@coordination-network/credential 0.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ethereum Foundation
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,67 @@
+# @coordination-network/credential
+
+The credential SDK for the coordination network: issuing, verifying and presenting the delegated user approval credential, in both of the forms the network uses.
+
+- **SD-JWT VC**, for selective disclosure. The holder chooses which claims to reveal, and a key-binding JWT proves the presentation came from the device the credential was bound to.
+- **ZK credential**, for unlinkable presentation. The holder proves in zero knowledge that an approved issuer signed a credential that has not been revoked, without revealing the credential, the issuer or themselves.
+
+## Install
+
+```bash
+yarn add @coordination-network/credential
+```
+
+The zero-knowledge paths load [`@noir-lang/noir_js`](https://noir-lang.org) and [`@aztec/bb.js`](https://github.com/AztecProtocol/aztec-packages) lazily, so an application that only issues or verifies SD-JWT credentials never pulls the proving stack into its startup path.
+
+## Usage
+
+### Issuing
+
+```ts
+import { issueSdJwtCredential } from "@coordination-network/credential"
+
+const token = await issueSdJwtCredential(params, signer, approvalResolver)
+```
+
+### Verifying
+
+```ts
+import { verifySdJwtCredential } from "@coordination-network/credential"
+
+const result = await verifySdJwtCredential(token, resolver)
+```
+
+### Presenting
+
+```ts
+import { presentSdJwtCredential, verifySdJwtPresentation } from "@coordination-network/credential"
+
+const presentation = await presentSdJwtCredential(token, deviceSigner, {
+    audience: verifierId,
+    nonce,
+    disclose: ["programme", "country"]
+})
+
+const result = await verifySdJwtPresentation(presentation, resolver, { audience: verifierId, nonce })
+```
+
+### Revocation
+
+```ts
+import {
+    generateRevocationSecret,
+    deriveRevocationCommitment,
+    buildStatusClaim
+} from "@coordination-network/credential"
+
+const secret = generateRevocationSecret()
+const commitment = deriveRevocationCommitment(secret)
+```
+
+The holder generates the secret and shows the issuer the commitment, with `signCommitmentOwnership` / `verifyCommitmentOwnership` proving they hold the preimage. The issuer embeds the commitment in the credential's status claim. Revoking later means inserting that commitment into [`@coordination-network/revocation-registry`](../revocation-registry), and proving a credential is still valid means proving the commitment is absent from it. |
+
+## Notes
+
+- The signer interfaces are structural, so keys can live in a KMS, a hardware wallet or a device keystore without this package knowing.
+- `ApprovalResolver` and `IssuerSet` are the two seams onto network membership. [`@coordination-network/issuer-set`](../issuer-set) provides an implementation of the latter.
+- This package ships a CommonJS build. Both `import` and `require` work.

package/dist/credential-message.d.ts

@@ -0,0 +1,11 @@
+import { Jwk, SerializedZkCredential, ZkCredential, ZkCredentialBody } from "./types";
+export declare const CREDENTIAL_DOMAIN = 363566488821926773809509531830640889725124777157045803797738936823559174026n;
+export declare const DEVICE_KEY_DOMAIN = 320507632879070882430325612169297945123468706597652794395401074724051126576n;
+export declare function stringToField(value: string): bigint;
+export declare function programmeHash(programme: string): bigint;
+export declare function countryCode(country: string): number;
+export declare function deriveDeviceKeyCommitment(publicKey: Jwk): bigint;
+export declare function zkCredentialCommitment(body: ZkCredentialBody): bigint;
+export declare function serializeZkCredential(credential: ZkCredential): SerializedZkCredential;
+export declare function parseZkCredential(value: unknown): ZkCredential;
+export declare function verifyZkCredential(credential: ZkCredential): boolean;

package/dist/credential-message.js

@@ -0,0 +1,164 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEVICE_KEY_DOMAIN = exports.CREDENTIAL_DOMAIN = void 0;
+exports.stringToField = stringToField;
+exports.programmeHash = programmeHash;
+exports.countryCode = countryCode;
+exports.deriveDeviceKeyCommitment = deriveDeviceKeyCommitment;
+exports.zkCredentialCommitment = zkCredentialCommitment;
+exports.serializeZkCredential = serializeZkCredential;
+exports.parseZkCredential = parseZkCredential;
+exports.verifyZkCredential = verifyZkCredential;
+const identity_1 = require("@semaphore-protocol/identity");
+const poseidon3_1 = require("poseidon-lite/poseidon3");
+const poseidon4_1 = require("poseidon-lite/poseidon4");
+const poseidon5_1 = require("poseidon-lite/poseidon5");
+const viem_1 = require("viem");
+const utils_1 = require("@noble/hashes/utils");
+const crypto_1 = require("./crypto");
+// keccak256(utf8("urn:cn:credential:v1")) >> 8
+exports.CREDENTIAL_DOMAIN = 363566488821926773809509531830640889725124777157045803797738936823559174026n;
+exports.DEVICE_KEY_DOMAIN = 320507632879070882430325612169297945123468706597652794395401074724051126576n;
+const FIELD_MODULUS = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
+function stringToField(value) {
+    return BigInt((0, viem_1.keccak256)((0, viem_1.stringToHex)(value))) >> 8n;
+}
+function programmeHash(programme) {
+    if (programme.length === 0)
+        throw new Error("programme must not be empty");
+    return stringToField(programme);
+}
+function countryCode(country) {
+    if (!/^[A-Z]{3}$/.test(country))
+        throw new Error("country must be an ISO 3166-1 alpha-3 code");
+    return [...country].reduce((value, character) => (value << 8) | character.charCodeAt(0), 0);
+}
+const bytesToBigint = (value) => BigInt(`0x${(0, utils_1.bytesToHex)(value)}`);
+function deriveDeviceKeyCommitment(publicKey) {
+    const encoded = (0, crypto_1.jwkToPublicKeyBytes)(publicKey);
+    const x = encoded.slice(1, 33);
+    const y = encoded.slice(33, 65);
+    return (0, poseidon5_1.poseidon5)([
+        exports.DEVICE_KEY_DOMAIN,
+        bytesToBigint(x.slice(0, 16)),
+        bytesToBigint(x.slice(16, 32)),
+        bytesToBigint(y.slice(0, 16)),
+        bytesToBigint(y.slice(16, 32))
+    ]);
+}
+function zkCredentialCommitment(body) {
+    const policy = (0, poseidon4_1.poseidon4)([
+        body.programmeHash,
+        BigInt(body.countryCode),
+        BigInt(body.notBefore),
+        BigInt(body.expiresAt)
+    ]);
+    const keys = (0, poseidon3_1.poseidon3)([body.deviceKeyCommitment, body.holderKeyCommitment, body.revocationCommitment]);
+    return (0, poseidon3_1.poseidon3)([exports.CREDENTIAL_DOMAIN, policy, keys]);
+}
+const decimal = (value, name) => {
+    if (typeof value !== "string" || !/^(0|[1-9][0-9]*)$/.test(value))
+        throw new Error(`${name} must be decimal`);
+    const parsed = BigInt(value);
+    if (parsed >= FIELD_MODULUS)
+        throw new Error(`${name} must fit the BN254 field`);
+    return parsed;
+};
+const timestamp = (value, name) => {
+    if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) {
+        throw new Error(`${name} must be a non-negative integer`);
+    }
+    return value;
+};
+const encodedCountryCode = (value) => {
+    if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0 || value > 0xffffff) {
+        throw new Error("credential.body.countryCode must be a three-byte integer");
+    }
+    return value;
+};
+const record = (value, name) => {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new Error(`${name} must be an object`);
+    }
+    return value;
+};
+const exactKeys = (value, keys, name) => {
+    const actual = Object.keys(value).sort();
+    const expected = [...keys].sort();
+    if (actual.length !== expected.length || actual.some((key, index) => key !== expected[index])) {
+        throw new Error(`${name} has unexpected fields`);
+    }
+};
+function serializeZkCredential(credential) {
+    return {
+        body: {
+            programmeHash: credential.body.programmeHash.toString(),
+            countryCode: credential.body.countryCode,
+            notBefore: credential.body.notBefore,
+            expiresAt: credential.body.expiresAt,
+            deviceKeyCommitment: credential.body.deviceKeyCommitment.toString(),
+            holderKeyCommitment: credential.body.holderKeyCommitment.toString(),
+            revocationCommitment: credential.body.revocationCommitment.toString()
+        },
+        issuerPublicKey: credential.issuerPublicKey.map(String),
+        signature: {
+            R8: credential.signature.R8.map(String),
+            S: credential.signature.S.toString()
+        }
+    };
+}
+function parseZkCredential(value) {
+    const credential = record(value, "credential");
+    exactKeys(credential, ["body", "issuerPublicKey", "signature"], "credential");
+    const body = record(credential.body, "credential.body");
+    exactKeys(body, [
+        "programmeHash",
+        "countryCode",
+        "notBefore",
+        "expiresAt",
+        "deviceKeyCommitment",
+        "holderKeyCommitment",
+        "revocationCommitment"
+    ], "credential.body");
+    if (!Array.isArray(credential.issuerPublicKey) || credential.issuerPublicKey.length !== 2) {
+        throw new Error("credential.issuerPublicKey must contain two values");
+    }
+    const signature = record(credential.signature, "credential.signature");
+    exactKeys(signature, ["R8", "S"], "credential.signature");
+    if (!Array.isArray(signature.R8) || signature.R8.length !== 2) {
+        throw new Error("credential.signature.R8 must contain two values");
+    }
+    const parsed = {
+        body: {
+            programmeHash: decimal(body.programmeHash, "credential.body.programmeHash"),
+            countryCode: encodedCountryCode(body.countryCode),
+            notBefore: timestamp(body.notBefore, "credential.body.notBefore"),
+            expiresAt: timestamp(body.expiresAt, "credential.body.expiresAt"),
+            deviceKeyCommitment: decimal(body.deviceKeyCommitment, "credential.body.deviceKeyCommitment"),
+            holderKeyCommitment: decimal(body.holderKeyCommitment, "credential.body.holderKeyCommitment"),
+            revocationCommitment: decimal(body.revocationCommitment, "credential.body.revocationCommitment")
+        },
+        issuerPublicKey: [
+            decimal(credential.issuerPublicKey[0], "credential.issuerPublicKey[0]"),
+            decimal(credential.issuerPublicKey[1], "credential.issuerPublicKey[1]")
+        ],
+        signature: {
+            R8: [
+                decimal(signature.R8[0], "credential.signature.R8[0]"),
+                decimal(signature.R8[1], "credential.signature.R8[1]")
+            ],
+            S: decimal(signature.S, "credential.signature.S")
+        }
+    };
+    if (parsed.body.notBefore >= parsed.body.expiresAt)
+        throw new Error("credential validity window is invalid");
+    return parsed;
+}
+function verifyZkCredential(credential) {
+    try {
+        return identity_1.Identity.verifySignature(zkCredentialCommitment(credential.body), credential.signature, credential.issuerPublicKey);
+    }
+    catch {
+        return false;
+    }
+}

package/dist/credential-signer.d.ts

@@ -0,0 +1,11 @@
+import { EddsaPublicKey, EddsaSignature } from "./types";
+export interface CredentialSigner {
+    getPublicKey(): Promise<EddsaPublicKey>;
+    sign(message: bigint): Promise<EddsaSignature>;
+}
+export declare class LocalCredentialSigner implements CredentialSigner {
+    private readonly identity;
+    constructor(secret: string | Uint8Array);
+    getPublicKey(): Promise<EddsaPublicKey>;
+    sign(message: bigint): Promise<EddsaSignature>;
+}

package/dist/credential-signer.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LocalCredentialSigner = void 0;
+const identity_1 = require("@semaphore-protocol/identity");
+class LocalCredentialSigner {
+    constructor(secret) {
+        this.identity = new identity_1.Identity(secret);
+    }
+    async getPublicKey() {
+        return [this.identity.publicKey[0], this.identity.publicKey[1]];
+    }
+    async sign(message) {
+        const signature = this.identity.signMessage(message);
+        return { R8: [signature.R8[0], signature.R8[1]], S: signature.S };
+    }
+}
+exports.LocalCredentialSigner = LocalCredentialSigner;

package/dist/crypto.d.ts

@@ -0,0 +1,51 @@
+import { bytesToBase64url } from "@coordination-network/identity";
+import { Jwk } from "./types";
+import { DeviceSigner, Signer } from "./signer";
+export { bytesToBase64url };
+/**
+ * Padding is optional under RFC 4648 §5 and some clients send it anyway (Python's
+ * urlsafe_b64encode, Java's URL encoder), so JWK coordinates are stripped before the strict decode
+ * rather than rejected.
+ */
+export declare function base64urlToBytes(encoded: string): Uint8Array;
+/** Uncompressed SEC1 point (65 bytes, 0x04 || x || y) from a P-256 JWK. */
+export declare function jwkToPublicKeyBytes(jwk: Jwk): Uint8Array;
+/**
+ * Registry keys are stored as the compressed SEC1 point (33 bytes, spec 07).
+ * Both converters go through the curve, so an off-curve point throws instead
+ * of round-tripping garbage.
+ */
+export declare function compressedPointToJwk(point: Uint8Array): Jwk;
+export declare function jwkToCompressedPoint(jwk: Jwk): Uint8Array;
+/** RFC 7638 JWK thumbprint: SHA-256 over the ordered required members. */
+export declare function jwkThumbprint(jwk: Jwk): Uint8Array;
+/**
+ * ECDSA P-256 verification in message mode. lowS is not enforced on verify:
+ * we produce low-s signatures ourselves, but external signers (KMS) may not,
+ * and JWS does not require it.
+ */
+export declare function verifyP256(message: Uint8Array, signature: Uint8Array, publicKey: Uint8Array): boolean;
+/** Bridges a Signer to the @sd-jwt signer callback (base64url over utf8 input). */
+export declare function createSdJwtSigner(signer: Signer): (data: string) => Promise<string>;
+/** Builds the @sd-jwt verifier callback from a resolved issuer JWK. */
+export declare function createSdJwtVerifier(jwk: Jwk): (data: string, signature: string) => boolean;
+/** The sha-256 hasher the @sd-jwt config takes. */
+export declare function sdJwtHasher(data: string | ArrayBuffer): Uint8Array;
+/** Hex salts for disclosure digests. */
+export declare function sdJwtSaltGenerator(length: number): string;
+/** RFC 4122 v4 UUID from CSPRNG bytes — node:crypto is unavailable under React Native. */
+export declare function randomUuid(): string;
+/**
+ * Software P-256 signer. The issuer demo and every test use it; production
+ * issuers replace it with a KMS-backed Signer, apps with a secure-element
+ * DeviceSigner. Signs in message mode with low-s, raw 64-byte output —
+ * exactly the Signer contract.
+ */
+export declare class LocalP256Signer implements Signer, DeviceSigner {
+    private readonly privateKey;
+    constructor(privateKey: Uint8Array);
+    static generate(): LocalP256Signer;
+    getPublicKeyJwk(): Promise<Jwk>;
+    sign(message: Uint8Array): Promise<Uint8Array>;
+    signDigest(digest: Uint8Array): Promise<Uint8Array>;
+}

package/dist/crypto.js

@@ -0,0 +1,141 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LocalP256Signer = exports.bytesToBase64url = void 0;
+exports.base64urlToBytes = base64urlToBytes;
+exports.jwkToPublicKeyBytes = jwkToPublicKeyBytes;
+exports.compressedPointToJwk = compressedPointToJwk;
+exports.jwkToCompressedPoint = jwkToCompressedPoint;
+exports.jwkThumbprint = jwkThumbprint;
+exports.verifyP256 = verifyP256;
+exports.createSdJwtSigner = createSdJwtSigner;
+exports.createSdJwtVerifier = createSdJwtVerifier;
+exports.sdJwtHasher = sdJwtHasher;
+exports.sdJwtSaltGenerator = sdJwtSaltGenerator;
+exports.randomUuid = randomUuid;
+const nist_js_1 = require("@noble/curves/nist.js");
+const sha2_1 = require("@noble/hashes/sha2");
+const utils_1 = require("@noble/hashes/utils");
+const identity_1 = require("@coordination-network/identity");
+Object.defineProperty(exports, "bytesToBase64url", { enumerable: true, get: function () { return identity_1.bytesToBase64url; } });
+/** Bridges the KMS-shaped Signer interface, the noble primitives, and the callback shapes @sd-jwt expects. */
+const utf8 = (data) => new TextEncoder().encode(data);
+/**
+ * Padding is optional under RFC 4648 §5 and some clients send it anyway (Python's
+ * urlsafe_b64encode, Java's URL encoder), so JWK coordinates are stripped before the strict decode
+ * rather than rejected.
+ */
+function base64urlToBytes(encoded) {
+    const unpadded = encoded.replace(/=+$/, "");
+    const invalid = unpadded.match(/[^A-Za-z0-9_-]/);
+    if (invalid)
+        throw new Error(`invalid base64url character: ${invalid[0]}`);
+    return (0, identity_1.base64urlToBytes)(unpadded);
+}
+/** Uncompressed SEC1 point (65 bytes, 0x04 || x || y) from a P-256 JWK. */
+function jwkToPublicKeyBytes(jwk) {
+    const x = base64urlToBytes(jwk.x);
+    const y = base64urlToBytes(jwk.y);
+    if (jwk.kty !== "EC" || jwk.crv !== "P-256" || x.length !== 32 || y.length !== 32) {
+        throw new Error("expected a P-256 EC JWK with 32-byte coordinates");
+    }
+    const point = new Uint8Array(65);
+    point[0] = 0x04;
+    point.set(x, 1);
+    point.set(y, 33);
+    return point;
+}
+/**
+ * Registry keys are stored as the compressed SEC1 point (33 bytes, spec 07).
+ * Both converters go through the curve, so an off-curve point throws instead
+ * of round-tripping garbage.
+ */
+function compressedPointToJwk(point) {
+    const raw = nist_js_1.p256.ProjectivePoint.fromHex(point).toRawBytes(false);
+    return {
+        kty: "EC",
+        crv: "P-256",
+        x: (0, identity_1.bytesToBase64url)(raw.slice(1, 33)),
+        y: (0, identity_1.bytesToBase64url)(raw.slice(33, 65))
+    };
+}
+function jwkToCompressedPoint(jwk) {
+    return nist_js_1.p256.ProjectivePoint.fromHex(jwkToPublicKeyBytes(jwk)).toRawBytes(true);
+}
+/** RFC 7638 JWK thumbprint: SHA-256 over the ordered required members. */
+function jwkThumbprint(jwk) {
+    return (0, sha2_1.sha256)(JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y }));
+}
+/**
+ * ECDSA P-256 verification in message mode. lowS is not enforced on verify:
+ * we produce low-s signatures ourselves, but external signers (KMS) may not,
+ * and JWS does not require it.
+ */
+function verifyP256(message, signature, publicKey) {
+    try {
+        return nist_js_1.p256.verify(signature, (0, sha2_1.sha256)(message), publicKey, { lowS: false });
+    }
+    catch {
+        return false;
+    }
+}
+/** Bridges a Signer to the @sd-jwt signer callback (base64url over utf8 input). */
+function createSdJwtSigner(signer) {
+    return async (data) => (0, identity_1.bytesToBase64url)(await signer.sign(utf8(data)));
+}
+/** Builds the @sd-jwt verifier callback from a resolved issuer JWK. */
+function createSdJwtVerifier(jwk) {
+    const publicKey = jwkToPublicKeyBytes(jwk);
+    return (data, signature) => {
+        try {
+            return verifyP256(utf8(data), base64urlToBytes(signature), publicKey);
+        }
+        catch {
+            return false;
+        }
+    };
+}
+/** The sha-256 hasher the @sd-jwt config takes. */
+function sdJwtHasher(data) {
+    return (0, sha2_1.sha256)(typeof data === "string" ? data : new Uint8Array(data));
+}
+/** Hex salts for disclosure digests. */
+function sdJwtSaltGenerator(length) {
+    return (0, utils_1.bytesToHex)((0, utils_1.randomBytes)(length));
+}
+/** RFC 4122 v4 UUID from CSPRNG bytes — node:crypto is unavailable under React Native. */
+function randomUuid() {
+    const bytes = (0, utils_1.randomBytes)(16);
+    bytes[6] = (bytes[6] & 0x0f) | 0x40;
+    bytes[8] = (bytes[8] & 0x3f) | 0x80;
+    const hex = (0, utils_1.bytesToHex)(bytes);
+    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+/**
+ * Software P-256 signer. The issuer demo and every test use it; production
+ * issuers replace it with a KMS-backed Signer, apps with a secure-element
+ * DeviceSigner. Signs in message mode with low-s, raw 64-byte output —
+ * exactly the Signer contract.
+ */
+class LocalP256Signer {
+    constructor(privateKey) {
+        if (privateKey.length !== 32) {
+            throw new Error("P-256 private key must be 32 bytes");
+        }
+        this.privateKey = privateKey;
+    }
+    static generate() {
+        return new LocalP256Signer(nist_js_1.p256.utils.randomSecretKey());
+    }
+    async getPublicKeyJwk() {
+        return compressedPointToJwk(nist_js_1.p256.getPublicKey(this.privateKey, true));
+    }
+    async sign(message) {
+        return nist_js_1.p256.sign((0, sha2_1.sha256)(message), this.privateKey, { lowS: true }).toCompactRawBytes();
+    }
+    async signDigest(digest) {
+        if (digest.length !== 32)
+            throw new Error("P-256 digest must be 32 bytes");
+        return nist_js_1.p256.sign(digest, this.privateKey, { lowS: true }).toCompactRawBytes();
+    }
+}
+exports.LocalP256Signer = LocalP256Signer;

package/dist/decode.d.ts

@@ -0,0 +1,8 @@
+import { ApprovalCredentialClaims } from "./types";
+/**
+ * Decodes a compact SD-JWT and reconstructs the full claim set from its
+ * disclosures WITHOUT verifying the signature — for callers that already
+ * trust the token, such as the issuer reading back a token it just signed.
+ * Untrusted tokens go through verifyCredential/verifyPresentation instead.
+ */
+export declare function decodeSdJwtCredentialClaims(token: string): ApprovalCredentialClaims;

package/dist/decode.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decodeSdJwtCredentialClaims = decodeSdJwtCredentialClaims;
+const decode_1 = require("@sd-jwt/decode");
+const crypto_1 = require("./crypto");
+const profile_1 = require("./profile");
+/**
+ * Decodes a compact SD-JWT and reconstructs the full claim set from its
+ * disclosures WITHOUT verifying the signature — for callers that already
+ * trust the token, such as the issuer reading back a token it just signed.
+ * Untrusted tokens go through verifyCredential/verifyPresentation instead.
+ */
+function decodeSdJwtCredentialClaims(token) {
+    let reconstructed;
+    try {
+        const decoded = (0, decode_1.decodeSdJwtSync)(token, crypto_1.sdJwtHasher);
+        reconstructed = (0, decode_1.getClaimsSync)(decoded.jwt.payload, decoded.disclosures, crypto_1.sdJwtHasher);
+    }
+    catch {
+        throw new Error("token is not a decodable SD-JWT");
+    }
+    const checked = (0, profile_1.validateClaims)(reconstructed);
+    if (!checked.ok) {
+        throw new Error(checked.message);
+    }
+    return checked.claims;
+}

package/dist/errors.d.ts

@@ -0,0 +1,5 @@
+export type IssuanceErrorCode = "INVALID_PARAMS" | "ISSUER_NOT_APPROVED" | "SUBJECT_MISMATCH" | "BINDING_INVALID" | "COMMITMENT_OWNERSHIP_INVALID";
+export declare class IssuanceError extends Error {
+    readonly code: IssuanceErrorCode;
+    constructor(code: IssuanceErrorCode, message: string);
+}

package/dist/errors.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IssuanceError = void 0;
+class IssuanceError extends Error {
+    constructor(code, message) {
+        super(message);
+        this.name = "IssuanceError";
+        this.code = code;
+    }
+}
+exports.IssuanceError = IssuanceError;

package/dist/index.d.ts

@@ -0,0 +1,19 @@
+export * from "./errors";
+export * from "./types";
+export * from "./signer";
+export * from "./credential-message";
+export * from "./credential-signer";
+export * from "./issue-credential";
+export * from "./issuer-set";
+export * from "./presentation-inputs";
+export * from "./witness";
+export * from "./zk-proof";
+export * from "./resolver";
+export * from "./registry-client";
+export * from "./crypto";
+export * from "./decode";
+export * from "./profile";
+export * from "./issue";
+export * from "./verify";
+export * from "./present";
+export * from "./revocation";

package/dist/index.js

@@ -0,0 +1,35 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./errors"), exports);
+__exportStar(require("./types"), exports);
+__exportStar(require("./signer"), exports);
+__exportStar(require("./credential-message"), exports);
+__exportStar(require("./credential-signer"), exports);
+__exportStar(require("./issue-credential"), exports);
+__exportStar(require("./issuer-set"), exports);
+__exportStar(require("./presentation-inputs"), exports);
+__exportStar(require("./witness"), exports);
+__exportStar(require("./zk-proof"), exports);
+__exportStar(require("./resolver"), exports);
+__exportStar(require("./registry-client"), exports);
+__exportStar(require("./crypto"), exports);
+__exportStar(require("./decode"), exports);
+__exportStar(require("./profile"), exports);
+__exportStar(require("./issue"), exports);
+__exportStar(require("./verify"), exports);
+__exportStar(require("./present"), exports);
+__exportStar(require("./revocation"), exports);

package/dist/issue-credential.d.ts

@@ -0,0 +1,4 @@
+import { CredentialSigner } from "./credential-signer";
+import { ApprovalResolver } from "./resolver";
+import { ZkCredential, ZkCredentialIssueParams } from "./types";
+export declare function issueZkCredential(params: ZkCredentialIssueParams, signer: CredentialSigner, approval: ApprovalResolver): Promise<ZkCredential>;