@atrib/verify 0.3.7 → 0.5.0

package/dist/ap2-vi-evidence.js

@@ -2,6 +2,8 @@
 import canonicalize from 'canonicalize';
 import { createPublicKey, verify as verifyEcdsa } from 'node:crypto';
 import { base64urlDecode, base64urlEncode, sha256 } from '@atrib/mcp';
+import { SDJwtInstance } from '@sd-jwt/core';
+import { SDJwtVcInstance } from '@sd-jwt/sd-jwt-vc';
 import { createLocalJWKSet, createRemoteJWKSet, customFetch, decodeJwt, decodeProtectedHeader, jwtVerify, } from 'jose';
 const textEncoder = new TextEncoder();
 const textDecoder = new TextDecoder();
@@ -14,6 +16,9 @@ function isString(value) {
 function isNumber(value) {
     return typeof value === 'number' && Number.isFinite(value);
 }
+function isSafeInteger(value) {
+    return typeof value === 'number' && Number.isSafeInteger(value);
+}
 function isJsonWebKeySet(value) {
     return (isRecord(value) && Array.isArray(value['keys']) && value['keys'].every((key) => isRecord(key)));
 }
@@ -26,18 +31,27 @@ function decodeBase64urlJson(value) {
 function signatureCheck(status, reason) {
     return reason === undefined ? { status } : { status, reason };
 }
-function collectDelegatePayloadDigests(payload) {
-    const digests = new Set();
+function sdJwtConformanceCheck(status, profile, reason) {
+    return reason === undefined ? { status, profile } : { status, profile, reason };
+}
+function collectDelegatePayloadDigestList(payload) {
+    const digests = [];
     const delegatePayload = payload['delegate_payload'];
     if (!Array.isArray(delegatePayload))
         return digests;
     for (const item of delegatePayload) {
         if (isRecord(item) && isString(item['...'])) {
-            digests.add(item['...']);
+            digests.push(item['...']);
         }
     }
     return digests;
 }
+function collectDelegatePayloadDigests(payload) {
+    return new Set(collectDelegatePayloadDigestList(payload));
+}
+function hasDuplicateStrings(values) {
+    return new Set(values).size !== values.length;
+}
 function disclosureValue(decoded) {
     if (!Array.isArray(decoded))
         return undefined;
@@ -65,7 +79,10 @@ function parseCredential(input) {
         const value = disclosureValue(decodeBase64urlJson(encoded));
         return { encoded, digest: hashAscii(encoded), value };
     });
-    const mandateValues = disclosures.flatMap((disclosure) => isRecord(disclosure.value) && isString(disclosure.value['vct']) ? [disclosure.value] : []);
+    const mandateDisclosures = disclosures.flatMap((disclosure) => isRecord(disclosure.value) && isString(disclosure.value['vct'])
+        ? [{ digest: disclosure.digest, value: disclosure.value }]
+        : []);
+    const mandateValues = mandateDisclosures.map((mandate) => mandate.value);
     return {
         input,
         jwt,
@@ -74,6 +91,7 @@ function parseCredential(input) {
         signingInput: `${parts[0]}.${parts[1]}`,
         signature: base64urlDecode(parts[2]),
         disclosures,
+        mandateDisclosures,
         mandateValues,
     };
 }
@@ -97,22 +115,473 @@ function sameJson(left, right) {
     const rightCanonical = canonicalJson(right);
     return leftCanonical !== null && leftCanonical === rightCanonical;
 }
+function getConstraintObjects(mandate) {
+    const constraints = mandate['constraints'];
+    if (!Array.isArray(constraints))
+        return [];
+    return constraints.filter(isRecord);
+}
+function normalizeConstraintType(value) {
+    return value.startsWith('mandate.') ? value.slice('mandate.'.length) : value;
+}
+function makeConstraintCheck(constraint, domain, status, reason) {
+    const type = isString(constraint['type']) ? constraint['type'] : `${domain}.unknown`;
+    return reason === undefined ? { type, domain, status } : { type, domain, status, reason };
+}
+function resolveDisclosureRefs(value, disclosures) {
+    if (Array.isArray(value))
+        return value.map((item) => resolveDisclosureRefs(item, disclosures));
+    if (!isRecord(value))
+        return value;
+    const digest = value['...'];
+    if (isString(digest) && Object.keys(value).length === 1) {
+        return disclosures.has(digest)
+            ? resolveDisclosureRefs(disclosures.get(digest), disclosures)
+            : value;
+    }
+    const resolved = {};
+    for (const [key, nested] of Object.entries(value)) {
+        resolved[key] = resolveDisclosureRefs(nested, disclosures);
+    }
+    return resolved;
+}
+function disclosureMap(parsedCredentials) {
+    const disclosures = new Map();
+    for (const parsed of parsedCredentials) {
+        for (const disclosure of parsed.disclosures) {
+            disclosures.set(disclosure.digest, disclosure.value);
+        }
+    }
+    return disclosures;
+}
+function comparableFields(left, right, fields) {
+    return fields.filter((field) => isString(left[field]) && isString(right[field]));
+}
+function entityMatches(left, right, fields) {
+    if (!isRecord(left) || !isRecord(right))
+        return false;
+    const fieldsToCompare = comparableFields(left, right, fields);
+    return (fieldsToCompare.length > 0 && fieldsToCompare.every((field) => left[field] === right[field]));
+}
+function anyEntityMatches(allowed, actual, fields) {
+    if (!Array.isArray(allowed))
+        return null;
+    if (!isRecord(actual))
+        return null;
+    const allowedRecords = allowed.filter(isRecord);
+    if (allowedRecords.length === 0)
+        return null;
+    return allowedRecords.some((candidate) => entityMatches(candidate, actual, fields));
+}
+function paymentAmount(target) {
+    const amount = target['payment_amount'];
+    if (!isRecord(amount) || !isSafeInteger(amount['amount']) || !isString(amount['currency'])) {
+        return null;
+    }
+    return { amount: amount['amount'], currency: amount['currency'] };
+}
+function optionalIntegerBound(value) {
+    if (value === undefined)
+        return undefined;
+    return isSafeInteger(value) ? value : null;
+}
+function compareIsoDate(value, lower, upper) {
+    const time = Date.parse(value);
+    if (!Number.isFinite(time))
+        return null;
+    if (isString(lower)) {
+        const lowerTime = Date.parse(lower);
+        if (!Number.isFinite(lowerTime) || time < lowerTime)
+            return false;
+    }
+    if (isString(upper)) {
+        const upperTime = Date.parse(upper);
+        if (!Number.isFinite(upperTime) || time > upperTime)
+            return false;
+    }
+    return true;
+}
+function decodeCompactJwtPayload(value) {
+    try {
+        const payload = decodeJwt(value);
+        return isRecord(payload) ? payload : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function resolveCheckoutPayload(explicitPayload, closedCheckoutMandates) {
+    if (isRecord(explicitPayload))
+        return explicitPayload;
+    for (const mandate of closedCheckoutMandates) {
+        const payload = mandate['checkout_payload'];
+        if (isRecord(payload))
+            return payload;
+        const checkoutJwt = mandate['checkout_jwt'];
+        if (isString(checkoutJwt)) {
+            const decoded = decodeCompactJwtPayload(checkoutJwt);
+            if (decoded)
+                return decoded;
+        }
+    }
+    return undefined;
+}
+function checkoutLineItemId(value) {
+    const product = value['product'];
+    if (isRecord(product) && isString(product['id']))
+        return product['id'];
+    if (isRecord(product) && isString(product['sku']))
+        return product['sku'];
+    if (isString(value['sku']))
+        return value['sku'];
+    return isString(value['id']) ? value['id'] : null;
+}
+function checkoutLineItems(checkoutPayload) {
+    const lineItems = checkoutPayload['line_items'];
+    if (Array.isArray(lineItems))
+        return lineItems;
+    const cart = checkoutPayload['cart'];
+    if (isRecord(cart) && Array.isArray(cart['items']))
+        return cart['items'];
+    return null;
+}
+function checkoutLineItemQuantities(checkoutPayload) {
+    const items = checkoutLineItems(checkoutPayload);
+    if (items === null)
+        return null;
+    const quantities = new Map();
+    for (const item of items) {
+        if (!isRecord(item))
+            return null;
+        const id = checkoutLineItemId(item);
+        const quantity = item['quantity'];
+        if (id === null || !isSafeInteger(quantity) || quantity < 0)
+            return null;
+        quantities.set(id, (quantities.get(id) ?? 0) + quantity);
+    }
+    return quantities;
+}
+function maxLineItemFlow(requirements, checkoutQuantities) {
+    const source = 'source';
+    const sink = 'sink';
+    const graph = new Map();
+    const addEdge = (from, to, capacity) => {
+        if (!graph.has(from))
+            graph.set(from, new Map());
+        if (!graph.has(to))
+            graph.set(to, new Map());
+        graph.get(from).set(to, (graph.get(from).get(to) ?? 0) + capacity);
+        graph.get(to).set(from, graph.get(to).get(from) ?? 0);
+    };
+    requirements.forEach((requirement, index) => {
+        const reqNode = `req:${index}`;
+        addEdge(source, reqNode, requirement.quantity);
+        for (const itemId of requirement.acceptableIds) {
+            if (checkoutQuantities.has(itemId))
+                addEdge(reqNode, `item:${itemId}`, Number.MAX_SAFE_INTEGER);
+        }
+    });
+    for (const [itemId, quantity] of checkoutQuantities) {
+        addEdge(`item:${itemId}`, sink, quantity);
+    }
+    let flow = 0;
+    for (;;) {
+        const parent = new Map();
+        const queue = [source];
+        parent.set(source, '');
+        for (let i = 0; i < queue.length && !parent.has(sink); i += 1) {
+            const node = queue[i];
+            for (const [next, capacity] of graph.get(node) ?? []) {
+                if (capacity > 0 && !parent.has(next)) {
+                    parent.set(next, node);
+                    queue.push(next);
+                }
+            }
+        }
+        if (!parent.has(sink))
+            return flow;
+        let increment = Number.MAX_SAFE_INTEGER;
+        for (let node = sink; node !== source; node = parent.get(node)) {
+            const prev = parent.get(node);
+            increment = Math.min(increment, graph.get(prev).get(node));
+        }
+        for (let node = sink; node !== source; node = parent.get(node)) {
+            const prev = parent.get(node);
+            graph.get(prev).set(node, graph.get(prev).get(node) - increment);
+            graph.get(node).set(prev, graph.get(node).get(prev) + increment);
+        }
+        flow += increment;
+    }
+}
+function evaluatePaymentConstraint(constraint, closedPaymentMandates, nowSeconds, checkoutPaymentBindingOk, openCheckoutMandateDigests = []) {
+    const type = isString(constraint['type']) ? normalizeConstraintType(constraint['type']) : '';
+    if (closedPaymentMandates.length === 0) {
+        return makeConstraintCheck(constraint, 'payment', 'unresolved', 'closed_payment_missing');
+    }
+    if (type === 'payment.amount_range') {
+        const min = optionalIntegerBound(constraint['min']);
+        const max = optionalIntegerBound(constraint['max']);
+        if (min === null || max === null) {
+            return makeConstraintCheck(constraint, 'payment', 'unresolved', 'amount_range');
+        }
+        for (const mandate of closedPaymentMandates) {
+            const amount = paymentAmount(mandate);
+            if (amount === null) {
+                return makeConstraintCheck(constraint, 'payment', 'unresolved', 'payment_amount');
+            }
+            if (isString(constraint['currency']) && constraint['currency'] !== amount.currency) {
+                return makeConstraintCheck(constraint, 'payment', 'failed', 'currency');
+            }
+            if (min !== undefined && amount.amount < min) {
+                return makeConstraintCheck(constraint, 'payment', 'failed', 'min');
+            }
+            if (max !== undefined && amount.amount > max) {
+                return makeConstraintCheck(constraint, 'payment', 'failed', 'max');
+            }
+        }
+        return makeConstraintCheck(constraint, 'payment', 'passed');
+    }
+    if (type === 'payment.allowed_payees') {
+        for (const mandate of closedPaymentMandates) {
+            const ok = anyEntityMatches(constraint['allowed'], mandate['payee'], [
+                'id',
+                'website',
+                'name',
+            ]);
+            if (ok === null)
+                return makeConstraintCheck(constraint, 'payment', 'unresolved', 'allowed');
+            if (!ok)
+                return makeConstraintCheck(constraint, 'payment', 'failed', 'payee');
+        }
+        return makeConstraintCheck(constraint, 'payment', 'passed');
+    }
+    if (type === 'payment.allowed_payment_instruments') {
+        for (const mandate of closedPaymentMandates) {
+            const ok = anyEntityMatches(constraint['allowed'], mandate['payment_instrument'], [
+                'id',
+                'type',
+                'description',
+            ]);
+            if (ok === null)
+                return makeConstraintCheck(constraint, 'payment', 'unresolved', 'allowed');
+            if (!ok)
+                return makeConstraintCheck(constraint, 'payment', 'failed', 'payment_instrument');
+        }
+        return makeConstraintCheck(constraint, 'payment', 'passed');
+    }
+    if (type === 'payment.allowed_pisps') {
+        for (const mandate of closedPaymentMandates) {
+            const ok = anyEntityMatches(constraint['allowed'], mandate['pisp'], [
+                'domain_name',
+                'brand_name',
+                'legal_name',
+            ]);
+            if (ok === null)
+                return makeConstraintCheck(constraint, 'payment', 'unresolved', 'allowed');
+            if (!ok)
+                return makeConstraintCheck(constraint, 'payment', 'failed', 'pisp');
+        }
+        return makeConstraintCheck(constraint, 'payment', 'passed');
+    }
+    if (type === 'payment.reference') {
+        const referencedCheckoutDigest = constraint['conditional_transaction_id'];
+        if (!isString(referencedCheckoutDigest)) {
+            return makeConstraintCheck(constraint, 'payment', 'unresolved', 'conditional_transaction_id');
+        }
+        if (openCheckoutMandateDigests.length === 0) {
+            return makeConstraintCheck(constraint, 'payment', 'unresolved', 'open_checkout_digest');
+        }
+        if (!openCheckoutMandateDigests.includes(referencedCheckoutDigest)) {
+            return makeConstraintCheck(constraint, 'payment', 'failed', 'open_checkout_digest');
+        }
+        if (checkoutPaymentBindingOk === false) {
+            return makeConstraintCheck(constraint, 'payment', 'failed', 'checkout_payment_binding');
+        }
+        if (checkoutPaymentBindingOk === null || checkoutPaymentBindingOk === undefined) {
+            return makeConstraintCheck(constraint, 'payment', 'unresolved', 'checkout_payment_binding');
+        }
+        return makeConstraintCheck(constraint, 'payment', 'passed');
+    }
+    if (type === 'payment.execution_date') {
+        const immediateExecutionDate = new Date(nowSeconds * 1000).toISOString();
+        for (const mandate of closedPaymentMandates) {
+            const executionDate = isString(mandate['execution_date'])
+                ? mandate['execution_date']
+                : immediateExecutionDate;
+            const ok = compareIsoDate(executionDate, constraint['not_before'], constraint['not_after']);
+            if (ok === null)
+                return makeConstraintCheck(constraint, 'payment', 'unresolved', 'date');
+            if (!ok)
+                return makeConstraintCheck(constraint, 'payment', 'failed', 'execution_date');
+        }
+        return makeConstraintCheck(constraint, 'payment', 'passed');
+    }
+    return makeConstraintCheck(constraint, 'payment', 'unsupported');
+}
+function evaluateCheckoutConstraint(constraint, checkoutPayload, closedPaymentMandates) {
+    const type = isString(constraint['type']) ? normalizeConstraintType(constraint['type']) : '';
+    if (type === 'checkout.allowed_merchants') {
+        const merchant = checkoutPayload?.['merchant'] ??
+            closedPaymentMandates.find((mandate) => mandate['payee'] !== undefined)?.['payee'];
+        const ok = anyEntityMatches(constraint['allowed'], merchant, ['id', 'website', 'name']);
+        if (ok === null)
+            return makeConstraintCheck(constraint, 'checkout', 'unresolved', 'merchant');
+        if (!ok)
+            return makeConstraintCheck(constraint, 'checkout', 'failed', 'merchant');
+        return makeConstraintCheck(constraint, 'checkout', 'passed');
+    }
+    if (type === 'checkout.line_items') {
+        if (!checkoutPayload) {
+            return makeConstraintCheck(constraint, 'checkout', 'unresolved', 'checkout_payload_missing');
+        }
+        const checkoutQuantities = checkoutLineItemQuantities(checkoutPayload);
+        const items = constraint['items'];
+        if (checkoutQuantities === null || !Array.isArray(items)) {
+            return makeConstraintCheck(constraint, 'checkout', 'unresolved', 'line_items');
+        }
+        const requirements = [];
+        for (const item of items) {
+            if (!isRecord(item)) {
+                return makeConstraintCheck(constraint, 'checkout', 'unresolved', 'requirement');
+            }
+            const quantity = item['quantity'];
+            if (!isSafeInteger(quantity) || quantity < 0) {
+                return makeConstraintCheck(constraint, 'checkout', 'unresolved', 'requirement');
+            }
+            const acceptableItems = item['acceptable_items'];
+            if (!Array.isArray(acceptableItems)) {
+                return makeConstraintCheck(constraint, 'checkout', 'unresolved', 'acceptable_items');
+            }
+            const acceptableIds = new Set();
+            for (const acceptable of acceptableItems) {
+                if (isRecord(acceptable) && isString(acceptable['id']))
+                    acceptableIds.add(acceptable['id']);
+            }
+            if (acceptableIds.size === 0) {
+                return makeConstraintCheck(constraint, 'checkout', 'unresolved', 'acceptable_items');
+            }
+            requirements.push({ quantity, acceptableIds });
+        }
+        const requiredQuantity = requirements.reduce((sum, item) => sum + item.quantity, 0);
+        const checkoutQuantity = [...checkoutQuantities.values()].reduce((sum, quantity) => sum + quantity, 0);
+        const maxFlow = maxLineItemFlow(requirements, checkoutQuantities);
+        if (maxFlow !== requiredQuantity || requiredQuantity !== checkoutQuantity) {
+            return makeConstraintCheck(constraint, 'checkout', 'failed', 'line_items');
+        }
+        return makeConstraintCheck(constraint, 'checkout', 'passed');
+    }
+    return makeConstraintCheck(constraint, 'checkout', 'unsupported');
+}
+function summarizeConstraintChecks(checks) {
+    if (checks.length === 0)
+        return 'not_applicable';
+    if (checks.some((check) => check.status === 'failed'))
+        return 'failed';
+    if (checks.some((check) => check.status === 'unresolved' || check.status === 'unsupported')) {
+        return 'unresolved';
+    }
+    return 'passed';
+}
+export function evaluateAp2ViConstraints(input, disclosures = new Map()) {
+    const openCheckoutMandates = (input.openCheckoutMandates ?? [])
+        .filter(isRecord)
+        .map((mandate) => resolveDisclosureRefs(mandate, disclosures))
+        .filter(isRecord);
+    const closedCheckoutMandates = (input.closedCheckoutMandates ?? [])
+        .filter(isRecord)
+        .map((mandate) => resolveDisclosureRefs(mandate, disclosures))
+        .filter(isRecord);
+    const openPaymentMandates = (input.openPaymentMandates ?? [])
+        .filter(isRecord)
+        .map((mandate) => resolveDisclosureRefs(mandate, disclosures))
+        .filter(isRecord);
+    const closedPaymentMandates = (input.closedPaymentMandates ?? [])
+        .filter(isRecord)
+        .map((mandate) => resolveDisclosureRefs(mandate, disclosures))
+        .filter(isRecord);
+    const resolvedCheckoutPayload = resolveDisclosureRefs(input.checkoutPayload, disclosures);
+    const checkoutPayload = resolveCheckoutPayload(resolvedCheckoutPayload, closedCheckoutMandates);
+    const nowSeconds = input.nowSeconds ?? Math.floor(Date.now() / 1000);
+    const checkoutPaymentBindingOk = input.checkoutPaymentBindingOk;
+    const openCheckoutMandateDigests = input.openCheckoutMandateDigests ?? [];
+    const checks = [];
+    for (const mandate of openCheckoutMandates) {
+        for (const constraint of getConstraintObjects(mandate)) {
+            const resolved = resolveDisclosureRefs(constraint, disclosures);
+            checks.push(evaluateCheckoutConstraint(isRecord(resolved) ? resolved : constraint, checkoutPayload, closedPaymentMandates));
+        }
+    }
+    for (const mandate of openPaymentMandates) {
+        for (const constraint of getConstraintObjects(mandate)) {
+            const resolved = resolveDisclosureRefs(constraint, disclosures);
+            checks.push(evaluatePaymentConstraint(isRecord(resolved) ? resolved : constraint, closedPaymentMandates, nowSeconds, checkoutPaymentBindingOk, openCheckoutMandateDigests));
+        }
+    }
+    return { status: summarizeConstraintChecks(checks), checks };
+}
 function normalizeJwks(value) {
     const keys = Array.isArray(value) ? value : value.keys;
+    if (keys.length === 0)
+        throw new Error('jwks_empty');
+    const seenKids = new Set();
+    for (const key of keys)
+        validateReceiptJwk(key, seenKids);
     return { keys: keys };
 }
-function verifyJwtSignature(parsed, publicJwk) {
+function verifyEs256Signature(data, signature, publicJwk) {
     const key = createPublicKey({ key: publicJwk, format: 'jwk' });
-    return verifyEcdsa('sha256', Buffer.from(parsed.signingInput, 'ascii'), { key, dsaEncoding: 'ieee-p1363' }, Buffer.from(parsed.signature));
+    return verifyEcdsa('sha256', Buffer.from(data, 'ascii'), { key, dsaEncoding: 'ieee-p1363' }, Buffer.from(signature));
+}
+function verifyJwtSignature(parsed, publicJwk) {
+    return verifyEs256Signature(parsed.signingInput, parsed.signature, publicJwk);
 }
 function findIssuerKey(kid, keys) {
     if (kid === null)
         return keys[0];
     return keys.find((key) => getKid(key) === kid);
 }
+function validateReceiptJwk(key, seenKids) {
+    const record = key;
+    const kid = getKid(record);
+    if (kid !== null) {
+        if (seenKids.has(kid))
+            throw new Error('jwks_duplicate_kid');
+        seenKids.add(kid);
+    }
+    if (record['kty'] !== 'EC' || record['crv'] !== 'P-256') {
+        throw new Error('jwks_key_unsupported');
+    }
+    const alg = record['alg'];
+    if (alg !== undefined && alg !== 'ES256') {
+        throw new Error('jwks_key_unsupported');
+    }
+    const use = record['use'];
+    if (use !== undefined && use !== 'sig') {
+        throw new Error('jwks_key_unsupported');
+    }
+    const keyOps = record['key_ops'];
+    if (keyOps !== undefined &&
+        (!Array.isArray(keyOps) || !keyOps.every(isString) || !keyOps.includes('verify'))) {
+        throw new Error('jwks_key_unsupported');
+    }
+}
 function receiptJwtError(kind, code) {
     return `ap2_${kind}_receipt_jwt_${code}`;
 }
+function normalizeReceiptJwtErrorCode(code) {
+    if (code === 'fetch_unavailable' ||
+        code === 'metadata_fetch_failed' ||
+        code === 'metadata_invalid' ||
+        code === 'metadata_jwks_missing' ||
+        code === 'key_source_missing' ||
+        code === 'jwks_empty' ||
+        code === 'jwks_duplicate_kid' ||
+        code === 'jwks_key_unsupported' ||
+        code === 'iat_in_future') {
+        return code === 'fetch_unavailable' ? 'metadata_fetch_unavailable' : code;
+    }
+    return 'invalid';
+}
 function addReceiptJwtFailure(verification, kind, code, policy) {
     const error = receiptJwtError(kind, code);
     verification.check.error = error;
@@ -189,6 +658,23 @@ function disclosureDigestsOk(parsed) {
     const delegateDigests = collectDelegatePayloadDigests(parsed.payload);
     return parsed.disclosures.every((disclosure) => sdDigests.has(disclosure.digest) || delegateDigests.has(disclosure.digest));
 }
+function credentialStructuralErrors(parsed) {
+    const errors = [];
+    if (hasDuplicateStrings(parsed.disclosures.map((disclosure) => disclosure.digest))) {
+        errors.push('vi_disclosure_duplicate');
+    }
+    const sdAlg = parsed.payload['_sd_alg'];
+    if (sdAlg !== undefined && sdAlg !== 'sha-256') {
+        errors.push('vi_sd_alg_unsupported');
+    }
+    const sd = parsed.payload['_sd'];
+    const sdDigests = Array.isArray(sd) ? sd.filter(isString) : [];
+    const delegateDigests = collectDelegatePayloadDigestList(parsed.payload);
+    if (hasDuplicateStrings(sdDigests) || hasDuplicateStrings(delegateDigests)) {
+        errors.push('vi_disclosure_digest_duplicate');
+    }
+    return errors;
+}
 function initialCredentialCheck(parsed) {
     const alg = isString(parsed.header['alg']) ? parsed.header['alg'] : null;
     const typ = isString(parsed.header['typ']) ? parsed.header['typ'] : null;
@@ -199,6 +685,7 @@ function initialCredentialCheck(parsed) {
         typ,
         kid,
         signature: signatureCheck('not_checked'),
+        sdJwtConformance: sdJwtConformanceCheck('not_checked', null, 'async_required'),
         sdHashOk: null,
         disclosuresOk: disclosureDigestsOk(parsed),
         mandateVcts: parsed.mandateValues.map((mandate) => String(mandate['vct'])),
@@ -264,6 +751,14 @@ async function verifyReceiptJwt(kind, receiptJwt, issuers, policy, nowSeconds, c
             addReceiptJwtFailure(verification, kind, 'alg_unsupported', policy);
             return verification;
         }
+        if (header.crit !== undefined) {
+            addReceiptJwtFailure(verification, kind, 'crit_unsupported', policy);
+            return verification;
+        }
+        if (!isString(header.kid) || header.kid.length === 0) {
+            addReceiptJwtFailure(verification, kind, 'kid_missing', policy);
+            return verification;
+        }
         const issuerConfig = findReceiptJwtIssuer(issuer, issuers);
         if (!issuerConfig) {
             addReceiptJwtFailure(verification, kind, 'issuer_untrusted', policy);
@@ -281,13 +776,18 @@ async function verifyReceiptJwt(kind, receiptJwt, issuers, policy, nowSeconds, c
         if (issuerConfig.issuer !== undefined)
             verifyOptions.issuer = issuerConfig.issuer;
         const verified = await jwtVerify(receiptJwt, key.getKey, verifyOptions);
+        const iat = verified.payload.iat;
+        if (isNumber(iat) && nowSeconds + clockSkewSeconds < iat) {
+            addReceiptJwtFailure(verification, kind, 'iat_in_future', policy);
+            return verification;
+        }
         verification.check.verified = true;
         verification.payload = verified.payload;
         return verification;
     }
     catch (error) {
         const code = error instanceof Error && error.message ? error.message : 'invalid';
-        addReceiptJwtFailure(verification, kind, code === 'fetch_unavailable' ? 'metadata_fetch_unavailable' : 'invalid', policy);
+        addReceiptJwtFailure(verification, kind, normalizeReceiptJwtErrorCode(code), policy);
         if (code !== 'invalid' && code !== 'fetch_unavailable') {
             verification.warnings.push(`${receiptJwtError(kind, 'detail')}:${code}`);
         }
@@ -304,6 +804,11 @@ function expectedReceiptReference(serialized, explicitHash) {
 function findMandates(parsedCredentials, vct) {
     return parsedCredentials.flatMap((parsed) => parsed.mandateValues.filter((mandate) => mandate['vct'] === vct));
 }
+function findMandateDigests(parsedCredentials, vct) {
+    return parsedCredentials.flatMap((parsed) => parsed.mandateDisclosures
+        .filter((mandate) => mandate.value['vct'] === vct)
+        .map((mandate) => mandate.digest));
+}
 function checkCheckoutHash(mandates, errors) {
     for (const mandate of mandates) {
         const checkoutJwt = mandate['checkout_jwt'];
@@ -426,12 +931,176 @@ function checkTimeWindow(parsedCredentials, nowSeconds, clockSkewSeconds, errors
         const iat = parsed.payload['iat'];
         if (isNumber(iat) && nowSeconds + clockSkewSeconds < iat)
             errors.push('vi_credential_iat_in_future');
+        const nbf = parsed.payload['nbf'];
+        if (isNumber(nbf) && nowSeconds + clockSkewSeconds < nbf)
+            errors.push('vi_credential_nbf_in_future');
     }
 }
+function sdJwtHasher(data, alg) {
+    if (alg !== 'sha-256')
+        throw new Error('hash_alg_unsupported');
+    const bytes = typeof data === 'string' ? textEncoder.encode(data) : new Uint8Array(data);
+    return sha256(bytes);
+}
+function sdJwtVerifier(publicJwk) {
+    return (data, signature) => verifyEs256Signature(data, base64urlDecode(signature), publicJwk);
+}
+function credentialVerificationKey(parsed, trustedIssuerKeys, byLayer) {
+    const kid = isString(parsed.header['kid']) ? parsed.header['kid'] : null;
+    if (parsed.input.layer === 'L1')
+        return findIssuerKey(kid, trustedIssuerKeys);
+    const l1UserKey = getCnfJwk(byLayer.get('L1')?.payload);
+    if (parsed.input.layer === 'L2')
+        return l1UserKey;
+    const l2AgentKeys = byLayer
+        .get('L2')
+        ?.mandateValues.map(getCnfJwk)
+        .filter((jwk) => jwk !== undefined) ?? [];
+    return l2AgentKeys.find((candidate) => getKid(candidate) === kid);
+}
+function sdJwtErrorReason(error) {
+    const message = error instanceof Error ? error.message.toLowerCase() : '';
+    if (message.includes('status_fetcher_unconfigured'))
+        return 'status_fetcher';
+    if (message.includes('vct_fetcher_unconfigured'))
+        return 'vct_fetcher';
+    if (message.includes('hash') || message.includes('digest'))
+        return 'disclosure_digest';
+    if (message.includes('signature'))
+        return 'signature';
+    if (message.includes('expired') || message.includes('exp'))
+        return 'exp';
+    if (message.includes('nbf'))
+        return 'nbf';
+    if (message.includes('iat'))
+        return 'iat';
+    if (message.includes('key binding') || message.includes('kb'))
+        return 'key_binding';
+    if (message.includes('vct'))
+        return 'vct';
+    if (message.includes('status'))
+        return 'status';
+    return 'invalid';
+}
+function addSdJwtConformanceFinding(policy, code, layer, errors, warnings) {
+    if (policy === 'require')
+        errors.push(code);
+    else
+        warnings.push(`${code}:${layer}`);
+}
+function addConstraintFindings(policy, constraints, errors, warnings) {
+    for (const check of constraints.checks) {
+        let code;
+        if (check.status === 'failed')
+            code = `vi_constraint_failed:${check.type}`;
+        if (check.status === 'unresolved')
+            code = `vi_constraint_unresolved:${check.type}`;
+        if (check.status === 'unsupported')
+            code = `vi_constraint_unsupported:${check.type}`;
+        if (code === undefined)
+            continue;
+        if (policy === 'require')
+            errors.push(code);
+        else
+            warnings.push(code);
+    }
+}
+async function verifyCredentialSdJwtConformance(credentials, trustedIssuerKeys, policy, profile, options, nowSeconds, clockSkewSeconds) {
+    const errors = [];
+    const warnings = [];
+    const parsedCredentials = [];
+    const checks = credentials.map(() => sdJwtConformanceCheck('not_checked', profile));
+    for (let index = 0; index < credentials.length; index += 1) {
+        const credential = credentials[index];
+        try {
+            parsedCredentials.push({ index, parsed: parseCredential(credential) });
+        }
+        catch {
+            checks[index] = sdJwtConformanceCheck('invalid', profile, 'parse');
+            addSdJwtConformanceFinding(policy, 'vi_sd_jwt_conformance_invalid', credential.layer, errors, warnings);
+        }
+    }
+    const byLayer = new Map();
+    for (const { parsed } of parsedCredentials)
+        byLayer.set(parsed.input.layer, parsed);
+    for (const { index: checkIndex, parsed } of parsedCredentials) {
+        const key = credentialVerificationKey(parsed, trustedIssuerKeys, byLayer);
+        const structuralErrors = credentialStructuralErrors(parsed);
+        if (parsed.header['alg'] !== 'ES256') {
+            checks[checkIndex] = sdJwtConformanceCheck('invalid', profile, 'alg');
+            addSdJwtConformanceFinding(policy, 'vi_sd_jwt_conformance_invalid', parsed.input.layer, errors, warnings);
+            continue;
+        }
+        if (structuralErrors.length > 0) {
+            checks[checkIndex] = sdJwtConformanceCheck('invalid', profile, structuralErrors[0]);
+            addSdJwtConformanceFinding(policy, 'vi_sd_jwt_conformance_invalid', parsed.input.layer, errors, warnings);
+            continue;
+        }
+        if (!key) {
+            checks[checkIndex] = sdJwtConformanceCheck('not_checked', profile, 'missing_key');
+            addSdJwtConformanceFinding(policy, 'vi_sd_jwt_conformance_key_missing', parsed.input.layer, errors, warnings);
+            continue;
+        }
+        if (disclosureDigestsOk(parsed) === false) {
+            checks[checkIndex] = sdJwtConformanceCheck('invalid', profile, 'disclosure_digest');
+            addSdJwtConformanceFinding(policy, 'vi_sd_jwt_conformance_invalid', parsed.input.layer, errors, warnings);
+            continue;
+        }
+        try {
+            const verifier = sdJwtVerifier(key);
+            const verifyOptions = { currentDate: nowSeconds, skewSeconds: clockSkewSeconds };
+            if (profile === 'sd-jwt-vc') {
+                const vcOptions = options.sdJwtVc ?? {};
+                const statusListFetcher = vcOptions.statusListFetcher ??
+                    (async () => {
+                        throw new Error('status_fetcher_unconfigured');
+                    });
+                const vctFetcher = vcOptions.vctFetcher ??
+                    (vcOptions.loadTypeMetadata
+                        ? async () => {
+                            throw new Error('vct_fetcher_unconfigured');
+                        }
+                        : undefined);
+                const vcConfig = {
+                    hasher: sdJwtHasher,
+                    hashAlg: 'sha-256',
+                    verifier,
+                    loadTypeMetadataFormat: vcOptions.loadTypeMetadata === true,
+                    statusListFetcher,
+                };
+                if (vcOptions.maxVctExtendsDepth !== undefined)
+                    Object.assign(vcConfig, { maxVctExtendsDepth: vcOptions.maxVctExtendsDepth });
+                if (vcOptions.statusValidator !== undefined)
+                    Object.assign(vcConfig, { statusValidator: vcOptions.statusValidator });
+                if (vctFetcher !== undefined)
+                    Object.assign(vcConfig, { vctFetcher });
+                const verifierInstance = new SDJwtVcInstance(vcConfig);
+                await verifierInstance.verify(parsed.input.sdJwt, verifyOptions);
+                await verifierInstance.getClaims(parsed.input.sdJwt);
+            }
+            else {
+                const verifierInstance = new SDJwtInstance({
+                    hasher: sdJwtHasher,
+                    hashAlg: 'sha-256',
+                    verifier,
+                });
+                await verifierInstance.verify(parsed.input.sdJwt, verifyOptions);
+                await verifierInstance.getClaims(parsed.input.sdJwt);
+            }
+            checks[checkIndex] = sdJwtConformanceCheck('verified', profile);
+        }
+        catch (error) {
+            checks[checkIndex] = sdJwtConformanceCheck('invalid', profile, sdJwtErrorReason(error));
+            addSdJwtConformanceFinding(policy, 'vi_sd_jwt_conformance_invalid', parsed.input.layer, errors, warnings);
+        }
+    }
+    return { checks, errors, warnings };
+}
 export function verifyAp2ViEvidence(bundle, options = {}) {
     const errors = [];
     const warnings = [];
     const signaturePolicy = options.signaturePolicy ?? 'require';
+    const constraintPolicy = options.constraintPolicy ?? 'require';
     const trustedIssuerKeys = options.trustedIssuerKeys ?? bundle.trustedIssuerKeys ?? [];
     const nowSeconds = options.nowSeconds ?? Math.floor(Date.now() / 1000);
     const clockSkewSeconds = options.clockSkewSeconds ?? 300;
@@ -447,6 +1116,7 @@ export function verifyAp2ViEvidence(bundle, options = {}) {
                 errors.push('vi_typ_mismatch');
             if (check.disclosuresOk === false)
                 errors.push('vi_disclosure_digest_mismatch');
+            errors.push(...credentialStructuralErrors(parsed));
         }
         catch (error) {
             const code = error instanceof Error && error.message ? error.message : 'vi_jwt_malformed';
@@ -457,6 +1127,7 @@ export function verifyAp2ViEvidence(bundle, options = {}) {
                 typ: null,
                 kid: null,
                 signature: signatureCheck('invalid', 'parse'),
+                sdJwtConformance: sdJwtConformanceCheck('invalid', null, 'parse'),
                 sdHashOk: null,
                 disclosuresOk: null,
                 mandateVcts: [],
@@ -470,6 +1141,7 @@ export function verifyAp2ViEvidence(bundle, options = {}) {
     const finalCheckoutMandates = findMandates(parsedCredentials, 'mandate.checkout.1');
     const openPaymentMandates = findMandates(parsedCredentials, 'mandate.payment.open.1');
     const openCheckoutMandates = findMandates(parsedCredentials, 'mandate.checkout.open.1');
+    const openCheckoutMandateDigests = findMandateDigests(parsedCredentials, 'mandate.checkout.open.1');
     checkCheckoutHash(finalCheckoutMandates, errors);
     const checkoutPaymentBindingOk = checkPaymentCheckoutBinding(finalPaymentMandates, finalCheckoutMandates, errors);
     const delegationOk = checkDelegation(openCheckoutMandates, openPaymentMandates, errors);
@@ -478,6 +1150,21 @@ export function verifyAp2ViEvidence(bundle, options = {}) {
         : finalPaymentMandates.length > 0 || finalCheckoutMandates.length > 0
             ? 'immediate'
             : 'unknown';
+    const constraints = constraintPolicy === 'off'
+        ? { status: 'not_checked', checks: [] }
+        : evaluateAp2ViConstraints({
+            openCheckoutMandates,
+            openCheckoutMandateDigests,
+            closedCheckoutMandates: finalCheckoutMandates,
+            openPaymentMandates,
+            closedPaymentMandates: finalPaymentMandates,
+            checkoutPayload: bundle.ap2?.checkoutPayload,
+            checkoutPaymentBindingOk,
+            nowSeconds,
+        }, disclosureMap(parsedCredentials));
+    if (constraintPolicy !== 'off') {
+        addConstraintFindings(constraintPolicy, constraints, errors, warnings);
+    }
     const ap2 = {};
     const expectedPaymentReference = expectedReceiptReference(bundle.ap2?.closedPaymentMandate, bundle.ap2?.closedPaymentMandateHash);
     const expectedCheckoutReference = expectedReceiptReference(bundle.ap2?.closedCheckoutMandate, bundle.ap2?.closedCheckoutMandateHash);
@@ -512,6 +1199,7 @@ export function verifyAp2ViEvidence(bundle, options = {}) {
             credentials: credentialChecks,
             delegationOk,
             checkoutPaymentBindingOk,
+            constraints,
         },
         errors: [...new Set(errors)],
         warnings: [...new Set(warnings)],
@@ -521,10 +1209,14 @@ export async function verifyAp2ViEvidenceAsync(bundle, options = {}) {
     const ap2 = { ...bundle.ap2 };
     const receiptJwtIssuers = options.receiptJwtIssuers ?? bundle.receiptJwtIssuers ?? [];
     const receiptJwtPolicy = options.receiptJwtPolicy ?? 'require';
+    const sdJwtConformancePolicy = options.sdJwtConformancePolicy ?? 'require';
+    const sdJwtConformanceProfile = options.sdJwtConformanceProfile ?? 'sd-jwt-vc';
     const nowSeconds = options.nowSeconds ?? Math.floor(Date.now() / 1000);
     const clockSkewSeconds = options.clockSkewSeconds ?? 300;
     const jwtErrors = [];
     const jwtWarnings = [];
+    const sdJwtErrors = [];
+    const sdJwtWarnings = [];
     const paymentJwt = ap2.paymentReceiptJwt
         ? await verifyReceiptJwt('payment', ap2.paymentReceiptJwt, receiptJwtIssuers, receiptJwtPolicy, nowSeconds, clockSkewSeconds, options.fetch)
         : undefined;
@@ -561,6 +1253,18 @@ export async function verifyAp2ViEvidenceAsync(bundle, options = {}) {
         }
     }
     const result = verifyAp2ViEvidence({ ...bundle, ap2 }, options);
+    if (sdJwtConformancePolicy !== 'off') {
+        const credentials = bundle.vi?.credentials ?? [];
+        const trustedIssuerKeys = options.trustedIssuerKeys ?? bundle.trustedIssuerKeys ?? [];
+        const sdJwt = await verifyCredentialSdJwtConformance(credentials, trustedIssuerKeys, sdJwtConformancePolicy, sdJwtConformanceProfile, options, nowSeconds, clockSkewSeconds);
+        for (let index = 0; index < sdJwt.checks.length; index += 1) {
+            const check = result.vi.credentials[index];
+            if (check)
+                check.sdJwtConformance = sdJwt.checks[index];
+        }
+        sdJwtErrors.push(...sdJwt.errors);
+        sdJwtWarnings.push(...sdJwt.warnings);
+    }
     if (paymentJwt) {
         if (result.ap2.paymentReceipt)
             result.ap2.paymentReceipt.jwt = paymentJwt.check;
@@ -573,8 +1277,8 @@ export async function verifyAp2ViEvidenceAsync(bundle, options = {}) {
         else
             result.ap2.checkoutReceipt = emptyJwtReceiptCheck(checkoutJwt.check);
     }
-    const errors = [...new Set([...result.errors, ...jwtErrors])];
-    const warnings = [...new Set([...result.warnings, ...jwtWarnings])];
+    const errors = [...new Set([...result.errors, ...jwtErrors, ...sdJwtErrors])];
+    const warnings = [...new Set([...result.warnings, ...jwtWarnings, ...sdJwtWarnings])];
     const hasAp2Receipt = result.ap2.paymentReceipt?.present === true || result.ap2.checkoutReceipt?.present === true;
     return {
         ...result,