@idos-network/credentials 1.5.0 → 2.2.0

package/src/utils/index.ts

@@ -1,122 +1,23 @@
-import { Ed25519VerificationKey2020 } from "@digitalbazaar/ed25519-verification-key-2020";
-import {
-  base64Decode,
-  base64Encode,
-  hexEncode,
-  utf8Encode,
-  fileToBase85,
-} from "@idos-network/utils/codecs";
+import { createBlobContentReference } from "@idos-network/utils/blob-gateway";
+import { base64Encode, hexEncode, utf8Encode } from "@idos-network/utils/codecs";
+import { encryptContent } from "@idos-network/utils/cryptography";
 import { every, get } from "es-toolkit/compat";
-import invariant from "tiny-invariant";
 import nacl from "tweetnacl";
 
-import type {
-  AvailableIssuerType,
-  CredentialFields,
-  CredentialResidentialAddress,
-  CredentialSubject,
-  CredentialSubjectFaceId,
-  CustomIssuerType,
-  InsertableIDOSCredential,
-} from "../types";
-
-export function capitalizeFirstLetter(str: string): string {
-  return str[0].toUpperCase() + str.slice(1);
-}
-
-function isIssuerKey(issuer: AvailableIssuerType): issuer is Ed25519VerificationKey2020 {
-  return (
-    typeof issuer === "object" &&
-    issuer !== null &&
-    "type" in issuer &&
-    "id" in issuer &&
-    "controller" in issuer
-  );
-}
-
-function isCustomIssuerType(issuer: AvailableIssuerType): issuer is CustomIssuerType {
-  return (
-    typeof issuer === "object" &&
-    issuer !== null &&
-    "issuer" in issuer &&
-    "publicKeyMultibase" in issuer
-  );
-}
-
-export async function issuerToKey(
-  issuer: AvailableIssuerType,
-): Promise<Ed25519VerificationKey2020> {
-  if (isIssuerKey(issuer)) {
-    return issuer;
-  }
-
-  if (isCustomIssuerType(issuer)) {
-    return await Ed25519VerificationKey2020.from({
-      id: `${issuer.issuer}/keys/1`,
-      controller: `${issuer.issuer}/issuers/1`,
-      publicKeyMultibase: issuer.publicKeyMultibase,
-      privateKeyMultibase: issuer.privateKeyMultibase,
-      type: "Ed25519VerificationKey2020",
-    });
-  }
-
-  return await Ed25519VerificationKey2020.from({ ...issuer, type: "Ed25519VerificationKey2020" });
-}
+import type { idOSCredential, SignedCredentialContentReference } from "../types";
 
-export function convertValues<
-  K extends
-    | CredentialFields
-    | CredentialSubject
-    | CredentialResidentialAddress
-    | CredentialSubjectFaceId,
->(fields: K, prefix?: string): Record<string, unknown> {
-  const acc: Record<string, unknown> = {};
-
-  for (const key in fields) {
-    if (Object.hasOwn(fields, key)) {
-      const value = fields[key];
-      const name = prefix ? `${prefix}${capitalizeFirstLetter(key)}` : key;
-      if (value instanceof Date) {
-        acc[name] = value.toISOString();
-      } else if (value instanceof Buffer) {
-        // Convert file to base85
-        acc[name] = fileToBase85(value);
-      } else {
-        acc[name] = value;
-      }
-    }
-  }
-
-  return acc;
-}
-
-type BaseLevel = "basic" | "plus";
-type Addon = "liveness" | "email" | "phoneNumber";
-
-export function deriveLevel(credential: CredentialSubject): string {
-  let level: BaseLevel = "basic";
-
-  // Address is a sign for plus+
-  const address = credential.residentialAddress;
-  if (address?.proofFile && address?.city && address?.proofCategory) {
-    level = "plus";
-  }
+// Proxying functions
+export * from "./issuer";
 
-  const addons: Addon[] = [];
-  if (credential.selfieFile) {
-    addons.push("liveness");
-  }
-
-  if (credential.email) {
-    addons.push("email");
-  }
-
-  if (credential.phoneNumber) {
-    addons.push("phoneNumber");
-  }
-
-  return [level, ...addons].join("+");
-}
+export type BaseLevel = "unverified" | "basic" | "plus";
+export type Addon =
+  | "liveness"
+  | "email"
+  | "phoneNumber"
+  | "edd"
+  | "sow"
+  | "screening"
+  | "onboarding";
 
 export function parseLevel(level: string): {
   base: BaseLevel;
@@ -126,6 +27,18 @@ export function parseLevel(level: string): {
   return { base, addons };
 }
 
+export function assertNoExtraFields(
+  section: string,
+  expectedFields: ReadonlySet<string>,
+  value: object | undefined,
+): void {
+  const extraFields = Object.keys(value ?? {}).filter((field) => !expectedFields.has(field));
+
+  if (extraFields.length > 0) {
+    throw new Error(`Unexpected ${section} fields: ${extraFields.join(", ")}`);
+  }
+}
+
 export function matchLevelOrHigher(
   level: BaseLevel,
   requiredAddons: Addon[],
@@ -133,7 +46,12 @@ export function matchLevelOrHigher(
 ): boolean {
   const { base: currentBaseLevel, addons: currentAddons } = parseLevel(currentLevel);
 
-  // TODO: Consider pop+ or uniqueness+ scenarios
+  // Basic can only match basic or plus not unverified
+  if (level === "basic" && currentBaseLevel === "unverified") {
+    return false;
+  }
+
+  // Plus can only match plus
   if (level === "plus" && currentBaseLevel !== "plus") {
     return false;
   }
@@ -145,6 +63,10 @@ export function levelScore(level: string): number {
   const { base, addons } = parseLevel(level);
   let score = 0;
 
+  if (base === "basic") {
+    score += 50;
+  }
+
   if (base === "plus") {
     score += 100;
   }
@@ -239,36 +161,109 @@ export function recordFilter(
   return true;
 }
 
-export function buildInsertableIDOSCredential(
-  userId: string,
+export function buildSignedCredentialContentReference(
   publicNotes: string,
-  content: string,
-  encryptorPublicKey: string,
-): InsertableIDOSCredential {
-  invariant(encryptorPublicKey, "Missing `encryptorPublicKey`");
-
-  const ephemeralAuthenticationKeyPair = nacl.sign.keyPair();
+  contentUri: string,
+  issuerSigningSecretKey: Uint8Array,
+): SignedCredentialContentReference {
+  const { publicKey, secretKey } = nacl.sign.keyPair.fromSecretKey(issuerSigningSecretKey);
 
-  const publicNotesSignature = nacl.sign.detached(
-    utf8Encode(publicNotes),
-    ephemeralAuthenticationKeyPair.secretKey,
-  );
+  const publicNotesSignature = nacl.sign.detached(utf8Encode(publicNotes), secretKey);
 
   return {
-    user_id: userId,
-    content,
-
     public_notes: publicNotes,
     public_notes_signature: base64Encode(publicNotesSignature),
 
     broader_signature: base64Encode(
       nacl.sign.detached(
-        Uint8Array.from([...publicNotesSignature, ...base64Decode(content)]),
-        ephemeralAuthenticationKeyPair.secretKey,
+        Uint8Array.from([...publicNotesSignature, ...utf8Encode(contentUri)]),
+        secretKey,
       ),
     ),
 
-    issuer_auth_public_key: hexEncode(ephemeralAuthenticationKeyPair.publicKey, true),
-    encryptor_public_key: encryptorPublicKey,
+    issuer_auth_public_key: hexEncode(publicKey, true),
+  };
+}
+
+/** User-issued share copy: sign with a fresh ephemeral key (need not match original issuer). */
+export function buildEphemeralSignedCredentialContentReference(
+  publicNotes: string,
+  contentUri: string,
+): SignedCredentialContentReference {
+  return buildSignedCredentialContentReference(
+    publicNotes,
+    contentUri,
+    nacl.sign.keyPair().secretKey,
+  );
+}
+
+export type PreliminaryIDOSCredential = {
+  id: string;
+  contentUri: string;
+  contentSize: number;
+  encryptedContent: Uint8Array;
+  publicNotes: string;
+  publicNotesSignature: string;
+  broaderSignature: string;
+  issuerAuthPublicKey: string;
+  encryptorPublicKey: string;
+};
+
+export function mapPreliminaryToIDOSCredential(
+  preliminaryCredential: PreliminaryIDOSCredential,
+): Omit<idOSCredential, "user_id"> {
+  return {
+    id: preliminaryCredential.id,
+    content_uri: preliminaryCredential.contentUri,
+    content_size: preliminaryCredential.contentSize,
+    public_notes: preliminaryCredential.publicNotes,
+    issuer_auth_public_key: preliminaryCredential.issuerAuthPublicKey,
+    encryptor_public_key: preliminaryCredential.encryptorPublicKey,
+  };
+}
+
+export interface BuildPreliminaryIDOSCredentialArgs {
+  publicNotes: string;
+  plaintextContent: Uint8Array;
+  recipientEncryptionPublicKey: Uint8Array;
+  issuerSigningSecretKey?: Uint8Array;
+  /** When set (MM / `ukyc://`), skip IPFS CID hashing. */
+  contentUri?: string;
+}
+
+export async function buildPreliminaryIDOSCredential({
+  publicNotes,
+  plaintextContent,
+  recipientEncryptionPublicKey,
+  // For user-issued credentials, use a fresh ephemeral key for the signed reference
+  // For issuer-side, use the signing key pair
+  issuerSigningSecretKey = nacl.sign.keyPair().secretKey,
+  contentUri,
+}: BuildPreliminaryIDOSCredentialArgs): Promise<Omit<PreliminaryIDOSCredential, "id">> {
+  const ephemeralKeyPair = nacl.box.keyPair();
+  const encryptedContent = encryptContent(
+    plaintextContent,
+    recipientEncryptionPublicKey, // user or dwg recipient
+    ephemeralKeyPair.secretKey,
+  );
+
+  const contentReference = contentUri
+    ? { uri: contentUri, size: encryptedContent.byteLength }
+    : await createBlobContentReference(encryptedContent);
+  const signedReference = buildSignedCredentialContentReference(
+    publicNotes,
+    contentReference.uri,
+    issuerSigningSecretKey,
+  );
+
+  return {
+    contentUri: contentReference.uri,
+    contentSize: contentReference.size,
+    encryptedContent,
+    publicNotes,
+    publicNotesSignature: signedReference.public_notes_signature,
+    broaderSignature: signedReference.broader_signature,
+    issuerAuthPublicKey: signedReference.issuer_auth_public_key,
+    encryptorPublicKey: base64Encode(ephemeralKeyPair.publicKey),
   };
 }

package/src/utils/issuer.ts

@@ -0,0 +1,42 @@
+import { Ed25519VerificationKey2020 } from "@digitalbazaar/ed25519-verification-key-2020";
+
+import type { AvailableIssuerType, CustomIssuerType } from "../types";
+
+function isIssuerKey(issuer: AvailableIssuerType): issuer is Ed25519VerificationKey2020 {
+  return (
+    typeof issuer === "object" &&
+    issuer !== null &&
+    "type" in issuer &&
+    "id" in issuer &&
+    "controller" in issuer
+  );
+}
+
+function isCustomIssuerType(issuer: AvailableIssuerType): issuer is CustomIssuerType {
+  return (
+    typeof issuer === "object" &&
+    issuer !== null &&
+    "issuer" in issuer &&
+    "publicKeyMultibase" in issuer
+  );
+}
+
+export async function issuerToKey(
+  issuer: AvailableIssuerType,
+): Promise<Ed25519VerificationKey2020> {
+  if (isIssuerKey(issuer)) {
+    return issuer;
+  }
+
+  if (isCustomIssuerType(issuer)) {
+    return await Ed25519VerificationKey2020.from({
+      id: `${issuer.issuer}/keys/1`,
+      controller: `${issuer.issuer}/issuers/1`,
+      publicKeyMultibase: issuer.publicKeyMultibase,
+      privateKeyMultibase: issuer.privateKeyMultibase,
+      type: "Ed25519VerificationKey2020",
+    });
+  }
+
+  return await Ed25519VerificationKey2020.from({ ...issuer, type: "Ed25519VerificationKey2020" });
+}

package/src/{builder → utils}/loader.ts

@@ -1,46 +1,51 @@
 import { type JsonLDDocumentLoaderInstance, JsonLdDocumentLoader } from "jsonld-document-loader";
 
 import ed25519Signature2020V1 from "../../assets/ed25519-signature-2020-v1.json";
+import idosCredentialSubjectEddV1 from "../../assets/idos-credential-subject-edd-v1.json";
+// Maybe we can generate those imports alongside the JSON-LD
 import idosCredentialSubjectFaceIdV1 from "../../assets/idos-credential-subject-face-id-v1.json";
 import idosCredentialSubjectV1 from "../../assets/idos-credential-subject-v1.json";
 import idosCredentialSubjectV2 from "../../assets/idos-credential-subject-v2.json";
+import idosCredentialSubjectV3 from "../../assets/idos-credential-subject-v3.json";
 import idosCredentialsV1 from "../../assets/idos-credentials-v1.json";
+import idosCredentialsV2 from "../../assets/idos-credentials-v2.json";
 import v1 from "../../assets/v1.json";
 
 export const CONTEXT_V1 = "https://www.w3.org/2018/credentials/v1";
 export const CONTEXT_ED25519_SIGNATURE_2020_V1 = "https://w3id.org/security/suites/ed25519-2020/v1";
 
-// Check .github/workflow/pages.yml how those are deployed
-export const CONTEXT_IDOS_CREDENTIAL_V1 =
-  "https://idos-network.github.io/idos-sdk-js/credentials/idos-credentials-v1.json";
-export const CONTEXT_IDOS_CREDENTIAL_V1_SUBJECT =
-  "https://idos-network.github.io/idos-sdk-js/credentials/idos-credential-subject-v1.json";
-export const CONTEXT_IDOS_CREDENTIAL_V2_SUBJECT =
-  "https://idos-network.github.io/idos-sdk-js/credentials/idos-credential-subject-v2.json";
-
-export const CONTEXT_IDOS_CREDENTIAL_V1_FACE_ID =
-  "https://idos-network.github.io/idos-sdk-js/credentials/idos-credential-subject-face-id-v1.json";
+export const BASE_PUBLIC_URL = "https://idos-network.github.io/idos-sdk-js/credentials/";
 
-// Latest contexts for builder
-export const CONTEXT_IDOS_CREDENTIAL: string = CONTEXT_IDOS_CREDENTIAL_V1;
-export const CONTEXT_IDOS_CREDENTIAL_SUBJECT: string = CONTEXT_IDOS_CREDENTIAL_V2_SUBJECT;
-export const CONTEXT_IDOS_SIGNATURE: string = CONTEXT_ED25519_SIGNATURE_2020_V1;
-export const CONTEXT_IDOS_CREDENTIAL_FACE_ID: string = CONTEXT_IDOS_CREDENTIAL_V1_FACE_ID;
+// Check .github/workflow/pages.yml how those are deployed
+export const CONTEXT_IDOS_CREDENTIAL_V1: string = `${BASE_PUBLIC_URL}idos-credentials-v1.json`;
+export const CONTEXT_IDOS_CREDENTIAL_V2: string = `${BASE_PUBLIC_URL}idos-credentials-v2.json`;
+export const CONTEXT_IDOS_CREDENTIAL_V1_SUBJECT: string = `${BASE_PUBLIC_URL}idos-credential-subject-v1.json`;
+export const CONTEXT_IDOS_CREDENTIAL_V2_SUBJECT: string = `${BASE_PUBLIC_URL}idos-credential-subject-v2.json`;
+export const CONTEXT_IDOS_CREDENTIAL_V3_SUBJECT: string = `${BASE_PUBLIC_URL}idos-credential-subject-v3.json`;
+export const CONTEXT_IDOS_CREDENTIAL_V1_FACE_ID: string = `${BASE_PUBLIC_URL}idos-credential-subject-face-id-v1.json`;
+export const CONTEXT_IDOS_CREDENTIAL_V1_EDD: string = `${BASE_PUBLIC_URL}idos-credential-subject-edd-v1.json`;
 
 export function buildDocumentLoader(): JsonLDDocumentLoaderInstance {
   const loader = new JsonLdDocumentLoader();
 
   loader.addStatic(CONTEXT_V1, v1);
-  loader.addStatic(CONTEXT_IDOS_CREDENTIAL_V1, idosCredentialsV1);
   loader.addStatic(CONTEXT_ED25519_SIGNATURE_2020_V1, ed25519Signature2020V1);
 
-  // plus / basic + liveness credentials
+  // Envelopes
+  loader.addStatic(CONTEXT_IDOS_CREDENTIAL_V1, idosCredentialsV1);
+  loader.addStatic(CONTEXT_IDOS_CREDENTIAL_V2, idosCredentialsV2);
+
+  // KYC
   loader.addStatic(CONTEXT_IDOS_CREDENTIAL_V1_SUBJECT, idosCredentialSubjectV1);
   loader.addStatic(CONTEXT_IDOS_CREDENTIAL_V2_SUBJECT, idosCredentialSubjectV2);
+  loader.addStatic(CONTEXT_IDOS_CREDENTIAL_V3_SUBJECT, idosCredentialSubjectV3);
 
   // PoP
   loader.addStatic(CONTEXT_IDOS_CREDENTIAL_V1_FACE_ID, idosCredentialSubjectFaceIdV1);
 
+  // EDD
+  loader.addStatic(CONTEXT_IDOS_CREDENTIAL_V1_EDD, idosCredentialSubjectEddV1);
+
   // DEPRECATED: Those should be removed
   [
     "1356fea6672d22deb07fedc5fa427478b2e1654c",

package/src/verifier/index.test.ts

@@ -0,0 +1,149 @@
+import { Ed25519VerificationKey2020 } from "@digitalbazaar/ed25519-verification-key-2020";
+import crypto from "node:crypto";
+import { describe, expect, it } from "vitest";
+
+import { verifyCredential } from ".";
+import { VerifiableCredentialFaceIdV1, VerifiableCredentialKycV3 } from "../schemas";
+
+const ISSUER = "https://vc-issuers.cool.id/idos";
+const ISSUER2 = "https://vc-issuers.cool.id/idos2";
+const CRED_ID = `${ISSUER}/credentials/z6MkszZtxCmA2Ce4vUV132PCuLQmwnaDD5mw2L23fGNnsiX3`;
+const ISSUED = new Date("2022-01-01");
+const APPROVED_AT = new Date("2022-01-02");
+const EXPIRATION_DATE = new Date("2030-01-01");
+
+/** The flat credential subject of a signed credential, which `issue()` types as unknown. */
+function subjectOf(credential: { credentialSubject: unknown }): Record<string, unknown> {
+  return credential.credentialSubject as Record<string, unknown>;
+}
+
+function generateKey(issuer: string) {
+  return Ed25519VerificationKey2020.generate({
+    id: `${issuer}/keys/1`,
+    controller: `${issuer}/issuers/1`,
+  });
+}
+
+async function issueFaceId(key: Ed25519VerificationKey2020) {
+  const credential = new VerifiableCredentialFaceIdV1();
+  credential.setEnvelope({ id: CRED_ID });
+  credential.setSubject({ faceSignUserId: crypto.randomUUID() });
+  return credential.issue(key);
+}
+
+async function issueKycV3(key: Ed25519VerificationKey2020) {
+  const credential = new VerifiableCredentialKycV3();
+  credential.setEnvelope({
+    id: CRED_ID,
+    issued: ISSUED,
+    approvedAt: APPROVED_AT,
+    expirationDate: EXPIRATION_DATE,
+  });
+  credential.setSubject({ id: "uuid:abc" });
+  credential.addSection("person", {
+    firstName: "John",
+    familyName: "Lennon",
+    nationality: "US",
+    dateOfBirth: new Date("1980-01-01"),
+  });
+  credential.addSection("idDocument", {
+    type: "PASSPORT",
+    number: "123456789",
+    country: "US",
+    frontFile: Buffer.from("Front"),
+    frontFileType: "image/jpeg",
+    frontFileName: "front.jpg",
+  });
+  credential.addSection("biometric", { selfieFile: Buffer.from("Selfie"), selfieMatch: 99 });
+  return credential.issue(key);
+}
+
+describe("issue + verifyCredential round-trip", () => {
+  it("issues a signed FaceId v1 credential that verifies against its issuer", async () => {
+    const validKey = await generateKey(ISSUER);
+    const otherKey = await generateKey(ISSUER2);
+
+    const data = await issueFaceId(validKey);
+
+    expect(data.proof.proofPurpose).toBe("assertionMethod");
+    expect(data.proof.type).toBe("Ed25519Signature2020");
+    expect(data.proof.verificationMethod).toBe(`${ISSUER}/keys/1`);
+
+    // Verifies against the correct issuer even when a wrong one is also allowed.
+    const [verified, results] = await verifyCredential(data, [otherKey, validKey]);
+    expect(verified).toBe(true);
+
+    const resultsArray = [...results.values()];
+    expect(resultsArray).toHaveLength(2);
+    expect(resultsArray[0].verified).toBe(false); // otherKey
+    expect(resultsArray[1].verified).toBe(true); // validKey
+  });
+
+  it("issues a signed KYC v3 credential that verifies against its issuer", async () => {
+    const validKey = await generateKey(ISSUER);
+
+    const data = await issueKycV3(validKey);
+
+    // Envelope fields are carried onto the signed credential.
+    expect(data.id).toBe(CRED_ID);
+    expect(data.issued).toBe(ISSUED.toISOString());
+    expect(data.approvedAt).toBe(APPROVED_AT.toISOString());
+    expect(data.expirationDate).toBe(EXPIRATION_DATE.toISOString());
+    expect(data.level).toBe("basic+liveness");
+    expect(data.kycLevel).toBe(1);
+
+    // Structured subject is flattened + prefixed on the signed credential.
+    expect(subjectOf(data).personFirstName).toBe("John");
+    expect(subjectOf(data).idDocumentType).toBe("PASSPORT");
+
+    const [verified] = await verifyCredential(data, [validKey]);
+    expect(verified).toBe(true);
+  });
+
+  it("rejects a tampered FaceId credential", async () => {
+    const validKey = await generateKey(ISSUER);
+    const data = await issueFaceId(validKey);
+
+    const [verified] = await verifyCredential(data, [validKey]);
+    expect(verified).toBe(true);
+
+    // Flip a subject field after signing — signature must no longer verify.
+    subjectOf(data).faceSignUserId = crypto.randomUUID();
+    const [verifiedAfterTamper] = await verifyCredential(data, [validKey]);
+    expect(verifiedAfterTamper).toBe(false);
+  });
+
+  it("rejects a tampered KYC v3 credential", async () => {
+    const validKey = await generateKey(ISSUER);
+    const data = await issueKycV3(validKey);
+
+    const [verified] = await verifyCredential(data, [validKey]);
+    expect(verified).toBe(true);
+
+    // Tamper with a subject field.
+    subjectOf(data).personFirstName = "Jane";
+    const [verifiedAfterSubjectTamper] = await verifyCredential(data, [validKey]);
+    expect(verifiedAfterSubjectTamper).toBe(false);
+  });
+
+  it("rejects a tampered KYC v3 envelope field", async () => {
+    const validKey = await generateKey(ISSUER);
+    const data = await issueKycV3(validKey);
+
+    // Tamper with a signed envelope field (e.g. extend expiry).
+    data.expirationDate = new Date("2999-01-01").toISOString();
+    const [verified] = await verifyCredential(data, [validKey]);
+    expect(verified).toBe(false);
+  });
+
+  it("rejects verification against the wrong issuer key", async () => {
+    const validKey = await generateKey(ISSUER);
+    const otherKey = await generateKey(ISSUER2);
+
+    const data = await issueFaceId(validKey);
+
+    const [verified, results] = await verifyCredential(data, [otherKey]);
+    expect(verified).toBe(false);
+    expect([...results.values()][0].verified).toBe(false);
+  });
+});

package/src/{builder/verifier.ts → verifier/index.ts}

@@ -3,18 +3,14 @@ import type { JsonLDDocumentLoaderInstance } from "jsonld-document-loader";
 import { Ed25519Signature2020 } from "@digitalbazaar/ed25519-signature-2020";
 import * as vc from "@digitalbazaar/vc";
 
-import type {
-  AvailableIssuerType,
-  VerifiableCredential,
-  VerifiableCredentialSubject,
-} from "../types";
+import type { AvailableIssuerType, VerifiableCredential } from "../types";
 
 import { issuerToKey } from "../utils";
-import { defaultDocumentLoader } from "./loader";
+import { defaultDocumentLoader } from "../utils/loader";
 
 export type VerifyCredentialResult = [boolean, Map<AvailableIssuerType, vc.VerifyCredentialResult>];
 
-export async function verifyCredential<K = VerifiableCredentialSubject>(
+export async function verifyCredential<K>(
   credential: VerifiableCredential<K>,
   issuers: AvailableIssuerType[],
   customDocumentLoader?: JsonLDDocumentLoaderInstance,
@@ -38,7 +34,7 @@ export async function verifyCredential<K = VerifiableCredentialSubject>(
 
     // Verify the signature
     const verifyCredentialResult = await vc.verifyCredential<K>({
-      credential: credential,
+      credential,
       suite: vcVerifyingSuite,
       controller,
       documentLoader: customDocumentLoader ?? defaultDocumentLoader,

package/types/internals.d.ts

@@ -46,7 +46,7 @@ declare module "@digitalbazaar/vc" {
     documentLoader: JsonLDDocumentLoaderInstance;
   }
 
-  export interface VerifiedCredentialsProof {
+  export interface VerifiedCredentialProof {
     type: string;
     created: string;
     verificationMethod: string;
@@ -54,25 +54,30 @@ declare module "@digitalbazaar/vc" {
     proofPurpose: string;
   }
 
-  export interface VerifiedCredentials<K> {
+  export interface VerifiedCredential<K> {
     "@context": string[];
     type: string[];
     issuer: string;
     id: string;
     level: string;
+    kycLevel?: number;
     issued: string;
     approvedAt: string;
-    expirationDate: string;
+    expirationDate?: string;
     credentialSubject: K;
     issuanceDate: string;
-    proof: VerifiedCredentialsProof;
+    proof: VerifiableCredentialProof;
   }
 
+  export type VerifiableCredential<K> = VerifiedCredential<K>;
+
   // oxlint-disable-next-line typescript/no-explicit-any -- I don't know the right type
-  export declare function issue<K = any>(options: IssueOptions): Promise<VerifiedCredentials<K>>;
+  export declare function issue<CredentialSubject = any, TExtension = any>(
+    options: IssueOptions,
+  ): Promise<VerifiedCredential<CredentialSubject> & TExtension>;
 
   export interface VerifyCredentialOptions<K> {
-    credential: VerifiedCredentials<K>;
+    credential: VerifiableCredential<K>;
     suite: Ed25519Signature2020;
     controller: object;
     documentLoader: JsonLDDocumentLoaderInstance;

package/dist/builder/index.d.mts

@@ -1,19 +0,0 @@
-import { AvailableIssuerType, CredentialFields, CredentialSubject, CredentialSubjectFaceId, VerifiableCredential, VerifiableCredentialSubject } from "../types/index.mjs";
-import * as vc from "@digitalbazaar/vc";
-import { JsonLDDocumentLoaderInstance } from "jsonld-document-loader";
-//#region src/builder/verifier.d.ts
-type VerifyCredentialResult = [boolean, Map<AvailableIssuerType, vc.VerifyCredentialResult>];
-declare function verifyCredential<K = VerifiableCredentialSubject>(credential: VerifiableCredential<K>, issuers: AvailableIssuerType[], customDocumentLoader?: JsonLDDocumentLoaderInstance): Promise<VerifyCredentialResult>;
-//#endregion
-//#region src/builder/index.d.ts
-type Credential = VerifiableCredential<VerifiableCredentialSubject>;
-type FaceIdCredential = VerifiableCredential<CredentialSubjectFaceId>;
-type CredentialBuilder<TInput, TOutput = TInput> = (fields: CredentialFields, subject: TInput, issuer: AvailableIssuerType, validate?: boolean) => Promise<VerifiableCredential<TOutput>>;
-type CredentialConverter<TInput> = (subject: TInput, validate: boolean) => Record<string, any>;
-declare const credentialSubjectConverter: CredentialConverter<CredentialSubject>;
-declare const credentialFaceIdSubjectConverter: CredentialConverter<CredentialSubjectFaceId>;
-declare const buildCredential: CredentialBuilder<CredentialSubject, VerifiableCredentialSubject>;
-declare const buildFaceIdCredential: CredentialBuilder<CredentialSubjectFaceId>;
-//#endregion
-export { Credential, CredentialBuilder, CredentialConverter, FaceIdCredential, type VerifyCredentialResult, buildCredential, buildFaceIdCredential, credentialFaceIdSubjectConverter, credentialSubjectConverter, verifyCredential };
-//# sourceMappingURL=index.d.mts.map

package/dist/builder/index.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/builder/verifier.ts","../../src/builder/index.ts"],"mappings":";;;;KAcY,mCAAmC,IAAI,qBAAqB,GAAG;iBAErD,iBAAiB,IAAI,6BACzC,YAAY,qBAAqB,IACjC,SAAS,uBACT,uBAAuB,+BACtB,QAAQ;;;KCOC,aAAa,qBAAqB;KAClC,mBAAmB,qBAAqB;KAExC,kBAAkB,QAAQ,UAAU,WAC9C,QAAQ,kBACR,SAAS,QACT,QAAQ,qBACR,uBACG,QAAQ,qBAAqB;KAEtB,oBAAoB,WAC9B,SAAS,QACT,sBAEG;cAyCQ,4BAA4B,oBAAoB;cAgBhD,kCAAkC,oBAAoB;cActD,iBAAiB,kBAAkB,mBAAmB;cAKtD,uBAAuB,kBAAkB"}