@credo-ts/core 0.6.1-pr-2091-20241119140918 → 0.6.1

package/build/modules/vc/sd-jwt-vc/W3cV2SdJwtCredentialService.mjs

@@ -0,0 +1,250 @@
+
+
+import { CredoError } from "../../../error/CredoError.mjs";
+import "../../../error/index.mjs";
+import { injectable } from "../../../plugins/index.mjs";
+import { __decorate } from "../../../_virtual/_@oxc-project_runtime@0.99.0/helpers/decorate.mjs";
+import { asArray } from "../../../utils/array.mjs";
+import { TypedArrayEncoder } from "../../../utils/TypedArrayEncoder.mjs";
+import { MessageValidator } from "../../../utils/MessageValidator.mjs";
+import { JsonTransformer } from "../../../utils/JsonTransformer.mjs";
+import { nowInSeconds } from "../../../utils/timestamp.mjs";
+import "../../../utils/index.mjs";
+import { KeyManagementApi } from "../../kms/KeyManagementApi.mjs";
+import "../../kms/index.mjs";
+import { JwtPayload } from "../../../crypto/jose/jwt/JwtPayload.mjs";
+import { getPublicJwkFromVerificationMethod } from "../../dids/domain/key-type/keyDidMapping.mjs";
+import "../../../crypto/index.mjs";
+import { sdJwtVcHasher } from "./W3cV2SdJwt.mjs";
+import { W3cV2SdJwtVerifiableCredential } from "./W3cV2SdJwtVerifiableCredential.mjs";
+import { extractKeyFromHolderBinding, getSdJwtSigner, getSdJwtVerifier, parseHolderBindingFromCredential } from "../../sd-jwt-vc/utils.mjs";
+import { W3cV2SdJwtVerifiablePresentation } from "./W3cV2SdJwtVerifiablePresentation.mjs";
+import { extractHolderFromPresentationCredentials, getVerificationMethodForJwt, validateAndResolveVerificationMethod } from "../v2-jwt-utils.mjs";
+import { SDJwtInstance } from "@sd-jwt/core";
+
+//#region src/modules/vc/sd-jwt-vc/W3cV2SdJwtCredentialService.ts
+/**
+* List of fields that cannot be selectively disclosed.
+*
+* @see https://www.w3.org/TR/vc-jose-cose/#securing-with-sd-jwt
+* @see https://www.w3.org/TR/vc-jose-cose/#securing-vps-sd-jwt
+*/
+const NON_DISCLOSEABLE_FIELDS = [
+	"@context",
+	"type",
+	"credentialStatus",
+	"credentialSchema",
+	"relatedResource"
+];
+let W3cV2SdJwtCredentialService = class W3cV2SdJwtCredentialService$1 {
+	/**
+	* Signs a credential
+	*/
+	async signCredential(agentContext, options) {
+		MessageValidator.validateSync(options.credential);
+		const payload = JsonTransformer.toJSON(options.credential);
+		payload.iat = nowInSeconds();
+		payload.cnf = options.holder ? (await extractKeyFromHolderBinding(agentContext, options.holder)).cnf : void 0;
+		const publicJwk = await validateAndResolveVerificationMethod(agentContext, options.verificationMethod, ["assertionMethod"]);
+		const disclosureFrame = options.disclosureFrame;
+		this.validateDisclosureFrame(disclosureFrame);
+		const compact = await new SDJwtInstance({
+			...this.getBaseSdJwtConfig(agentContext),
+			signer: getSdJwtSigner(agentContext, publicJwk),
+			hashAlg: options.hashingAlgorithm ?? "sha-256",
+			signAlg: options.alg
+		}).issue(payload, disclosureFrame, { header: {
+			typ: "vc+sd-jwt",
+			alg: options.alg,
+			kid: options.verificationMethod
+		} });
+		return W3cV2SdJwtVerifiableCredential.fromCompact(compact);
+	}
+	/**
+	* Verifies the signature(s) of a credential
+	*
+	* @param credential the credential to be verified
+	* @returns the verification result
+	*/
+	async verifyCredential(agentContext, options) {
+		const validationResults = {
+			isValid: false,
+			validations: {}
+		};
+		const sdJwt = new SDJwtInstance({ ...this.getBaseSdJwtConfig(agentContext) });
+		try {
+			let credential;
+			try {
+				if (options.credential instanceof W3cV2SdJwtVerifiableCredential) options.credential.validate();
+				credential = options.credential instanceof W3cV2SdJwtVerifiableCredential ? options.credential : W3cV2SdJwtVerifiableCredential.fromCompact(options.credential);
+				JwtPayload.fromJson(credential.sdJwt.payload).validate();
+				validationResults.validations.dataModel = { isValid: true };
+			} catch (error) {
+				validationResults.validations.dataModel = {
+					isValid: false,
+					error
+				};
+				return validationResults;
+			}
+			const issuerVerificationMethod = await getVerificationMethodForJwt(agentContext, credential, ["assertionMethod"]);
+			const issuerPublicKey = getPublicJwkFromVerificationMethod(issuerVerificationMethod);
+			const holderBinding = parseHolderBindingFromCredential(credential.sdJwt.prettyClaims);
+			const holder = holderBinding ? await extractKeyFromHolderBinding(agentContext, holderBinding) : void 0;
+			sdJwt.config({
+				verifier: getSdJwtVerifier(agentContext, issuerPublicKey),
+				kbVerifier: holder ? getSdJwtVerifier(agentContext, holder.publicJwk) : void 0
+			});
+			try {
+				await sdJwt.verify(credential.encoded);
+				validationResults.validations.signature = { isValid: true };
+			} catch (error) {
+				validationResults.validations.signature = {
+					isValid: false,
+					error
+				};
+			}
+			if (credential.resolvedCredential.issuerId !== issuerVerificationMethod.controller) validationResults.validations.issuerIsSigner = {
+				isValid: false,
+				error: new CredoError(`Credential is signed using verification method ${issuerVerificationMethod.id}, while the issuer of the credential is '${credential.resolvedCredential.issuerId}'`)
+			};
+			else validationResults.validations.issuerIsSigner = { isValid: true };
+			validationResults.isValid = Object.values(validationResults.validations).every((v) => v.isValid);
+			return validationResults;
+		} catch (error) {
+			validationResults.error = error;
+			return validationResults;
+		}
+	}
+	/**
+	* Signs a presentation including the credentials it includes
+	*
+	* @param presentation the presentation to be signed
+	* @returns the signed presentation
+	*/
+	async signPresentation(agentContext, options) {
+		MessageValidator.validateSync(options.presentation);
+		const payload = JsonTransformer.toJSON(options.presentation);
+		payload.nonce = options.challenge;
+		payload.aud = options.domain;
+		const holder = await extractHolderFromPresentationCredentials(agentContext, options.presentation);
+		const sdJwt = new SDJwtInstance({
+			...this.getBaseSdJwtConfig(agentContext),
+			signer: getSdJwtSigner(agentContext, holder.publicJwk),
+			hashAlg: options.hashingAlgorithm ?? "sha-256",
+			signAlg: holder.alg
+		});
+		const disclosureFrame = options.disclosureFrame;
+		this.validateDisclosureFrame(disclosureFrame);
+		const compact = await sdJwt.issue(payload, disclosureFrame, { header: {
+			typ: "vp+sd-jwt",
+			alg: holder.alg,
+			kid: holder?.cnf?.kid
+		} });
+		return W3cV2SdJwtVerifiablePresentation.fromCompact(compact);
+	}
+	/**
+	* Verifies a presentation including the credentials it includes
+	*
+	* @param presentation the presentation to be verified
+	* @returns the verification result
+	*/
+	async verifyPresentation(agentContext, options) {
+		const validationResults = {
+			isValid: false,
+			validations: {}
+		};
+		const sdjwt = new SDJwtInstance({ ...this.getBaseSdJwtConfig(agentContext) });
+		try {
+			let presentation;
+			try {
+				if (options.presentation instanceof W3cV2SdJwtVerifiablePresentation) MessageValidator.validateSync(options.presentation.resolvedPresentation);
+				presentation = options.presentation instanceof W3cV2SdJwtVerifiablePresentation ? options.presentation : W3cV2SdJwtVerifiablePresentation.fromCompact(options.presentation);
+				JwtPayload.fromJson(presentation.sdJwt.payload).validate();
+				validationResults.validations.dataModel = { isValid: true };
+			} catch (error) {
+				validationResults.validations.dataModel = {
+					isValid: false,
+					error
+				};
+				return validationResults;
+			}
+			const proverVerificationMethod = await getVerificationMethodForJwt(agentContext, presentation, ["authentication"]);
+			const proverPublicKey = getPublicJwkFromVerificationMethod(proverVerificationMethod);
+			const holderBinding = parseHolderBindingFromCredential(presentation.sdJwt.prettyClaims);
+			const holder = holderBinding ? await extractKeyFromHolderBinding(agentContext, holderBinding) : void 0;
+			sdjwt.config({
+				verifier: getSdJwtVerifier(agentContext, proverPublicKey),
+				kbVerifier: holder ? getSdJwtVerifier(agentContext, holder.publicJwk) : void 0
+			});
+			try {
+				await sdjwt.verify(presentation.encoded);
+				validationResults.validations.presentationSignature = { isValid: true };
+			} catch (error) {
+				validationResults.validations.presentationSignature = {
+					isValid: false,
+					error
+				};
+			}
+			if (presentation.resolvedPresentation.holderId && proverVerificationMethod.controller !== presentation.resolvedPresentation.holderId) validationResults.validations.holderIsSigner = {
+				isValid: false,
+				error: new CredoError(`Presentation is signed using verification method ${proverVerificationMethod.id}, while the holder of the presentation is '${presentation.resolvedPresentation.holderId}'`)
+			};
+			else validationResults.validations.holderIsSigner = { isValid: true };
+			const credentials = asArray(presentation.resolvedPresentation.verifiableCredential);
+			validationResults.validations.credentials = await Promise.all(credentials.map(async (credential) => {
+				if (!(credential.envelopedCredential instanceof W3cV2SdJwtVerifiableCredential)) return {
+					isValid: false,
+					error: new CredoError("Credential is not of format SD-JWT. Presentations in SD-JWT format can only contain credentials in SD-JWT format."),
+					validations: {}
+				};
+				const credentialResult = await this.verifyCredential(agentContext, { credential: credential.envelopedCredential });
+				let credentialSubjectAuthentication;
+				const credentialSubjectIds = credential.resolvedCredential.credentialSubjectIds;
+				const presentationAuthenticatesCredentialSubject = credentialSubjectIds.some((subjectId) => proverVerificationMethod.controller === subjectId);
+				if (credentialSubjectIds.length > 0 && !presentationAuthenticatesCredentialSubject) credentialSubjectAuthentication = {
+					isValid: false,
+					error: new CredoError("Credential has one or more credentialSubject ids, but presentation does not authenticate credential subject")
+				};
+				else credentialSubjectAuthentication = { isValid: true };
+				return {
+					...credentialResult,
+					isValid: credentialResult.isValid && credentialSubjectAuthentication.isValid,
+					validations: {
+						...credentialResult.validations,
+						credentialSubjectAuthentication
+					}
+				};
+			}));
+			validationResults.isValid = Object.values(validationResults.validations).every((v) => Array.isArray(v) ? v.every((vv) => vv.isValid) : v.isValid);
+			return validationResults;
+		} catch (error) {
+			validationResults.error = error;
+			return validationResults;
+		}
+	}
+	async present(agentContext, options) {
+		const originalCompact = options.credential instanceof W3cV2SdJwtVerifiableCredential ? options.credential.encoded : options.credential;
+		const presentationFrame = options.presentationFrame;
+		const disclosedCompact = await new SDJwtInstance(this.getBaseSdJwtConfig(agentContext)).present(originalCompact, presentationFrame);
+		return W3cV2SdJwtVerifiableCredential.fromCompact(disclosedCompact);
+	}
+	validateDisclosureFrame(disclosureFrame) {
+		if (!disclosureFrame) return;
+		for (const field of NON_DISCLOSEABLE_FIELDS) {
+			if (disclosureFrame[field]) throw new CredoError(`'${field}' property cannot be selectively disclosed`);
+			if (Array.isArray(disclosureFrame._sd) && disclosureFrame._sd?.includes(field)) throw new CredoError(`'${field}' property cannot be selectively disclosed`);
+		}
+	}
+	getBaseSdJwtConfig(agentContext) {
+		const kms = agentContext.resolve(KeyManagementApi);
+		return {
+			hasher: sdJwtVcHasher,
+			saltGenerator: (length) => TypedArrayEncoder.toBase64URL(kms.randomBytes({ length })).slice(0, length)
+		};
+	}
+};
+W3cV2SdJwtCredentialService = __decorate([injectable()], W3cV2SdJwtCredentialService);
+
+//#endregion
+export { W3cV2SdJwtCredentialService };
+//# sourceMappingURL=W3cV2SdJwtCredentialService.mjs.map

package/build/modules/vc/sd-jwt-vc/W3cV2SdJwtCredentialService.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"W3cV2SdJwtCredentialService.mjs","names":["W3cV2SdJwtCredentialService","validationResults: W3cV2VerifyCredentialResult","credential: W3cV2SdJwtVerifiableCredential","validationResults: W3cV2VerifyPresentationResult","presentation: W3cV2SdJwtVerifiablePresentation","credentialSubjectAuthentication: SingleValidationResult"],"sources":["../../../../src/modules/vc/sd-jwt-vc/W3cV2SdJwtCredentialService.ts"],"sourcesContent":["import { SDJwtInstance } from '@sd-jwt/core'\nimport type { DisclosureFrame, PresentationFrame, SDJWTConfig } from '@sd-jwt/types'\nimport type { AgentContext } from '../../../agent/context'\nimport { JwtPayload } from '../../../crypto'\nimport { CredoError } from '../../../error'\nimport { injectable } from '../../../plugins'\nimport { asArray, JsonTransformer, MessageValidator, nowInSeconds, TypedArrayEncoder } from '../../../utils'\nimport { getPublicJwkFromVerificationMethod } from '../../dids/domain/key-type/keyDidMapping'\nimport { KeyManagementApi } from '../../kms'\nimport {\n  extractKeyFromHolderBinding,\n  getSdJwtSigner,\n  getSdJwtVerifier,\n  parseHolderBindingFromCredential,\n} from '../../sd-jwt-vc/utils'\nimport type {\n  SingleValidationResult,\n  W3cV2JsonCredential,\n  W3cV2JsonPresentation,\n  W3cV2VerifyCredentialResult,\n  W3cV2VerifyPresentationResult,\n} from '../models'\nimport {\n  extractHolderFromPresentationCredentials,\n  getVerificationMethodForJwt,\n  validateAndResolveVerificationMethod,\n} from '../v2-jwt-utils'\nimport type {\n  W3cV2SdJwtSignCredentialOptions,\n  W3cV2SdJwtSignPresentationOptions,\n  W3cV2SdJwtVcPresentOptions,\n  W3cV2SdJwtVerifyCredentialOptions,\n  W3cV2SdJwtVerifyPresentationOptions,\n} from '../W3cV2CredentialServiceOptions'\nimport { sdJwtVcHasher } from './W3cV2SdJwt'\nimport { W3cV2SdJwtVerifiableCredential } from './W3cV2SdJwtVerifiableCredential'\nimport { W3cV2SdJwtVerifiablePresentation } from './W3cV2SdJwtVerifiablePresentation'\n\n/**\n * List of fields that cannot be selectively disclosed.\n *\n * @see https://www.w3.org/TR/vc-jose-cose/#securing-with-sd-jwt\n * @see https://www.w3.org/TR/vc-jose-cose/#securing-vps-sd-jwt\n */\nconst NON_DISCLOSEABLE_FIELDS = ['@context', 'type', 'credentialStatus', 'credentialSchema', 'relatedResource']\n\n/**\n * Supports signing and verifying W3C Verifiable Credentials and Presentations\n * secured with Selective Disclosure JSON Web Tokens (SD-JWT).\n *\n * @see https://www.w3.org/TR/vc-data-model/\n * @see https://www.w3.org/TR/vc-jose-cose/#with-sd-jwt\n */\n@injectable()\nexport class W3cV2SdJwtCredentialService {\n  /**\n   * Signs a credential\n   */\n  public async signCredential(\n    agentContext: AgentContext,\n    options: W3cV2SdJwtSignCredentialOptions\n  ): Promise<W3cV2SdJwtVerifiableCredential> {\n    // Validate the instance\n    MessageValidator.validateSync(options.credential)\n\n    // The JWT payload is simply the credential\n    const payload = JsonTransformer.toJSON(options.credential) as W3cV2JsonCredential\n\n    // Add iat and cnf to the payload\n    payload.iat = nowInSeconds()\n    payload.cnf = options.holder ? (await extractKeyFromHolderBinding(agentContext, options.holder)).cnf : undefined\n\n    // Validate and resolve the verification method\n    const publicJwk = await validateAndResolveVerificationMethod(agentContext, options.verificationMethod, [\n      'assertionMethod',\n    ])\n\n    // Validate the disclosure frame\n    const disclosureFrame = options.disclosureFrame as DisclosureFrame<W3cV2JsonCredential> | undefined\n    this.validateDisclosureFrame(disclosureFrame)\n\n    const sdJwt = new SDJwtInstance({\n      ...this.getBaseSdJwtConfig(agentContext),\n      signer: getSdJwtSigner(agentContext, publicJwk),\n      hashAlg: options.hashingAlgorithm ?? 'sha-256',\n      signAlg: options.alg,\n    })\n\n    // Sign SD-JWT\n    const compact = await sdJwt.issue<W3cV2JsonCredential>(payload, disclosureFrame, {\n      header: {\n        typ: 'vc+sd-jwt',\n        alg: options.alg,\n        kid: options.verificationMethod,\n      },\n    })\n\n    return W3cV2SdJwtVerifiableCredential.fromCompact(compact)\n  }\n\n  /**\n   * Verifies the signature(s) of a credential\n   *\n   * @param credential the credential to be verified\n   * @returns the verification result\n   */\n  public async verifyCredential(\n    agentContext: AgentContext,\n    options: W3cV2SdJwtVerifyCredentialOptions\n  ): Promise<W3cV2VerifyCredentialResult> {\n    const validationResults: W3cV2VerifyCredentialResult = {\n      isValid: false,\n      validations: {},\n    }\n\n    const sdJwt = new SDJwtInstance({\n      ...this.getBaseSdJwtConfig(agentContext),\n    })\n\n    try {\n      let credential: W3cV2SdJwtVerifiableCredential\n      try {\n        // If instance is provided as input, we want to validate the credential\n        // Otherwise, it is done by fromCompact below\n        if (options.credential instanceof W3cV2SdJwtVerifiableCredential) {\n          options.credential.validate()\n        }\n\n        credential =\n          options.credential instanceof W3cV2SdJwtVerifiableCredential\n            ? options.credential\n            : W3cV2SdJwtVerifiableCredential.fromCompact(options.credential)\n\n        // Validate JWT payload\n        JwtPayload.fromJson(credential.sdJwt.payload).validate()\n\n        validationResults.validations.dataModel = {\n          isValid: true,\n        }\n      } catch (error) {\n        validationResults.validations.dataModel = {\n          isValid: false,\n          error,\n        }\n\n        return validationResults\n      }\n\n      const issuerVerificationMethod = await getVerificationMethodForJwt(agentContext, credential, ['assertionMethod'])\n      const issuerPublicKey = getPublicJwkFromVerificationMethod(issuerVerificationMethod)\n\n      const holderBinding = parseHolderBindingFromCredential(credential.sdJwt.prettyClaims)\n      const holder = holderBinding ? await extractKeyFromHolderBinding(agentContext, holderBinding) : undefined\n\n      sdJwt.config({\n        verifier: getSdJwtVerifier(agentContext, issuerPublicKey),\n        kbVerifier: holder ? getSdJwtVerifier(agentContext, holder.publicJwk) : undefined,\n      })\n\n      try {\n        await sdJwt.verify(credential.encoded)\n\n        validationResults.validations.signature = {\n          isValid: true,\n        }\n      } catch (error) {\n        validationResults.validations.signature = {\n          isValid: false,\n          error,\n        }\n      }\n\n      // Validate whether the credential is signed with the 'issuer' id\n      // NOTE: this uses the verificationMethod.controller. We may want to use the verificationMethod.id?\n      if (credential.resolvedCredential.issuerId !== issuerVerificationMethod.controller) {\n        validationResults.validations.issuerIsSigner = {\n          isValid: false,\n          error: new CredoError(\n            `Credential is signed using verification method ${issuerVerificationMethod.id}, while the issuer of the credential is '${credential.resolvedCredential.issuerId}'`\n          ),\n        }\n      } else {\n        validationResults.validations.issuerIsSigner = {\n          isValid: true,\n        }\n      }\n\n      validationResults.isValid = Object.values(validationResults.validations).every((v) => v.isValid)\n      return validationResults\n    } catch (error) {\n      validationResults.error = error\n      return validationResults\n    }\n  }\n\n  /**\n   * Signs a presentation including the credentials it includes\n   *\n   * @param presentation the presentation to be signed\n   * @returns the signed presentation\n   */\n  public async signPresentation(\n    agentContext: AgentContext,\n    options: W3cV2SdJwtSignPresentationOptions\n  ): Promise<W3cV2SdJwtVerifiablePresentation> {\n    // Validate the instance\n    MessageValidator.validateSync(options.presentation)\n\n    // The JWT payload is simply the presentation\n    const payload = JsonTransformer.toJSON(options.presentation) as W3cV2JsonPresentation\n\n    // Add the nonce and aud to the payload\n    payload.nonce = options.challenge\n    payload.aud = options.domain\n\n    const holder = await extractHolderFromPresentationCredentials(agentContext, options.presentation)\n\n    const sdJwt = new SDJwtInstance({\n      ...this.getBaseSdJwtConfig(agentContext),\n      signer: getSdJwtSigner(agentContext, holder.publicJwk),\n      hashAlg: options.hashingAlgorithm ?? 'sha-256',\n      signAlg: holder.alg,\n    })\n\n    // Validate the disclosure frame\n    const disclosureFrame = options.disclosureFrame as DisclosureFrame<W3cV2JsonPresentation> | undefined\n    this.validateDisclosureFrame(disclosureFrame)\n\n    // Sign SD-JWT\n    const compact = await sdJwt.issue<W3cV2JsonPresentation>(payload, disclosureFrame, {\n      header: {\n        typ: 'vp+sd-jwt',\n        alg: holder.alg,\n        kid: holder?.cnf?.kid,\n      },\n    })\n\n    return W3cV2SdJwtVerifiablePresentation.fromCompact(compact)\n  }\n\n  /**\n   * Verifies a presentation including the credentials it includes\n   *\n   * @param presentation the presentation to be verified\n   * @returns the verification result\n   */\n  public async verifyPresentation(\n    agentContext: AgentContext,\n    options: W3cV2SdJwtVerifyPresentationOptions\n  ): Promise<W3cV2VerifyPresentationResult> {\n    const validationResults: W3cV2VerifyPresentationResult = {\n      isValid: false,\n      validations: {},\n    }\n\n    const sdjwt = new SDJwtInstance({\n      ...this.getBaseSdJwtConfig(agentContext),\n    })\n\n    try {\n      let presentation: W3cV2SdJwtVerifiablePresentation\n      try {\n        // If instance is provided as input, we want to validate the presentation\n        if (options.presentation instanceof W3cV2SdJwtVerifiablePresentation) {\n          MessageValidator.validateSync(options.presentation.resolvedPresentation)\n        }\n\n        presentation =\n          options.presentation instanceof W3cV2SdJwtVerifiablePresentation\n            ? options.presentation\n            : W3cV2SdJwtVerifiablePresentation.fromCompact(options.presentation)\n\n        // Validate JWT payload\n        JwtPayload.fromJson(presentation.sdJwt.payload).validate()\n\n        validationResults.validations.dataModel = {\n          isValid: true,\n        }\n      } catch (error) {\n        validationResults.validations.dataModel = {\n          isValid: false,\n          error,\n        }\n\n        return validationResults\n      }\n\n      const proverVerificationMethod = await getVerificationMethodForJwt(agentContext, presentation, ['authentication'])\n      const proverPublicKey = getPublicJwkFromVerificationMethod(proverVerificationMethod)\n      const holderBinding = parseHolderBindingFromCredential(presentation.sdJwt.prettyClaims)\n      const holder = holderBinding ? await extractKeyFromHolderBinding(agentContext, holderBinding) : undefined\n\n      sdjwt.config({\n        verifier: getSdJwtVerifier(agentContext, proverPublicKey),\n        kbVerifier: holder ? getSdJwtVerifier(agentContext, holder.publicJwk) : undefined,\n      })\n\n      try {\n        await sdjwt.verify(presentation.encoded)\n\n        validationResults.validations.presentationSignature = {\n          isValid: true,\n        }\n      } catch (error) {\n        validationResults.validations.presentationSignature = {\n          isValid: false,\n          error,\n        }\n      }\n\n      // Validate whether the presentation is signed with the 'holder' id\n      // NOTE: this uses the verificationMethod.controller. We may want to use the verificationMethod.id?\n      if (\n        presentation.resolvedPresentation.holderId &&\n        proverVerificationMethod.controller !== presentation.resolvedPresentation.holderId\n      ) {\n        validationResults.validations.holderIsSigner = {\n          isValid: false,\n          error: new CredoError(\n            `Presentation is signed using verification method ${proverVerificationMethod.id}, while the holder of the presentation is '${presentation.resolvedPresentation.holderId}'`\n          ),\n        }\n      } else {\n        // If no holderId is present, this validation passes by default as there can't be\n        // a mismatch between the 'holder' property and the signer of the presentation.\n        validationResults.validations.holderIsSigner = {\n          isValid: true,\n        }\n      }\n\n      // To keep things simple, we only support JWT VCs in JWT VPs for now\n      const credentials = asArray(presentation.resolvedPresentation.verifiableCredential)\n\n      // Verify all credentials in parallel, and await the result\n      validationResults.validations.credentials = await Promise.all(\n        credentials.map(async (credential) => {\n          if (!(credential.envelopedCredential instanceof W3cV2SdJwtVerifiableCredential)) {\n            return {\n              isValid: false,\n              error: new CredoError(\n                'Credential is not of format SD-JWT. Presentations in SD-JWT format can only contain credentials in SD-JWT format.'\n              ),\n              validations: {},\n            }\n          }\n\n          const credentialResult = await this.verifyCredential(agentContext, {\n            credential: credential.envelopedCredential,\n          })\n\n          let credentialSubjectAuthentication: SingleValidationResult\n\n          // Check whether any of the credentialSubjectIds for each credential is the same as the controller of the verificationMethod\n          // This authenticates the presentation creator controls one of the credentialSubject ids.\n          // NOTE: this doesn't take into account the case where the credentialSubject is no the holder. In the\n          // future we can add support for other flows, but for now this is the most common use case.\n          // TODO: should this be handled on a higher level? I don't really see it being handled in the jsonld lib\n          // or in the did-jwt-vc lib (it seems they don't even verify the credentials itself), but we probably need some\n          // more experience on the use cases before we loosen the restrictions (as it means we need to handle it on a higher layer).\n          const credentialSubjectIds = credential.resolvedCredential.credentialSubjectIds\n          const presentationAuthenticatesCredentialSubject = credentialSubjectIds.some(\n            (subjectId) => proverVerificationMethod.controller === subjectId\n          )\n\n          if (credentialSubjectIds.length > 0 && !presentationAuthenticatesCredentialSubject) {\n            credentialSubjectAuthentication = {\n              isValid: false,\n              error: new CredoError(\n                'Credential has one or more credentialSubject ids, but presentation does not authenticate credential subject'\n              ),\n            }\n          } else {\n            credentialSubjectAuthentication = {\n              isValid: true,\n            }\n          }\n\n          return {\n            ...credentialResult,\n            isValid: credentialResult.isValid && credentialSubjectAuthentication.isValid,\n            validations: {\n              ...credentialResult.validations,\n              credentialSubjectAuthentication,\n            },\n          }\n        })\n      )\n\n      // Deeply nested check whether all validations have passed\n      validationResults.isValid = Object.values(validationResults.validations).every((v) =>\n        Array.isArray(v) ? v.every((vv) => vv.isValid) : v.isValid\n      )\n\n      return validationResults\n    } catch (error) {\n      validationResults.error = error\n      return validationResults\n    }\n  }\n\n  public async present(\n    agentContext: AgentContext,\n    options: W3cV2SdJwtVcPresentOptions\n  ): Promise<W3cV2SdJwtVerifiableCredential> {\n    const originalCompact =\n      options.credential instanceof W3cV2SdJwtVerifiableCredential ? options.credential.encoded : options.credential\n\n    const presentationFrame = options.presentationFrame as PresentationFrame<W3cV2JsonCredential>\n\n    const sdjwt = new SDJwtInstance(this.getBaseSdJwtConfig(agentContext))\n    const disclosedCompact = await sdjwt.present(originalCompact, presentationFrame)\n\n    return W3cV2SdJwtVerifiableCredential.fromCompact(disclosedCompact)\n  }\n\n  private validateDisclosureFrame(disclosureFrame?: DisclosureFrame<W3cV2JsonCredential | W3cV2JsonPresentation>) {\n    if (!disclosureFrame) return\n\n    for (const field of NON_DISCLOSEABLE_FIELDS) {\n      if (disclosureFrame[field]) {\n        throw new CredoError(`'${field}' property cannot be selectively disclosed`)\n      }\n\n      if (Array.isArray(disclosureFrame._sd) && disclosureFrame._sd?.includes(field)) {\n        throw new CredoError(`'${field}' property cannot be selectively disclosed`)\n      }\n    }\n  }\n\n  private getBaseSdJwtConfig(agentContext: AgentContext): SDJWTConfig {\n    const kms = agentContext.resolve(KeyManagementApi)\n\n    return {\n      hasher: sdJwtVcHasher,\n      saltGenerator: (length) => TypedArrayEncoder.toBase64URL(kms.randomBytes({ length })).slice(0, length),\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4CA,MAAM,0BAA0B;CAAC;CAAY;CAAQ;CAAoB;CAAoB;CAAkB;AAUxG,wCAAMA,8BAA4B;;;;CAIvC,MAAa,eACX,cACA,SACyC;AAEzC,mBAAiB,aAAa,QAAQ,WAAW;EAGjD,MAAM,UAAU,gBAAgB,OAAO,QAAQ,WAAW;AAG1D,UAAQ,MAAM,cAAc;AAC5B,UAAQ,MAAM,QAAQ,UAAU,MAAM,4BAA4B,cAAc,QAAQ,OAAO,EAAE,MAAM;EAGvG,MAAM,YAAY,MAAM,qCAAqC,cAAc,QAAQ,oBAAoB,CACrG,kBACD,CAAC;EAGF,MAAM,kBAAkB,QAAQ;AAChC,OAAK,wBAAwB,gBAAgB;EAU7C,MAAM,UAAU,MARF,IAAI,cAAc;GAC9B,GAAG,KAAK,mBAAmB,aAAa;GACxC,QAAQ,eAAe,cAAc,UAAU;GAC/C,SAAS,QAAQ,oBAAoB;GACrC,SAAS,QAAQ;GAClB,CAAC,CAG0B,MAA2B,SAAS,iBAAiB,EAC/E,QAAQ;GACN,KAAK;GACL,KAAK,QAAQ;GACb,KAAK,QAAQ;GACd,EACF,CAAC;AAEF,SAAO,+BAA+B,YAAY,QAAQ;;;;;;;;CAS5D,MAAa,iBACX,cACA,SACsC;EACtC,MAAMC,oBAAiD;GACrD,SAAS;GACT,aAAa,EAAE;GAChB;EAED,MAAM,QAAQ,IAAI,cAAc,EAC9B,GAAG,KAAK,mBAAmB,aAAa,EACzC,CAAC;AAEF,MAAI;GACF,IAAIC;AACJ,OAAI;AAGF,QAAI,QAAQ,sBAAsB,+BAChC,SAAQ,WAAW,UAAU;AAG/B,iBACE,QAAQ,sBAAsB,iCAC1B,QAAQ,aACR,+BAA+B,YAAY,QAAQ,WAAW;AAGpE,eAAW,SAAS,WAAW,MAAM,QAAQ,CAAC,UAAU;AAExD,sBAAkB,YAAY,YAAY,EACxC,SAAS,MACV;YACM,OAAO;AACd,sBAAkB,YAAY,YAAY;KACxC,SAAS;KACT;KACD;AAED,WAAO;;GAGT,MAAM,2BAA2B,MAAM,4BAA4B,cAAc,YAAY,CAAC,kBAAkB,CAAC;GACjH,MAAM,kBAAkB,mCAAmC,yBAAyB;GAEpF,MAAM,gBAAgB,iCAAiC,WAAW,MAAM,aAAa;GACrF,MAAM,SAAS,gBAAgB,MAAM,4BAA4B,cAAc,cAAc,GAAG;AAEhG,SAAM,OAAO;IACX,UAAU,iBAAiB,cAAc,gBAAgB;IACzD,YAAY,SAAS,iBAAiB,cAAc,OAAO,UAAU,GAAG;IACzE,CAAC;AAEF,OAAI;AACF,UAAM,MAAM,OAAO,WAAW,QAAQ;AAEtC,sBAAkB,YAAY,YAAY,EACxC,SAAS,MACV;YACM,OAAO;AACd,sBAAkB,YAAY,YAAY;KACxC,SAAS;KACT;KACD;;AAKH,OAAI,WAAW,mBAAmB,aAAa,yBAAyB,WACtE,mBAAkB,YAAY,iBAAiB;IAC7C,SAAS;IACT,OAAO,IAAI,WACT,kDAAkD,yBAAyB,GAAG,2CAA2C,WAAW,mBAAmB,SAAS,GACjK;IACF;OAED,mBAAkB,YAAY,iBAAiB,EAC7C,SAAS,MACV;AAGH,qBAAkB,UAAU,OAAO,OAAO,kBAAkB,YAAY,CAAC,OAAO,MAAM,EAAE,QAAQ;AAChG,UAAO;WACA,OAAO;AACd,qBAAkB,QAAQ;AAC1B,UAAO;;;;;;;;;CAUX,MAAa,iBACX,cACA,SAC2C;AAE3C,mBAAiB,aAAa,QAAQ,aAAa;EAGnD,MAAM,UAAU,gBAAgB,OAAO,QAAQ,aAAa;AAG5D,UAAQ,QAAQ,QAAQ;AACxB,UAAQ,MAAM,QAAQ;EAEtB,MAAM,SAAS,MAAM,yCAAyC,cAAc,QAAQ,aAAa;EAEjG,MAAM,QAAQ,IAAI,cAAc;GAC9B,GAAG,KAAK,mBAAmB,aAAa;GACxC,QAAQ,eAAe,cAAc,OAAO,UAAU;GACtD,SAAS,QAAQ,oBAAoB;GACrC,SAAS,OAAO;GACjB,CAAC;EAGF,MAAM,kBAAkB,QAAQ;AAChC,OAAK,wBAAwB,gBAAgB;EAG7C,MAAM,UAAU,MAAM,MAAM,MAA6B,SAAS,iBAAiB,EACjF,QAAQ;GACN,KAAK;GACL,KAAK,OAAO;GACZ,KAAK,QAAQ,KAAK;GACnB,EACF,CAAC;AAEF,SAAO,iCAAiC,YAAY,QAAQ;;;;;;;;CAS9D,MAAa,mBACX,cACA,SACwC;EACxC,MAAMC,oBAAmD;GACvD,SAAS;GACT,aAAa,EAAE;GAChB;EAED,MAAM,QAAQ,IAAI,cAAc,EAC9B,GAAG,KAAK,mBAAmB,aAAa,EACzC,CAAC;AAEF,MAAI;GACF,IAAIC;AACJ,OAAI;AAEF,QAAI,QAAQ,wBAAwB,iCAClC,kBAAiB,aAAa,QAAQ,aAAa,qBAAqB;AAG1E,mBACE,QAAQ,wBAAwB,mCAC5B,QAAQ,eACR,iCAAiC,YAAY,QAAQ,aAAa;AAGxE,eAAW,SAAS,aAAa,MAAM,QAAQ,CAAC,UAAU;AAE1D,sBAAkB,YAAY,YAAY,EACxC,SAAS,MACV;YACM,OAAO;AACd,sBAAkB,YAAY,YAAY;KACxC,SAAS;KACT;KACD;AAED,WAAO;;GAGT,MAAM,2BAA2B,MAAM,4BAA4B,cAAc,cAAc,CAAC,iBAAiB,CAAC;GAClH,MAAM,kBAAkB,mCAAmC,yBAAyB;GACpF,MAAM,gBAAgB,iCAAiC,aAAa,MAAM,aAAa;GACvF,MAAM,SAAS,gBAAgB,MAAM,4BAA4B,cAAc,cAAc,GAAG;AAEhG,SAAM,OAAO;IACX,UAAU,iBAAiB,cAAc,gBAAgB;IACzD,YAAY,SAAS,iBAAiB,cAAc,OAAO,UAAU,GAAG;IACzE,CAAC;AAEF,OAAI;AACF,UAAM,MAAM,OAAO,aAAa,QAAQ;AAExC,sBAAkB,YAAY,wBAAwB,EACpD,SAAS,MACV;YACM,OAAO;AACd,sBAAkB,YAAY,wBAAwB;KACpD,SAAS;KACT;KACD;;AAKH,OACE,aAAa,qBAAqB,YAClC,yBAAyB,eAAe,aAAa,qBAAqB,SAE1E,mBAAkB,YAAY,iBAAiB;IAC7C,SAAS;IACT,OAAO,IAAI,WACT,oDAAoD,yBAAyB,GAAG,6CAA6C,aAAa,qBAAqB,SAAS,GACzK;IACF;OAID,mBAAkB,YAAY,iBAAiB,EAC7C,SAAS,MACV;GAIH,MAAM,cAAc,QAAQ,aAAa,qBAAqB,qBAAqB;AAGnF,qBAAkB,YAAY,cAAc,MAAM,QAAQ,IACxD,YAAY,IAAI,OAAO,eAAe;AACpC,QAAI,EAAE,WAAW,+BAA+B,gCAC9C,QAAO;KACL,SAAS;KACT,OAAO,IAAI,WACT,oHACD;KACD,aAAa,EAAE;KAChB;IAGH,MAAM,mBAAmB,MAAM,KAAK,iBAAiB,cAAc,EACjE,YAAY,WAAW,qBACxB,CAAC;IAEF,IAAIC;IASJ,MAAM,uBAAuB,WAAW,mBAAmB;IAC3D,MAAM,6CAA6C,qBAAqB,MACrE,cAAc,yBAAyB,eAAe,UACxD;AAED,QAAI,qBAAqB,SAAS,KAAK,CAAC,2CACtC,mCAAkC;KAChC,SAAS;KACT,OAAO,IAAI,WACT,8GACD;KACF;QAED,mCAAkC,EAChC,SAAS,MACV;AAGH,WAAO;KACL,GAAG;KACH,SAAS,iBAAiB,WAAW,gCAAgC;KACrE,aAAa;MACX,GAAG,iBAAiB;MACpB;MACD;KACF;KACD,CACH;AAGD,qBAAkB,UAAU,OAAO,OAAO,kBAAkB,YAAY,CAAC,OAAO,MAC9E,MAAM,QAAQ,EAAE,GAAG,EAAE,OAAO,OAAO,GAAG,QAAQ,GAAG,EAAE,QACpD;AAED,UAAO;WACA,OAAO;AACd,qBAAkB,QAAQ;AAC1B,UAAO;;;CAIX,MAAa,QACX,cACA,SACyC;EACzC,MAAM,kBACJ,QAAQ,sBAAsB,iCAAiC,QAAQ,WAAW,UAAU,QAAQ;EAEtG,MAAM,oBAAoB,QAAQ;EAGlC,MAAM,mBAAmB,MADX,IAAI,cAAc,KAAK,mBAAmB,aAAa,CAAC,CACjC,QAAQ,iBAAiB,kBAAkB;AAEhF,SAAO,+BAA+B,YAAY,iBAAiB;;CAGrE,AAAQ,wBAAwB,iBAAgF;AAC9G,MAAI,CAAC,gBAAiB;AAEtB,OAAK,MAAM,SAAS,yBAAyB;AAC3C,OAAI,gBAAgB,OAClB,OAAM,IAAI,WAAW,IAAI,MAAM,4CAA4C;AAG7E,OAAI,MAAM,QAAQ,gBAAgB,IAAI,IAAI,gBAAgB,KAAK,SAAS,MAAM,CAC5E,OAAM,IAAI,WAAW,IAAI,MAAM,4CAA4C;;;CAKjF,AAAQ,mBAAmB,cAAyC;EAClE,MAAM,MAAM,aAAa,QAAQ,iBAAiB;AAElD,SAAO;GACL,QAAQ;GACR,gBAAgB,WAAW,kBAAkB,YAAY,IAAI,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,GAAG,OAAO;GACvG;;;0CA9XJ,YAAY"}

package/build/modules/vc/sd-jwt-vc/W3cV2SdJwtVerifiableCredential.d.mts

@@ -0,0 +1,42 @@
+import { ClaimFormat } from "../models/ClaimFormat.mjs";
+import { W3cV2Credential } from "../models/credential/W3cV2Credential.mjs";
+import { W3cV2SdJwt } from "./W3cV2SdJwt.mjs";
+
+//#region src/modules/vc/sd-jwt-vc/W3cV2SdJwtVerifiableCredential.d.ts
+interface W3cV2SdJwtVerifiableCredentialOptions {
+  sdJwt: W3cV2SdJwt<ClaimFormat.SdJwtW3cVc>;
+}
+/**
+ * Represents a Verifiable Credential encoded as a SD-JWT.
+ *
+ * @see https://www.w3.org/TR/vc-jose-cose/#securing-with-sd-jwt
+ */
+declare class W3cV2SdJwtVerifiableCredential {
+  constructor(options: W3cV2SdJwtVerifiableCredentialOptions);
+  static fromCompact(compact: string): W3cV2SdJwtVerifiableCredential;
+  /**
+   * The original SD-JWT.
+   */
+  readonly sdJwt: W3cV2SdJwt<ClaimFormat.SdJwtW3cVc>;
+  /**
+   * Resolved credential is the fully resolved {@link W3cV2Credential} instance.
+   */
+  readonly resolvedCredential: W3cV2Credential;
+  /**
+   * The encoded version of this credential.
+   */
+  get encoded(): string;
+  /**
+   * The {@link ClaimFormat} of the credential.
+   *
+   * For W3C VC SD-JWT credentials this is always `vc+sd-jwt`.
+   */
+  get claimFormat(): ClaimFormat.SdJwtW3cVc;
+  /**
+   * Validates the SD-JWT and the resolved credential.
+   */
+  validate(): void;
+}
+//#endregion
+export { W3cV2SdJwtVerifiableCredential, W3cV2SdJwtVerifiableCredentialOptions };
+//# sourceMappingURL=W3cV2SdJwtVerifiableCredential.d.mts.map

package/build/modules/vc/sd-jwt-vc/W3cV2SdJwtVerifiableCredential.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"W3cV2SdJwtVerifiableCredential.d.mts","names":[],"sources":["../../../../src/modules/vc/sd-jwt-vc/W3cV2SdJwtVerifiableCredential.ts"],"sourcesContent":[],"mappings":";;;;;UAMiB,qCAAA;SACR,WAAW,WAAA,CAAY;;;AADhC;AASA;;;AAoBoC,cApBvB,8BAAA,CAoBmC;EAAvB,WAAA,CAAA,OAAA,EAnBK,qCAmBL;EAKa,OAAA,WAAA,CAAA,OAAA,EAAA,MAAA,CAAA,EAhBK,8BAgBL;EAcV;;;kBAnBH,WAAW,WAAA,CAAY;;;;+BAKV;;;;;;;;;;qBAcV,WAAA,CAAY"}

package/build/modules/vc/sd-jwt-vc/W3cV2SdJwtVerifiableCredential.mjs

@@ -0,0 +1,66 @@
+
+
+import { CredoError } from "../../../error/CredoError.mjs";
+import "../../../error/index.mjs";
+import { MessageValidator } from "../../../utils/MessageValidator.mjs";
+import { JsonTransformer } from "../../../utils/JsonTransformer.mjs";
+import "../../../utils/index.mjs";
+import { ClaimFormat } from "../models/ClaimFormat.mjs";
+import { W3cV2Credential } from "../models/credential/W3cV2Credential.mjs";
+import { decodeSdJwt } from "./W3cV2SdJwt.mjs";
+
+//#region src/modules/vc/sd-jwt-vc/W3cV2SdJwtVerifiableCredential.ts
+/**
+* Represents a Verifiable Credential encoded as a SD-JWT.
+*
+* @see https://www.w3.org/TR/vc-jose-cose/#securing-with-sd-jwt
+*/
+var W3cV2SdJwtVerifiableCredential = class W3cV2SdJwtVerifiableCredential {
+	constructor(options) {
+		this.sdJwt = options.sdJwt;
+		this.resolvedCredential = JsonTransformer.fromJSON(options.sdJwt.prettyClaims, W3cV2Credential, { validate: false });
+		this.validate();
+	}
+	static fromCompact(compact) {
+		return new W3cV2SdJwtVerifiableCredential({ sdJwt: decodeSdJwt(compact, ClaimFormat.SdJwtW3cVc) });
+	}
+	/**
+	* The encoded version of this credential.
+	*/
+	get encoded() {
+		return this.sdJwt.compact;
+	}
+	/**
+	* The {@link ClaimFormat} of the credential.
+	*
+	* For W3C VC SD-JWT credentials this is always `vc+sd-jwt`.
+	*/
+	get claimFormat() {
+		return ClaimFormat.SdJwtW3cVc;
+	}
+	/**
+	* Validates the SD-JWT and the resolved credential.
+	*/
+	validate() {
+		MessageValidator.validateSync(this.resolvedCredential);
+		const sdJwt = this.sdJwt;
+		const header = sdJwt.header;
+		const payload = sdJwt.prettyClaims;
+		if ("typ" in header && header.typ !== "vc+sd-jwt") throw new CredoError(`The provided W3C VC SD-JWT does not have the correct 'typ' header.`);
+		if ("cyt" in header && header.cyt !== "vc") throw new CredoError(`The provided W3C VC SD-JWT does not have the correct 'cyt' header.`);
+		const iss = header.iss ?? payload.iss;
+		if (iss) {
+			if (this.resolvedCredential.issuerId !== iss) throw new CredoError(`The provided W3C VC SD-JWT has both 'iss' and 'issuer' claims, but they differ.`);
+		}
+		if (payload.jti) {
+			if (this.resolvedCredential.id && this.resolvedCredential.id !== payload.jti) throw new CredoError(`The provided W3C VC JWT has both 'jti' and 'id' claims, but they differ.`);
+		}
+		if (payload.sub) {
+			if (!this.resolvedCredential.credentialSubjectIds.includes(payload.sub)) throw new CredoError(`The provided W3C VC SD-JWT has a 'sub' claim, but it does not match any credentialSubject.`);
+		}
+	}
+};
+
+//#endregion
+export { W3cV2SdJwtVerifiableCredential };
+//# sourceMappingURL=W3cV2SdJwtVerifiableCredential.mjs.map

package/build/modules/vc/sd-jwt-vc/W3cV2SdJwtVerifiableCredential.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"W3cV2SdJwtVerifiableCredential.mjs","names":[],"sources":["../../../../src/modules/vc/sd-jwt-vc/W3cV2SdJwtVerifiableCredential.ts"],"sourcesContent":["import { CredoError } from '../../../error'\nimport { JsonTransformer, MessageValidator } from '../../../utils'\nimport { ClaimFormat } from '../models/ClaimFormat'\nimport { W3cV2Credential } from '../models/credential/W3cV2Credential'\nimport { decodeSdJwt, type W3cV2SdJwt } from './W3cV2SdJwt'\n\nexport interface W3cV2SdJwtVerifiableCredentialOptions {\n  sdJwt: W3cV2SdJwt<ClaimFormat.SdJwtW3cVc>\n}\n\n/**\n * Represents a Verifiable Credential encoded as a SD-JWT.\n *\n * @see https://www.w3.org/TR/vc-jose-cose/#securing-with-sd-jwt\n */\nexport class W3cV2SdJwtVerifiableCredential {\n  public constructor(options: W3cV2SdJwtVerifiableCredentialOptions) {\n    this.sdJwt = options.sdJwt\n    this.resolvedCredential = JsonTransformer.fromJSON(options.sdJwt.prettyClaims, W3cV2Credential, { validate: false })\n\n    // Validates the SD-JWT and resolved credential\n    this.validate()\n  }\n\n  public static fromCompact(compact: string) {\n    const sdJwt = decodeSdJwt(compact, ClaimFormat.SdJwtW3cVc)\n\n    return new W3cV2SdJwtVerifiableCredential({\n      sdJwt,\n    })\n  }\n\n  /**\n   * The original SD-JWT.\n   */\n  public readonly sdJwt: W3cV2SdJwt<ClaimFormat.SdJwtW3cVc>\n\n  /**\n   * Resolved credential is the fully resolved {@link W3cV2Credential} instance.\n   */\n  public readonly resolvedCredential: W3cV2Credential\n\n  /**\n   * The encoded version of this credential.\n   */\n  public get encoded() {\n    return this.sdJwt.compact\n  }\n\n  /**\n   * The {@link ClaimFormat} of the credential.\n   *\n   * For W3C VC SD-JWT credentials this is always `vc+sd-jwt`.\n   */\n  public get claimFormat(): ClaimFormat.SdJwtW3cVc {\n    return ClaimFormat.SdJwtW3cVc\n  }\n\n  /**\n   * Validates the SD-JWT and the resolved credential.\n   */\n  public validate() {\n    // Validate the resolved credential according to the data model\n    MessageValidator.validateSync(this.resolvedCredential)\n\n    // Basic JWT validations to ensure compliance to the specification\n    const sdJwt = this.sdJwt\n    const header = sdJwt.header\n    const payload = sdJwt.prettyClaims\n\n    if ('typ' in header && header.typ !== 'vc+sd-jwt') {\n      throw new CredoError(`The provided W3C VC SD-JWT does not have the correct 'typ' header.`)\n    }\n\n    if ('cyt' in header && header.cyt !== 'vc') {\n      throw new CredoError(`The provided W3C VC SD-JWT does not have the correct 'cyt' header.`)\n    }\n\n    const iss = header.iss ?? payload.iss\n    if (iss) {\n      if (this.resolvedCredential.issuerId !== iss) {\n        throw new CredoError(`The provided W3C VC SD-JWT has both 'iss' and 'issuer' claims, but they differ.`)\n      }\n    }\n\n    if (payload.jti) {\n      if (this.resolvedCredential.id && this.resolvedCredential.id !== payload.jti) {\n        throw new CredoError(`The provided W3C VC JWT has both 'jti' and 'id' claims, but they differ.`)\n      }\n    }\n\n    if (payload.sub) {\n      if (!this.resolvedCredential.credentialSubjectIds.includes(payload.sub as string)) {\n        throw new CredoError(\n          `The provided W3C VC SD-JWT has a 'sub' claim, but it does not match any credentialSubject.`\n        )\n      }\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAeA,IAAa,iCAAb,MAAa,+BAA+B;CAC1C,AAAO,YAAY,SAAgD;AACjE,OAAK,QAAQ,QAAQ;AACrB,OAAK,qBAAqB,gBAAgB,SAAS,QAAQ,MAAM,cAAc,iBAAiB,EAAE,UAAU,OAAO,CAAC;AAGpH,OAAK,UAAU;;CAGjB,OAAc,YAAY,SAAiB;AAGzC,SAAO,IAAI,+BAA+B,EACxC,OAHY,YAAY,SAAS,YAAY,WAAW,EAIzD,CAAC;;;;;CAgBJ,IAAW,UAAU;AACnB,SAAO,KAAK,MAAM;;;;;;;CAQpB,IAAW,cAAsC;AAC/C,SAAO,YAAY;;;;;CAMrB,AAAO,WAAW;AAEhB,mBAAiB,aAAa,KAAK,mBAAmB;EAGtD,MAAM,QAAQ,KAAK;EACnB,MAAM,SAAS,MAAM;EACrB,MAAM,UAAU,MAAM;AAEtB,MAAI,SAAS,UAAU,OAAO,QAAQ,YACpC,OAAM,IAAI,WAAW,qEAAqE;AAG5F,MAAI,SAAS,UAAU,OAAO,QAAQ,KACpC,OAAM,IAAI,WAAW,qEAAqE;EAG5F,MAAM,MAAM,OAAO,OAAO,QAAQ;AAClC,MAAI,KACF;OAAI,KAAK,mBAAmB,aAAa,IACvC,OAAM,IAAI,WAAW,kFAAkF;;AAI3G,MAAI,QAAQ,KACV;OAAI,KAAK,mBAAmB,MAAM,KAAK,mBAAmB,OAAO,QAAQ,IACvE,OAAM,IAAI,WAAW,2EAA2E;;AAIpG,MAAI,QAAQ,KACV;OAAI,CAAC,KAAK,mBAAmB,qBAAqB,SAAS,QAAQ,IAAc,CAC/E,OAAM,IAAI,WACR,6FACD"}

package/build/modules/vc/sd-jwt-vc/W3cV2SdJwtVerifiablePresentation.d.mts

@@ -0,0 +1,43 @@
+import { ClaimFormat } from "../models/ClaimFormat.mjs";
+import { W3cV2SdJwt } from "./W3cV2SdJwt.mjs";
+import { W3cV2Presentation } from "../models/presentation/W3cV2Presentation.mjs";
+import "../models/index.mjs";
+
+//#region src/modules/vc/sd-jwt-vc/W3cV2SdJwtVerifiablePresentation.d.ts
+interface W3cV2SdJwtVerifiablePresentationOptions {
+  sdJwt: W3cV2SdJwt<ClaimFormat.SdJwtW3cVp>;
+}
+/**
+ * Represents a Verifiable Presentation encoded as a SD-JWT.
+ *
+ * @see https://www.w3.org/TR/vc-jose-cose/#securing-vps-sd-jwt
+ */
+declare class W3cV2SdJwtVerifiablePresentation {
+  constructor(options: W3cV2SdJwtVerifiablePresentationOptions);
+  static fromCompact(compact: string): W3cV2SdJwtVerifiablePresentation;
+  /**
+   * The original SD-JWT.
+   */
+  readonly sdJwt: W3cV2SdJwt<ClaimFormat.SdJwtW3cVp>;
+  /**
+   * Resolved presentation is the fully resolved {@link W3cV2Presentation} instance.
+   */
+  readonly resolvedPresentation: W3cV2Presentation;
+  /**
+   * The encoded version of this presentation.
+   */
+  get encoded(): string;
+  /**
+   * The {@link ClaimFormat} of the presentation.
+   *
+   * For W3C VP SD-JWT credentials this is always `vp+sd-jwt`.
+   */
+  get claimFormat(): ClaimFormat.SdJwtW3cVp;
+  /**
+   * Validates the SD-JWT and the resolved presentation.
+   */
+  validate(): void;
+}
+//#endregion
+export { W3cV2SdJwtVerifiablePresentation, W3cV2SdJwtVerifiablePresentationOptions };
+//# sourceMappingURL=W3cV2SdJwtVerifiablePresentation.d.mts.map

package/build/modules/vc/sd-jwt-vc/W3cV2SdJwtVerifiablePresentation.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"W3cV2SdJwtVerifiablePresentation.d.mts","names":[],"sources":["../../../../src/modules/vc/sd-jwt-vc/W3cV2SdJwtVerifiablePresentation.ts"],"sourcesContent":[],"mappings":";;;;;;UAMiB,uCAAA;SACR,WAAW,WAAA,CAAY;;;;AADhC;AASA;;AAW2C,cAX9B,gCAAA,CAW8B;EAWP,WAAY,CAAA,OAAA,EArBlB,uCAqBkB;EAAvB,OAAA,WAAA,CAAA,OAAA,EAAA,MAAA,CAAA,EAXkB,gCAWlB;EAKe;;;kBALf,WAAW,WAAA,CAAY;;;;iCAKR;;;;;;;;;;qBAcZ,WAAA,CAAY"}

package/build/modules/vc/sd-jwt-vc/W3cV2SdJwtVerifiablePresentation.mjs

@@ -0,0 +1,61 @@
+
+
+import { CredoError } from "../../../error/CredoError.mjs";
+import "../../../error/index.mjs";
+import { MessageValidator } from "../../../utils/MessageValidator.mjs";
+import { JsonTransformer } from "../../../utils/JsonTransformer.mjs";
+import "../../../utils/index.mjs";
+import { ClaimFormat } from "../models/ClaimFormat.mjs";
+import { decodeSdJwt } from "./W3cV2SdJwt.mjs";
+import { W3cV2Presentation } from "../models/presentation/W3cV2Presentation.mjs";
+import "../models/index.mjs";
+
+//#region src/modules/vc/sd-jwt-vc/W3cV2SdJwtVerifiablePresentation.ts
+/**
+* Represents a Verifiable Presentation encoded as a SD-JWT.
+*
+* @see https://www.w3.org/TR/vc-jose-cose/#securing-vps-sd-jwt
+*/
+var W3cV2SdJwtVerifiablePresentation = class W3cV2SdJwtVerifiablePresentation {
+	constructor(options) {
+		this.sdJwt = options.sdJwt;
+		this.resolvedPresentation = JsonTransformer.fromJSON(options.sdJwt.prettyClaims, W3cV2Presentation, { validate: false });
+		this.validate();
+	}
+	static fromCompact(compact) {
+		return new W3cV2SdJwtVerifiablePresentation({ sdJwt: decodeSdJwt(compact, ClaimFormat.SdJwtW3cVp) });
+	}
+	/**
+	* The encoded version of this presentation.
+	*/
+	get encoded() {
+		return this.sdJwt.compact;
+	}
+	/**
+	* The {@link ClaimFormat} of the presentation.
+	*
+	* For W3C VP SD-JWT credentials this is always `vp+sd-jwt`.
+	*/
+	get claimFormat() {
+		return ClaimFormat.SdJwtW3cVp;
+	}
+	/**
+	* Validates the SD-JWT and the resolved presentation.
+	*/
+	validate() {
+		MessageValidator.validateSync(this.resolvedPresentation);
+		const sdJwt = this.sdJwt;
+		const header = sdJwt.header;
+		const payload = sdJwt.prettyClaims;
+		if ("typ" in header && header.typ !== "vp+sd-jwt") throw new CredoError(`The provided W3C VP JWT does not have the correct 'typ' header.`);
+		if ("cyt" in header && header.cyt !== "vp") throw new CredoError(`The provided W3C VP JWT does not have the correct 'cyt' header.`);
+		const iss = header.iss ?? payload.iss;
+		if (iss && this.resolvedPresentation.holderId) {
+			if (this.resolvedPresentation.holderId !== iss) throw new CredoError(`The provided W3C VP SD-JWT has both 'iss' and 'holder' claims, but they differ.`);
+		}
+	}
+};
+
+//#endregion
+export { W3cV2SdJwtVerifiablePresentation };
+//# sourceMappingURL=W3cV2SdJwtVerifiablePresentation.mjs.map

package/build/modules/vc/sd-jwt-vc/W3cV2SdJwtVerifiablePresentation.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"W3cV2SdJwtVerifiablePresentation.mjs","names":[],"sources":["../../../../src/modules/vc/sd-jwt-vc/W3cV2SdJwtVerifiablePresentation.ts"],"sourcesContent":["import { CredoError } from '../../../error'\nimport { JsonTransformer, MessageValidator } from '../../../utils'\nimport { ClaimFormat } from '../models'\nimport { W3cV2Presentation } from '../models/presentation/W3cV2Presentation'\nimport { decodeSdJwt, type W3cV2SdJwt } from './W3cV2SdJwt'\n\nexport interface W3cV2SdJwtVerifiablePresentationOptions {\n  sdJwt: W3cV2SdJwt<ClaimFormat.SdJwtW3cVp>\n}\n\n/**\n * Represents a Verifiable Presentation encoded as a SD-JWT.\n *\n * @see https://www.w3.org/TR/vc-jose-cose/#securing-vps-sd-jwt\n */\nexport class W3cV2SdJwtVerifiablePresentation {\n  public constructor(options: W3cV2SdJwtVerifiablePresentationOptions) {\n    this.sdJwt = options.sdJwt\n    this.resolvedPresentation = JsonTransformer.fromJSON(options.sdJwt.prettyClaims, W3cV2Presentation, {\n      validate: false,\n    })\n\n    // Validates the SD-JWT and resolved presentation\n    this.validate()\n  }\n\n  public static fromCompact(compact: string) {\n    const sdJwt = decodeSdJwt(compact, ClaimFormat.SdJwtW3cVp)\n\n    return new W3cV2SdJwtVerifiablePresentation({\n      sdJwt,\n    })\n  }\n\n  /**\n   * The original SD-JWT.\n   */\n  public readonly sdJwt: W3cV2SdJwt<ClaimFormat.SdJwtW3cVp>\n\n  /**\n   * Resolved presentation is the fully resolved {@link W3cV2Presentation} instance.\n   */\n  public readonly resolvedPresentation: W3cV2Presentation\n\n  /**\n   * The encoded version of this presentation.\n   */\n  public get encoded() {\n    return this.sdJwt.compact\n  }\n\n  /**\n   * The {@link ClaimFormat} of the presentation.\n   *\n   * For W3C VP SD-JWT credentials this is always `vp+sd-jwt`.\n   */\n  public get claimFormat(): ClaimFormat.SdJwtW3cVp {\n    return ClaimFormat.SdJwtW3cVp\n  }\n\n  /**\n   * Validates the SD-JWT and the resolved presentation.\n   */\n  public validate() {\n    // Validate the resolved credential according to the data model\n    MessageValidator.validateSync(this.resolvedPresentation)\n\n    // Basic JWT validations to ensure compliance to the specification\n    const sdJwt = this.sdJwt\n    const header = sdJwt.header\n    const payload = sdJwt.prettyClaims\n\n    if ('typ' in header && header.typ !== 'vp+sd-jwt') {\n      throw new CredoError(`The provided W3C VP JWT does not have the correct 'typ' header.`)\n    }\n\n    if ('cyt' in header && header.cyt !== 'vp') {\n      throw new CredoError(`The provided W3C VP JWT does not have the correct 'cyt' header.`)\n    }\n\n    const iss = header.iss ?? payload.iss\n    if (iss && this.resolvedPresentation.holderId) {\n      if (this.resolvedPresentation.holderId !== iss) {\n        throw new CredoError(`The provided W3C VP SD-JWT has both 'iss' and 'holder' claims, but they differ.`)\n      }\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAeA,IAAa,mCAAb,MAAa,iCAAiC;CAC5C,AAAO,YAAY,SAAkD;AACnE,OAAK,QAAQ,QAAQ;AACrB,OAAK,uBAAuB,gBAAgB,SAAS,QAAQ,MAAM,cAAc,mBAAmB,EAClG,UAAU,OACX,CAAC;AAGF,OAAK,UAAU;;CAGjB,OAAc,YAAY,SAAiB;AAGzC,SAAO,IAAI,iCAAiC,EAC1C,OAHY,YAAY,SAAS,YAAY,WAAW,EAIzD,CAAC;;;;;CAgBJ,IAAW,UAAU;AACnB,SAAO,KAAK,MAAM;;;;;;;CAQpB,IAAW,cAAsC;AAC/C,SAAO,YAAY;;;;;CAMrB,AAAO,WAAW;AAEhB,mBAAiB,aAAa,KAAK,qBAAqB;EAGxD,MAAM,QAAQ,KAAK;EACnB,MAAM,SAAS,MAAM;EACrB,MAAM,UAAU,MAAM;AAEtB,MAAI,SAAS,UAAU,OAAO,QAAQ,YACpC,OAAM,IAAI,WAAW,kEAAkE;AAGzF,MAAI,SAAS,UAAU,OAAO,QAAQ,KACpC,OAAM,IAAI,WAAW,kEAAkE;EAGzF,MAAM,MAAM,OAAO,OAAO,QAAQ;AAClC,MAAI,OAAO,KAAK,qBAAqB,UACnC;OAAI,KAAK,qBAAqB,aAAa,IACzC,OAAM,IAAI,WAAW,kFAAkF"}

package/build/modules/vc/sd-jwt-vc/index.d.mts

@@ -0,0 +1,4 @@
+import { W3cV2SdJwt, W3cV2SdJwtHeader, W3cV2SdJwtPayload, decodeSdJwt, sdJwtVcHasher } from "./W3cV2SdJwt.mjs";
+import { W3cV2SdJwtVerifiableCredential, W3cV2SdJwtVerifiableCredentialOptions } from "./W3cV2SdJwtVerifiableCredential.mjs";
+import { W3cV2SdJwtVerifiablePresentation, W3cV2SdJwtVerifiablePresentationOptions } from "./W3cV2SdJwtVerifiablePresentation.mjs";
+import { W3cV2SdJwtCredentialService } from "./W3cV2SdJwtCredentialService.mjs";

package/build/modules/vc/sd-jwt-vc/index.mjs

@@ -0,0 +1,6 @@
+
+
+import { decodeSdJwt, sdJwtVcHasher } from "./W3cV2SdJwt.mjs";
+import { W3cV2SdJwtVerifiableCredential } from "./W3cV2SdJwtVerifiableCredential.mjs";
+import { W3cV2SdJwtVerifiablePresentation } from "./W3cV2SdJwtVerifiablePresentation.mjs";
+import { W3cV2SdJwtCredentialService } from "./W3cV2SdJwtCredentialService.mjs";

package/build/modules/vc/util.d.mts

@@ -0,0 +1,11 @@
+//#region src/modules/vc/util.d.ts
+/**
+ * Formats an input date to w3c standard date format
+ * @param date {number|string} Optional if not defined current date is returned
+ *
+ * @returns {string} date in a standard format as a string
+ */
+declare const w3cDate: (date?: number | string) => string;
+//#endregion
+export { w3cDate };
+//# sourceMappingURL=util.d.mts.map

package/build/modules/vc/util.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"util.d.mts","names":[],"sources":["../../../src/modules/vc/util.ts"],"sourcesContent":[],"mappings":";;;;AAMA;;;cAAa"}

package/build/modules/vc/util.mjs

@@ -0,0 +1,19 @@
+
+
+//#region src/modules/vc/util.ts
+/**
+* Formats an input date to w3c standard date format
+* @param date {number|string} Optional if not defined current date is returned
+*
+* @returns {string} date in a standard format as a string
+*/
+const w3cDate = (date) => {
+	let result = /* @__PURE__ */ new Date();
+	if (typeof date === "number" || typeof date === "string") result = new Date(date);
+	const str = result.toISOString();
+	return `${str.substr(0, str.length - 5)}Z`;
+};
+
+//#endregion
+export { w3cDate };
+//# sourceMappingURL=util.mjs.map

package/build/modules/vc/util.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"util.mjs","names":[],"sources":["../../../src/modules/vc/util.ts"],"sourcesContent":["/**\n * Formats an input date to w3c standard date format\n * @param date {number|string} Optional if not defined current date is returned\n *\n * @returns {string} date in a standard format as a string\n */\nexport const w3cDate = (date?: number | string): string => {\n  let result = new Date()\n  if (typeof date === 'number' || typeof date === 'string') {\n    result = new Date(date)\n  }\n  const str = result.toISOString()\n  return `${str.substr(0, str.length - 5)}Z`\n}\n"],"mappings":";;;;;;;;;AAMA,MAAa,WAAW,SAAmC;CACzD,IAAI,yBAAS,IAAI,MAAM;AACvB,KAAI,OAAO,SAAS,YAAY,OAAO,SAAS,SAC9C,UAAS,IAAI,KAAK,KAAK;CAEzB,MAAM,MAAM,OAAO,aAAa;AAChC,QAAO,GAAG,IAAI,OAAO,GAAG,IAAI,SAAS,EAAE,CAAC"}