sd_jwt 0.1.0

data/lib/sd_jwt/key_binding.rb

@@ -0,0 +1,86 @@
+# frozen_string_literal: true
+
+module SDJWT
+  module KeyBinding
+    module_function
+
+    def public_jwk(jwk)
+      raise ValidationError, "Holder JWK must be an object" unless jwk.is_a?(Hash)
+
+      object = Codec.copy(jwk)
+      unless %w[EC RSA].include?(object["kty"]) && !object.keys.intersect?(%w[d p q dp dq qi oth k])
+        raise ValidationError, "Holder JWK must contain only an asymmetric public key"
+      end
+      raise ValidationError, "Holder JWK does not permit signatures" if object.key?("use") && object["use"] != "sig"
+      if object.key?("key_ops") && (!object["key_ops"].is_a?(Array) || !object["key_ops"].include?("verify"))
+        raise ValidationError, "Holder JWK does not permit verification"
+      end
+
+      validate_key_size(object)
+      key = import_public_key(object)
+      Codec.validate_rsa_key(key) if object["kty"] == "RSA"
+      object
+    rescue ParseError, JWT::JWKError, OpenSSL::OpenSSLError, ArgumentError, TypeError
+      raise ValidationError, "Invalid holder public key", cause: nil
+    end
+
+    def import_public_key(object)
+      JWT::JWK.import(object).public_key
+    rescue StandardError
+      # JRuby's crypto provider can raise Java exceptions for invalid key material.
+      raise ValidationError, "Invalid holder public key", cause: nil
+    end
+
+    def validate_key_size(jwk)
+      if jwk["kty"] == "EC"
+        size = { "P-256" => 32, "P-384" => 48, "P-521" => 66 }[jwk["crv"]]
+        unless size && %w[x y].all? { |coordinate| Codec.decode(jwk[coordinate]).bytesize == size }
+          raise ValidationError, "Unsupported holder elliptic curve or coordinate size"
+        end
+      else
+        modulus = Codec.decode(jwk["n"])
+        exponent = Codec.decode(jwk["e"])
+        unless (256..1024).cover?(modulus.bytesize) && modulus.getbyte(0) >= 128 && (1..8).cover?(exponent.bytesize) && exponent.getbyte(0).positive?
+          raise ValidationError, "Holder RSA key must use a 2048 to 8192 bit modulus and bounded exponent"
+        end
+        unless modulus.getbyte(-1).odd? && exponent.getbyte(-1).odd? && exponent.unpack1("H*").to_i(16) >= 3
+          raise ValidationError, "Invalid holder RSA modulus or exponent"
+        end
+      end
+    end
+
+    def create(sd_jwt, key:, alg:, aud:, nonce:, hash_algorithm: "sha-256", iat: Time.now.to_i)
+      raise ValidationError, "Holder signatures must be asymmetric" if alg.to_s.start_with?("HS")
+      unless aud.is_a?(String) && !aud.empty? && nonce.is_a?(String) && !nonce.empty? && iat.is_a?(Integer)
+        raise ValidationError, "Invalid key binding transaction"
+      end
+
+      payload = { "iat" => iat, "aud" => aud, "nonce" => nonce, "sd_hash" => HashAlg.digest(sd_jwt, hash_algorithm) }
+      Codec.sign(payload, key: key, algorithm: alg, header: { "typ" => "kb+jwt" })
+    end
+
+    def verify(signature, claims:, hash_algorithm:, algorithms:, audience:, nonce:, max_age:, now:, max_depth:)
+      jwk = claims.dig("cnf", "jwk") if claims["cnf"].is_a?(Hash)
+      public_jwk(jwk)
+      key = JWT::JWK.import(jwk)
+      kb_payload, kb_header = Codec.verify_signature(signature.fetch("kb_jwt"), key: key, algorithms: algorithms, max_depth: max_depth)
+      raise VerificationError, "Invalid key binding type" unless kb_header["typ"] == "kb+jwt"
+
+      iat = kb_payload["iat"]
+      raise VerificationError, "Invalid key binding issuance time" unless iat.is_a?(Numeric) && iat.finite? && iat <= now && iat >= now - max_age
+      raise VerificationError, "Key binding transaction mismatch" unless kb_payload["aud"] == audience && kb_payload["nonce"] == nonce
+
+      sd_jwt = ([signature.fetch("jwt")] + signature.fetch("disclosures") + [""]).join("~")
+      expected = HashAlg.digest(sd_jwt, hash_algorithm)
+      actual = kb_payload["sd_hash"]
+      unless actual.is_a?(String) && actual.bytesize == expected.bytesize && OpenSSL.fixed_length_secure_compare(actual, expected)
+        raise VerificationError, "Key binding digest mismatch"
+      end
+
+      Verifier.check_times(kb_payload, now)
+      true
+    rescue JWT::JWKError, KeyError, OpenSSL::OpenSSLError, ArgumentError, TypeError
+      raise VerificationError, "Invalid key binding", cause: nil
+    end
+  end
+end

data/lib/sd_jwt/pointer.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module SDJWT
+  module Pointer
+    module_function
+
+    def tokens(path)
+      unless path.is_a?(String) && path.start_with?("/") && !path.match?(/~(?:[^01]|$)/)
+        raise ValidationError.new("Invalid disclosure JSON Pointer", pointer: path.is_a?(String) ? path : "")
+      end
+
+      path.split("/", -1).drop(1).map { |part| part.gsub("~1", "/").gsub("~0", "~") }
+    end
+
+    def append(path, name)
+      "#{path}/#{name.to_s.gsub("~", "~0").gsub("/", "~1")}"
+    end
+
+    def locate(root, path)
+      parts = tokens(path)
+      parent = parts[0...-1].reduce(root) { |value, name| value_at(value, name, path) }
+      name = parts.last
+      value_at(parent, name, path)
+      [parent, parent.is_a?(Array) ? Integer(name, 10) : name]
+    end
+
+    def value_at(value, name, path)
+      if value.is_a?(Hash) && value.key?(name)
+        value[name]
+      elsif value.is_a?(Array) && name.match?(/\A(?:0|[1-9][0-9]*)\z/) && name.to_i < value.length
+        value[name.to_i]
+      else
+        raise ValidationError.new("Disclosure path does not exist", pointer: path)
+      end
+    end
+  end
+end

data/lib/sd_jwt/processor.rb

@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+
+module SDJWT
+  class Processor
+    attr_reader :claims, :paths, :hash_algorithm
+
+    def initialize(payload, disclosures, max_depth: Codec::MAX_DEPTH, hash_algorithms: HashAlg::ALGORITHMS.keys)
+      @max_depth = max_depth
+      @hash_algorithm = HashAlg.validate(payload.fetch("_sd_alg", "sha-256"), allowed: hash_algorithms)
+      @digests = compute_digests(disclosures)
+      @seen = Set.new
+      @used = Set.new
+      @paths = {}
+      @claims = embed_disclosures(payload, "", [], 0)
+      check_unreferenced
+    end
+
+    private
+
+    # RFC 9901 section 7.1 step 3.a: hash the original encoded disclosures.
+    def compute_digests(disclosures)
+      disclosures.each_with_object({}) do |encoded, result|
+        disclosure = Disclosure.parse(encoded, max_depth: @max_depth + 2)
+        digest = disclosure.digest(@hash_algorithm)
+        raise VerificationError, "Duplicate disclosure" if result.key?(digest)
+
+        result[digest] = disclosure
+      end
+    end
+
+    # RFC 9901 section 7.1 step 3.b-f: recursively restore disclosed claims.
+    def embed_disclosures(value, path, dependencies, depth)
+      raise VerificationError, "Nesting limit exceeded" if depth > @max_depth
+
+      case value
+      when Hash then embed_object(value, path, dependencies, depth)
+      when Array
+        value.each_with_index.with_object([]) do |(item, index), result|
+          child_path = Pointer.append(path, index)
+          if item.is_a?(Hash) && item.key?("...")
+            raise VerificationError, "Invalid array placeholder" unless item.keys == ["..."]
+
+            disclosure = find_disclosure(item["..."])
+            next unless disclosure
+            raise VerificationError, "Invalid array disclosure" unless disclosure.array_element?
+
+            chain = dependencies + [disclosure.encoded]
+            @paths[child_path] = chain
+            result << embed_disclosures(disclosure.value, child_path, chain, depth + 1)
+          else
+            result << embed_disclosures(item, child_path, dependencies, depth + 1)
+          end
+        end
+      else value
+      end
+    end
+
+    def embed_object(value, path, dependencies, depth)
+      raise VerificationError, "Reserved object member" if value.key?("...")
+      raise VerificationError, "Hash algorithm must be a root claim" if depth.positive? && value.key?("_sd_alg")
+
+      result = value.each_with_object({}) do |(name, item), output|
+        next if %w[_sd _sd_alg].include?(name)
+
+        output[name] = embed_disclosures(item, Pointer.append(path, name), dependencies, depth + 1)
+      end
+      digests = value.fetch("_sd", [])
+      raise VerificationError, "Invalid digest array" unless digests.is_a?(Array)
+
+      digests.each do |digest|
+        disclosure = find_disclosure(digest)
+        next unless disclosure
+        raise VerificationError, "Invalid object disclosure" if disclosure.array_element?
+        raise VerificationError, "Disclosed claim collision" if result.key?(disclosure.name) || %w[_sd_alg].include?(disclosure.name)
+
+        child_path = Pointer.append(path, disclosure.name)
+        chain = dependencies + [disclosure.encoded]
+        @paths[child_path] = chain
+        result[disclosure.name] = embed_disclosures(disclosure.value, child_path, chain, depth + 1)
+      end
+      result
+    end
+
+    def find_disclosure(digest)
+      raise VerificationError, "Invalid embedded digest" unless digest.is_a?(String)
+
+      raw = Codec.decode(digest)
+      expected_length = { "sha-256" => 32, "sha-384" => 48, "sha-512" => 64 }.fetch(@hash_algorithm)
+      raise VerificationError, "Invalid embedded digest length" unless raw.bytesize == expected_length
+
+      check_duplicates(digest)
+      disclosure = @digests[digest]
+      @used << digest if disclosure
+      disclosure
+    end
+
+    # RFC 9901 section 7.1 step 4: includes undisclosed and decoy digests.
+    def check_duplicates(digest)
+      raise VerificationError, "Duplicate embedded digest" unless @seen.add?(digest)
+    end
+
+    # RFC 9901 section 7.1 step 5: no extraneous disclosures are accepted.
+    def check_unreferenced
+      raise VerificationError, "Unreferenced disclosure" unless @used.length == @digests.length
+    end
+  end
+end

data/lib/sd_jwt/serialization.rb

@@ -0,0 +1,92 @@
+# frozen_string_literal: true
+
+module SDJWT
+  module Serialization
+    module_function
+
+    def parse(source, limits:)
+      raise ParseError, "Input must be a string" unless source.is_a?(String)
+      raise ParseError, "Input size limit exceeded" if source.bytesize > limits[:max_bytes]
+
+      source = source.dup.force_encoding(Encoding::UTF_8)
+      raise ParseError, "Invalid UTF-8 input" unless source.valid_encoding?
+
+      entries = if source.lstrip.start_with?("{")
+                  parse_json(source, limits)
+                else
+                  parse_compact(source)
+                end
+      raise ParseError, "Signature limit exceeded" if entries.length > limits[:max_signatures]
+
+      entries.each do |entry|
+        validate_entry(entry, limits)
+      end
+      Token.new(entries, limits: limits)
+    end
+
+    def parse_compact(source)
+      raise ParseError, "Invalid compact serialization" unless source.ascii_only? && source.include?("~")
+
+      pieces = source.split("~", -1)
+      jwt = pieces.shift
+      kb_jwt = pieces.pop
+      entry = { "jwt" => jwt, "disclosures" => pieces, "unprotected" => {} }
+      entry["kb_jwt"] = kb_jwt unless kb_jwt.empty?
+      [entry]
+    end
+
+    def parse_json(source, limits)
+      object = Codec.parse_json(source, max_depth: limits[:max_depth] + 4)
+      raise ParseError, "JWS serialization must be an object" unless object.is_a?(Hash)
+
+      if object.key?("signatures")
+        unless !object.keys.intersect?(%w[signature protected header]) && object["signatures"].is_a?(Array) && !object["signatures"].empty?
+          raise ParseError, "Invalid General JWS serialization"
+        end
+
+        entries = object["signatures"]
+      else
+        entries = [object]
+      end
+      raise ParseError, "Signature limit exceeded" if entries.length > limits[:max_signatures]
+
+      first_header = entries.first.is_a?(Hash) ? entries.first.fetch("header", {}) : {}
+      raise ParseError, "Invalid first unprotected header" unless first_header.is_a?(Hash)
+
+      entries.each_with_index.map do |entry, index|
+        raise ParseError, "Invalid JWS signature entry" unless entry.is_a?(Hash)
+
+        header = entry.fetch("header", {})
+        raise ParseError, "Invalid unprotected header" unless header.is_a?(Hash)
+
+        if index.positive? && header.keys.intersect?(%w[disclosures kb_jwt])
+          raise ParseError, "General JWS disclosure metadata is permitted only on the first signature"
+        end
+
+        parts = [entry.fetch("protected", ""), object["payload"], entry["signature"]]
+        raise ParseError, "Invalid JWS members" unless parts.all?(String)
+
+        result = { "jwt" => parts.join("."), "disclosures" => first_header.fetch("disclosures", []),
+                   "unprotected" => header.except("disclosures", "kb_jwt") }
+        result["kb_jwt"] = header["kb_jwt"] if header.key?("kb_jwt")
+        result
+      end
+    end
+
+    def validate_entry(entry, limits)
+      _, header, = Codec.jwt_parts(entry.fetch("jwt"), max_depth: limits[:max_depth])
+      raise ParseError, "Disclosure metadata must be unprotected" if header.keys.intersect?(%w[disclosures kb_jwt])
+      raise ParseError, "Overlapping JWS headers" if header.keys.intersect?(entry.fetch("unprotected").keys)
+      if header.keys.intersect?(%w[crit b64]) || entry.fetch("unprotected").keys.intersect?(%w[crit b64])
+        raise ParseError, "Unsupported critical or unencoded JWS"
+      end
+
+      disclosures = entry.fetch("disclosures")
+      raise ParseError, "Invalid disclosures" unless disclosures.is_a?(Array)
+      raise ParseError, "Disclosure limit exceeded" if disclosures.length > limits[:max_disclosures]
+
+      disclosures.each { |encoded| Disclosure.parse(encoded, max_depth: limits[:max_depth] + 2) }
+      Codec.jwt_parts(entry["kb_jwt"], max_depth: limits[:max_depth]) if entry.key?("kb_jwt")
+    end
+  end
+end

data/lib/sd_jwt/testing.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+require "sd_jwt"
+
+module SDJWT
+  # Deterministic salts are available only when this test-only file is explicitly required.
+  module Testing
+    module_function
+
+    def with_salts(salts)
+      previous = Thread.current[:sd_jwt_test_salts]
+      raise ArgumentError, "Salts must be strings" unless salts.is_a?(Array) && salts.all?(String)
+
+      Thread.current[:sd_jwt_test_salts] = salts.map(&:dup)
+      yield
+    ensure
+      Thread.current[:sd_jwt_test_salts] = previous
+    end
+  end
+end

data/lib/sd_jwt/token.rb

@@ -0,0 +1,97 @@
+# frozen_string_literal: true
+
+module SDJWT
+  class Token
+    attr_reader :signatures, :warnings
+
+    def initialize(signatures, limits:)
+      @limits = limits
+      @signatures = Codec.freeze_tree(signatures)
+      @warnings = [].freeze
+      freeze
+    end
+
+    def disclosures
+      signatures.first.fetch("disclosures").dup
+    end
+
+    def issuer_jwt
+      signatures.first.fetch("jwt")
+    end
+
+    def key_binding_jwt
+      signatures.first["kb_jwt"]
+    end
+
+    # This payload is NOT authenticated. Use Verifier#verify for trusted claims.
+    def unverified_claims
+      processor(signatures.first).claims
+    end
+
+    def disclosed_paths
+      processor(signatures.first).paths.keys
+    end
+
+    def to_s
+      raise ConversionError, "Multiple signatures require General JSON serialization" unless signatures.length == 1
+
+      raise ConversionError, "Unprotected JWS headers require JSON serialization" unless signatures.first.fetch("unprotected").empty?
+
+      compact(signatures.first)
+    end
+
+    def to_json(*, format: :flattened)
+      raise ArgumentError, "Unknown JWS JSON format" unless %i[flattened general].include?(format)
+      raise ConversionError, "Multiple signatures require General JSON serialization" if format == :flattened && signatures.length != 1
+
+      entries = signatures.each_with_index.map do |signature, index|
+        protected_header, payload, encoded_signature = signature.fetch("jwt").split(".", -1)
+        header = signature.fetch("unprotected").dup
+        header["disclosures"] = signature.fetch("disclosures") if index.zero?
+        header["kb_jwt"] = signature["kb_jwt"] if signature["kb_jwt"]
+        { "protected" => protected_header, "payload" => payload, "signature" => encoded_signature, "header" => header }
+      end
+      if format == :general
+        entries.each { |entry| entry.delete("payload") }
+        Codec.generate({ "payload" => signatures.first.fetch("jwt").split(".", -1)[1], "signatures" => entries })
+      else
+        Codec.generate(entries.first)
+      end
+    end
+
+    def present(only:, key_binding: nil)
+      raise ArgumentError, "Disclosure paths must be an array" unless only.is_a?(Array)
+
+      selected = signatures.each_with_index.map do |signature, index|
+        processed = processor(signature)
+        requested = only.flat_map do |path|
+          Pointer.tokens(path)
+          processed.paths.fetch(path) { raise ValidationError.new("Path is not selectively disclosable", pointer: path) }
+        end.uniq
+        entry = Codec.copy(signature)
+        entry["disclosures"] = signature.fetch("disclosures").select { |encoded| requested.include?(encoded) }
+        entry.delete("kb_jwt")
+        if key_binding && index.zero?
+          raise ArgumentError, "Key binding options must be a hash" unless key_binding.is_a?(Hash)
+
+          entry["kb_jwt"] = KeyBinding.create(compact(entry), hash_algorithm: processed.hash_algorithm, **key_binding)
+        end
+        entry
+      end
+      token = self.class.new(selected, limits: @limits)
+      serialized = selected.length == 1 && selected.first.fetch("unprotected").empty? ? token.to_s : token.to_json(format: :general)
+      SDJWT.parse(serialized, **@limits)
+    end
+
+    private
+
+    def compact(signature)
+      ([signature.fetch("jwt")] + signature.fetch("disclosures") + [signature.fetch("kb_jwt", "")]).join("~")
+    end
+
+    def processor(signature)
+      _, _, payload = Codec.jwt_parts(signature.fetch("jwt"), max_depth: @limits[:max_depth])
+      Processor.new(payload, signature.fetch("disclosures"), max_depth: @limits[:max_depth])
+    end
+  end
+end

data/lib/sd_jwt/verifier.rb

@@ -0,0 +1,109 @@
+# frozen_string_literal: true
+
+module SDJWT
+  class Result
+    attr_reader :claims, :headers, :key_binding_verified
+
+    def initialize(claims:, headers:, key_binding_verified:)
+      @claims = Codec.freeze_tree(claims)
+      @headers = Codec.freeze_tree(headers)
+      @key_binding_verified = key_binding_verified
+      freeze
+    end
+  end
+
+  class Verifier
+    def initialize(algorithms:, issuer_key:, hash_algorithms: ["sha-256"], require_key_binding: false,
+                   audience: nil, nonce: nil, max_kb_age: 300, key_binding_algorithms: %w[ES256 ES384 ES512 RS256 RS384 RS512 PS256 PS384 PS512],
+                   required_claims: [], issuer: nil, leeway: 0, max_bytes: Codec::MAX_BYTES, max_depth: Codec::MAX_DEPTH,
+                   max_disclosures: Codec::MAX_DISCLOSURES, max_signatures: Codec::MAX_SIGNATURES)
+      @algorithms = Codec.allowlist(algorithms)
+      @kb_algorithms = Codec.allowlist(key_binding_algorithms)
+      raise ArgumentError, "Holder signatures must be asymmetric" if @kb_algorithms.any? { |algorithm| algorithm.start_with?("HS") }
+      unless hash_algorithms.is_a?(Array) && !hash_algorithms.empty? && hash_algorithms.all? { |alg| HashAlg::ALGORITHMS.key?(alg) }
+        raise ArgumentError, "A nonempty supported hash algorithm allowlist is required"
+      end
+      raise ArgumentError, "Required claim names must be strings" unless required_claims.is_a?(Array) && required_claims.all?(String)
+      raise ArgumentError, "Invalid key binding policy" unless [true, false].include?(require_key_binding)
+      unless max_kb_age.is_a?(Numeric) && max_kb_age.finite? && max_kb_age.positive? && leeway.is_a?(Numeric) && leeway.finite? && leeway >= 0
+        raise ArgumentError, "Invalid time policy"
+      end
+      if require_key_binding && (!audience.is_a?(String) || audience.empty? || !nonce.is_a?(String) || nonce.empty?)
+        raise ArgumentError, "Key binding requires a nonempty audience and nonce"
+      end
+
+      @key = issuer_key
+      @hash_algorithms = hash_algorithms.map(&:dup).each(&:freeze).freeze
+      @require_key_binding = require_key_binding
+      @audience = audience
+      @nonce = nonce
+      @max_kb_age = max_kb_age
+      @required_claims = required_claims.map(&:dup).each(&:freeze).freeze
+      @issuer = issuer
+      @leeway = leeway
+      @limits = Codec.limits(max_bytes: max_bytes, max_depth: max_depth, max_disclosures: max_disclosures, max_signatures: max_signatures)
+    end
+
+    def verify(source)
+      token = split(source)
+      now = Time.now.to_f
+      results = token.signatures.each_with_index.map do |signature, index|
+        payload, header = verify_issuer_jwt(signature)
+        processed = Processor.new(payload, signature.fetch("disclosures"), max_depth: @limits[:max_depth], hash_algorithms: @hash_algorithms)
+        check_validity_claims(processed.claims, now)
+        if @require_key_binding && index.zero?
+          raise VerificationError, "Missing required key binding" unless signature["kb_jwt"]
+
+          KeyBinding.verify(signature, claims: processed.claims, hash_algorithm: processed.hash_algorithm, algorithms: @kb_algorithms,
+                                       audience: @audience, nonce: @nonce, max_age: @max_kb_age, now: now, max_depth: @limits[:max_depth])
+        end
+        [processed.claims, header]
+      end
+      raise VerificationError, "General JWS signatures disclose different claims" unless results.all? { |claims, _| claims == results.first[0] }
+
+      Result.new(claims: results.first[0], headers: results.map(&:last), key_binding_verified: @require_key_binding)
+    rescue ParseError, ValidationError, JWT::DecodeError, JWT::EncodeError
+      raise VerificationError, "Invalid SD-JWT", cause: nil
+    end
+
+    def self.check_times(claims, now, leeway = 0)
+      Codec.validate_claim_types(claims)
+      raise VerificationError, "Expired credential" if claims.key?("exp") && now >= claims["exp"] + leeway
+      raise VerificationError, "Credential is not yet valid" if claims.key?("nbf") && now + leeway < claims["nbf"]
+    end
+
+    private
+
+    # RFC 9901 section 7.1 step 1. Reparse Token inputs under this verifier's limits.
+    def split(source)
+      source = source.to_json(format: :general) if source.is_a?(Token)
+      SDJWT.parse(source, **@limits)
+    end
+
+    # RFC 9901 section 7.1 step 2. The callback is responsible for issuer/key trust.
+    def verify_issuer_jwt(signature)
+      _, header, payload = Codec.jwt_parts(signature.fetch("jwt"), max_depth: @limits[:max_depth])
+      merged_header = header.merge(signature.fetch("unprotected"))
+      raise VerificationError, "Signing algorithm is not allowed" unless @algorithms.include?(merged_header["alg"])
+
+      key = @key.respond_to?(:call) ? @key.call(Codec.freeze_tree(Codec.copy(merged_header)), Codec.freeze_tree(Codec.copy(payload))) : @key
+      Codec.verify_signature(signature.fetch("jwt"), key: key, algorithms: @algorithms,
+                                                     unprotected: signature.fetch("unprotected"), max_depth: @limits[:max_depth])
+    end
+
+    # RFC 9901 section 7.1 step 6: check validity after selective disclosure.
+    def check_validity_claims(claims, now)
+      raise VerificationError, "Required validity claim missing" unless @required_claims.all? { |name| claims.key?(name) }
+      raise VerificationError, "Issuer mismatch" if @issuer && claims["iss"] != @issuer
+
+      if claims.key?("aud")
+        audience = claims["aud"]
+        audiences = audience.is_a?(String) ? [audience] : audience
+        unless audiences.is_a?(Array) && !audiences.empty? && audiences.all?(String) && @audience && audiences.include?(@audience)
+          raise VerificationError, "Audience mismatch"
+        end
+      end
+      self.class.check_times(claims, now, @leeway)
+    end
+  end
+end

data/lib/sd_jwt/version.rb

@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+module SDJWT
+  VERSION = "0.1.0"
+end
+SdJwt = SDJWT

data/lib/sd_jwt.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+require_relative "sd_jwt/version"
+require_relative "sd_jwt/errors"
+require_relative "sd_jwt/codec"
+require_relative "sd_jwt/hash_alg"
+require_relative "sd_jwt/disclosure"
+require_relative "sd_jwt/pointer"
+require_relative "sd_jwt/processor"
+require_relative "sd_jwt/token"
+require_relative "sd_jwt/serialization"
+require_relative "sd_jwt/key_binding"
+require_relative "sd_jwt/issuer"
+require_relative "sd_jwt/verifier"
+
+module SDJWT
+  # Parse holder input without authenticating it. Verification is always explicit.
+  def self.parse(source, max_bytes: Codec::MAX_BYTES, max_depth: Codec::MAX_DEPTH,
+                 max_disclosures: Codec::MAX_DISCLOSURES, max_signatures: Codec::MAX_SIGNATURES, strict: true)
+    raise ArgumentError, "Cryptographic inputs require strict parsing" unless strict
+
+    limits = Codec.limits(max_bytes: max_bytes, max_depth: max_depth, max_disclosures: max_disclosures, max_signatures: max_signatures)
+    Serialization.parse(source, limits: limits)
+  end
+end

data/sig/sd_jwt.rbs

@@ -0,0 +1,71 @@
+module SDJWT
+  VERSION: String
+  type json = nil | bool | Integer | Float | String | Array[json] | Hash[String, json]
+  def self.parse: (String source, ?max_bytes: Integer, ?max_depth: Integer, ?max_disclosures: Integer, ?max_signatures: Integer, ?strict: bool) -> Token
+
+  class Error < StandardError
+  end
+  class ParseError < Error
+  end
+  class ValidationError < Error
+    attr_reader pointer: String
+    def initialize: (String message, ?pointer: String) -> void
+  end
+  class ConversionError < Error
+  end
+  class VerificationError < Error
+  end
+
+  class Disclosure
+    attr_reader encoded: String
+    attr_reader salt: String
+    attr_reader name: String?
+    attr_reader value: json
+    def self.parse: (String, ?max_depth: Integer) -> Disclosure
+    def initialize: (Array[json], ?encoded: String?, ?max_depth: Integer) -> void
+    def digest: (?String) -> String
+    def array_element?: () -> bool
+    def to_s: () -> String
+  end
+
+  module HashAlg
+    def self.digest: (String, ?String) -> String
+  end
+
+  class Issuer
+    def initialize: (signing_key: untyped, ?alg: String, ?hash_alg: String, ?max_bytes: Integer, ?max_depth: Integer, ?max_disclosures: Integer) -> void
+    def issue: (Hash[String, json], ?disclose: Array[String], ?decoys: Integer, ?holder_jwk: Hash[String, json]?, ?header: Hash[String, json]) -> Token
+  end
+
+  class Token
+    attr_reader signatures: Array[Hash[String, untyped]]
+    attr_reader warnings: Array[String]
+    def disclosures: () -> Array[String]
+    def issuer_jwt: () -> String
+    def key_binding_jwt: () -> String?
+    def unverified_claims: () -> Hash[String, json]
+    def disclosed_paths: () -> Array[String]
+    def to_s: () -> String
+    def to_json: (*untyped, ?format: :flattened | :general) -> String
+    def present: (only: Array[String], ?key_binding: Hash[Symbol, untyped]?) -> Token
+  end
+
+  class Result
+    attr_reader claims: Hash[String, json]
+    attr_reader headers: Array[Hash[String, json]]
+    attr_reader key_binding_verified: bool
+  end
+
+  class Verifier
+    def initialize: (algorithms: Array[String], issuer_key: untyped, ?hash_algorithms: Array[String], ?require_key_binding: bool,
+      ?audience: String?, ?nonce: String?, ?max_kb_age: Numeric, ?key_binding_algorithms: Array[String], ?required_claims: Array[String],
+      ?issuer: String?, ?leeway: Numeric, ?max_bytes: Integer, ?max_depth: Integer, ?max_disclosures: Integer, ?max_signatures: Integer) -> void
+    def verify: (String | Token) -> Result
+  end
+
+  module Testing
+    def self.with_salts: [T] (Array[String]) { () -> T } -> T
+  end
+end
+
+module SdJwt = SDJWT