@coordination-network/credential 0.0.1 → 0.0.2

package/src/revocation.ts

@@ -1,6 +1,7 @@
+import { inPrimeOrderSubgroup } from "@coordination-network/issuer-set"
 import { Identity } from "@semaphore-protocol/identity"
 import { bytesToHex, randomBytes } from "@noble/hashes/utils"
-import { EddsaPublicKey, EddsaSignature, StatusClaim } from "./types"
+import { EddsaPublicKey, EddsaSignature } from "./types"
 
 /**
  * Device-side revocation material (spec 08). r is 32 random bytes, generated
@@ -51,8 +52,10 @@ export function signCommitmentOwnership(
 }
 
 /**
- * Issuer-side check: verifies the EdDSA signature over the nonce, recomputes
- * the commitment from the public key, and compares it to the claimed one.
+ * Issuer-side check: requires a prime-order public key, verifies the EdDSA
+ * signature over the nonce, recomputes the commitment from the public key, and
+ * compares it to the claimed one. A low-order key is refused because its
+ * signatures need no secret.
  */
 export function verifyCommitmentOwnership(params: {
     commitment: bigint
@@ -61,6 +64,9 @@ export function verifyCommitmentOwnership(params: {
     nonce: Uint8Array
 }): boolean {
     try {
+        if (!inPrimeOrderSubgroup(params.publicKey)) {
+            return false
+        }
         if (!Identity.verifySignature(nonceToBigint(params.nonce), params.signature, params.publicKey)) {
             return false
         }
@@ -69,13 +75,3 @@ export function verifyCommitmentOwnership(params: {
         return false
     }
 }
-
-/** Builds the status.cn_zk_revocation claim for the signed body (spec 07). */
-export function buildStatusClaim(commitment: bigint, revocationRegistry: string): StatusClaim {
-    return {
-        cn_zk_revocation: {
-            revocationRegistry,
-            revocationCommitment: commitment.toString(10)
-        }
-    }
-}

package/src/signer.ts

@@ -1,21 +1,9 @@
 import { Jwk } from "./types"
 
-/**
- * Issuer signing key, KMS-shaped. sign receives the JWS signing input in
- * message mode (the service applies SHA-256 itself, never a precomputed
- * digest) and returns the raw 64-byte r||s signature.
- */
-export interface Signer {
+/** Holder P-256 device key backed by a secure element in production. */
+export interface DeviceSigner {
     getPublicKeyJwk(): Promise<Jwk>
     sign(message: Uint8Array): Promise<Uint8Array>
-}
-
-/**
- * Holder P-256 device key: the secure element in the app, a software key in
- * tests. Same contract as Signer; a separate type because the two keys must
- * never be interchangeable in signatures.
- */
-export interface DeviceSigner extends Signer {
     /** Signs an already-computed 32-byte digest, without hashing it again. */
     signDigest(digest: Uint8Array): Promise<Uint8Array>
 }

package/src/types.ts

@@ -27,31 +27,6 @@ export interface EddsaSignature {
     S: bigint
 }
 
-/**
- * The custom status member inside the signed body (spec 07). The commitment
- * is issuer-attested and visible to WS1 verifiers by design.
- */
-export interface StatusClaim {
-    cn_zk_revocation: {
-        /** urn:cn:contract: URN of the on-chain revocation registry. */
-        revocationRegistry: string
-        revocationCommitment: string
-    }
-}
-
-/** The reconstructed claim set of a verified credential. */
-export interface ApprovalCredentialClaims {
-    vct: string
-    iss: string
-    sub: string
-    jti: string
-    nbf: number
-    exp: number
-    cnf: { jwk: Jwk }
-    status: StatusClaim
-    approvalScope: ApprovalScope
-}
-
 export interface IssuanceRequest {
     issuerNetworkId: Hex32
     subjectNetworkId: Hex32
@@ -70,10 +45,6 @@ export interface IssuanceRequest {
     }
 }
 
-export interface SdJwtIssueParams extends IssuanceRequest {
-    revocationRegistry: string
-}
-
 export interface ZkCredentialIssueParams extends IssuanceRequest {
     identityPublicKey: EddsaPublicKey
 }
@@ -107,10 +78,3 @@ export interface SerializedZkCredential {
     issuerPublicKey: [string, string]
     signature: { R8: [string, string]; S: string }
 }
-
-export type VerifyErrorCode =
-    "MALFORMED" | "ISSUER_NOT_APPROVED" | "KEY_NOT_FOUND" | "PROOF_INVALID" | "EXPIRED" | "NOT_YET_VALID" | "REVOKED"
-
-/** Checks run in spec order (07, verification flow) and the first failure wins. */
-export type VerifyResult =
-    { ok: true; claims: ApprovalCredentialClaims } | { ok: false; code: VerifyErrorCode; message: string }

package/src/zk-proof.ts

@@ -25,6 +25,12 @@ export interface ExpectedZkPresentation {
     country: string
 }
 
+/**
+ * `approvedIssuerRoot` and `revocationRoot` are the proof's public outputs and are
+ * not checked here. Check them against the registries before accepting the presentation:
+ * the issuer root against the approved-issuer set, the revocation root with the revocation
+ * registry's `isValidRoot`.
+ */
 export type ZkPresentationVerifyResult =
     | { ok: true; approvedIssuerRoot: bigint; revocationRoot: bigint }
     | { ok: false; code: "PUBLIC_INPUT_MISMATCH"; publicInput?: PublicInputName }
@@ -183,6 +189,10 @@ export async function generateZkPresentationProof(
     }
 }
 
+/**
+ * Verifies a presentation proof against the expected public inputs and returns the roots
+ * from the proof. Check those roots against the registries; see {@link ZkPresentationVerifyResult}.
+ */
 export async function verifyZkPresentationProof(
     circuit: CompiledCircuit,
     proof: ZkPresentationProof,

package/dist/decode.d.ts

@@ -1,8 +0,0 @@
-import { ApprovalCredentialClaims } from "./types";
-/**
- * Decodes a compact SD-JWT and reconstructs the full claim set from its
- * disclosures WITHOUT verifying the signature — for callers that already
- * trust the token, such as the issuer reading back a token it just signed.
- * Untrusted tokens go through verifyCredential/verifyPresentation instead.
- */
-export declare function decodeSdJwtCredentialClaims(token: string): ApprovalCredentialClaims;

package/dist/decode.js

@@ -1,27 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.decodeSdJwtCredentialClaims = decodeSdJwtCredentialClaims;
-const decode_1 = require("@sd-jwt/decode");
-const crypto_1 = require("./crypto");
-const profile_1 = require("./profile");
-/**
- * Decodes a compact SD-JWT and reconstructs the full claim set from its
- * disclosures WITHOUT verifying the signature — for callers that already
- * trust the token, such as the issuer reading back a token it just signed.
- * Untrusted tokens go through verifyCredential/verifyPresentation instead.
- */
-function decodeSdJwtCredentialClaims(token) {
-    let reconstructed;
-    try {
-        const decoded = (0, decode_1.decodeSdJwtSync)(token, crypto_1.sdJwtHasher);
-        reconstructed = (0, decode_1.getClaimsSync)(decoded.jwt.payload, decoded.disclosures, crypto_1.sdJwtHasher);
-    }
-    catch {
-        throw new Error("token is not a decodable SD-JWT");
-    }
-    const checked = (0, profile_1.validateClaims)(reconstructed);
-    if (!checked.ok) {
-        throw new Error(checked.message);
-    }
-    return checked.claims;
-}

package/dist/issue.d.ts

@@ -1,9 +0,0 @@
-import { ApprovalResolver } from "./resolver";
-import { Signer } from "./signer";
-import { SdJwtIssueParams } from "./types";
-/**
- * Issues the delegated user approval credential (spec 07, issuance flow).
- * Throws IssuanceError, without signing anything, if the issuer isn't
- * approved or any challenge signature fails.
- */
-export declare function issueSdJwtCredential(params: SdJwtIssueParams, signer: Signer, approval: ApprovalResolver): Promise<string>;

package/dist/issue.js

@@ -1,65 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.issueSdJwtCredential = issueSdJwtCredential;
-const sd_jwt_vc_1 = require("@sd-jwt/sd-jwt-vc");
-const identity_1 = require("@coordination-network/identity");
-const crypto_1 = require("./crypto");
-const errors_1 = require("./errors");
-const profile_1 = require("./profile");
-const revocation_1 = require("./revocation");
-/**
- * Issues the delegated user approval credential (spec 07, issuance flow).
- * Throws IssuanceError, without signing anything, if the issuer isn't
- * approved or any challenge signature fails.
- */
-async function issueSdJwtCredential(params, signer, approval) {
-    if (!(await approval.isApprovedNetworkMember(params.issuerNetworkId))) {
-        throw new errors_1.IssuanceError("ISSUER_NOT_APPROVED", `issuer ${params.issuerNetworkId} is not an approved network member`);
-    }
-    if (!(params.validFrom < params.validUntil)) {
-        throw new errors_1.IssuanceError("INVALID_PARAMS", "validFrom must be before validUntil");
-    }
-    let binding;
-    try {
-        binding = (0, identity_1.verifyCredentialBinding)({
-            nonce: params.nonce,
-            accountPublicKey: params.accountPublicKey,
-            confirmationKey: (0, crypto_1.jwkToPublicKeyBytes)(params.confirmationKey),
-            accountSignature: params.accountPopSignature,
-            deviceSignature: params.devicePopSignature
-        });
-    }
-    catch (error) {
-        if (error instanceof identity_1.InvalidBindingInputError) {
-            throw new errors_1.IssuanceError("INVALID_PARAMS", `malformed binding input: ${error.message}`);
-        }
-        throw error;
-    }
-    if (binding.networkId !== params.subjectNetworkId.toLowerCase()) {
-        throw new errors_1.IssuanceError("SUBJECT_MISMATCH", "subjectNetworkId does not match the account public key");
-    }
-    if (!binding.valid) {
-        throw new errors_1.IssuanceError("BINDING_INVALID", "credential binding failed");
-    }
-    const ownershipOk = (0, revocation_1.verifyCommitmentOwnership)({
-        commitment: params.revocation.commitment,
-        publicKey: params.revocation.publicKey,
-        signature: params.revocation.ownershipSignature,
-        nonce: params.nonce
-    });
-    if (!ownershipOk) {
-        throw new errors_1.IssuanceError("COMMITMENT_OWNERSHIP_INVALID", "revocation commitment ownership proof failed");
-    }
-    const payload = (0, profile_1.buildPayload)({ ...params, subjectNetworkId: binding.networkId }, `urn:uuid:${(0, crypto_1.randomUuid)()}`);
-    const sdjwt = new sd_jwt_vc_1.SDJwtVcInstance({
-        signer: (0, crypto_1.createSdJwtSigner)(signer),
-        signAlg: "ES256",
-        hasher: crypto_1.sdJwtHasher,
-        hashAlg: "sha-256",
-        saltGenerator: crypto_1.sdJwtSaltGenerator
-    });
-    // Cast: the library types `status` as its own status-list reference, but
-    // our custom cn_zk_revocation member is deliberate (spec 07) and the
-    // status-list fetcher only triggers on status.status_list.
-    return sdjwt.issue({ ...payload }, profile_1.DISCLOSURE_FRAME);
-}

package/dist/present.d.ts

@@ -1,32 +0,0 @@
-import { Resolver } from "./resolver";
-import { DeviceSigner } from "./signer";
-import { VerifyResult } from "./types";
-export interface PresentOptions {
-    /** Verifier URN, pinned as the KB-JWT audience. */
-    audience: string;
-    /** Verifier-issued nonce, echoed in the KB-JWT. */
-    nonce: string;
-    /** Which approvalScope members to disclose. Both when omitted. */
-    disclose?: ("programme" | "country")[];
-}
-export interface VerifyPresentationOptions {
-    /** The verifier's own URN; the KB-JWT audience must match it. */
-    audience: string;
-    /** The nonce this verifier handed out; must be fresh and match. */
-    nonce: string;
-    /** Verification time, unix seconds. Defaults to now. */
-    currentDate?: number;
-}
-/**
- * Builds a presentation from a stored credential: the JWS, the selected
- * disclosures, and a KB-JWT signed by the device key binding the verifier's
- * audience, the nonce and the sd_hash of the exact presented token (spec 07,
- * verification flow step 7).
- */
-export declare function presentSdJwtCredential(token: string, deviceSigner: DeviceSigner, options: PresentOptions): Promise<string>;
-/**
- * Verifies a presentation: the full verifyCredential pipeline, plus the
- * KB-JWT under the credential's cnf.jwk with nonce, sd_hash (both checked by
- * the library) and audience (checked here) pinned.
- */
-export declare function verifySdJwtPresentation(presentation: string, resolver: Resolver, options: VerifyPresentationOptions): Promise<VerifyResult>;

package/dist/present.js

@@ -1,73 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.presentSdJwtCredential = presentSdJwtCredential;
-exports.verifySdJwtPresentation = verifySdJwtPresentation;
-const sd_jwt_vc_1 = require("@sd-jwt/sd-jwt-vc");
-const crypto_1 = require("./crypto");
-const verify_1 = require("./verify");
-/**
- * Builds a presentation from a stored credential: the JWS, the selected
- * disclosures, and a KB-JWT signed by the device key binding the verifier's
- * audience, the nonce and the sd_hash of the exact presented token (spec 07,
- * verification flow step 7).
- */
-async function presentSdJwtCredential(token, deviceSigner, options) {
-    const disclose = options.disclose ?? ["programme", "country"];
-    const frame = { approvalScope: Object.fromEntries(disclose.map((member) => [member, true])) };
-    const sdjwt = new sd_jwt_vc_1.SDJwtVcInstance({
-        hasher: crypto_1.sdJwtHasher,
-        hashAlg: "sha-256",
-        saltGenerator: crypto_1.sdJwtSaltGenerator,
-        kbSigner: (0, crypto_1.createSdJwtSigner)(deviceSigner),
-        kbSignAlg: "ES256"
-    });
-    return sdjwt.present(token, frame, {
-        kb: {
-            payload: {
-                aud: options.audience,
-                nonce: options.nonce,
-                iat: Math.floor(Date.now() / 1000)
-            }
-        }
-    });
-}
-/**
- * Verifies a presentation: the full verifyCredential pipeline, plus the
- * KB-JWT under the credential's cnf.jwk with nonce, sd_hash (both checked by
- * the library) and audience (checked here) pinned.
- */
-async function verifySdJwtPresentation(presentation, resolver, options) {
-    const now = options.currentDate ?? Math.floor(Date.now() / 1000);
-    let audience;
-    const { result } = await (0, verify_1.runPipeline)(presentation, resolver, now, async (issuerJwk, clampedNow) => {
-        const sdjwt = new sd_jwt_vc_1.SDJwtVcInstance({
-            verifier: (0, crypto_1.createSdJwtVerifier)(issuerJwk),
-            hasher: crypto_1.sdJwtHasher,
-            hashAlg: "sha-256",
-            kbVerifier: (data, signature, payload) => {
-                const cnfJwk = payload.cnf?.jwk;
-                if (!cnfJwk)
-                    return false;
-                try {
-                    return (0, crypto_1.createSdJwtVerifier)(cnfJwk)(data, signature);
-                }
-                catch {
-                    return false;
-                }
-            }
-        });
-        const { payload, kb } = await sdjwt.verify(presentation, {
-            currentDate: clampedNow,
-            keyBindingNonce: options.nonce
-        });
-        audience = kb?.payload.aud;
-        return payload;
-    });
-    if (!result.ok) {
-        return result;
-    }
-    if (audience !== options.audience) {
-        return { ok: false, code: "PROOF_INVALID", message: "KB-JWT audience does not match this verifier" };
-    }
-    return result;
-}

package/dist/profile.d.ts

@@ -1,32 +0,0 @@
-import { ApprovalCredentialClaims, Hex32, SdJwtIssueParams } from "./types";
-/**
- * The claims profile of the delegated user approval credential (spec 07):
- * payload construction, the disclosure frame, and the shape validator that
- * backs the MALFORMED verdict.
- */
-export declare const APPROVAL_CREDENTIAL_VCT = "urn:cn:credential:approval:v1";
-/** Only the two approvalScope members are disclosable; everything else is plain. */
-export declare const DISCLOSURE_FRAME: {
-    readonly approvalScope: {
-        readonly _sd: readonly ["programme", "country"];
-    };
-};
-export declare function networkIdToUrn(id: Hex32): string;
-export declare function urnToNetworkId(urn: string): Hex32 | null;
-/** Assembles the full signed payload; the disclosure frame is applied at issue time. */
-export declare function buildPayload(params: SdJwtIssueParams, jti: string): ApprovalCredentialClaims;
-type ClaimsCheck = {
-    ok: true;
-    claims: ApprovalCredentialClaims;
-} | {
-    ok: false;
-    message: string;
-};
-/**
- * Validates the reconstructed payload of a verified token against the
- * profile. Strict on both sides: a missing required claim and an unknown
- * plain claim both fail (spec 07; a tampered disclosure surfaces here as a
- * missing approvalScope member).
- */
-export declare function validateClaims(payload: unknown): ClaimsCheck;
-export {};

package/dist/profile.js

@@ -1,122 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DISCLOSURE_FRAME = exports.APPROVAL_CREDENTIAL_VCT = void 0;
-exports.networkIdToUrn = networkIdToUrn;
-exports.urnToNetworkId = urnToNetworkId;
-exports.buildPayload = buildPayload;
-exports.validateClaims = validateClaims;
-const revocation_1 = require("./revocation");
-/**
- * The claims profile of the delegated user approval credential (spec 07):
- * payload construction, the disclosure frame, and the shape validator that
- * backs the MALFORMED verdict.
- */
-exports.APPROVAL_CREDENTIAL_VCT = "urn:cn:credential:approval:v1";
-/** Only the two approvalScope members are disclosable; everything else is plain. */
-exports.DISCLOSURE_FRAME = {
-    approvalScope: { _sd: ["programme", "country"] }
-};
-const NETWORK_ID_RE = /^0x[0-9a-f]{64}$/;
-const NETWORK_URN_RE = /^urn:cn:network:[0-9a-f]{64}$/;
-const CONTRACT_URN_RE = /^urn:cn:contract:.+$/;
-const UUID_URN_RE = /^urn:uuid:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
-function networkIdToUrn(id) {
-    const normalized = id.toLowerCase();
-    if (!NETWORK_ID_RE.test(normalized)) {
-        throw new Error("networkId must be a 0x-prefixed 32-byte hex string");
-    }
-    return `urn:cn:network:${normalized.slice(2)}`;
-}
-function urnToNetworkId(urn) {
-    return NETWORK_URN_RE.test(urn) ? `0x${urn.slice("urn:cn:network:".length)}` : null;
-}
-/** Assembles the full signed payload; the disclosure frame is applied at issue time. */
-function buildPayload(params, jti) {
-    return {
-        vct: exports.APPROVAL_CREDENTIAL_VCT,
-        iss: networkIdToUrn(params.issuerNetworkId),
-        sub: networkIdToUrn(params.subjectNetworkId),
-        jti,
-        nbf: params.validFrom,
-        exp: params.validUntil,
-        cnf: { jwk: params.confirmationKey },
-        status: (0, revocation_1.buildStatusClaim)(params.revocation.commitment, params.revocationRegistry),
-        approvalScope: { ...params.approvalScope }
-    };
-}
-const ALLOWED_TOP_LEVEL = new Set(["vct", "iss", "sub", "jti", "nbf", "exp", "cnf", "status", "approvalScope"]);
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function isJwk(value) {
-    if (!isRecord(value))
-        return false;
-    const keys = Object.keys(value);
-    return (keys.length === 4 &&
-        value.kty === "EC" &&
-        value.crv === "P-256" &&
-        typeof value.x === "string" &&
-        typeof value.y === "string");
-}
-function isStatusClaim(value) {
-    if (!isRecord(value) || Object.keys(value).length !== 1)
-        return false;
-    const entry = value.cn_zk_revocation;
-    if (!isRecord(entry) || Object.keys(entry).length !== 2)
-        return false;
-    return (typeof entry.revocationRegistry === "string" &&
-        CONTRACT_URN_RE.test(entry.revocationRegistry) &&
-        typeof entry.revocationCommitment === "string" &&
-        /^[0-9]+$/.test(entry.revocationCommitment));
-}
-function isApprovalScope(value) {
-    if (!isRecord(value))
-        return false;
-    const keys = Object.keys(value);
-    return (keys.length === 2 &&
-        typeof value.programme === "string" &&
-        value.programme.length > 0 &&
-        typeof value.country === "string" &&
-        /^[A-Z]{3}$/.test(value.country));
-}
-/**
- * Validates the reconstructed payload of a verified token against the
- * profile. Strict on both sides: a missing required claim and an unknown
- * plain claim both fail (spec 07; a tampered disclosure surfaces here as a
- * missing approvalScope member).
- */
-function validateClaims(payload) {
-    if (!isRecord(payload)) {
-        return { ok: false, message: "payload is not an object" };
-    }
-    for (const key of Object.keys(payload)) {
-        if (!ALLOWED_TOP_LEVEL.has(key)) {
-            return { ok: false, message: `unknown claim: ${key}` };
-        }
-    }
-    if (payload.vct !== exports.APPROVAL_CREDENTIAL_VCT) {
-        return { ok: false, message: "vct missing or not the approval credential type" };
-    }
-    if (typeof payload.iss !== "string" || urnToNetworkId(payload.iss) === null) {
-        return { ok: false, message: "iss missing or not a urn:cn:network URN" };
-    }
-    if (typeof payload.sub !== "string" || urnToNetworkId(payload.sub) === null) {
-        return { ok: false, message: "sub missing or not a urn:cn:network URN" };
-    }
-    if (typeof payload.jti !== "string" || !UUID_URN_RE.test(payload.jti)) {
-        return { ok: false, message: "jti missing or not a urn:uuid URN" };
-    }
-    if (typeof payload.nbf !== "number" || typeof payload.exp !== "number") {
-        return { ok: false, message: "nbf/exp missing or not NumericDate values" };
-    }
-    if (!isRecord(payload.cnf) || Object.keys(payload.cnf).length !== 1 || !isJwk(payload.cnf.jwk)) {
-        return { ok: false, message: "cnf.jwk missing or not a P-256 JWK" };
-    }
-    if (!isStatusClaim(payload.status)) {
-        return { ok: false, message: "status.cn_zk_revocation missing or malformed" };
-    }
-    if (!isApprovalScope(payload.approvalScope)) {
-        return { ok: false, message: "approvalScope missing programme/country" };
-    }
-    return { ok: true, claims: payload };
-}

package/dist/verify.d.ts

@@ -1,29 +0,0 @@
-import { Resolver } from "./resolver";
-import { Hex32, Jwk, VerifyResult } from "./types";
-export interface VerifyOptions {
-    /** Verification time, unix seconds. Defaults to now. */
-    currentDate?: number;
-}
-/**
- * The shared verification pipeline (spec 07, verification flow), check order
- * first-failure-wins: decode/structure -> issuer approved -> key fetch ->
- * signature and disclosure digests -> claims shape -> validity window ->
- * revocation. A disclosure whose digest matches nothing is silently dropped
- * by the library (phase 1 spike), so it surfaces in the claims-shape step as
- * a missing approvalScope member and fails MALFORMED.
- *
- * The library's own nbf/exp check runs against a clamped timestamp so the
- * window verdict (EXPIRED vs NOT_YET_VALID) always comes from our check,
- * after the signature has been verified.
- */
-declare function runPipeline(token: string, resolver: Resolver, now: number, verifyWithLibrary: (issuerJwk: Jwk, clampedNow: number) => Promise<Record<string, unknown>>): Promise<{
-    result: VerifyResult;
-    issuerId?: Hex32;
-}>;
-/**
- * Verifies a compact SD-JWT credential with all its disclosures — the
- * holder's verify-on-receipt and any check that does not involve a live
- * presentation. Key binding is not checked here; that is verifyPresentation.
- */
-export declare function verifySdJwtCredential(token: string, resolver: Resolver, options?: VerifyOptions): Promise<VerifyResult>;
-export { runPipeline };

package/dist/verify.js

@@ -1,102 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.verifySdJwtCredential = verifySdJwtCredential;
-exports.runPipeline = runPipeline;
-const sd_jwt_vc_1 = require("@sd-jwt/sd-jwt-vc");
-const crypto_1 = require("./crypto");
-const profile_1 = require("./profile");
-const fail = (code, message) => ({ ok: false, code, message });
-/**
- * The shared verification pipeline (spec 07, verification flow), check order
- * first-failure-wins: decode/structure -> issuer approved -> key fetch ->
- * signature and disclosure digests -> claims shape -> validity window ->
- * revocation. A disclosure whose digest matches nothing is silently dropped
- * by the library (phase 1 spike), so it surfaces in the claims-shape step as
- * a missing approvalScope member and fails MALFORMED.
- *
- * The library's own nbf/exp check runs against a clamped timestamp so the
- * window verdict (EXPIRED vs NOT_YET_VALID) always comes from our check,
- * after the signature has been verified.
- */
-async function runPipeline(token, resolver, now, verifyWithLibrary) {
-    let payload;
-    try {
-        const jwt = token.split("~")[0];
-        const segments = jwt.split(".");
-        if (segments.length !== 3) {
-            return { result: fail("MALFORMED", "not a compact SD-JWT") };
-        }
-        payload = JSON.parse(new TextDecoder().decode((0, crypto_1.base64urlToBytes)(segments[1])));
-        if (typeof payload !== "object" || payload === null) {
-            return { result: fail("MALFORMED", "JWS payload is not an object") };
-        }
-    }
-    catch {
-        return { result: fail("MALFORMED", "token could not be decoded") };
-    }
-    const issuerId = typeof payload.iss === "string" ? (0, profile_1.urnToNetworkId)(payload.iss) : null;
-    if (issuerId === null) {
-        return { result: fail("MALFORMED", "iss missing or not a urn:cn:network URN") };
-    }
-    if (!(await resolver.isApprovedNetworkMember(issuerId))) {
-        return {
-            result: fail("ISSUER_NOT_APPROVED", `issuer ${payload.iss} is not an approved network member`),
-            issuerId
-        };
-    }
-    const issuerJwk = await resolver.getCredentialPublicKey(issuerId);
-    if (issuerJwk === null) {
-        return { result: fail("KEY_NOT_FOUND", `no credential public key published for ${payload.iss}`), issuerId };
-    }
-    // Clamp the library's clock inside the token's window; our own check below decides the verdict.
-    let clampedNow = now;
-    if (typeof payload.exp === "number" && clampedNow > payload.exp)
-        clampedNow = payload.exp;
-    if (typeof payload.nbf === "number" && clampedNow < payload.nbf)
-        clampedNow = payload.nbf;
-    let reconstructed;
-    try {
-        reconstructed = await verifyWithLibrary(issuerJwk, clampedNow);
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        if (message.includes("not yet valid"))
-            return { result: fail("NOT_YET_VALID", message), issuerId };
-        if (message.includes("expired"))
-            return { result: fail("EXPIRED", message), issuerId };
-        return { result: fail("PROOF_INVALID", message), issuerId };
-    }
-    const checked = (0, profile_1.validateClaims)(reconstructed);
-    if (!checked.ok) {
-        return { result: fail("MALFORMED", checked.message), issuerId };
-    }
-    const claims = checked.claims;
-    if (now < claims.nbf) {
-        return { result: fail("NOT_YET_VALID", "credential is not yet within its validity window"), issuerId };
-    }
-    if (now > claims.exp) {
-        return { result: fail("EXPIRED", "credential validity window has passed"), issuerId };
-    }
-    if (await resolver.isRevoked(BigInt(claims.status.cn_zk_revocation.revocationCommitment))) {
-        return { result: fail("REVOKED", "credential commitment is in the revocation registry"), issuerId };
-    }
-    return { result: { ok: true, claims }, issuerId };
-}
-/**
- * Verifies a compact SD-JWT credential with all its disclosures — the
- * holder's verify-on-receipt and any check that does not involve a live
- * presentation. Key binding is not checked here; that is verifyPresentation.
- */
-async function verifySdJwtCredential(token, resolver, options) {
-    const now = options?.currentDate ?? Math.floor(Date.now() / 1000);
-    const { result } = await runPipeline(token, resolver, now, async (issuerJwk, clampedNow) => {
-        const sdjwt = new sd_jwt_vc_1.SDJwtVcInstance({
-            verifier: (0, crypto_1.createSdJwtVerifier)(issuerJwk),
-            hasher: crypto_1.sdJwtHasher,
-            hashAlg: "sha-256"
-        });
-        const { payload } = await sdjwt.verify(token, { currentDate: clampedNow });
-        return payload;
-    });
-    return result;
-}