA': {\n      const pem = await generateRSAKeyAsPEM('RSA-PSS', 'SHA-256', 2048)\n      return privateKeyHexFromPEM(pem)\n    }\n    default:\n      throw Error(`not_supported: Key type ${type} not yet supported for this did:jwk implementation`)\n  }\n}\n\nconst keyMetaAlgorithmsFromKeyType = (type: string | TKeyType) => {\n  switch (type) {\n    case 'Ed25519':\n      return ['Ed25519', 'EdDSA']\n    case 'ES256K':\n    case 'Secp256k1':\n      return ['ES256K', 'ES256K-R', 'eth_signTransaction', 'eth_signTypedData', 'eth_signMessage', 'eth_rawSign']\n    case 'Secp256r1':\n      return ['ES256']\n    case 'X25519':\n      return ['ECDH', 'ECDH-ES', 'ECDH-1PU']\n    case 'RSA':\n      return ['RS256', 'RS512', 'PS256', 'PS512']\n  }\n  return [type]\n}\n\n/**\n * We optionally generate and then import our own keys.\n *\n * @param args The key arguments\n * @param context The Veramo agent context\n * @private\n */\nexport async function importProvidedOrGeneratedKey(\n  args: IImportProvidedOrGeneratedKeyArgs & {\n    kms: string\n  },\n  context: IAgentContext<IKeyManager>\n): Promise<IKey> {\n  // @ts-ignore\n  const type = args.options?.type ?? args.options?.key?.type ?? args.options?.keyType ?? 'Secp256r1'\n  const key = args?.options?.key\n  // Make sure x509 options are also set on the metadata as that is what the kms will look for\n  if (args.options?.x509 && key) {\n    key.meta = {\n      ...key.meta,\n      x509: {\n        ...args.options.x509,\n        ...key.meta?.x509,\n      },\n    }\n  }\n\n  if (args.options && args.options?.use === JwkKeyUse.Encryption && !ENC_KEY_ALGS.includes(type)) {\n    throw new Error(`${type} keys are not valid for encryption`)\n  }\n\n  let privateKeyHex: string | undefined = undefined\n  if (key) {\n    privateKeyHex = key.privateKeyHex ?? key.meta?.x509?.privateKeyHex\n    if ((!privateKeyHex || privateKeyHex.trim() === '') && key?.meta?.x509?.privateKeyPEM) {\n      // If we do not have a privateKeyHex but do have a PEM\n      privateKeyHex = privateKeyHexFromPEM(key.meta.x509.privateKeyPEM)\n    }\n  }\n  if (privateKeyHex) {\n    return context.agent.keyManagerImport({\n      ...key,\n      kms: args.kms,\n      type,\n      privateKeyHex: privateKeyHex!,\n    })\n  }\n\n  return context.agent.keyManagerCreate({\n    type,\n    kms: args.kms,\n    meta: {\n      ...key?.meta,\n      algorithms: keyMetaAlgorithmsFromKeyType(type),\n      keyAlias: args.alias,\n    },\n  })\n}\n\nexport const calculateJwkThumbprintForKey = (args: {\n  key: IKey | MinimalImportableKey | ManagedKeyInfo\n  digestAlgorithm?: 'sha256' | 'sha512'\n}): string => {\n  const { key } = args\n\n  const jwk = key.publicKeyHex\n    ? toJwk(key.publicKeyHex, key.type, { key: key, isPrivateKey: false })\n    : 'privateKeyHex' in key && key.privateKeyHex\n    ? toJwk(key.privateKeyHex, key.type, { isPrivateKey: true })\n    : undefined\n  if (!jwk) {\n    throw Error(`Could not determine jwk from key ${key.kid}`)\n  }\n  return calculateJwkThumbprint({ jwk, digestAlgorithm: args.digestAlgorithm })\n}\n\nconst assertJwkClaimPresent = (value: unknown, description: string) => {\n  if (typeof value !== 'string' || !value) {\n    throw new Error(`${description} missing or invalid`)\n  }\n}\nexport const toBase64url = (input: string): string => toString(fromString(input), 'base64url')\n\n/**\n * Calculate the JWK thumbprint\n * @param args\n */\nexport const calculateJwkThumbprint = (args: { jwk: JWK; digestAlgorithm?: 'sha256' | 'sha512' }): string => {\n  const { digestAlgorithm = 'sha256' } = args\n  const jwk = sanitizedJwk(args.jwk)\n  let components\n  switch (jwk.kty) {\n    case 'EC':\n      assertJwkClaimPresent(jwk.crv, '\"crv\" (Curve) Parameter')\n      assertJwkClaimPresent(jwk.x, '\"x\" (X Coordinate) Parameter')\n      assertJwkClaimPresent(jwk.y, '\"y\" (Y Coordinate) Parameter')\n      components = { crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y }\n      break\n    case 'OKP':\n      assertJwkClaimPresent(jwk.crv, '\"crv\" (Subtype of Key Pair) Parameter')\n      assertJwkClaimPresent(jwk.x, '\"x\" (Public Key) Parameter')\n      components = { crv: jwk.crv, kty: jwk.kty, x: jwk.x }\n      break\n    case 'RSA':\n      assertJwkClaimPresent(jwk.e, '\"e\" (Exponent) Parameter')\n      assertJwkClaimPresent(jwk.n, '\"n\" (Modulus) Parameter')\n      components = { e: jwk.e, kty: jwk.kty, n: jwk.n }\n      break\n    case 'oct':\n      assertJwkClaimPresent(jwk.k, '\"k\" (Key Value) Parameter')\n      components = { k: jwk.k, kty: jwk.kty }\n      break\n    default:\n      throw new Error('\"kty\" (Key Type) Parameter missing or unsupported')\n  }\n  const data = JSON.stringify(components)\n\n  return digestAlgorithm === 'sha512'\n    ? digestMethodParams('SHA-512').digestMethod(data, 'base64url')\n    : digestMethodParams('SHA-256').digestMethod(data, 'base64url')\n}\n\nexport const toJwkFromKey = (\n  key: IKey | MinimalImportableKey | ManagedKeyInfo,\n  opts?: {\n    use?: JwkKeyUse\n    noKidThumbprint?: boolean\n  }\n): JWK => {\n  const isPrivateKey = 'privateKeyHex' in key\n  return toJwk(key.publicKeyHex!, key.type, { ...opts, key, isPrivateKey })\n}\n\n/**\n * Converts a public key in hex format to a JWK\n * @param publicKeyHex public key in hex\n * @param type The type of the key (Ed25519, Secp256k1/r1)\n * @param opts. Options, like the optional use for the key (sig/enc)\n * @return The JWK\n */\nexport const toJwk = (\n  publicKeyHex: string,\n  type: TKeyType,\n  opts?: { use?: JwkKeyUse; key?: IKey | MinimalImportableKey; isPrivateKey?: boolean; noKidThumbprint?: boolean }\n): JWK => {\n  const { key, noKidThumbprint = false } = opts ?? {}\n  if (key && key.publicKeyHex !== publicKeyHex && opts?.isPrivateKey !== true) {\n    throw Error(`Provided key with id ${key.kid}, has a different public key hex ${key.publicKeyHex} than supplied public key ${publicKeyHex}`)\n  }\n  let jwk: JWK\n  switch (type) {\n    case 'Ed25519':\n      jwk = toEd25519OrX25519Jwk(publicKeyHex, { ...opts, crv: JoseCurve.Ed25519 })\n      break\n    case 'X25519':\n      jwk = toEd25519OrX25519Jwk(publicKeyHex, { ...opts, crv: JoseCurve.X25519 })\n      break\n    case 'Secp256k1':\n      jwk = toSecp256k1Jwk(publicKeyHex, opts)\n      break\n    case 'Secp256r1':\n      jwk = toSecp256r1Jwk(publicKeyHex, opts)\n      break\n    case 'RSA':\n      jwk = toRSAJwk(publicKeyHex, opts)\n      break\n    default:\n      throw new Error(`not_supported: Key type ${type} not yet supported for this did:jwk implementation`)\n  }\n  if (!jwk.kid && !noKidThumbprint) {\n    jwk['kid'] = calculateJwkThumbprint({ jwk })\n  }\n  return sanitizedJwk(jwk)\n}\n\n/**\n * Convert a JWK to a raw hex key.\n * Currently supports `RSA` and `EC` keys. Extendable for other key types.\n * @param jwk - The JSON Web Key object.\n * @returns A string representing the key in raw hexadecimal format.\n */\nexport const jwkToRawHexKey = async (jwk: JWK): Promise<string> => {\n  // TODO: Probably makes sense to have an option to do the same for private keys\n  jwk = sanitizedJwk(jwk)\n  if (jwk.kty === 'RSA') {\n    return rsaJwkToRawHexKey(jwk)\n  } else if (jwk.kty === 'EC') {\n    return ecJwkToRawHexKey(jwk)\n  } else if (jwk.kty === 'OKP') {\n    return okpJwkToRawHexKey(jwk)\n  } else if (jwk.kty === 'oct') {\n    return octJwkToRawHexKey(jwk)\n  } else {\n    throw new Error(`Unsupported key type: ${jwk.kty}`)\n  }\n}\n\n/**\n * Convert an RSA JWK to a raw hex key.\n * @param jwk - The RSA JWK object.\n * @returns A string representing the RSA key in raw hexadecimal format.\n */\nexport function rsaJwkToRawHexKey(jwk: JsonWebKey): string {\n  /**\n   * Encode an integer value (given as a Uint8Array) into DER INTEGER:\n   * 0x02 || length || value (with a leading 0x00 if the high bit is set).\n   */\n  function encodeInteger(bytes: Uint8Array): Uint8Array {\n    // if high bit set, prefix a 0x00\n    if (bytes[0] & 0x80) {\n      bytes = Uint8Array.from([0x00, ...bytes])\n    }\n    const len = encodeLength(bytes.length)\n    return Uint8Array.from([0x02, ...len, ...bytes])\n  }\n\n  /**\n   * Encode length per DER rules:\n   * - If <128, one byte\n   * - Else 0x80|numBytes followed by big-endian length\n   */\n  function encodeLength(len: any) {\n    if (len < 0x80) {\n      return Uint8Array.of(len)\n    }\n    let hex = len.toString(16)\n    if (hex.length % 2 === 1) {\n      hex = '0' + hex\n    }\n    const lenBytes = Uint8Array.from(hex.match(/.{2}/g)!.map((h: any) => parseInt(h, 16)))\n    return Uint8Array.of(0x80 | lenBytes.length, ...lenBytes)\n  }\n\n  /**\n   * Wrap one or more DER elements in a SEQUENCE:\n   * 0x30 || totalLength || concatenatedElements\n   */\n  function encodeSequence(elements: any) {\n    const content = elements.reduce((acc: any, elm: any) => Uint8Array.from([...acc, ...elm]), new Uint8Array())\n    const len = encodeLength(content.length)\n    return Uint8Array.from([0x30, ...len, ...content])\n  }\n\n  /**\n   * Convert a Base64-URL string into a Uint8Array (handles padding & “-_/”).\n   */\n  function base64UrlToBytes(b64url: string): Uint8Array {\n    return fromString(b64url, 'base64url')\n  }\n\n  jwk = sanitizedJwk(jwk)\n  if (!jwk.n || !jwk.e) {\n    throw new Error(\"RSA JWK must contain 'n' and 'e' properties.\")\n  }\n  const modulusBytes = base64UrlToBytes(jwk.n)\n  const exponentBytes = base64UrlToBytes(jwk.e)\n  const sequence = encodeSequence([encodeInteger(modulusBytes), encodeInteger(exponentBytes)])\n  const result = toString(sequence, 'hex')\n  return result\n  /*\n    // We are converting from base64 to base64url to be sure. The spec uses base64url, but in the wild we sometimes encounter a base64 string\n    const modulus = fromString(jwk.n.replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, ''), 'base64url') // 'n' is the modulus\n    const exponent = fromString(jwk.e.replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, ''), 'base64url') // 'e' is the exponent\n  \n    return toString(modulus, 'hex') + toString(exponent, 'hex')*/\n}\n\n/**\n * Convert an EC JWK to a raw hex key.\n * @param jwk - The EC JWK object.\n * @returns A string representing the EC key in raw hexadecimal format.\n */\nfunction ecJwkToRawHexKey(jwk: JsonWebKey): string {\n  jwk = sanitizedJwk(jwk)\n  if (!jwk.x || !jwk.y) {\n    throw new Error(\"EC JWK must contain 'x' and 'y' properties.\")\n  }\n\n  // We are converting from base64 to base64url to be sure. The spec uses base64url, but in the wild we sometimes encounter a base64 string\n  const x = fromString(jwk.x.replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, ''), 'base64url')\n  const y = fromString(jwk.y.replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, ''), 'base64url')\n\n  return '04' + toString(x, 'hex') + toString(y, 'hex')\n}\n\n/**\n * Convert an EC JWK to a raw hex key.\n * @param jwk - The EC JWK object.\n * @returns A string representing the EC key in raw hexadecimal format.\n */\nfunction okpJwkToRawHexKey(jwk: JsonWebKey): string {\n  jwk = sanitizedJwk(jwk)\n  if (!jwk.x) {\n    throw new Error(\"OKP JWK must contain 'x' property.\")\n  }\n\n  // We are converting from base64 to base64url to be sure. The spec uses base64url, but in the wild we sometimes encounter a base64 string\n  const x = fromString(jwk.x.replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, ''), 'base64url')\n\n  return toString(x, 'hex')\n}\n\n/**\n * Convert an octet JWK to a raw hex key.\n * @param jwk - The octet JWK object.\n * @returns A string representing the octet key in raw hexadecimal format.\n */\nfunction octJwkToRawHexKey(jwk: JsonWebKey): string {\n  jwk = sanitizedJwk(jwk)\n  if (!jwk.k) {\n    throw new Error(\"Octet JWK must contain 'k' property.\")\n  }\n\n  // We are converting from base64 to base64url to be sure. The spec uses base64url, but in the wild we sometimes encounter a base64 string\n  const key = fromString(jwk.k.replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, ''), 'base64url')\n\n  return toString(key, 'hex')\n}\n\n/**\n * Determines the use param based upon the key/signature type or supplied use value.\n *\n * @param type The key type\n * @param suppliedUse A supplied use. Will be used in case it is present\n */\nexport const jwkDetermineUse = (type: TKeyType, suppliedUse?: JwkKeyUse): JwkKeyUse | undefined => {\n  return suppliedUse\n    ? suppliedUse\n    : SIG_KEY_ALGS.includes(type)\n    ? JwkKeyUse.Signature\n    : ENC_KEY_ALGS.includes(type)\n    ? JwkKeyUse.Encryption\n    : undefined\n}\n\n/**\n * Assert the key has a proper length\n *\n * @param keyHex Input key\n * @param expectedKeyLength Expected key length(s)\n */\nconst assertProperKeyLength = (keyHex: string, expectedKeyLength: number | number[]) => {\n  if (Array.isArray(expectedKeyLength)) {\n    if (!expectedKeyLength.includes(keyHex.length)) {\n      throw Error(\n        `Invalid key length. Needs to be a hex string with length from ${JSON.stringify(expectedKeyLength)} instead of ${\n          keyHex.length\n        }. Input: ${keyHex}`\n      )\n    }\n  } else if (keyHex.length !== expectedKeyLength) {\n    throw Error(`Invalid key length. Needs to be a hex string with length ${expectedKeyLength} instead of ${keyHex.length}. Input: ${keyHex}`)\n  }\n}\n\n/**\n * Generates a JWK from a Secp256k1 public key\n * @param keyHex Secp256k1 public or private key in hex\n * @param use The use for the key\n * @return The JWK\n */\nconst toSecp256k1Jwk = (keyHex: string, opts?: { use?: JwkKeyUse; isPrivateKey?: boolean }): JWK => {\n  const { use } = opts ?? {}\n  logger.debug(`toSecp256k1Jwk keyHex: ${keyHex}, length: ${keyHex.length}`)\n  if (opts?.isPrivateKey) {\n    assertProperKeyLength(keyHex, [64])\n  } else {\n    assertProperKeyLength(keyHex, [66, 130])\n  }\n\n  const secp256k1 = new elliptic.ec('secp256k1')\n  const keyBytes = fromString(keyHex, 'base16')\n  const keyPair = opts?.isPrivateKey ? secp256k1.keyFromPrivate(keyBytes) : secp256k1.keyFromPublic(keyBytes)\n  const pubPoint = keyPair.getPublic()\n\n  return sanitizedJwk({\n    alg: JoseSignatureAlgorithm.ES256K,\n    ...(use !== undefined && { use }),\n    kty: JwkKeyType.EC,\n    crv: JoseCurve.secp256k1,\n    x: hexToBase64(pubPoint.getX().toString('hex'), 'base64url'),\n    y: hexToBase64(pubPoint.getY().toString('hex'), 'base64url'),\n    ...(opts?.isPrivateKey && { d: hexToBase64(keyPair.getPrivate('hex'), 'base64url') }),\n  })\n}\n\n/**\n * Generates a JWK from a Secp256r1 public key\n * @param keyHex Secp256r1 public key in hex\n * @param use The use for the key\n * @return The JWK\n */\nconst toSecp256r1Jwk = (keyHex: string, opts?: { use?: JwkKeyUse; isPrivateKey?: boolean }): JWK => {\n  const { use } = opts ?? {}\n  logger.debug(`toSecp256r1Jwk keyHex: ${keyHex}, length: ${keyHex.length}`)\n  if (opts?.isPrivateKey) {\n    assertProperKeyLength(keyHex, [64])\n  } else {\n    assertProperKeyLength(keyHex, [66, 130])\n  }\n\n  const secp256r1 = new elliptic.ec('p256')\n  const keyBytes = fromString(keyHex, 'base16')\n  logger.debug(`keyBytes length: ${keyBytes}`)\n  const keyPair = opts?.isPrivateKey ? secp256r1.keyFromPrivate(keyBytes) : secp256r1.keyFromPublic(keyBytes)\n  const pubPoint = keyPair.getPublic()\n  return sanitizedJwk({\n    alg: JoseSignatureAlgorithm.ES256,\n    ...(use !== undefined && { use }),\n    kty: JwkKeyType.EC,\n    crv: JoseCurve.P_256,\n    x: hexToBase64(pubPoint.getX().toString('hex'), 'base64url'),\n    y: hexToBase64(pubPoint.getY().toString('hex'), 'base64url'),\n    ...(opts?.isPrivateKey && { d: hexToBase64(keyPair.getPrivate('hex'), 'base64url') }),\n  })\n}\n\n/**\n * Generates a JWK from an Ed25519/X25519 public key\n * @param publicKeyHex Ed25519/X25519 public key in hex\n * @param opts\n * @return The JWK\n */\nconst toEd25519OrX25519Jwk = (\n  publicKeyHex: string,\n  opts: {\n    use?: JwkKeyUse\n    crv: JoseCurve.Ed25519 | JoseCurve.X25519\n  }\n): JWK => {\n  assertProperKeyLength(publicKeyHex, 64)\n  const { use } = opts ?? {}\n  return sanitizedJwk({\n    alg: JoseSignatureAlgorithm.EdDSA,\n    ...(use !== undefined && { use }),\n    kty: JwkKeyType.OKP,\n    crv: opts?.crv ?? JoseCurve.Ed25519,\n    x: hexToBase64(publicKeyHex, 'base64url'),\n  })\n}\n\nconst toRSAJwk = (publicKeyHex: string, opts?: { use?: JwkKeyUse; key?: IKey | MinimalImportableKey }): JWK => {\n  function parseDerIntegers(pubKeyHex: string): { modulus: string; exponent: string } {\n    const bytes = Buffer.from(pubKeyHex, 'hex')\n    let offset = 0\n\n    // 1) Outer SEQUENCE\n    if (bytes[offset++] !== 0x30) throw new Error('Not a SEQUENCE')\n    let len = bytes[offset++]\n    if (len & 0x80) {\n      const nBytes = len & 0x7f\n      len = 0\n      for (let i = 0; i < nBytes; i++) {\n        len = (len << 8) + bytes[offset++]\n      }\n    }\n\n    // 2) Look at next tag: INTEGER(0x02) means raw PKCS#1,\n    //    otherwise assume X.509/SPKI wrapper.\n    if (bytes[offset] !== 0x02) {\n      // --- skip AlgorithmIdentifier SEQUENCE ---\n      if (bytes[offset++] !== 0x30) throw new Error('Expected alg-ID SEQUENCE')\n      let algLen = bytes[offset++]\n      if (algLen & 0x80) {\n        const nB = algLen & 0x7f\n        algLen = 0\n        for (let i = 0; i < nB; i++) algLen = (algLen << 8) + bytes[offset++]\n      }\n      offset += algLen\n\n      // --- skip BIT STRING wrapper ---\n      if (bytes[offset++] !== 0x03) throw new Error('Expected BIT STRING')\n      let bitLen = bytes[offset++]\n      if (bitLen & 0x80) {\n        const nB = bitLen & 0x7f\n        bitLen = 0\n        for (let i = 0; i < nB; i++) bitLen = (bitLen << 8) + bytes[offset++]\n      }\n      // skip the “unused bits” byte\n      offset += 1\n\n      // now the next byte should be 0x30 for the inner SEQUENCE\n      if (bytes[offset++] !== 0x30) throw new Error('Expected inner SEQUENCE')\n      let innerLen = bytes[offset++]\n      if (innerLen & 0x80) {\n        const nB = innerLen & 0x7f\n        innerLen = 0\n        for (let i = 0; i < nB; i++) innerLen = (innerLen << 8) + bytes[offset++]\n      }\n    }\n\n    // 3) Parse modulus INTEGER\n    if (bytes[offset++] !== 0x02) throw new Error('Expected INTEGER for modulus')\n    let modLen = bytes[offset++]\n    if (modLen & 0x80) {\n      const nB = modLen & 0x7f\n      modLen = 0\n      for (let i = 0; i < nB; i++) modLen = (modLen << 8) + bytes[offset++]\n    }\n    let modulusBytes = bytes.slice(offset, offset + modLen)\n    offset += modLen\n\n    // strip leading zero if present (unsigned integer in JWK)\n    if (modulusBytes[0] === 0x00) {\n      modulusBytes = modulusBytes.slice(1)\n    }\n\n    // 4) Parse exponent INTEGER\n    if (bytes[offset++] !== 0x02) throw new Error('Expected INTEGER for exponent')\n    let expLen = bytes[offset++]\n    if (expLen & 0x80) {\n      const nB = expLen & 0x7f\n      expLen = 0\n      for (let i = 0; i < nB; i++) expLen = (expLen << 8) + bytes[offset++]\n    }\n    const exponentBytes = bytes.slice(offset, offset + expLen)\n\n    return {\n      modulus: modulusBytes.toString('hex'),\n      exponent: exponentBytes.toString('hex'),\n    }\n  }\n\n  const meta = opts?.key?.meta\n  if (meta?.publicKeyJwk || meta?.publicKeyPEM) {\n    if (meta?.publicKeyJwk) {\n      return meta.publicKeyJwk as JWK\n    }\n    const publicKeyPEM = meta?.publicKeyPEM ?? hexToPEM(publicKeyHex, 'public')\n    const jwk = PEMToJwk(publicKeyPEM, 'public') as JWK\n    return jwk\n  }\n\n  const { modulus, exponent } = parseDerIntegers(publicKeyHex)\n  const sanitized = sanitizedJwk({\n    kty: 'RSA',\n    n: hexToBase64(modulus, 'base64url'),\n    e: hexToBase64(exponent, 'base64url'),\n  })\n  return sanitized\n}\n\nexport const padLeft = (args: { data: string; size?: number; padString?: string }): string => {\n  const { data } = args\n  const size = args.size ?? 32\n  const padString = args.padString ?? '0'\n  if (data.length >= size) {\n    return data\n  }\n\n  if (padString && padString.length === 0) {\n    throw Error(`Pad string needs to have at least a length of 1`)\n  }\n  const length = padString.length\n  return padString.repeat((size - data.length) / length) + data\n}\n\nenum OIDType {\n  Secp256k1,\n  Secp256r1,\n  Ed25519,\n}\n\nconst OID: Record<OIDType, Uint8Array> = {\n  [OIDType.Secp256k1]: new Uint8Array([0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01]),\n  [OIDType.Secp256r1]: new Uint8Array([0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07]),\n  [OIDType.Ed25519]: new Uint8Array([0x06, 0x03, 0x2b, 0x65, 0x70]),\n}\n\nconst compareUint8Arrays = (a: Uint8Array, b: Uint8Array): boolean => {\n  if (a.length !== b.length) {\n    return false\n  }\n  for (let i = 0; i < a.length; i++) {\n    if (a[i] !== b[i]) {\n      return false\n    }\n  }\n  return true\n}\n\nconst findSubarray = (haystack: Uint8Array, needle: Uint8Array): number => {\n  for (let i = 0; i <= haystack.length - needle.length; i++) {\n    if (compareUint8Arrays(haystack.subarray(i, i + needle.length), needle)) {\n      return i\n    }\n  }\n  return -1\n}\n\nconst getTargetOID = (keyType: TKeyType) => {\n  switch (keyType) {\n    case 'Secp256k1':\n      return OID[OIDType.Secp256k1]\n    case 'Secp256r1':\n      return OID[OIDType.Secp256r1]\n    case 'Ed25519':\n      return OID[OIDType.Ed25519]\n    default:\n      throw new Error(`Unsupported key type: ${keyType}`)\n  }\n}\n\nexport const isAsn1Der = (key: Uint8Array): boolean => key[0] === 0x30\n\nexport const asn1DerToRawPublicKey = (derKey: Uint8Array, keyType: TKeyType): Uint8Array => {\n  if (!isAsn1Der(derKey)) {\n    throw new Error('Invalid DER encoding: Expected to start with sequence tag')\n  }\n\n  let index = 2\n  if (derKey[1] & 0x80) {\n    const lengthBytesCount = derKey[1] & 0x7f\n    index += lengthBytesCount\n  }\n  const targetOid = getTargetOID(keyType)\n  const oidIndex = findSubarray(derKey, targetOid)\n  if (oidIndex === -1) {\n    throw new Error(`OID for ${keyType} not found in DER encoding`)\n  }\n\n  index = oidIndex + targetOid.length\n\n  while (index < derKey.length && derKey[index] !== 0x03) {\n    index++\n  }\n\n  if (index >= derKey.length) {\n    throw new Error('Invalid DER encoding: Bit string not found')\n  }\n\n  // Skip the bit string tag (0x03) and length byte\n  index += 2\n\n  // Skip the unused bits count byte\n  index++\n\n  return derKey.slice(index)\n}\n\nexport const isRawCompressedPublicKey = (key: Uint8Array): boolean => key.length === 33 && (key[0] === 0x02 || key[0] === 0x03)\n\nexport const toRawCompressedHexPublicKey = (rawPublicKey: Uint8Array, keyType: TKeyType): string => {\n  if (isRawCompressedPublicKey(rawPublicKey)) {\n    return hexStringFromUint8Array(rawPublicKey)\n  }\n\n  if (keyType === 'Secp256k1' || keyType === 'Secp256r1') {\n    if (rawPublicKey[0] === 0x04 && rawPublicKey.length === 65) {\n      const xCoordinate = rawPublicKey.slice(1, 33)\n      const yCoordinate = rawPublicKey.slice(33)\n      const prefix = new Uint8Array([yCoordinate[31] % 2 === 0 ? 0x02 : 0x03])\n      const resultKey = hexStringFromUint8Array(new Uint8Array([...prefix, ...xCoordinate]))\n      logger.debug(`converted public key ${hexStringFromUint8Array(rawPublicKey)} to ${resultKey}`)\n      return resultKey\n    }\n    return toString(rawPublicKey, 'base16')\n  } else if (keyType === 'Ed25519') {\n    // Ed25519 keys are always in compressed form\n    return toString(rawPublicKey, 'base16')\n  }\n\n  throw new Error(`Unsupported key type: ${keyType}`)\n}\n\nexport const hexStringFromUint8Array = (value: Uint8Array): string => toString(value, 'base16')\n\nexport const signatureAlgorithmFromKey = async (args: SignatureAlgorithmFromKeyArgs): Promise<JoseSignatureAlgorithm> => {\n  const { key } = args\n  return signatureAlgorithmFromKeyType({ type: key.type })\n}\n\nexport const signatureAlgorithmFromKeyType = (args: SignatureAlgorithmFromKeyTypeArgs): JoseSignatureAlgorithm => {\n  const { type } = args\n  switch (type) {\n    case 'Ed25519':\n    case 'X25519':\n      return JoseSignatureAlgorithm.EdDSA\n    case 'Secp256r1':\n      return JoseSignatureAlgorithm.ES256\n    case 'Secp384r1':\n      return JoseSignatureAlgorithm.ES384\n    case 'Secp521r1':\n      return JoseSignatureAlgorithm.ES512\n    case 'Secp256k1':\n      return JoseSignatureAlgorithm.ES256K\n    case 'RSA':\n      return JoseSignatureAlgorithm.PS256\n    default:\n      throw new Error(`Key type '${type}' not supported`)\n  }\n}\n\n// TODO improve this conversion for jwt and jsonld, not a fan of current structure\nexport const keyTypeFromCryptographicSuite = (args: KeyTypeFromCryptographicSuiteArgs): TKeyType => {\n  const { crv, kty, alg } = args\n\n  switch (alg) {\n    case 'RSASSA-PSS':\n    case 'RS256':\n    case 'RS384':\n    case 'RS512':\n    case 'PS256':\n    case 'PS384':\n    case 'PS512':\n      return 'RSA'\n  }\n\n  switch (crv) {\n    case 'EdDSA':\n    case 'Ed25519':\n    case 'Ed25519Signature2018':\n    case 'Ed25519Signature2020':\n    case 'JcsEd25519Signature2020':\n      return 'Ed25519'\n    case 'JsonWebSignature2020':\n    case 'ES256':\n    case 'ECDSA':\n    case 'P-256':\n      return 'Secp256r1'\n    case 'ES384':\n    case 'P-384':\n      return 'Secp384r1'\n    case 'ES512':\n    case 'P-521':\n      return 'Secp521r1'\n    case 'EcdsaSecp256k1Signature2019':\n    case 'secp256k1':\n    case 'ES256K':\n    case 'EcdsaSecp256k1VerificationKey2019':\n    case 'EcdsaSecp256k1RecoveryMethod2020':\n      return 'Secp256k1'\n  }\n  if (kty) {\n    return kty as TKeyType\n  }\n\n  throw new Error(`Cryptographic suite '${crv}' not supported`)\n}\n\nexport function removeNulls<T>(obj: T | any) {\n  Object.keys(obj).forEach((key) => {\n    if (obj[key] && typeof obj[key] === 'object') removeNulls(obj[key])\n    else if (obj[key] == null) delete obj[key]\n  })\n  return obj\n}\n\nexport const globalCrypto = (setGlobal: boolean, suppliedCrypto?: Crypto): Crypto => {\n  let webcrypto: Crypto\n  if (typeof suppliedCrypto !== 'undefined') {\n    webcrypto = suppliedCrypto\n  } else if (typeof crypto !== 'undefined') {\n    webcrypto = crypto\n  } else if (typeof global.crypto !== 'undefined') {\n    webcrypto = global.crypto\n  } else {\n    // @ts-ignore\n    if (typeof global.window?.crypto?.subtle !== 'undefined') {\n      // @ts-ignore\n      webcrypto = global.window.crypto\n    } else {\n      webcrypto = import('crypto') as Crypto\n    }\n  }\n  if (setGlobal) {\n    global.crypto = webcrypto\n  }\n\n  return webcrypto\n}\n\nexport const sanitizedJwk = (input: JWK | JsonWebKey): JWK => {\n  const inputJwk = typeof input['toJsonDTO'] === 'function' ? input['toJsonDTO']() : ({ ...input } as JWK) // KMP code can expose this. It converts a KMP JWK with mangled names into a clean JWK\n\n  const jwk = {\n    ...inputJwk,\n    ...(inputJwk.x && { x: base64ToBase64Url(inputJwk.x as string) }),\n    ...(inputJwk.y && { y: base64ToBase64Url(inputJwk.y as string) }),\n    ...(inputJwk.d && { d: base64ToBase64Url(inputJwk.d as string) }),\n    ...(inputJwk.n && { n: base64ToBase64Url(inputJwk.n as string) }),\n    ...(inputJwk.e && { e: base64ToBase64Url(inputJwk.e as string) }),\n    ...(inputJwk.k && { k: base64ToBase64Url(inputJwk.k as string) }),\n  } as JWK\n\n  return removeNulls(jwk)\n}\n\nconst base64ToBase64Url = (input: string): string => {\n  return input.replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '')\n}\n\n/**\n *\n */\nexport async function verifyRawSignature({\n  data,\n  signature,\n  key: inputKey,\n  opts,\n}: {\n  data: Uint8Array\n  signature: Uint8Array\n  key: JWK\n  opts?: {\n    signatureAlg?: JoseSignatureAlgorithm\n  }\n}) {\n  /**\n   * Converts a Base64URL-encoded JWK property to a BigInt.\n   * @param jwkProp - The Base64URL-encoded string.\n   * @returns The BigInt representation of the decoded value.\n   */\n  function jwkPropertyToBigInt(jwkProp: string): bigint {\n    // Decode Base64URL to Uint8Array\n    const byteArray = fromString(jwkProp, 'base64url')\n\n    // Convert Uint8Array to hexadecimal string and then to BigInt\n    const hex = toString(byteArray, 'hex')\n    return BigInt(`0x${hex}`)\n  }\n\n  try {\n    debug(`verifyRawSignature for: ${inputKey}`)\n    const jwk = sanitizedJwk(inputKey)\n    validateJwk(jwk, { crvOptional: true })\n    const keyType = keyTypeFromCryptographicSuite({ crv: jwk.crv, kty: jwk.kty, alg: jwk.alg })\n    const publicKeyHex = await jwkToRawHexKey(jwk)\n\n    // TODO: We really should look at the signature alg first if provided! From key type should be the last resort\n    switch (keyType) {\n      case 'Secp256k1':\n        return secp256k1.verify(signature, data, publicKeyHex, { format: 'compact', prehash: true })\n      case 'Secp256r1':\n        return p256.verify(signature, data, publicKeyHex, { format: 'compact', prehash: true })\n      case 'Secp384r1':\n        return p384.verify(signature, data, publicKeyHex, { format: 'compact', prehash: true })\n      case 'Secp521r1':\n        return p521.verify(signature, data, publicKeyHex, { format: 'compact', prehash: true })\n      case 'Ed25519':\n        return ed25519.verify(signature, data, fromString(publicKeyHex, 'hex'))\n      case 'Bls12381G1':\n      case 'Bls12381G2':\n        return bls12_381.verify(signature, data, fromString(publicKeyHex, 'hex'))\n      case 'RSA': {\n        const signatureAlgorithm = opts?.signatureAlg ?? (jwk.alg as JoseSignatureAlgorithm | undefined) ?? JoseSignatureAlgorithm.PS256\n        const hashAlg =\n          signatureAlgorithm === (JoseSignatureAlgorithm.RS512 || JoseSignatureAlgorithm.PS512)\n            ? sha512\n            : signatureAlgorithm === (JoseSignatureAlgorithm.RS384 || JoseSignatureAlgorithm.PS384)\n            ? sha384\n            : sha256\n        switch (signatureAlgorithm) {\n          case JoseSignatureAlgorithm.RS256:\n            return rsa.PKCS1_SHA256.verify(\n              {\n                n: jwkPropertyToBigInt(jwk.n!),\n                e: jwkPropertyToBigInt(jwk.e!),\n              },\n              data,\n              signature\n            )\n          case JoseSignatureAlgorithm.RS384:\n            return rsa.PKCS1_SHA384.verify(\n              {\n                n: jwkPropertyToBigInt(jwk.n!),\n                e: jwkPropertyToBigInt(jwk.e!),\n              },\n              data,\n              signature\n            )\n          case JoseSignatureAlgorithm.RS512:\n            return rsa.PKCS1_SHA512.verify(\n              {\n                n: jwkPropertyToBigInt(jwk.n!),\n                e: jwkPropertyToBigInt(jwk.e!),\n              },\n              data,\n              signature\n            )\n          case JoseSignatureAlgorithm.PS256:\n          case JoseSignatureAlgorithm.PS384:\n          case JoseSignatureAlgorithm.PS512:\n            if (typeof crypto !== 'undefined' && typeof crypto.subtle !== 'undefined') {\n              const key = await cryptoSubtleImportRSAKey(jwk, 'RSA-PSS')\n              const saltLength =\n                signatureAlgorithm === JoseSignatureAlgorithm.PS256 ? 32 : signatureAlgorithm === JoseSignatureAlgorithm.PS384 ? 48 : 64\n              return crypto.subtle.verify({ name: 'rsa-pss', hash: hashAlg, saltLength }, key, signature, data)\n            }\n\n            // FIXME\n            console.warn(`Using fallback for RSA-PSS verify signature, which is known to be flaky!!`)\n            return rsa.PSS(hashAlg, rsa.mgf1(hashAlg)).verify(\n              {\n                n: jwkPropertyToBigInt(jwk.n!),\n                e: jwkPropertyToBigInt(jwk.e!),\n              },\n              data,\n              signature\n            )\n        }\n      }\n    }\n\n    throw Error(`Unsupported key type for signature validation: ${keyType}`)\n  } catch (error: any) {\n    logger.error(`Error: ${error}`)\n    throw error\n  }\n}\n\n/**\n * Minimal DER parser to unwrap X.509/SPKI‐wrapped RSA keys\n * into raw PKCS#1 RSAPublicKey format, using only Uint8Array.\n */\n\n/**\n * Read a DER length at the given offset.\n * @param bytes – full DER buffer\n * @param offset – index of the length byte\n * @returns the parsed length, and how many bytes were used to encode it\n */\nfunction readLength(bytes: Uint8Array, offset: number): { length: number; lengthBytes: number } {\n  const first = bytes[offset]\n  if (first < 0x80) {\n    return { length: first, lengthBytes: 1 }\n  }\n  const numBytes = first & 0x7f\n  let length = 0\n  for (let i = 0; i < numBytes; i++) {\n    length = (length << 8) | bytes[offset + 1 + i]\n  }\n  return { length, lengthBytes: 1 + numBytes }\n}\n\n/**\n * Ensure the given DER‐encoded RSA public key (Uint8Array)\n * is raw PKCS#1. If it's X.509/SPKI‐wrapped, we strip the wrapper.\n *\n * @param derBytes – DER‐encoded public key, either PKCS#1 or X.509/SPKI\n * @returns DER‐encoded PKCS#1 RSAPublicKey\n */\nexport function toPkcs1(derBytes: Uint8Array): Uint8Array {\n  if (derBytes[0] !== 0x30) {\n    throw new Error('Invalid DER: expected SEQUENCE')\n  }\n\n  // Parse outer SEQUENCE length\n  const { lengthBytes: outerLenBytes } = readLength(derBytes, 1)\n  const outerHeaderLen = 1 + outerLenBytes\n  const innerTag = derBytes[outerHeaderLen]\n\n  // If next tag is INTEGER (0x02), it's already raw PKCS#1\n  if (innerTag === 0x02) {\n    return derBytes\n  }\n\n  // Otherwise expect X.509/SPKI: SEQUENCE { algId, BIT STRING }\n  if (innerTag !== 0x30) {\n    throw new Error('Unexpected DER tag, not PKCS#1 or SPKI')\n  }\n\n  // Skip the algId SEQUENCE\n  const { length: algLen, lengthBytes: algLenBytes } = readLength(derBytes, outerHeaderLen + 1)\n  const algHeaderLen = 1 + algLenBytes\n  const algIdEnd = outerHeaderLen + algHeaderLen + algLen\n\n  // Next tag should be BIT STRING (0x03)\n  if (derBytes[algIdEnd] !== 0x03) {\n    throw new Error('Expected BIT STRING after algId')\n  }\n\n  const { length: bitStrLen, lengthBytes: bitStrLenBytes } = readLength(derBytes, algIdEnd + 1)\n  const bitStrHeaderLen = 1 + bitStrLenBytes\n  const bitStrStart = algIdEnd + bitStrHeaderLen\n\n  // First byte of the BIT STRING is the \"unused bits\" count; usually 0x00\n  const unusedBits = derBytes[bitStrStart]\n  if (unusedBits !== 0x00) {\n    throw new Error(`Unexpected unused bits: ${unusedBits}`)\n  }\n\n  // The rest is the PKCS#1 DER\n  const pkcs1Start = bitStrStart + 1\n  const pkcs1Len = bitStrLen - 1\n\n  return derBytes.slice(pkcs1Start, pkcs1Start + pkcs1Len)\n}\n\n/**\n * Ensure the given DER‐encoded RSA public key in Hex\n * is raw PKCS#1. If it's X.509/SPKI‐wrapped, we strip the wrapper.\n *\n * @param derBytes – DER‐encoded public key, either PKCS#1 or X.509/SPKI\n * @returns DER‐encoded PKCS#1 RSAPublicKey in hex\n */\nexport function toPkcs1FromHex(publicKeyHex: string) {\n  const pkcs1 = toPkcs1(fromString(publicKeyHex, 'hex'))\n  return toString(pkcs1, 'hex')\n}\n","import { sha256 } from '@noble/hashes/sha256'\nimport { sha384, sha512 } from '@noble/hashes/sha512'\nimport type { HasherSync } from '@sphereon/ssi-types'\n// @ts-ignore\nimport * as u8a from 'uint8arrays'\nconst { fromString, toString, SupportedEncodings } = u8a\n\nexport type HashAlgorithm = 'SHA-256' | 'SHA-384' | 'SHA-512'\nexport type TDigestMethod = (input: string, encoding?: typeof SupportedEncodings) => string\n\nexport const digestMethodParams = (\n  hashAlgorithm: HashAlgorithm\n): { hashAlgorithm: HashAlgorithm; digestMethod: TDigestMethod; hash: (data: Uint8Array) => Uint8Array } => {\n  if (hashAlgorithm === 'SHA-256') {\n    return { hashAlgorithm: 'SHA-256', digestMethod: sha256DigestMethod, hash: sha256 }\n  } else if (hashAlgorithm === 'SHA-384') {\n    return { hashAlgorithm: 'SHA-384', digestMethod: sha384DigestMethod, hash: sha384 }\n  } else {\n    return { hashAlgorithm: 'SHA-512', digestMethod: sha512DigestMethod, hash: sha512 }\n  }\n}\n\nexport const shaHasher: HasherSync = (input: string | ArrayBuffer, alg: string): Uint8Array => {\n  const hashAlgorithm: HashAlgorithm = alg.includes('384') ? 'SHA-384' : alg.includes('512') ? 'SHA-512' : 'SHA-256'\n  return digestMethodParams(hashAlgorithm).hash(typeof input === 'string' ? fromString(input, 'utf-8') : new Uint8Array(input))\n}\n\nconst sha256DigestMethod = (input: string, encoding: typeof SupportedEncodings = 'base16'): string => {\n  return toString(sha256(fromString(input, 'utf-8')), encoding)\n}\n\nconst sha384DigestMethod = (input: string, encoding: typeof SupportedEncodings = 'base16'): string => {\n  return toString(sha384(fromString(input, 'utf-8')), encoding)\n}\n\nconst sha512DigestMethod = (input: string, encoding: typeof SupportedEncodings = 'base16'): string => {\n  return toString(sha512(fromString(input, 'utf-8')), encoding)\n}\n\n/*\n// PKCS#1 (PSS) mask generation function\nfunction pss_mgf1_str(seed, len, hash) {\n    var mask = '', i = 0;\n\n    while (mask.length < len) {\n        mask += hextorstr(hash(rstrtohex(seed + String.fromCharCode.apply(String, [\n                (i & 0xff000000) >> 24,\n                (i & 0x00ff0000) >> 16,\n                (i & 0x0000ff00) >> 8,\n                i & 0x000000ff]))));\n        i += 1;\n    }\n\n    return mask;\n}\n\n */\n\n/*\n\n/!**\n * Generate mask of specified length.\n *\n * @param {String} seed The seed for mask generation.\n * @param maskLen Number of bytes to generate.\n * @return {String} The generated mask.\n *!/\nexport const mgf1 = (dm: TDigestMethod, seed: string, maskLen: number) => {\n  /!* 2. Let T be the empty octet string. *!/\n  var t = new forge.util.ByteBuffer();\n\n  /!* 3. For counter from 0 to ceil(maskLen / hLen), do the following: *!/\n  var len = Math.ceil(maskLen / md.digestLength);\n  for(var i = 0; i < len; i++) {\n    /!* a. Convert counter to an octet string C of length 4 octets *!/\n    var c = new forge.util.ByteBuffer();\n    c.putInt32(i);\n\n    /!* b. Concatenate the hash of the seed mgfSeed and C to the octet\n     * string T: *!/\n    md.start();\n    md.update(seed + c.getBytes());\n    t.putBuffer(md.digest());\n  }\n\n  /!* Output the leading maskLen octets of T as the octet string mask. *!/\n  t.truncate(t.length() - maskLen);\n  return t.getBytes();\n}\n*/\n","import { JsonWebKey, JWK } from '@sphereon/ssi-types'\n// @ts-ignore\nimport type { ByteView } from 'multiformats/codecs/interface'\n// @ts-ignore\nimport { TextDecoder, TextEncoder } from 'web-encoding'\n\nconst textEncoder = new TextEncoder()\nconst textDecoder = new TextDecoder()\n\n/**\n * Checks if the value is a non-empty string.\n *\n * @param value - The value to check.\n * @param description - Description of the value to check.\n * @param optional\n */\nfunction check(value: unknown, description: string, optional: boolean = false) {\n  if (optional && !value) {\n    return\n  }\n  if (typeof value !== 'string' || !value) {\n    throw new Error(`${description} missing or invalid`)\n  }\n}\n\n/**\n * Checks if the value is a valid JSON object.\n *\n * @param value - The value to check.\n */\nfunction assertObject(value: unknown) {\n  if (!value || typeof value !== 'object') {\n    throw new Error('Value must be an object')\n  }\n}\n\n/**\n * Checks if the JWK is valid. It must contain all the required members.\n *\n * @see https://www.rfc-editor.org/rfc/rfc7518#section-6\n * @see https://www.rfc-editor.org/rfc/rfc8037#section-2\n *\n * @param jwk - The JWK to check.\n * @param opts\n */\nexport function validateJwk(jwk: any, opts?: { crvOptional?: boolean }) {\n  assertObject(jwk)\n  const { crvOptional = false } = opts ?? {}\n  check(jwk.kty, '\"kty\" (Key Type) Parameter', false)\n\n  // Check JWK required members based on the key type\n  switch (jwk.kty) {\n    /**\n     * @see https://www.rfc-editor.org/rfc/rfc7518#section-6.2.1\n     */\n    case 'EC':\n      check(jwk.crv, '\"crv\" (Curve) Parameter', crvOptional)\n      check(jwk.x, '\"x\" (X Coordinate) Parameter')\n      check(jwk.y, '\"y\" (Y Coordinate) Parameter')\n      break\n    /**\n     * @see https://www.rfc-editor.org/rfc/rfc8037#section-2\n     */\n    case 'OKP':\n      check(jwk.crv, '\"crv\" (Subtype of Key Pair) Parameter', crvOptional) // Shouldn't this one always be true as crv is not always present?\n      check(jwk.x, '\"x\" (Public Key) Parameter')\n      break\n    /**\n     * @see https://www.rfc-editor.org/rfc/rfc7518#section-6.3.1\n     */\n    case 'RSA':\n      check(jwk.e, '\"e\" (Exponent) Parameter')\n      check(jwk.n, '\"n\" (Modulus) Parameter')\n      break\n    default:\n      throw new Error('\"kty\" (Key Type) Parameter missing or unsupported')\n  }\n}\n\n/**\n * Extracts the required members of the JWK and canonicalizes it.\n *\n * @param jwk - The JWK to canonicalize.\n * @returns The JWK with only the required members, ordered lexicographically.\n */\nexport function minimalJwk(jwk: any): JWK {\n  // \"default\" case is not needed\n  // eslint-disable-next-line default-case\n  switch (jwk.kty) {\n    case 'EC':\n      return { ...(jwk.crv && { crv: jwk.crv }), kty: jwk.kty, x: jwk.x, y: jwk.y }\n    case 'OKP':\n      return { ...(jwk.crv && { crv: jwk.crv }), kty: jwk.kty, x: jwk.x }\n    case 'RSA':\n      return { e: jwk.e, kty: jwk.kty, n: jwk.n }\n  }\n  throw Error(`Unsupported key type (kty) provided: ${jwk.kty}`)\n}\n\n/**\n * Encodes a JWK into a Uint8Array. Only the required JWK members are encoded.\n *\n * @see https://www.rfc-editor.org/rfc/rfc7518#section-6\n * @see https://www.rfc-editor.org/rfc/rfc8037#section-2\n * @see https://github.com/panva/jose/blob/3b8aa47b92d07a711bf5c3125276cc9a011794a4/src/jwk/thumbprint.ts#L37\n *\n * @param jwk - JSON Web Key.\n * @returns Uint8Array-encoded JWK.\n */\nexport function jwkJcsEncode(jwk: unknown): Uint8Array {\n  validateJwk(jwk)\n  const strippedJwk = minimalJwk(jwk)\n  return textEncoder.encode(jcsCanonicalize(strippedJwk))\n}\n\n/**\n * Decodes an array of bytes into a JWK. Throws an error if the JWK is not valid.\n *\n * @param bytes - The array of bytes to decode.\n * @returns The corresponding JSON Web Key.\n */\nexport function jwkJcsDecode(bytes: ByteView<JsonWebKey>): JsonWebKey {\n  const jwk = JSON.parse(textDecoder.decode(bytes))\n  validateJwk(jwk)\n  if (JSON.stringify(jwk) !== jcsCanonicalize(minimalJwk(jwk))) {\n    throw new Error('The JWK embedded in the DID is not correctly formatted')\n  }\n  return jwk\n}\n\n// From: https://github.com/cyberphone/json-canonicalization\nexport function jcsCanonicalize(object: any) {\n  let buffer = ''\n  serialize(object)\n  return buffer\n\n  function serialize(object: any) {\n    if (object === null || typeof object !== 'object' || object.toJSON != null) {\n      /////////////////////////////////////////////////\n      // Primitive type or toJSON - Use ES6/JSON     //\n      /////////////////////////////////////////////////\n      buffer += JSON.stringify(object)\n    } else if (Array.isArray(object)) {\n      /////////////////////////////////////////////////\n      // Array - Maintain element order              //\n      /////////////////////////////////////////////////\n      buffer += '['\n      let next = false\n      object.forEach((element) => {\n        if (next) {\n          buffer += ','\n        }\n        next = true\n        /////////////////////////////////////////\n        // Array element - Recursive expansion //\n        /////////////////////////////////////////\n        serialize(element)\n      })\n      buffer += ']'\n    } else {\n      /////////////////////////////////////////////////\n      // Object - Sort properties before serializing //\n      /////////////////////////////////////////////////\n      buffer += '{'\n      let next = false\n      Object.keys(object)\n        .sort()\n        .forEach((property) => {\n          if (next) {\n            buffer += ','\n          }\n          next = true\n          ///////////////////////////////////////////////\n          // Property names are strings - Use ES6/JSON //\n          ///////////////////////////////////////////////\n          buffer += JSON.stringify(property)\n          buffer += ':'\n          //////////////////////////////////////////\n          // Property value - Recursive expansion //\n          //////////////////////////////////////////\n          serialize(object[property])\n        })\n      buffer += '}'\n    }\n  }\n}\n","import type { IKey, MinimalImportableKey } from '@veramo/core'\n\nexport const JWK_JCS_PUB_NAME = 'jwk_jcs-pub' as const\nexport const JWK_JCS_PUB_PREFIX = 0xeb51\n\nexport type TKeyType = 'Ed25519' | 'Secp256k1' | 'Secp256r1' | 'Secp384r1' | 'Secp521r1' | 'X25519' | 'Bls12381G1' | 'Bls12381G2' | 'RSA'\n\nexport enum Key {\n  Ed25519 = 'Ed25519',\n  Secp256k1 = 'Secp256k1',\n  Secp256r1 = 'Secp256r1',\n}\n\nexport enum JwkKeyUse {\n  Encryption = 'enc',\n  Signature = 'sig',\n}\n\nexport const SIG_KEY_ALGS = ['ES256', 'ES384', 'ES512', 'EdDSA', 'ES256K', 'Ed25519', 'Secp256k1', 'Secp256r1', 'Bls12381G1', 'Bls12381G2']\nexport const ENC_KEY_ALGS = ['X25519', 'ECDH_ES_A256KW', 'RSA_OAEP_256']\n\nexport type KeyVisibility = 'public' | 'private'\n\nexport interface X509Opts {\n  cn?: string // The certificate Common Name. Will be used as the KID for the private key. Uses alias if not provided.\n  privateKeyPEM?: string // Optional as you also need to provide it in hex format, but advisable to use it\n  certificatePEM?: string // Optional, as long as the certificate then is part of the certificateChainPEM\n  certificateChainURL?: string // Certificate chain URL. If used this is where the certificateChainPEM will be hosted/found.\n  certificateChainPEM?: string // Base64 (not url!) encoded DER certificate chain. Please provide even if certificateChainURL is used!\n}\n\nexport interface IImportProvidedOrGeneratedKeyArgs {\n  kms?: string\n  alias?: string\n  options?: IKeyOpts\n}\nexport interface IKeyOpts {\n  key?: Partial<MinimalImportableKey> // Optional key to import with only privateKeyHex mandatory. If not specified a key with random kid will be created\n  type?: Exclude<TKeyType, 'Secp384r1' | 'Secp521r1'> // The key type. Defaults to Secp256k1. The exclude is there as we do not support it yet for key generation\n  use?: JwkKeyUse // The key use\n  x509?: X509Opts\n}\n/*\n// Needed to make a single property required\ntype WithRequiredProperty<Type, Key extends keyof Type> = Type & {\n  [Property in Key]-?: Type[Property]\n}*/\n\nexport type SignatureAlgorithmFromKeyArgs = {\n  key: IKey\n}\n\nexport type SignatureAlgorithmFromKeyTypeArgs = {\n  type: TKeyType\n}\n\nexport type KeyTypeFromCryptographicSuiteArgs = {\n  crv?: string\n  kty?: string\n  alg?: string\n}\n","import {\n  ICoseCurve,\n  type ICoseKeyJson,\n  ICoseKeyOperation,\n  ICoseKeyType,\n  ICoseSignatureAlgorithm,\n  JoseCurve,\n  type JoseCurveString,\n  JoseKeyOperation,\n  type JoseKeyOperationString,\n  JoseSignatureAlgorithm,\n  type JoseSignatureAlgorithmString,\n  type JWK,\n  JwkKeyType,\n  type JwkKeyTypeString,\n} from '@sphereon/ssi-types'\nimport { removeNulls } from './functions'\n\nexport function coseKeyToJwk(coseKey: ICoseKeyJson): JWK {\n  const { x5chain, key_ops, crv, alg, baseIV, kty, ...rest } = coseKey\n  return removeNulls({\n    ...rest,\n    kty: coseToJoseKty(kty),\n    ...(crv && { crv: coseToJoseCurve(crv) }),\n    ...(key_ops && { key_ops: key_ops.map(coseToJoseKeyOperation) }),\n    ...(alg && { alg: coseToJoseSignatureAlg(alg) }),\n    ...(baseIV && { iv: baseIV }),\n    ...(x5chain && { x5c: x5chain }),\n  }) satisfies JWK\n}\n\nexport function jwkToCoseKey(jwk: JWK): ICoseKeyJson {\n  const { x5c, key_ops, crv, alg, iv, kty, ...rest } = jwk\n\n  return removeNulls({\n    ...rest,\n    kty: joseToCoseKty(kty),\n    ...(crv && { crv: joseToCoseCurve(crv) }),\n    ...(key_ops && { key_ops: key_ops.map(joseToCoseKeyOperation) }),\n    ...(alg && { alg: joseToCoseSignatureAlg(alg) }),\n    ...(iv && { baseIV: iv }),\n    ...(x5c && { x5chain: x5c }),\n    // @ts-ignore\n  } satisfies ICoseKeyJson)\n}\n\nexport function coseToJoseKty(kty: ICoseKeyType): JwkKeyType {\n  switch (kty) {\n    case ICoseKeyType.EC2:\n      return JwkKeyType.EC\n    case ICoseKeyType.RSA:\n      return JwkKeyType.RSA\n    case ICoseKeyType.Symmetric:\n      return JwkKeyType.oct\n    case ICoseKeyType.OKP:\n      return JwkKeyType.OKP\n    default:\n      throw Error(`Key type ${kty} not supported in JWA`)\n  }\n}\n\nexport function joseToCoseKty(kty: JwkKeyType | JwkKeyTypeString): ICoseKeyType {\n  switch (kty) {\n    case 'EC':\n      return ICoseKeyType.EC2\n    case 'RSA':\n      return ICoseKeyType.RSA\n    case 'oct':\n      return ICoseKeyType.Symmetric\n    case 'OKP':\n      return ICoseKeyType.OKP\n    default:\n      throw Error(`Key type ${kty} not supported in Cose`)\n  }\n}\n\nexport function coseToJoseSignatureAlg(coseAlg: ICoseSignatureAlgorithm): JoseSignatureAlgorithm {\n  switch (coseAlg) {\n    case ICoseSignatureAlgorithm.ES256K:\n      return JoseSignatureAlgorithm.ES256K\n    case ICoseSignatureAlgorithm.ES256:\n      return JoseSignatureAlgorithm.ES256\n    case ICoseSignatureAlgorithm.ES384:\n      return JoseSignatureAlgorithm.ES384\n    case ICoseSignatureAlgorithm.ES512:\n      return JoseSignatureAlgorithm.ES512\n    case ICoseSignatureAlgorithm.PS256:\n      return JoseSignatureAlgorithm.PS256\n    case ICoseSignatureAlgorithm.PS384:\n      return JoseSignatureAlgorithm.PS384\n    case ICoseSignatureAlgorithm.PS512:\n      return JoseSignatureAlgorithm.PS512\n    case ICoseSignatureAlgorithm.HS256:\n      return JoseSignatureAlgorithm.HS256\n    case ICoseSignatureAlgorithm.HS384:\n      return JoseSignatureAlgorithm.HS384\n    case ICoseSignatureAlgorithm.HS512:\n      return JoseSignatureAlgorithm.HS512\n    case ICoseSignatureAlgorithm.EdDSA:\n      return JoseSignatureAlgorithm.EdDSA\n    default:\n      throw Error(`Signature algorithm ${coseAlg} not supported in Jose`)\n  }\n}\n\nexport function joseToCoseSignatureAlg(joseAlg: JoseSignatureAlgorithm | JoseSignatureAlgorithmString): ICoseSignatureAlgorithm {\n  switch (joseAlg) {\n    case (JoseSignatureAlgorithm.ES256K, 'ES256K'):\n      return ICoseSignatureAlgorithm.ES256K\n    case (JoseSignatureAlgorithm.ES256, 'ES256'):\n      return ICoseSignatureAlgorithm.ES256\n    case (JoseSignatureAlgorithm.ES384, 'ES384'):\n      return ICoseSignatureAlgorithm.ES384\n    case (JoseSignatureAlgorithm.ES512, 'ES512'):\n      return ICoseSignatureAlgorithm.ES512\n    case (JoseSignatureAlgorithm.PS256, 'PS256'):\n      return ICoseSignatureAlgorithm.PS256\n    case (JoseSignatureAlgorithm.PS384, 'PS384'):\n      return ICoseSignatureAlgorithm.PS384\n    case (JoseSignatureAlgorithm.PS512, 'PS512'):\n      return ICoseSignatureAlgorithm.PS512\n    case (JoseSignatureAlgorithm.HS256, 'HS256'):\n      return ICoseSignatureAlgorithm.HS256\n    case (JoseSignatureAlgorithm.HS384, 'HS384'):\n      return ICoseSignatureAlgorithm.HS384\n    case (JoseSignatureAlgorithm.HS512, 'HS512'):\n      return ICoseSignatureAlgorithm.HS512\n    case (JoseSignatureAlgorithm.EdDSA, 'EdDSA'):\n      return ICoseSignatureAlgorithm.EdDSA\n    default:\n      throw Error(`Signature algorithm ${joseAlg} not supported in Cose`)\n  }\n}\n\nexport function joseToCoseKeyOperation(keyOp: JoseKeyOperation | JoseKeyOperationString): ICoseKeyOperation {\n  switch (keyOp) {\n    case (JoseKeyOperation.SIGN, 'sign'):\n      return ICoseKeyOperation.SIGN\n    case (JoseKeyOperation.VERIFY, 'verify'):\n      return ICoseKeyOperation.VERIFY\n    case (JoseKeyOperation.ENCRYPT, 'encrypt'):\n      return ICoseKeyOperation.ENCRYPT\n    case (JoseKeyOperation.DECRYPT, 'decrypt'):\n      return ICoseKeyOperation.DECRYPT\n    case (JoseKeyOperation.WRAP_KEY, 'wrapKey'):\n      return ICoseKeyOperation.WRAP_KEY\n    case (JoseKeyOperation.UNWRAP_KEY, 'unwrapKey'):\n      return ICoseKeyOperation.UNWRAP_KEY\n    case (JoseKeyOperation.DERIVE_KEY, 'deriveKey'):\n      return ICoseKeyOperation.DERIVE_KEY\n    case (JoseKeyOperation.DERIVE_BITS, 'deriveBits'):\n      return ICoseKeyOperation.DERIVE_BITS\n    default:\n      throw Error(`Key operation ${keyOp} not supported in Cose`)\n  }\n}\n\nexport function coseToJoseKeyOperation(keyOp: ICoseKeyOperation): JoseKeyOperation {\n  switch (keyOp) {\n    case ICoseKeyOperation.SIGN:\n      return JoseKeyOperation.SIGN\n    case ICoseKeyOperation.VERIFY:\n      return JoseKeyOperation.VERIFY\n    case ICoseKeyOperation.ENCRYPT:\n      return JoseKeyOperation.ENCRYPT\n    case ICoseKeyOperation.DECRYPT:\n      return JoseKeyOperation.DECRYPT\n    case ICoseKeyOperation.WRAP_KEY:\n      return JoseKeyOperation.WRAP_KEY\n    case ICoseKeyOperation.UNWRAP_KEY:\n      return JoseKeyOperation.UNWRAP_KEY\n    case ICoseKeyOperation.DERIVE_KEY:\n      return JoseKeyOperation.DERIVE_KEY\n    case ICoseKeyOperation.DERIVE_BITS:\n      return JoseKeyOperation.DERIVE_BITS\n    default:\n      throw Error(`Key operation ${keyOp} not supported in Jose`)\n  }\n}\n\nexport function joseToCoseCurve(curve: JoseCurve | JoseCurveString): ICoseCurve {\n  switch (curve) {\n    case (JoseCurve.P_256, 'P-256'):\n      return ICoseCurve.P_256\n    case (JoseCurve.P_384, 'P-384'):\n      return ICoseCurve.P_384\n    case (JoseCurve.P_521, 'P-521'):\n      return ICoseCurve.P_521\n    case (JoseCurve.X25519, 'X25519'):\n      return ICoseCurve.X25519\n    case (JoseCurve.X448, 'X448'):\n      return ICoseCurve.X448\n    case (JoseCurve.Ed25519, 'Ed25519'):\n      return ICoseCurve.Ed25519\n    case (JoseCurve.Ed448, 'Ed448'):\n      return ICoseCurve.Ed448\n    case (JoseCurve.secp256k1, 'secp256k1'):\n      return ICoseCurve.secp256k1\n    default:\n      throw Error(`Curve ${curve} not supported in Cose`)\n  }\n}\n\nexport function coseToJoseCurve(curve: ICoseCurve): JoseCurve {\n  switch (curve) {\n    case ICoseCurve.P_256:\n      return JoseCurve.P_256\n    case ICoseCurve.P_384:\n      return JoseCurve.P_384\n    case ICoseCurve.P_521:\n      return JoseCurve.P_521\n    case ICoseCurve.X25519:\n      return JoseCurve.X25519\n    case ICoseCurve.X448:\n      return JoseCurve.X448\n    case ICoseCurve.Ed25519:\n      return JoseCurve.Ed25519\n    case ICoseCurve.Ed448:\n      return JoseCurve.Ed448\n    case ICoseCurve.secp256k1:\n      return JoseCurve.secp256k1\n    default:\n      throw Error(`Curve ${curve} not supported in Jose`)\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACAA,oBAA4B;AAE5B,uBAA0B;AAC1B,qBAAwB;AACxB,kBAAqB;AACrB,kBAAqB;AACrB,kBAAqB;AACrB,uBAA0B;AAC1B,kBAAuC;AACvC,yBAOO;AACP,uBAAiF;AACjF,IAAAA,kBAA0D;AAE1D,mBAAkB;AAGlB,sBAAqB;AACrB,UAAqB;AAKrB,IAAAC,OAAqB;;;AC7BrB,oBAAuB;AACvB,oBAA+B;AAG/B,UAAqB;AACrB,IAAM,EAAEC,YAAYC,UAAUC,mBAAkB,IAAKC;AAK9C,IAAMC,qBAAqB,wBAChCC,kBAAAA;AAEA,MAAIA,kBAAkB,WAAW;AAC/B,WAAO;MAAEA,eAAe;MAAWC,cAAcC;MAAoBC,MAAMC;IAAO;EACpF,WAAWJ,kBAAkB,WAAW;AACtC,WAAO;MAAEA,eAAe;MAAWC,cAAcI;MAAoBF,MAAMG;IAAO;EACpF,OAAO;AACL,WAAO;MAAEN,eAAe;MAAWC,cAAcM;MAAoBJ,MAAMK;IAAO;EACpF;AACF,GAVkC;AAY3B,IAAMC,YAAwB,wBAACC,OAA6BC,QAAAA;AACjE,QAAMX,gBAA+BW,IAAIC,SAAS,KAAA,IAAS,YAAYD,IAAIC,SAAS,KAAA,IAAS,YAAY;AACzG,SAAOb,mBAAmBC,aAAAA,EAAeG,KAAK,OAAOO,UAAU,WAAWf,WAAWe,OAAO,OAAA,IAAW,IAAIG,WAAWH,KAAAA,CAAAA;AACxH,GAHqC;AAKrC,IAAMR,qBAAqB,wBAACQ,OAAeI,WAAsC,aAAQ;AACvF,SAAOlB,aAASQ,sBAAOT,WAAWe,OAAO,OAAA,CAAA,GAAWI,QAAAA;AACtD,GAF2B;AAI3B,IAAMT,qBAAqB,wBAACK,OAAeI,WAAsC,aAAQ;AACvF,SAAOlB,aAASU,sBAAOX,WAAWe,OAAO,OAAA,CAAA,GAAWI,QAAAA;AACtD,GAF2B;AAI3B,IAAMP,qBAAqB,wBAACG,OAAeI,WAAsC,aAAQ;AACvF,SAAOlB,aAASY,sBAAOb,WAAWe,OAAO,OAAA,CAAA,GAAWI,QAAAA;AACtD,GAF2B;;;AC/B3B,0BAAyC;AAEzC,IAAMC,cAAc,IAAIC,gCAAAA;AACxB,IAAMC,cAAc,IAAIC,gCAAAA;AASxB,SAASC,MAAMC,OAAgBC,aAAqBC,WAAoB,OAAK;AAC3E,MAAIA,YAAY,CAACF,OAAO;AACtB;EACF;AACA,MAAI,OAAOA,UAAU,YAAY,CAACA,OAAO;AACvC,UAAM,IAAIG,MAAM,GAAGF,WAAAA,qBAAgC;EACrD;AACF;AAPSF;AAcT,SAASK,aAAaJ,OAAc;AAClC,MAAI,CAACA,SAAS,OAAOA,UAAU,UAAU;AACvC,UAAM,IAAIG,MAAM,yBAAA;EAClB;AACF;AAJSC;AAeF,SAASC,YAAYC,KAAUC,MAAgC;AACpEH,eAAaE,GAAAA;AACb,QAAM,EAAEE,cAAc,MAAK,IAAKD,QAAQ,CAAC;AACzCR,QAAMO,IAAIG,KAAK,8BAA8B,KAAA;AAG7C,UAAQH,IAAIG,KAAG;;;;IAIb,KAAK;AACHV,YAAMO,IAAII,KAAK,2BAA2BF,WAAAA;AAC1CT,YAAMO,IAAIK,GAAG,8BAAA;AACbZ,YAAMO,IAAIM,GAAG,8BAAA;AACb;;;;IAIF,KAAK;AACHb,YAAMO,IAAII,KAAK,yCAAyCF,WAAAA;AACxDT,YAAMO,IAAIK,GAAG,4BAAA;AACb;;;;IAIF,KAAK;AACHZ,YAAMO,IAAIO,GAAG,0BAAA;AACbd,YAAMO,IAAIQ,GAAG,yBAAA;AACb;IACF;AACE,YAAM,IAAIX,MAAM,mDAAA;EACpB;AACF;AAhCgBE;AAwCT,SAASU,WAAWT,KAAQ;AAGjC,UAAQA,IAAIG,KAAG;IACb,KAAK;AACH,aAAO;QAAE,GAAIH,IAAII,OAAO;UAAEA,KAAKJ,IAAII;QAAI;QAAID,KAAKH,IAAIG;QAAKE,GAAGL,IAAIK;QAAGC,GAAGN,IAAIM;MAAE;IAC9E,KAAK;AACH,aAAO;QAAE,GAAIN,IAAII,OAAO;UAAEA,KAAKJ,IAAII;QAAI;QAAID,KAAKH,IAAIG;QAAKE,GAAGL,IAAIK;MAAE;IACpE,KAAK;AACH,aAAO;QAAEE,GAAGP,IAAIO;QAAGJ,KAAKH,IAAIG;QAAKK,GAAGR,IAAIQ;MAAE;EAC9C;AACA,QAAMX,MAAM,wCAAwCG,IAAIG,GAAG,EAAE;AAC/D;AAZgBM;AAwBT,SAASC,aAAaV,KAAY;AACvCD,cAAYC,GAAAA;AACZ,QAAMW,cAAcF,WAAWT,GAAAA;AAC/B,SAAOX,YAAYuB,OAAOC,gBAAgBF,WAAAA,CAAAA;AAC5C;AAJgBD;AAYT,SAASI,aAAaC,OAA2B;AACtD,QAAMf,MAAMgB,KAAKC,MAAM1B,YAAY2B,OAAOH,KAAAA,CAAAA;AAC1ChB,cAAYC,GAAAA;AACZ,MAAIgB,KAAKG,UAAUnB,GAAAA,MAASa,gBAAgBJ,WAAWT,GAAAA,CAAAA,GAAO;AAC5D,UAAM,IAAIH,MAAM,wDAAA;EAClB;AACA,SAAOG;AACT;AAPgBc;AAUT,SAASD,gBAAgBO,QAAW;AACzC,MAAIC,SAAS;AACbC,YAAUF,MAAAA;AACV,SAAOC;AAEP,WAASC,UAAUF,SAAW;AAC5B,QAAIA,YAAW,QAAQ,OAAOA,YAAW,YAAYA,QAAOG,UAAU,MAAM;AAI1EF,gBAAUL,KAAKG,UAAUC,OAAAA;IAC3B,WAAWI,MAAMC,QAAQL,OAAAA,GAAS;AAIhCC,gBAAU;AACV,UAAIK,OAAO;AACXN,MAAAA,QAAOO,QAAQ,CAACC,YAAAA;AACd,YAAIF,MAAM;AACRL,oBAAU;QACZ;AACAK,eAAO;AAIPJ,kBAAUM,OAAAA;MACZ,CAAA;AACAP,gBAAU;IACZ,OAAO;AAILA,gBAAU;AACV,UAAIK,OAAO;AACXG,aAAOC,KAAKV,OAAAA,EACTW,KAAI,EACJJ,QAAQ,CAACK,aAAAA;AACR,YAAIN,MAAM;AACRL,oBAAU;QACZ;AACAK,eAAO;AAIPL,kBAAUL,KAAKG,UAAUa,QAAAA;AACzBX,kBAAU;AAIVC,kBAAUF,QAAOY,QAAAA,CAAS;MAC5B,CAAA;AACFX,gBAAU;IACZ;EACF;AAhDSC;AAiDX;AAtDgBT;;;ACjIT,IAAMoB,mBAAmB;AACzB,IAAMC,qBAAqB;AAI3B,IAAKC,MAAAA,yBAAAA,MAAAA;;;;SAAAA;;AAML,IAAKC,YAAAA,yBAAAA,YAAAA;;;SAAAA;;AAKL,IAAMC,eAAe;EAAC;EAAS;EAAS;EAAS;EAAS;EAAU;EAAW;EAAa;EAAa;EAAc;;AACvH,IAAMC,eAAe;EAAC;EAAU;EAAkB;;;;AHwBzD,IAAM,EAAEC,YAAAA,aAAYC,UAAAA,UAAQ,IAAKC;AAE1B,IAAMC,SAASC,yBAAQC,QAAQC,IAAI,oBAAA;AAQnC,IAAMC,SAAS,8BAAOC,SAA6BC,QAAAA;AACxD,MAAIA,KAAK;AACP,WAAOA;EACT;AACA,MAAI,CAACD,QAAQE,MAAMC,iBAAgB,EAAGC,SAAS,yCAAA,GAA4C;AACzF,UAAMC,MAAM,2FAAA;EACd;AACA,SAAOL,QAAQE,MAAMI,wCAAuC;AAC9D,GARsB;AAef,IAAMC,wBAAwB,8BAAOC,SAAAA;AAC1C,UAAQA,MAAAA;IACN,KAAK,WAAW;AACd,YAAMC,qBAAiBC,gBAAAA,iBAAAA;AACvB,aAAOjB,UAASgB,eAAeE,WAAW,QAAA;IAC5C;;IAEA,KAAK;IACL,KAAK,aAAa;AAChB,YAAMC,mBAAeC,2BAAY,EAAA;AACjC,aAAOpB,UAASmB,cAAc,QAAA;IAChC;IACA,KAAK,OAAO;AACV,YAAME,MAAM,UAAMC,wCAAoB,WAAW,WAAW,IAAA;AAC5D,iBAAOC,yCAAqBF,GAAAA;IAC9B;IACA;AACE,YAAMT,MAAM,2BAA2BG,IAAAA,oDAAwD;EACnG;AACF,GAnBqC;AAqBrC,IAAMS,+BAA+B,wBAACT,SAAAA;AACpC,UAAQA,MAAAA;IACN,KAAK;AACH,aAAO;QAAC;QAAW;;IACrB,KAAK;IACL,KAAK;AACH,aAAO;QAAC;QAAU;QAAY;QAAuB;QAAqB;QAAmB;;IAC/F,KAAK;AACH,aAAO;QAAC;;IACV,KAAK;AACH,aAAO;QAAC;QAAQ;QAAW;;IAC7B,KAAK;AACH,aAAO;QAAC;QAAS;QAAS;QAAS;;EACvC;AACA,SAAO;IAACA;;AACV,GAfqC;AAwBrC,eAAsBU,6BACpBC,MAGAnB,SAAmC;AAGnC,QAAMQ,OAAOW,KAAKC,SAASZ,QAAQW,KAAKC,SAASC,KAAKb,QAAQW,KAAKC,SAASE,WAAW;AACvF,QAAMD,MAAMF,MAAMC,SAASC;AAE3B,MAAIF,KAAKC,SAASG,QAAQF,KAAK;AAC7BA,QAAIG,OAAO;MACT,GAAGH,IAAIG;MACPD,MAAM;QACJ,GAAGJ,KAAKC,QAAQG;QAChB,GAAGF,IAAIG,MAAMD;MACf;IACF;EACF;AAEA,MAAIJ,KAAKC,WAAWD,KAAKC,SAASK,QAAQC,UAAUC,cAAc,CAACC,aAAaxB,SAASI,IAAAA,GAAO;AAC9F,UAAM,IAAIH,MAAM,GAAGG,IAAAA,oCAAwC;EAC7D;AAEA,MAAIqB,gBAAoCC;AACxC,MAAIT,KAAK;AACPQ,oBAAgBR,IAAIQ,iBAAiBR,IAAIG,MAAMD,MAAMM;AACrD,SAAK,CAACA,iBAAiBA,cAAcE,KAAI,MAAO,OAAOV,KAAKG,MAAMD,MAAMS,eAAe;AAErFH,0BAAgBb,yCAAqBK,IAAIG,KAAKD,KAAKS,aAAa;IAClE;EACF;AACA,MAAIH,eAAe;AACjB,WAAO7B,QAAQE,MAAM+B,iBAAiB;MACpC,GAAGZ;MACHpB,KAAKkB,KAAKlB;MACVO;MACAqB;IACF,CAAA;EACF;AAEA,SAAO7B,QAAQE,MAAMgC,iBAAiB;IACpC1B;IACAP,KAAKkB,KAAKlB;IACVuB,MAAM;MACJ,GAAGH,KAAKG;MACRW,YAAYlB,6BAA6BT,IAAAA;MACzC4B,UAAUjB,KAAKkB;IACjB;EACF,CAAA;AACF;AAlDsBnB;AAoDf,IAAMoB,+BAA+B,wBAACnB,SAAAA;AAI3C,QAAM,EAAEE,IAAG,IAAKF;AAEhB,QAAMoB,MAAMlB,IAAImB,eACZC,MAAMpB,IAAImB,cAAcnB,IAAIb,MAAM;IAAEa;IAAUqB,cAAc;EAAM,CAAA,IAClE,mBAAmBrB,OAAOA,IAAIQ,gBAC9BY,MAAMpB,IAAIQ,eAAeR,IAAIb,MAAM;IAAEkC,cAAc;EAAK,CAAA,IACxDZ;AACJ,MAAI,CAACS,KAAK;AACR,UAAMlC,MAAM,oCAAoCgB,IAAIsB,GAAG,EAAE;EAC3D;AACA,SAAOC,uBAAuB;IAAEL;IAAKM,iBAAiB1B,KAAK0B;EAAgB,CAAA;AAC7E,GAf4C;AAiB5C,IAAMC,wBAAwB,wBAACC,OAAgBC,gBAAAA;AAC7C,MAAI,OAAOD,UAAU,YAAY,CAACA,OAAO;AACvC,UAAM,IAAI1C,MAAM,GAAG2C,WAAAA,qBAAgC;EACrD;AACF,GAJ8B;AAKvB,IAAMC,cAAc,wBAACC,UAA0BzD,UAASD,YAAW0D,KAAAA,GAAQ,WAAA,GAAvD;AAMpB,IAAMN,yBAAyB,wBAACzB,SAAAA;AACrC,QAAM,EAAE0B,kBAAkB,SAAQ,IAAK1B;AACvC,QAAMoB,MAAMY,aAAahC,KAAKoB,GAAG;AACjC,MAAIa;AACJ,UAAQb,IAAIc,KAAG;IACb,KAAK;AACHP,4BAAsBP,IAAIe,KAAK,yBAAA;AAC/BR,4BAAsBP,IAAIgB,GAAG,8BAAA;AAC7BT,4BAAsBP,IAAIiB,GAAG,8BAAA;AAC7BJ,mBAAa;QAAEE,KAAKf,IAAIe;QAAKD,KAAKd,IAAIc;QAAKE,GAAGhB,IAAIgB;QAAGC,GAAGjB,IAAIiB;MAAE;AAC9D;IACF,KAAK;AACHV,4BAAsBP,IAAIe,KAAK,uCAAA;AAC/BR,4BAAsBP,IAAIgB,GAAG,4BAAA;AAC7BH,mBAAa;QAAEE,KAAKf,IAAIe;QAAKD,KAAKd,IAAIc;QAAKE,GAAGhB,IAAIgB;MAAE;AACpD;IACF,KAAK;AACHT,4BAAsBP,IAAIkB,GAAG,0BAAA;AAC7BX,4BAAsBP,IAAImB,GAAG,yBAAA;AAC7BN,mBAAa;QAAEK,GAAGlB,IAAIkB;QAAGJ,KAAKd,IAAIc;QAAKK,GAAGnB,IAAImB;MAAE;AAChD;IACF,KAAK;AACHZ,4BAAsBP,IAAIoB,GAAG,2BAAA;AAC7BP,mBAAa;QAAEO,GAAGpB,IAAIoB;QAAGN,KAAKd,IAAIc;MAAI;AACtC;IACF;AACE,YAAM,IAAIhD,MAAM,mDAAA;EACpB;AACA,QAAMuD,OAAOC,KAAKC,UAAUV,UAAAA;AAE5B,SAAOP,oBAAoB,WACvBkB,mBAAmB,SAAA,EAAWC,aAAaJ,MAAM,WAAA,IACjDG,mBAAmB,SAAA,EAAWC,aAAaJ,MAAM,WAAA;AACvD,GAjCsC;AAmC/B,IAAMK,eAAe,wBAC1B5C,KACA6C,SAAAA;AAKA,QAAMxB,eAAe,mBAAmBrB;AACxC,SAAOoB,MAAMpB,IAAImB,cAAenB,IAAIb,MAAM;IAAE,GAAG0D;IAAM7C;IAAKqB;EAAa,CAAA;AACzE,GAT4B;AAkBrB,IAAMD,QAAQ,wBACnBD,cACAhC,MACA0D,SAAAA;AAEA,QAAM,EAAE7C,KAAK8C,kBAAkB,MAAK,IAAKD,QAAQ,CAAC;AAClD,MAAI7C,OAAOA,IAAImB,iBAAiBA,gBAAgB0B,MAAMxB,iBAAiB,MAAM;AAC3E,UAAMrC,MAAM,wBAAwBgB,IAAIsB,GAAG,oCAAoCtB,IAAImB,YAAY,6BAA6BA,YAAAA,EAAc;EAC5I;AACA,MAAID;AACJ,UAAQ/B,MAAAA;IACN,KAAK;AACH+B,YAAM6B,qBAAqB5B,cAAc;QAAE,GAAG0B;QAAMZ,KAAKe,2BAAUC;MAAQ,CAAA;AAC3E;IACF,KAAK;AACH/B,YAAM6B,qBAAqB5B,cAAc;QAAE,GAAG0B;QAAMZ,KAAKe,2BAAUE;MAAO,CAAA;AAC1E;IACF,KAAK;AACHhC,YAAMiC,eAAehC,cAAc0B,IAAAA;AACnC;IACF,KAAK;AACH3B,YAAMkC,eAAejC,cAAc0B,IAAAA;AACnC;IACF,KAAK;AACH3B,YAAMmC,SAASlC,cAAc0B,IAAAA;AAC7B;IACF;AACE,YAAM,IAAI7D,MAAM,2BAA2BG,IAAAA,oDAAwD;EACvG;AACA,MAAI,CAAC+B,IAAII,OAAO,CAACwB,iBAAiB;AAChC5B,QAAI,KAAA,IAASK,uBAAuB;MAAEL;IAAI,CAAA;EAC5C;AACA,SAAOY,aAAaZ,GAAAA;AACtB,GAjCqB;AAyCd,IAAMoC,iBAAiB,8BAAOpC,QAAAA;AAEnCA,QAAMY,aAAaZ,GAAAA;AACnB,MAAIA,IAAIc,QAAQ,OAAO;AACrB,WAAOuB,kBAAkBrC,GAAAA;EAC3B,WAAWA,IAAIc,QAAQ,MAAM;AAC3B,WAAOwB,iBAAiBtC,GAAAA;EAC1B,WAAWA,IAAIc,QAAQ,OAAO;AAC5B,WAAOyB,kBAAkBvC,GAAAA;EAC3B,WAAWA,IAAIc,QAAQ,OAAO;AAC5B,WAAO0B,kBAAkBxC,GAAAA;EAC3B,OAAO;AACL,UAAM,IAAIlC,MAAM,yBAAyBkC,IAAIc,GAAG,EAAE;EACpD;AACF,GAd8B;AAqBvB,SAASuB,kBAAkBrC,KAAe;AAK/C,WAASyC,cAAcC,OAAiB;AAEtC,QAAIA,MAAM,CAAA,IAAK,KAAM;AACnBA,cAAQC,WAAWC,KAAK;QAAC;WAASF;OAAM;IAC1C;AACA,UAAMG,MAAMC,aAAaJ,MAAMK,MAAM;AACrC,WAAOJ,WAAWC,KAAK;MAAC;SAASC;SAAQH;KAAM;EACjD;AAPSD;AAcT,WAASK,aAAaD,KAAQ;AAC5B,QAAIA,MAAM,KAAM;AACd,aAAOF,WAAWK,GAAGH,GAAAA;IACvB;AACA,QAAII,MAAMJ,IAAI3F,SAAS,EAAA;AACvB,QAAI+F,IAAIF,SAAS,MAAM,GAAG;AACxBE,YAAM,MAAMA;IACd;AACA,UAAMC,WAAWP,WAAWC,KAAKK,IAAIE,MAAM,OAAA,EAAUC,IAAI,CAACC,MAAWC,SAASD,GAAG,EAAA,CAAA,CAAA;AACjF,WAAOV,WAAWK,GAAG,MAAOE,SAASH,QAAM,GAAKG,QAAAA;EAClD;AAVSJ;AAgBT,WAASS,eAAeC,UAAa;AACnC,UAAMC,UAAUD,SAASE,OAAO,CAACC,KAAUC,QAAajB,WAAWC,KAAK;SAAIe;SAAQC;KAAI,GAAG,IAAIjB,WAAAA,CAAAA;AAC/F,UAAME,MAAMC,aAAaW,QAAQV,MAAM;AACvC,WAAOJ,WAAWC,KAAK;MAAC;SAASC;SAAQY;KAAQ;EACnD;AAJSF;AAST,WAASM,iBAAiBC,QAAc;AACtC,WAAO7G,YAAW6G,QAAQ,WAAA;EAC5B;AAFSD;AAIT7D,QAAMY,aAAaZ,GAAAA;AACnB,MAAI,CAACA,IAAImB,KAAK,CAACnB,IAAIkB,GAAG;AACpB,UAAM,IAAIpD,MAAM,8CAAA;EAClB;AACA,QAAMiG,eAAeF,iBAAiB7D,IAAImB,CAAC;AAC3C,QAAM6C,gBAAgBH,iBAAiB7D,IAAIkB,CAAC;AAC5C,QAAM+C,WAAWV,eAAe;IAACd,cAAcsB,YAAAA;IAAetB,cAAcuB,aAAAA;GAAe;AAC3F,QAAME,SAAShH,UAAS+G,UAAU,KAAA;AAClC,SAAOC;AAOT;AA/DgB7B;AAsEhB,SAASC,iBAAiBtC,KAAe;AACvCA,QAAMY,aAAaZ,GAAAA;AACnB,MAAI,CAACA,IAAIgB,KAAK,CAAChB,IAAIiB,GAAG;AACpB,UAAM,IAAInD,MAAM,6CAAA;EAClB;AAGA,QAAMkD,IAAI/D,YAAW+C,IAAIgB,EAAEmD,QAAQ,OAAO,GAAA,EAAKA,QAAQ,OAAO,GAAA,EAAKA,QAAQ,OAAO,EAAA,GAAK,WAAA;AACvF,QAAMlD,IAAIhE,YAAW+C,IAAIiB,EAAEkD,QAAQ,OAAO,GAAA,EAAKA,QAAQ,OAAO,GAAA,EAAKA,QAAQ,OAAO,EAAA,GAAK,WAAA;AAEvF,SAAO,OAAOjH,UAAS8D,GAAG,KAAA,IAAS9D,UAAS+D,GAAG,KAAA;AACjD;AAXSqB;AAkBT,SAASC,kBAAkBvC,KAAe;AACxCA,QAAMY,aAAaZ,GAAAA;AACnB,MAAI,CAACA,IAAIgB,GAAG;AACV,UAAM,IAAIlD,MAAM,oCAAA;EAClB;AAGA,QAAMkD,IAAI/D,YAAW+C,IAAIgB,EAAEmD,QAAQ,OAAO,GAAA,EAAKA,QAAQ,OAAO,GAAA,EAAKA,QAAQ,OAAO,EAAA,GAAK,WAAA;AAEvF,SAAOjH,UAAS8D,GAAG,KAAA;AACrB;AAVSuB;AAiBT,SAASC,kBAAkBxC,KAAe;AACxCA,QAAMY,aAAaZ,GAAAA;AACnB,MAAI,CAACA,IAAIoB,GAAG;AACV,UAAM,IAAItD,MAAM,sCAAA;EAClB;AAGA,QAAMgB,MAAM7B,YAAW+C,IAAIoB,EAAE+C,QAAQ,OAAO,GAAA,EAAKA,QAAQ,OAAO,GAAA,EAAKA,QAAQ,OAAO,EAAA,GAAK,WAAA;AAEzF,SAAOjH,UAAS4B,KAAK,KAAA;AACvB;AAVS0D;AAkBF,IAAM4B,kBAAkB,wBAACnG,MAAgBoG,gBAAAA;AAC9C,SAAOA,cACHA,cACAC,aAAazG,SAASI,IAAAA,IACtBkB,UAAUoF,YACVlF,aAAaxB,SAASI,IAAAA,IACtBkB,UAAUC,aACVG;AACN,GAR+B;AAgB/B,IAAMiF,wBAAwB,wBAACC,QAAgBC,sBAAAA;AAC7C,MAAIC,MAAMC,QAAQF,iBAAAA,GAAoB;AACpC,QAAI,CAACA,kBAAkB7G,SAAS4G,OAAO1B,MAAM,GAAG;AAC9C,YAAMjF,MACJ,iEAAiEwD,KAAKC,UAAUmD,iBAAAA,CAAAA,eAC9ED,OAAO1B,MAAM,YACH0B,MAAAA,EAAQ;IAExB;EACF,WAAWA,OAAO1B,WAAW2B,mBAAmB;AAC9C,UAAM5G,MAAM,4DAA4D4G,iBAAAA,eAAgCD,OAAO1B,MAAM,YAAY0B,MAAAA,EAAQ;EAC3I;AACF,GAZ8B;AAoB9B,IAAMxC,iBAAiB,wBAACwC,QAAgB9C,SAAAA;AACtC,QAAM,EAAEzC,IAAG,IAAKyC,QAAQ,CAAC;AACzBvE,SAAOyH,MAAM,0BAA0BJ,MAAAA,aAAmBA,OAAO1B,MAAM,EAAE;AACzE,MAAIpB,MAAMxB,cAAc;AACtBqE,0BAAsBC,QAAQ;MAAC;KAAG;EACpC,OAAO;AACLD,0BAAsBC,QAAQ;MAAC;MAAI;KAAI;EACzC;AAEA,QAAMK,aAAY,IAAIC,gBAAAA,QAASC,GAAG,WAAA;AAClC,QAAMC,WAAWhI,YAAWwH,QAAQ,QAAA;AACpC,QAAMS,UAAUvD,MAAMxB,eAAe2E,WAAUK,eAAeF,QAAAA,IAAYH,WAAUM,cAAcH,QAAAA;AAClG,QAAMI,WAAWH,QAAQI,UAAS;AAElC,SAAO1E,aAAa;IAClB2E,KAAKC,wCAAuBC;IAC5B,GAAIvG,QAAQK,UAAa;MAAEL;IAAI;IAC/B4B,KAAK4E,4BAAWC;IAChB5E,KAAKe,2BAAUgD;IACf9D,OAAG4E,gCAAYP,SAASQ,KAAI,EAAG3I,SAAS,KAAA,GAAQ,WAAA;IAChD+D,OAAG2E,gCAAYP,SAASS,KAAI,EAAG5I,SAAS,KAAA,GAAQ,WAAA;IAChD,GAAIyE,MAAMxB,gBAAgB;MAAE4F,OAAGH,gCAAYV,QAAQc,WAAW,KAAA,GAAQ,WAAA;IAAa;EACrF,CAAA;AACF,GAvBuB;AA+BvB,IAAM9D,iBAAiB,wBAACuC,QAAgB9C,SAAAA;AACtC,QAAM,EAAEzC,IAAG,IAAKyC,QAAQ,CAAC;AACzBvE,SAAOyH,MAAM,0BAA0BJ,MAAAA,aAAmBA,OAAO1B,MAAM,EAAE;AACzE,MAAIpB,MAAMxB,cAAc;AACtBqE,0BAAsBC,QAAQ;MAAC;KAAG;EACpC,OAAO;AACLD,0BAAsBC,QAAQ;MAAC;MAAI;KAAI;EACzC;AAEA,QAAMwB,YAAY,IAAIlB,gBAAAA,QAASC,GAAG,MAAA;AAClC,QAAMC,WAAWhI,YAAWwH,QAAQ,QAAA;AACpCrH,SAAOyH,MAAM,oBAAoBI,QAAAA,EAAU;AAC3C,QAAMC,UAAUvD,MAAMxB,eAAe8F,UAAUd,eAAeF,QAAAA,IAAYgB,UAAUb,cAAcH,QAAAA;AAClG,QAAMI,WAAWH,QAAQI,UAAS;AAClC,SAAO1E,aAAa;IAClB2E,KAAKC,wCAAuBU;IAC5B,GAAIhH,QAAQK,UAAa;MAAEL;IAAI;IAC/B4B,KAAK4E,4BAAWC;IAChB5E,KAAKe,2BAAUqE;IACfnF,OAAG4E,gCAAYP,SAASQ,KAAI,EAAG3I,SAAS,KAAA,GAAQ,WAAA;IAChD+D,OAAG2E,gCAAYP,SAASS,KAAI,EAAG5I,SAAS,KAAA,GAAQ,WAAA;IAChD,GAAIyE,MAAMxB,gBAAgB;MAAE4F,OAAGH,gCAAYV,QAAQc,WAAW,KAAA,GAAQ,WAAA;IAAa;EACrF,CAAA;AACF,GAvBuB;AA+BvB,IAAMnE,uBAAuB,wBAC3B5B,cACA0B,SAAAA;AAKA6C,wBAAsBvE,cAAc,EAAA;AACpC,QAAM,EAAEf,IAAG,IAAKyC,QAAQ,CAAC;AACzB,SAAOf,aAAa;IAClB2E,KAAKC,wCAAuBY;IAC5B,GAAIlH,QAAQK,UAAa;MAAEL;IAAI;IAC/B4B,KAAK4E,4BAAWW;IAChBtF,KAAKY,MAAMZ,OAAOe,2BAAUC;IAC5Bf,OAAG4E,gCAAY3F,cAAc,WAAA;EAC/B,CAAA;AACF,GAhB6B;AAkB7B,IAAMkC,WAAW,wBAAClC,cAAsB0B,SAAAA;AACtC,WAAS2E,iBAAiBC,WAAiB;AACzC,UAAM7D,QAAQ8D,OAAO5D,KAAK2D,WAAW,KAAA;AACrC,QAAIE,SAAS;AAGb,QAAI/D,MAAM+D,QAAAA,MAAc,GAAM,OAAM,IAAI3I,MAAM,gBAAA;AAC9C,QAAI+E,MAAMH,MAAM+D,QAAAA;AAChB,QAAI5D,MAAM,KAAM;AACd,YAAM6D,SAAS7D,MAAM;AACrBA,YAAM;AACN,eAAS8D,IAAI,GAAGA,IAAID,QAAQC,KAAK;AAC/B9D,eAAOA,OAAO,KAAKH,MAAM+D,QAAAA;MAC3B;IACF;AAIA,QAAI/D,MAAM+D,MAAAA,MAAY,GAAM;AAE1B,UAAI/D,MAAM+D,QAAAA,MAAc,GAAM,OAAM,IAAI3I,MAAM,0BAAA;AAC9C,UAAI8I,SAASlE,MAAM+D,QAAAA;AACnB,UAAIG,SAAS,KAAM;AACjB,cAAMC,KAAKD,SAAS;AACpBA,iBAAS;AACT,iBAASD,IAAI,GAAGA,IAAIE,IAAIF,IAAKC,WAAUA,UAAU,KAAKlE,MAAM+D,QAAAA;MAC9D;AACAA,gBAAUG;AAGV,UAAIlE,MAAM+D,QAAAA,MAAc,EAAM,OAAM,IAAI3I,MAAM,qBAAA;AAC9C,UAAIgJ,SAASpE,MAAM+D,QAAAA;AACnB,UAAIK,SAAS,KAAM;AACjB,cAAMD,KAAKC,SAAS;AACpBA,iBAAS;AACT,iBAASH,IAAI,GAAGA,IAAIE,IAAIF,IAAKG,WAAUA,UAAU,KAAKpE,MAAM+D,QAAAA;MAC9D;AAEAA,gBAAU;AAGV,UAAI/D,MAAM+D,QAAAA,MAAc,GAAM,OAAM,IAAI3I,MAAM,yBAAA;AAC9C,UAAIiJ,WAAWrE,MAAM+D,QAAAA;AACrB,UAAIM,WAAW,KAAM;AACnB,cAAMF,KAAKE,WAAW;AACtBA,mBAAW;AACX,iBAASJ,IAAI,GAAGA,IAAIE,IAAIF,IAAKI,aAAYA,YAAY,KAAKrE,MAAM+D,QAAAA;MAClE;IACF;AAGA,QAAI/D,MAAM+D,QAAAA,MAAc,EAAM,OAAM,IAAI3I,MAAM,8BAAA;AAC9C,QAAIkJ,SAAStE,MAAM+D,QAAAA;AACnB,QAAIO,SAAS,KAAM;AACjB,YAAMH,KAAKG,SAAS;AACpBA,eAAS;AACT,eAASL,IAAI,GAAGA,IAAIE,IAAIF,IAAKK,WAAUA,UAAU,KAAKtE,MAAM+D,QAAAA;IAC9D;AACA,QAAI1C,eAAerB,MAAMuE,MAAMR,QAAQA,SAASO,MAAAA;AAChDP,cAAUO;AAGV,QAAIjD,aAAa,CAAA,MAAO,GAAM;AAC5BA,qBAAeA,aAAakD,MAAM,CAAA;IACpC;AAGA,QAAIvE,MAAM+D,QAAAA,MAAc,EAAM,OAAM,IAAI3I,MAAM,+BAAA;AAC9C,QAAIoJ,SAASxE,MAAM+D,QAAAA;AACnB,QAAIS,SAAS,KAAM;AACjB,YAAML,KAAKK,SAAS;AACpBA,eAAS;AACT,eAASP,IAAI,GAAGA,IAAIE,IAAIF,IAAKO,WAAUA,UAAU,KAAKxE,MAAM+D,QAAAA;IAC9D;AACA,UAAMzC,gBAAgBtB,MAAMuE,MAAMR,QAAQA,SAASS,MAAAA;AAEnD,WAAO;MACLC,SAASpD,aAAa7G,SAAS,KAAA;MAC/BkK,UAAUpD,cAAc9G,SAAS,KAAA;IACnC;EACF;AA/ESoJ;AAiFT,QAAMrH,OAAO0C,MAAM7C,KAAKG;AACxB,MAAIA,MAAMoI,gBAAgBpI,MAAMqI,cAAc;AAC5C,QAAIrI,MAAMoI,cAAc;AACtB,aAAOpI,KAAKoI;IACd;AACA,UAAMC,eAAerI,MAAMqI,oBAAgBC,6BAAStH,cAAc,QAAA;AAClE,UAAMD,UAAMwH,6BAASF,cAAc,QAAA;AACnC,WAAOtH;EACT;AAEA,QAAM,EAAEmH,SAASC,SAAQ,IAAKd,iBAAiBrG,YAAAA;AAC/C,QAAMwH,YAAY7G,aAAa;IAC7BE,KAAK;IACLK,OAAGyE,gCAAYuB,SAAS,WAAA;IACxBjG,OAAG0E,gCAAYwB,UAAU,WAAA;EAC3B,CAAA;AACA,SAAOK;AACT,GAnGiB;AAqGV,IAAMC,UAAU,wBAAC9I,SAAAA;AACtB,QAAM,EAAEyC,KAAI,IAAKzC;AACjB,QAAM+I,OAAO/I,KAAK+I,QAAQ;AAC1B,QAAMC,YAAYhJ,KAAKgJ,aAAa;AACpC,MAAIvG,KAAK0B,UAAU4E,MAAM;AACvB,WAAOtG;EACT;AAEA,MAAIuG,aAAaA,UAAU7E,WAAW,GAAG;AACvC,UAAMjF,MAAM,iDAAiD;EAC/D;AACA,QAAMiF,SAAS6E,UAAU7E;AACzB,SAAO6E,UAAUC,QAAQF,OAAOtG,KAAK0B,UAAUA,MAAAA,IAAU1B;AAC3D,GAbuB;AAqBvB,IAAMyG,MAAmC;EACvC,CAAA,CAAA,GAAqB,IAAIC,WAAW;IAAC;IAAM;IAAM;IAAM;IAAM;IAAM;IAAM;IAAM;IAAM;GAAK;EAC1F,CAAA,CAAA,GAAqB,IAAIA,WAAW;IAAC;IAAM;IAAM;IAAM;IAAM;IAAM;IAAM;IAAM;IAAM;IAAM;GAAK;EAChG,CAAA,CAAA,GAAmB,IAAIA,WAAW;IAAC;IAAM;IAAM;IAAM;IAAM;GAAK;AAClE;AAEA,IAAMC,qBAAqB,wBAACC,GAAeC,MAAAA;AACzC,MAAID,EAAEE,WAAWD,EAAEC,QAAQ;AACzB,WAAO;EACT;AACA,WAASC,IAAI,GAAGA,IAAIH,EAAEE,QAAQC,KAAK;AACjC,QAAIH,EAAEG,CAAAA,MAAOF,EAAEE,CAAAA,GAAI;AACjB,aAAO;IACT;EACF;AACA,SAAO;AACT,GAV2B;AAY3B,IAAMC,eAAe,wBAACC,UAAsBC,WAAAA;AAC1C,WAASH,IAAI,GAAGA,KAAKE,SAASH,SAASI,OAAOJ,QAAQC,KAAK;AACzD,QAAIJ,mBAAmBM,SAASE,SAASJ,GAAGA,IAAIG,OAAOJ,MAAM,GAAGI,MAAAA,GAAS;AACvE,aAAOH;IACT;EACF;AACA,SAAO;AACT,GAPqB;AASrB,IAAMK,eAAe,wBAACC,YAAAA;AACpB,UAAQA,SAAAA;IACN,KAAK;AACH,aAAOZ,IAAG,CAAA;IACZ,KAAK;AACH,aAAOA,IAAG,CAAA;IACZ,KAAK;AACH,aAAOA,IAAG,CAAA;IACZ;AACE,YAAM,IAAIa,MAAM,yBAAyBD,OAAAA,EAAS;EACtD;AACF,GAXqB;AAad,IAAME,YAAY,wBAACC,QAA6BA,IAAI,CAAA,MAAO,IAAzC;AAElB,IAAMC,wBAAwB,wBAACC,QAAoBL,YAAAA;AACxD,MAAI,CAACE,UAAUG,MAAAA,GAAS;AACtB,UAAM,IAAIJ,MAAM,2DAAA;EAClB;AAEA,MAAIK,QAAQ;AACZ,MAAID,OAAO,CAAA,IAAK,KAAM;AACpB,UAAME,mBAAmBF,OAAO,CAAA,IAAK;AACrCC,aAASC;EACX;AACA,QAAMC,YAAYT,aAAaC,OAAAA;AAC/B,QAAMS,WAAWd,aAAaU,QAAQG,SAAAA;AACtC,MAAIC,aAAa,IAAI;AACnB,UAAM,IAAIR,MAAM,WAAWD,OAAAA,4BAAmC;EAChE;AAEAM,UAAQG,WAAWD,UAAUf;AAE7B,SAAOa,QAAQD,OAAOZ,UAAUY,OAAOC,KAAAA,MAAW,GAAM;AACtDA;EACF;AAEA,MAAIA,SAASD,OAAOZ,QAAQ;AAC1B,UAAM,IAAIQ,MAAM,4CAAA;EAClB;AAGAK,WAAS;AAGTA;AAEA,SAAOD,OAAOK,MAAMJ,KAAAA;AACtB,GAjCqC;AAmC9B,IAAMK,2BAA2B,wBAACR,QAA6BA,IAAIV,WAAW,OAAOU,IAAI,CAAA,MAAO,KAAQA,IAAI,CAAA,MAAO,IAAlF;AAEjC,IAAMS,8BAA8B,wBAACC,cAA0Bb,YAAAA;AACpE,MAAIW,yBAAyBE,YAAAA,GAAe;AAC1C,WAAOC,wBAAwBD,YAAAA;EACjC;AAEA,MAAIb,YAAY,eAAeA,YAAY,aAAa;AACtD,QAAIa,aAAa,CAAA,MAAO,KAAQA,aAAapB,WAAW,IAAI;AAC1D,YAAMsB,cAAcF,aAAaH,MAAM,GAAG,EAAA;AAC1C,YAAMM,cAAcH,aAAaH,MAAM,EAAA;AACvC,YAAMO,SAAS,IAAI5B,WAAW;QAAC2B,YAAY,EAAA,IAAM,MAAM,IAAI,IAAO;OAAK;AACvE,YAAME,YAAYJ,wBAAwB,IAAIzB,WAAW;WAAI4B;WAAWF;OAAY,CAAA;AACpFI,aAAOC,MAAM,wBAAwBN,wBAAwBD,YAAAA,CAAAA,OAAoBK,SAAAA,EAAW;AAC5F,aAAOA;IACT;AACA,WAAOG,UAASR,cAAc,QAAA;EAChC,WAAWb,YAAY,WAAW;AAEhC,WAAOqB,UAASR,cAAc,QAAA;EAChC;AAEA,QAAM,IAAIZ,MAAM,yBAAyBD,OAAAA,EAAS;AACpD,GArB2C;AAuBpC,IAAMc,0BAA0B,wBAACQ,UAA8BD,UAASC,OAAO,QAAA,GAA/C;AAEhC,IAAMC,4BAA4B,8BAAOC,SAAAA;AAC9C,QAAM,EAAErB,IAAG,IAAKqB;AAChB,SAAOC,8BAA8B;IAAEC,MAAMvB,IAAIuB;EAAK,CAAA;AACxD,GAHyC;AAKlC,IAAMD,gCAAgC,wBAACD,SAAAA;AAC5C,QAAM,EAAEE,KAAI,IAAKF;AACjB,UAAQE,MAAAA;IACN,KAAK;IACL,KAAK;AACH,aAAOC,wCAAuBC;IAChC,KAAK;AACH,aAAOD,wCAAuBE;IAChC,KAAK;AACH,aAAOF,wCAAuBG;IAChC,KAAK;AACH,aAAOH,wCAAuBI;IAChC,KAAK;AACH,aAAOJ,wCAAuBK;IAChC,KAAK;AACH,aAAOL,wCAAuBM;IAChC;AACE,YAAM,IAAIhC,MAAM,aAAayB,IAAAA,iBAAqB;EACtD;AACF,GAnB6C;AAsBtC,IAAMQ,gCAAgC,wBAACV,SAAAA;AAC5C,QAAM,EAAEW,KAAKC,KAAKC,IAAG,IAAKb;AAE1B,UAAQa,KAAAA;IACN,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;AACH,aAAO;EACX;AAEA,UAAQF,KAAAA;IACN,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;AACH,aAAO;IACT,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;AACH,aAAO;IACT,KAAK;IACL,KAAK;AACH,aAAO;IACT,KAAK;IACL,KAAK;AACH,aAAO;IACT,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;AACH,aAAO;EACX;AACA,MAAIC,KAAK;AACP,WAAOA;EACT;AAEA,QAAM,IAAInC,MAAM,wBAAwBkC,GAAAA,iBAAoB;AAC9D,GA5C6C;AA8CtC,SAASG,YAAeC,KAAY;AACzCC,SAAOC,KAAKF,GAAAA,EAAKG,QAAQ,CAACvC,QAAAA;AACxB,QAAIoC,IAAIpC,GAAAA,KAAQ,OAAOoC,IAAIpC,GAAAA,MAAS,SAAUmC,aAAYC,IAAIpC,GAAAA,CAAI;aACzDoC,IAAIpC,GAAAA,KAAQ,KAAM,QAAOoC,IAAIpC,GAAAA;EACxC,CAAA;AACA,SAAOoC;AACT;AANgBD;AAQT,IAAMK,eAAe,wBAACC,WAAoBC,mBAAAA;AAC/C,MAAIC;AACJ,MAAI,OAAOD,mBAAmB,aAAa;AACzCC,gBAAYD;EACd,WAAW,OAAOE,WAAW,aAAa;AACxCD,gBAAYC;EACd,WAAW,OAAOC,OAAOD,WAAW,aAAa;AAC/CD,gBAAYE,OAAOD;EACrB,OAAO;AAEL,QAAI,OAAOC,OAAOC,QAAQF,QAAQG,WAAW,aAAa;AAExDJ,kBAAYE,OAAOC,OAAOF;IAC5B,OAAO;AACLD,kBAAY,OAAO,QAAA;IACrB;EACF;AACA,MAAIF,WAAW;AACbI,WAAOD,SAASD;EAClB;AAEA,SAAOA;AACT,GAtB4B;AAwBrB,IAAMK,eAAe,wBAACC,UAAAA;AAC3B,QAAMC,WAAW,OAAOD,MAAM,WAAA,MAAiB,aAAaA,MAAM,WAAA,EAAY,IAAM;IAAE,GAAGA;EAAM;AAE/F,QAAME,MAAM;IACV,GAAGD;IACH,GAAIA,SAASE,KAAK;MAAEA,GAAGC,kBAAkBH,SAASE,CAAC;IAAY;IAC/D,GAAIF,SAASI,KAAK;MAAEA,GAAGD,kBAAkBH,SAASI,CAAC;IAAY;IAC/D,GAAIJ,SAASK,KAAK;MAAEA,GAAGF,kBAAkBH,SAASK,CAAC;IAAY;IAC/D,GAAIL,SAASM,KAAK;MAAEA,GAAGH,kBAAkBH,SAASM,CAAC;IAAY;IAC/D,GAAIN,SAASO,KAAK;MAAEA,GAAGJ,kBAAkBH,SAASO,CAAC;IAAY;IAC/D,GAAIP,SAASQ,KAAK;MAAEA,GAAGL,kBAAkBH,SAASQ,CAAC;IAAY;EACjE;AAEA,SAAOvB,YAAYgB,GAAAA;AACrB,GAd4B;AAgB5B,IAAME,oBAAoB,wBAACJ,UAAAA;AACzB,SAAOA,MAAMU,QAAQ,OAAO,GAAA,EAAKA,QAAQ,OAAO,GAAA,EAAKA,QAAQ,OAAO,EAAA;AACtE,GAF0B;AAO1B,eAAsBC,mBAAmB,EACvCC,MACAC,WACA9D,KAAK+D,UACLC,KAAI,GAQL;AAMC,WAASC,oBAAoBC,SAAe;AAE1C,UAAMC,YAAYC,YAAWF,SAAS,WAAA;AAGtC,UAAMG,MAAMnD,UAASiD,WAAW,KAAA;AAChC,WAAOG,OAAO,KAAKD,GAAAA,EAAK;EAC1B;AAPSJ;AAST,MAAI;AACFhD,qBAAAA,SAAM,2BAA2B8C,QAAAA,EAAU;AAC3C,UAAMZ,MAAMH,aAAae,QAAAA;AACzBQ,gBAAYpB,KAAK;MAAEqB,aAAa;IAAK,CAAA;AACrC,UAAM3E,UAAUkC,8BAA8B;MAAEC,KAAKmB,IAAInB;MAAKC,KAAKkB,IAAIlB;MAAKC,KAAKiB,IAAIjB;IAAI,CAAA;AACzF,UAAMuC,eAAe,MAAMC,eAAevB,GAAAA;AAG1C,YAAQtD,SAAAA;MACN,KAAK;AACH,eAAO8E,2BAAUC,OAAOd,WAAWD,MAAMY,cAAc;UAAEI,QAAQ;UAAWC,SAAS;QAAK,CAAA;MAC5F,KAAK;AACH,eAAOC,iBAAKH,OAAOd,WAAWD,MAAMY,cAAc;UAAEI,QAAQ;UAAWC,SAAS;QAAK,CAAA;MACvF,KAAK;AACH,eAAOE,iBAAKJ,OAAOd,WAAWD,MAAMY,cAAc;UAAEI,QAAQ;UAAWC,SAAS;QAAK,CAAA;MACvF,KAAK;AACH,eAAOG,iBAAKL,OAAOd,WAAWD,MAAMY,cAAc;UAAEI,QAAQ;UAAWC,SAAS;QAAK,CAAA;MACvF,KAAK;AACH,eAAOI,uBAAQN,OAAOd,WAAWD,MAAMO,YAAWK,cAAc,KAAA,CAAA;MAClE,KAAK;MACL,KAAK;AACH,eAAOU,2BAAUP,OAAOd,WAAWD,MAAMO,YAAWK,cAAc,KAAA,CAAA;MACpE,KAAK,OAAO;AACV,cAAMW,qBAAqBpB,MAAMqB,gBAAiBlC,IAAIjB,OAA8CV,wCAAuBM;AAC3H,cAAMwD,UACJF,wBAAwB5D,wCAAuB+D,SAAS/D,wCAAuBgE,SAC3EC,qBACAL,wBAAwB5D,wCAAuBkE,SAASlE,wCAAuBmE,SAC/EC,qBACAC;AACN,gBAAQT,oBAAAA;UACN,KAAK5D,wCAAuBsE;AAC1B,mBAAWC,iBAAanB,OACtB;cACEpB,GAAGS,oBAAoBd,IAAIK,CAAC;cAC5BC,GAAGQ,oBAAoBd,IAAIM,CAAC;YAC9B,GACAI,MACAC,SAAAA;UAEJ,KAAKtC,wCAAuBkE;AAC1B,mBAAWM,iBAAapB,OACtB;cACEpB,GAAGS,oBAAoBd,IAAIK,CAAC;cAC5BC,GAAGQ,oBAAoBd,IAAIM,CAAC;YAC9B,GACAI,MACAC,SAAAA;UAEJ,KAAKtC,wCAAuB+D;AAC1B,mBAAWU,iBAAarB,OACtB;cACEpB,GAAGS,oBAAoBd,IAAIK,CAAC;cAC5BC,GAAGQ,oBAAoBd,IAAIM,CAAC;YAC9B,GACAI,MACAC,SAAAA;UAEJ,KAAKtC,wCAAuBM;UAC5B,KAAKN,wCAAuBmE;UAC5B,KAAKnE,wCAAuBgE;AAC1B,gBAAI,OAAO5C,WAAW,eAAe,OAAOA,OAAOG,WAAW,aAAa;AACzE,oBAAM/C,MAAM,UAAMkG,6CAAyB/C,KAAK,SAAA;AAChD,oBAAMgD,aACJf,uBAAuB5D,wCAAuBM,QAAQ,KAAKsD,uBAAuB5D,wCAAuBmE,QAAQ,KAAK;AACxH,qBAAO/C,OAAOG,OAAO6B,OAAO;gBAAEwB,MAAM;gBAAWC,MAAMf;gBAASa;cAAW,GAAGnG,KAAK8D,WAAWD,IAAAA;YAC9F;AAGAyC,oBAAQC,KAAK,2EAA2E;AACxF,mBAAWC,QAAIlB,SAAamB,SAAKnB,OAAAA,CAAAA,EAAUV,OACzC;cACEpB,GAAGS,oBAAoBd,IAAIK,CAAC;cAC5BC,GAAGQ,oBAAoBd,IAAIM,CAAC;YAC9B,GACAI,MACAC,SAAAA;QAEN;MACF;IACF;AAEA,UAAMhE,MAAM,kDAAkDD,OAAAA,EAAS;EACzE,SAAS6G,OAAY;AACnB1F,WAAO0F,MAAM,UAAUA,KAAAA,EAAO;AAC9B,UAAMA;EACR;AACF;AAlHsB9C;AA+HtB,SAAS+C,WAAWC,OAAmBC,QAAc;AACnD,QAAMC,QAAQF,MAAMC,MAAAA;AACpB,MAAIC,QAAQ,KAAM;AAChB,WAAO;MAAExH,QAAQwH;MAAOC,aAAa;IAAE;EACzC;AACA,QAAMC,WAAWF,QAAQ;AACzB,MAAIxH,SAAS;AACb,WAASC,IAAI,GAAGA,IAAIyH,UAAUzH,KAAK;AACjCD,aAAUA,UAAU,IAAKsH,MAAMC,SAAS,IAAItH,CAAAA;EAC9C;AACA,SAAO;IAAED;IAAQyH,aAAa,IAAIC;EAAS;AAC7C;AAXSL;AAoBF,SAASM,QAAQC,UAAoB;AAC1C,MAAIA,SAAS,CAAA,MAAO,IAAM;AACxB,UAAM,IAAIpH,MAAM,gCAAA;EAClB;AAGA,QAAM,EAAEiH,aAAaI,cAAa,IAAKR,WAAWO,UAAU,CAAA;AAC5D,QAAME,iBAAiB,IAAID;AAC3B,QAAME,WAAWH,SAASE,cAAAA;AAG1B,MAAIC,aAAa,GAAM;AACrB,WAAOH;EACT;AAGA,MAAIG,aAAa,IAAM;AACrB,UAAM,IAAIvH,MAAM,wCAAA;EAClB;AAGA,QAAM,EAAER,QAAQgI,QAAQP,aAAaQ,YAAW,IAAKZ,WAAWO,UAAUE,iBAAiB,CAAA;AAC3F,QAAMI,eAAe,IAAID;AACzB,QAAME,WAAWL,iBAAiBI,eAAeF;AAGjD,MAAIJ,SAASO,QAAAA,MAAc,GAAM;AAC/B,UAAM,IAAI3H,MAAM,iCAAA;EAClB;AAEA,QAAM,EAAER,QAAQoI,WAAWX,aAAaY,eAAc,IAAKhB,WAAWO,UAAUO,WAAW,CAAA;AAC3F,QAAMG,kBAAkB,IAAID;AAC5B,QAAME,cAAcJ,WAAWG;AAG/B,QAAME,aAAaZ,SAASW,WAAAA;AAC5B,MAAIC,eAAe,GAAM;AACvB,UAAM,IAAIhI,MAAM,2BAA2BgI,UAAAA,EAAY;EACzD;AAGA,QAAMC,aAAaF,cAAc;AACjC,QAAMG,WAAWN,YAAY;AAE7B,SAAOR,SAAS3G,MAAMwH,YAAYA,aAAaC,QAAAA;AACjD;AA7CgBf;AAsDT,SAASgB,eAAexD,cAAoB;AACjD,QAAMyD,QAAQjB,QAAQ7C,YAAWK,cAAc,KAAA,CAAA;AAC/C,SAAOvD,UAASgH,OAAO,KAAA;AACzB;AAHgBD;;;AI9kChB,IAAAE,oBAeO;AAGA,SAASC,aAAaC,SAAqB;AAChD,QAAM,EAAEC,SAASC,SAASC,KAAKC,KAAKC,QAAQC,KAAK,GAAGC,KAAAA,IAASP;AAC7D,SAAOQ,YAAY;IACjB,GAAGD;IACHD,KAAKG,cAAcH,GAAAA;IACnB,GAAIH,OAAO;MAAEA,KAAKO,gBAAgBP,GAAAA;IAAK;IACvC,GAAID,WAAW;MAAEA,SAASA,QAAQS,IAAIC,sBAAAA;IAAwB;IAC9D,GAAIR,OAAO;MAAEA,KAAKS,uBAAuBT,GAAAA;IAAK;IAC9C,GAAIC,UAAU;MAAES,IAAIT;IAAO;IAC3B,GAAIJ,WAAW;MAAEc,KAAKd;IAAQ;EAChC,CAAA;AACF;AAXgBF;AAaT,SAASiB,aAAaC,KAAQ;AACnC,QAAM,EAAEF,KAAKb,SAASC,KAAKC,KAAKU,IAAIR,KAAK,GAAGC,KAAAA,IAASU;AAErD,SAAOT,YAAY;IACjB,GAAGD;IACHD,KAAKY,cAAcZ,GAAAA;IACnB,GAAIH,OAAO;MAAEA,KAAKgB,gBAAgBhB,GAAAA;IAAK;IACvC,GAAID,WAAW;MAAEA,SAASA,QAAQS,IAAIS,sBAAAA;IAAwB;IAC9D,GAAIhB,OAAO;MAAEA,KAAKiB,uBAAuBjB,GAAAA;IAAK;IAC9C,GAAIU,MAAM;MAAET,QAAQS;IAAG;IACvB,GAAIC,OAAO;MAAEd,SAASc;IAAI;EAE5B,CAAA;AACF;AAbgBC;AAeT,SAASP,cAAcH,KAAiB;AAC7C,UAAQA,KAAAA;IACN,KAAKgB,+BAAaC;AAChB,aAAOC,6BAAWC;IACpB,KAAKH,+BAAaI;AAChB,aAAOF,6BAAWE;IACpB,KAAKJ,+BAAaK;AAChB,aAAOH,6BAAWI;IACpB,KAAKN,+BAAaO;AAChB,aAAOL,6BAAWK;IACpB;AACE,YAAMC,MAAM,YAAYxB,GAAAA,uBAA0B;EACtD;AACF;AAbgBG;AAeT,SAASS,cAAcZ,KAAkC;AAC9D,UAAQA,KAAAA;IACN,KAAK;AACH,aAAOgB,+BAAaC;IACtB,KAAK;AACH,aAAOD,+BAAaI;IACtB,KAAK;AACH,aAAOJ,+BAAaK;IACtB,KAAK;AACH,aAAOL,+BAAaO;IACtB;AACE,YAAMC,MAAM,YAAYxB,GAAAA,wBAA2B;EACvD;AACF;AAbgBY;AAeT,SAASL,uBAAuBkB,SAAgC;AACrE,UAAQA,SAAAA;IACN,KAAKC,0CAAwBC;AAC3B,aAAOC,yCAAuBD;IAChC,KAAKD,0CAAwBG;AAC3B,aAAOD,yCAAuBC;IAChC,KAAKH,0CAAwBI;AAC3B,aAAOF,yCAAuBE;IAChC,KAAKJ,0CAAwBK;AAC3B,aAAOH,yCAAuBG;IAChC,KAAKL,0CAAwBM;AAC3B,aAAOJ,yCAAuBI;IAChC,KAAKN,0CAAwBO;AAC3B,aAAOL,yCAAuBK;IAChC,KAAKP,0CAAwBQ;AAC3B,aAAON,yCAAuBM;IAChC,KAAKR,0CAAwBS;AAC3B,aAAOP,yCAAuBO;IAChC,KAAKT,0CAAwBU;AAC3B,aAAOR,yCAAuBQ;IAChC,KAAKV,0CAAwBW;AAC3B,aAAOT,yCAAuBS;IAChC,KAAKX,0CAAwBY;AAC3B,aAAOV,yCAAuBU;IAChC;AACE,YAAMd,MAAM,uBAAuBC,OAAAA,wBAA+B;EACtE;AACF;AA3BgBlB;AA6BT,SAASQ,uBAAuBwB,SAA8D;AACnG,UAAQA,SAAAA;IACN,MAAMX,yCAAuBD,QAAQ;AACnC,aAAOD,0CAAwBC;IACjC,MAAMC,yCAAuBC,OAAO;AAClC,aAAOH,0CAAwBG;IACjC,MAAMD,yCAAuBE,OAAO;AAClC,aAAOJ,0CAAwBI;IACjC,MAAMF,yCAAuBG,OAAO;AAClC,aAAOL,0CAAwBK;IACjC,MAAMH,yCAAuBI,OAAO;AAClC,aAAON,0CAAwBM;IACjC,MAAMJ,yCAAuBK,OAAO;AAClC,aAAOP,0CAAwBO;IACjC,MAAML,yCAAuBM,OAAO;AAClC,aAAOR,0CAAwBQ;IACjC,MAAMN,yCAAuBO,OAAO;AAClC,aAAOT,0CAAwBS;IACjC,MAAMP,yCAAuBQ,OAAO;AAClC,aAAOV,0CAAwBU;IACjC,MAAMR,yCAAuBS,OAAO;AAClC,aAAOX,0CAAwBW;IACjC,MAAMT,yCAAuBU,OAAO;AAClC,aAAOZ,0CAAwBY;IACjC;AACE,YAAMd,MAAM,uBAAuBe,OAAAA,wBAA+B;EACtE;AACF;AA3BgBxB;AA6BT,SAASD,uBAAuB0B,OAAgD;AACrF,UAAQA,OAAAA;IACN,MAAMC,mCAAiBC,MAAM;AAC3B,aAAOC,oCAAkBD;IAC3B,MAAMD,mCAAiBG,QAAQ;AAC7B,aAAOD,oCAAkBC;IAC3B,MAAMH,mCAAiBI,SAAS;AAC9B,aAAOF,oCAAkBE;IAC3B,MAAMJ,mCAAiBK,SAAS;AAC9B,aAAOH,oCAAkBG;IAC3B,MAAML,mCAAiBM,UAAU;AAC/B,aAAOJ,oCAAkBI;IAC3B,MAAMN,mCAAiBO,YAAY;AACjC,aAAOL,oCAAkBK;IAC3B,MAAMP,mCAAiBQ,YAAY;AACjC,aAAON,oCAAkBM;IAC3B,MAAMR,mCAAiBS,aAAa;AAClC,aAAOP,oCAAkBO;IAC3B;AACE,YAAM1B,MAAM,iBAAiBgB,KAAAA,wBAA6B;EAC9D;AACF;AArBgB1B;AAuBT,SAASR,uBAAuBkC,OAAwB;AAC7D,UAAQA,OAAAA;IACN,KAAKG,oCAAkBD;AACrB,aAAOD,mCAAiBC;IAC1B,KAAKC,oCAAkBC;AACrB,aAAOH,mCAAiBG;IAC1B,KAAKD,oCAAkBE;AACrB,aAAOJ,mCAAiBI;IAC1B,KAAKF,oCAAkBG;AACrB,aAAOL,mCAAiBK;IAC1B,KAAKH,oCAAkBI;AACrB,aAAON,mCAAiBM;IAC1B,KAAKJ,oCAAkBK;AACrB,aAAOP,mCAAiBO;IAC1B,KAAKL,oCAAkBM;AACrB,aAAOR,mCAAiBQ;IAC1B,KAAKN,oCAAkBO;AACrB,aAAOT,mCAAiBS;IAC1B;AACE,YAAM1B,MAAM,iBAAiBgB,KAAAA,wBAA6B;EAC9D;AACF;AArBgBlC;AAuBT,SAASO,gBAAgBsC,OAAkC;AAChE,UAAQA,OAAAA;IACN,MAAMC,4BAAUC,OAAO;AACrB,aAAOC,6BAAWD;IACpB,MAAMD,4BAAUG,OAAO;AACrB,aAAOD,6BAAWC;IACpB,MAAMH,4BAAUI,OAAO;AACrB,aAAOF,6BAAWE;IACpB,MAAMJ,4BAAUK,QAAQ;AACtB,aAAOH,6BAAWG;IACpB,MAAML,4BAAUM,MAAM;AACpB,aAAOJ,6BAAWI;IACpB,MAAMN,4BAAUO,SAAS;AACvB,aAAOL,6BAAWK;IACpB,MAAMP,4BAAUQ,OAAO;AACrB,aAAON,6BAAWM;IACpB,MAAMR,4BAAUS,WAAW;AACzB,aAAOP,6BAAWO;IACpB;AACE,YAAMrC,MAAM,SAAS2B,KAAAA,wBAA6B;EACtD;AACF;AArBgBtC;AAuBT,SAAST,gBAAgB+C,OAAiB;AAC/C,UAAQA,OAAAA;IACN,KAAKG,6BAAWD;AACd,aAAOD,4BAAUC;IACnB,KAAKC,6BAAWC;AACd,aAAOH,4BAAUG;IACnB,KAAKD,6BAAWE;AACd,aAAOJ,4BAAUI;IACnB,KAAKF,6BAAWG;AACd,aAAOL,4BAAUK;IACnB,KAAKH,6BAAWI;AACd,aAAON,4BAAUM;IACnB,KAAKJ,6BAAWK;AACd,aAAOP,4BAAUO;IACnB,KAAKL,6BAAWM;AACd,aAAOR,4BAAUQ;IACnB,KAAKN,6BAAWO;AACd,aAAOT,4BAAUS;IACnB;AACE,YAAMrC,MAAM,SAAS2B,KAAAA,wBAA6B;EACtD;AACF;AArBgB/C;","names":["import_ed25519","u8a","fromString","toString","SupportedEncodings","u8a","digestMethodParams","hashAlgorithm","digestMethod","sha256DigestMethod","hash","sha256","sha384DigestMethod","sha384","sha512DigestMethod","sha512","shaHasher","input","alg","includes","Uint8Array","encoding","textEncoder","TextEncoder","textDecoder","TextDecoder","check","value","description","optional","Error","assertObject","validateJwk","jwk","opts","crvOptional","kty","crv","x","y","e","n","minimalJwk","jwkJcsEncode","strippedJwk","encode","jcsCanonicalize","jwkJcsDecode","bytes","JSON","parse","decode","stringify","object","buffer","serialize","toJSON","Array","isArray","next","forEach","element","Object","keys","sort","property","JWK_JCS_PUB_NAME","JWK_JCS_PUB_PREFIX","Key","JwkKeyUse","SIG_KEY_ALGS","ENC_KEY_ALGS","fromString","toString","u8a","logger","Loggers","DEFAULT","get","getKms","context","kms","agent","availableMethods","includes","Error","keyManagerGetDefaultKeyManagementSystem","generatePrivateKeyHex","type","keyPairEd25519","generateSigningKeyPair","secretKey","privateBytes","randomBytes","pem","generateRSAKeyAsPEM","privateKeyHexFromPEM","keyMetaAlgorithmsFromKeyType","importProvidedOrGeneratedKey","args","options","key","keyType","x509","meta","use","JwkKeyUse","Encryption","ENC_KEY_ALGS","privateKeyHex","undefined","trim","privateKeyPEM","keyManagerImport","keyManagerCreate","algorithms","keyAlias","alias","calculateJwkThumbprintForKey","jwk","publicKeyHex","toJwk","isPrivateKey","kid","calculateJwkThumbprint","digestAlgorithm","assertJwkClaimPresent","value","description","toBase64url","input","sanitizedJwk","components","kty","crv","x","y","e","n","k","data","JSON","stringify","digestMethodParams","digestMethod","toJwkFromKey","opts","noKidThumbprint","toEd25519OrX25519Jwk","JoseCurve","Ed25519","X25519","toSecp256k1Jwk","toSecp256r1Jwk","toRSAJwk","jwkToRawHexKey","rsaJwkToRawHexKey","ecJwkToRawHexKey","okpJwkToRawHexKey","octJwkToRawHexKey","encodeInteger","bytes","Uint8Array","from","len","encodeLength","length","of","hex","lenBytes","match","map","h","parseInt","encodeSequence","elements","content","reduce","acc","elm","base64UrlToBytes","b64url","modulusBytes","exponentBytes","sequence","result","replace","jwkDetermineUse","suppliedUse","SIG_KEY_ALGS","Signature","assertProperKeyLength","keyHex","expectedKeyLength","Array","isArray","debug","secp256k1","elliptic","ec","keyBytes","keyPair","keyFromPrivate","keyFromPublic","pubPoint","getPublic","alg","JoseSignatureAlgorithm","ES256K","JwkKeyType","EC","hexToBase64","getX","getY","d","getPrivate","secp256r1","ES256","P_256","EdDSA","OKP","parseDerIntegers","pubKeyHex","Buffer","offset","nBytes","i","algLen","nB","bitLen","innerLen","modLen","slice","expLen","modulus","exponent","publicKeyJwk","publicKeyPEM","hexToPEM","PEMToJwk","sanitized","padLeft","size","padString","repeat","OID","Uint8Array","compareUint8Arrays","a","b","length","i","findSubarray","haystack","needle","subarray","getTargetOID","keyType","Error","isAsn1Der","key","asn1DerToRawPublicKey","derKey","index","lengthBytesCount","targetOid","oidIndex","slice","isRawCompressedPublicKey","toRawCompressedHexPublicKey","rawPublicKey","hexStringFromUint8Array","xCoordinate","yCoordinate","prefix","resultKey","logger","debug","toString","value","signatureAlgorithmFromKey","args","signatureAlgorithmFromKeyType","type","JoseSignatureAlgorithm","EdDSA","ES256","ES384","ES512","ES256K","PS256","keyTypeFromCryptographicSuite","crv","kty","alg","removeNulls","obj","Object","keys","forEach","globalCrypto","setGlobal","suppliedCrypto","webcrypto","crypto","global","window","subtle","sanitizedJwk","input","inputJwk","jwk","x","base64ToBase64Url","y","d","n","e","k","replace","verifyRawSignature","data","signature","inputKey","opts","jwkPropertyToBigInt","jwkProp","byteArray","fromString","hex","BigInt","validateJwk","crvOptional","publicKeyHex","jwkToRawHexKey","secp256k1","verify","format","prehash","p256","p384","p521","ed25519","bls12_381","signatureAlgorithm","signatureAlg","hashAlg","RS512","PS512","sha512","RS384","PS384","sha384","sha256","RS256","PKCS1_SHA256","PKCS1_SHA384","PKCS1_SHA512","cryptoSubtleImportRSAKey","saltLength","name","hash","console","warn","PSS","mgf1","error","readLength","bytes","offset","first","lengthBytes","numBytes","toPkcs1","derBytes","outerLenBytes","outerHeaderLen","innerTag","algLen","algLenBytes","algHeaderLen","algIdEnd","bitStrLen","bitStrLenBytes","bitStrHeaderLen","bitStrStart","unusedBits","pkcs1Start","pkcs1Len","toPkcs1FromHex","pkcs1","import_ssi_types","coseKeyToJwk","coseKey","x5chain","key_ops","crv","alg","baseIV","kty","rest","removeNulls","coseToJoseKty","coseToJoseCurve","map","coseToJoseKeyOperation","coseToJoseSignatureAlg","iv","x5c","jwkToCoseKey","jwk","joseToCoseKty","joseToCoseCurve","joseToCoseKeyOperation","joseToCoseSignatureAlg","ICoseKeyType","EC2","JwkKeyType","EC","RSA","Symmetric","oct","OKP","Error","coseAlg","ICoseSignatureAlgorithm","ES256K","JoseSignatureAlgorithm","ES256","ES384","ES512","PS256","PS384","PS512","HS256","HS384","HS512","EdDSA","joseAlg","keyOp","JoseKeyOperation","SIGN","ICoseKeyOperation","VERIFY","ENCRYPT","DECRYPT","WRAP_KEY","UNWRAP_KEY","DERIVE_KEY","DERIVE_BITS","curve","JoseCurve","P_256","ICoseCurve","P_384","P_521","X25519","X448","Ed25519","Ed448","secp256k1"]}