@originator-profile/securing-mechanism 0.4.0-beta.1

package/README.md

@@ -0,0 +1,3 @@
+# Profile JWT Securing Mechanism
+
+VC の Securing 処理をするためのパッケージです。

package/dist/index.cjs

@@ -0,0 +1,182 @@
+'use strict';
+
+var jose = require('jose');
+var cryptography = require('@originator-profile/cryptography');
+var errors = require('jose/errors');
+var Ajv = require('ajv');
+var addFormats = require('ajv-formats');
+
+class VcVerifyFailed extends Error {
+  constructor(message, result) {
+    super(message);
+    this.result = result;
+  }
+  static get code() {
+    return "ERR_VC_VERIFY_FAILED";
+  }
+  code = VcVerifyFailed.code;
+}
+class VcDecodeFailed extends Error {
+  constructor(message, result) {
+    super(message);
+    this.result = result;
+  }
+  static get code() {
+    return "ERR_VC_DECODE_FAILED";
+  }
+  code = VcDecodeFailed.code;
+}
+class VcValidateFailed extends Error {
+  constructor(message, result) {
+    super(message);
+    this.result = result;
+  }
+  static get code() {
+    return "ERR_VC_VALIDATION_FAILED";
+  }
+  code = VcValidateFailed.code;
+}
+
+const constructFromSymbol = Symbol.for("constructDateFrom");
+
+function constructFrom(date, value) {
+  if (typeof date === "function") return date(value);
+  if (date && typeof date === "object" && constructFromSymbol in date)
+    return date[constructFromSymbol](value);
+  if (date instanceof Date) return new date.constructor(value);
+  return new Date(value);
+}
+
+function toDate(argument, context) {
+  return constructFrom(argument, argument);
+}
+
+function fromUnixTime(unixTime, options) {
+  return toDate(unixTime * 1e3);
+}
+
+function getUnixTime(date) {
+  return Math.trunc(+toDate(date) / 1e3);
+}
+
+function toUnverifiedJwtVc(payload, protectedHeader, jwt) {
+  const {
+    aud: _aud,
+    exp,
+    iat,
+    iss: _iss,
+    jti: _jti,
+    nbf: _nbf,
+    sub: _sub,
+    ...rest
+  } = payload;
+  const { alg, typ } = protectedHeader;
+  const doc = rest;
+  return {
+    doc,
+    issuedAt: iat ? fromUnixTime(iat) : void 0,
+    expiredAt: exp ? fromUnixTime(exp) : void 0,
+    mediaType: typ && `application/${typ}`,
+    algorithm: alg,
+    source: jwt
+  };
+}
+function toVerifiedJwtVc(payload, protectedHeader, jwt, key) {
+  const unverified = toUnverifiedJwtVc(payload, protectedHeader, jwt);
+  const verificationKey = {
+    ...key,
+    kid: protectedHeader.kid
+  };
+  return { ...unverified, verificationKey, validated: false };
+}
+
+function JwtVcDecoder() {
+  function decode(jwt) {
+    let payload;
+    let protectedHeader;
+    try {
+      payload = jose.decodeJwt(jwt);
+      protectedHeader = jose.decodeProtectedHeader(jwt);
+    } catch (e) {
+      const error = e;
+      return new VcDecodeFailed(
+        "JWT VC Decoding Failure",
+        {
+          source: jwt,
+          error
+        }
+      );
+    }
+    return toUnverifiedJwtVc(payload, protectedHeader, jwt);
+  }
+  return decode;
+}
+
+async function signJwtVc(vc, privateKey, options) {
+  const payload = vc;
+  const { alg = "ES256", issuedAt, expiredAt } = options;
+  const header = {
+    alg,
+    kid: privateKey.kid ?? await cryptography.createThumbprint(privateKey, alg),
+    typ: "vc+jwt",
+    cty: "vc"
+  };
+  const privateKeyImported = await jose.importJWK(privateKey, alg);
+  const jwt = await new jose.SignJWT(payload).setProtectedHeader(header).setIssuer(vc.issuer).setSubject(vc.credentialSubject.id).setIssuedAt(getUnixTime(issuedAt)).setExpirationTime(getUnixTime(expiredAt)).sign(privateKeyImported);
+  return jwt;
+}
+
+function JwtVcVerifier(keys, issuer, validator) {
+  async function verify(jwt) {
+    const verified = await jose.jwtVerify(jwt, keys, { issuer }).catch(
+      (e) => e
+    );
+    if (verified instanceof errors.JOSEError) {
+      return new VcVerifyFailed(
+        "JWT VC Verification Failure",
+        {
+          source: jwt,
+          error: verified
+        }
+      );
+    }
+    const { payload, protectedHeader, key } = verified;
+    const jwk = await jose.exportJWK(key);
+    const vc = toVerifiedJwtVc(payload, protectedHeader, jwt, jwk);
+    if (!validator) return vc;
+    const validated = validator(vc);
+    if (validated instanceof VcValidateFailed) return validated;
+    validated.validated = true;
+    return validated;
+  }
+  return verify;
+}
+
+function VcValidator(jsonSchema) {
+  const ajv = new Ajv();
+  addFormats(ajv);
+  const validateVcPayload = ajv.compile(jsonSchema);
+  function validate(vc) {
+    if (!validateVcPayload(vc.doc)) {
+      return new VcValidateFailed(
+        ajv.errorsText(validateVcPayload.errors),
+        {
+          ...vc,
+          error: new Ajv.ValidationError(validateVcPayload.errors ?? [])
+        }
+      );
+    }
+    return vc;
+  }
+  return validate;
+}
+
+exports.JwtVcDecoder = JwtVcDecoder;
+exports.JwtVcVerifier = JwtVcVerifier;
+exports.VcDecodeFailed = VcDecodeFailed;
+exports.VcValidateFailed = VcValidateFailed;
+exports.VcValidator = VcValidator;
+exports.VcVerifyFailed = VcVerifyFailed;
+exports.signJwtVc = signJwtVc;
+exports.toUnverifiedJwtVc = toUnverifiedJwtVc;
+exports.toVerifiedJwtVc = toVerifiedJwtVc;

package/dist/index.d.cts

@@ -0,0 +1,134 @@
+import { OpVc, Jwk } from '@originator-profile/model';
+import { ValidationError, AnySchema } from 'ajv';
+import { JWTInvalid, JOSEError } from 'jose/errors';
+import { JWTPayload, ProtectedHeaderParameters } from 'jose';
+import { Keys } from '@originator-profile/cryptography';
+
+/** 未復号 VC */
+type UndecodedVc = {
+    /** ソース */
+    source: unknown;
+};
+/** 未検証 VC */
+type UnverifiedVc<T extends OpVc = OpVc> = UndecodedVc & {
+    /** VC DM 2.0 文書 */
+    doc: T;
+    /** 発行日 */
+    issuedAt?: Date;
+    /** 有効期限 */
+    expiredAt?: Date;
+    /** メディアタイプ */
+    mediaType?: string;
+    /** 暗号アルゴリズム */
+    algorithm?: string;
+};
+/** 検証済み VC */
+type VerifiedVc<T extends OpVc = OpVc> = UnverifiedVc<T> & {
+    /** 検証鍵 */
+    verificationKey: Jwk;
+    /** 妥当性確認済みか否か */
+    validated: boolean;
+};
+type WithError<V extends object, E extends Error = Error> = V & {
+    error: E;
+};
+/** VC 復号失敗 */
+type VcDecodingFailure<V extends UndecodedVc = UndecodedVc, E extends Error = Error> = WithError<V, E>;
+/** VC 妥当性確認失敗 */
+type VcValidationFailure<V extends UnverifiedVc = UnverifiedVc> = WithError<V, ValidationError>;
+/** VC 検証失敗 */
+type VcVerificationFailure<V extends UndecodedVc = UndecodedVc, E extends Error = Error> = WithError<V, E>;
+/** VC 復号結果 */
+type VcDecodingResult<Success extends UnverifiedVc, Failure extends VcDecodingFailure> = Success | VcDecodeFailed<Failure>;
+/** VC 妥当性確認結果 */
+type VcValidationResult<Success extends UnverifiedVc, Failure extends VcValidationFailure> = Success | VcValidateFailed<VcValidationFailure<Failure>>;
+/** VC 検証結果 */
+type VcVerificationResult<Success extends VerifiedVc, Failure extends VcVerificationFailure> = Success | VcVerifyFailed<VcVerificationFailure<Failure>>;
+
+/** VC 検証失敗 */
+declare class VcVerifyFailed<T extends VcVerificationFailure> extends Error {
+    result: T;
+    static get code(): string;
+    readonly code: string;
+    constructor(message: string, result: T);
+}
+/** VC 復号失敗 */
+declare class VcDecodeFailed<T extends VcDecodingFailure> extends Error {
+    result: T;
+    static get code(): string;
+    readonly code: string;
+    constructor(message: string, result: T);
+}
+/**
+ * VC 妥当性確認失敗
+ *
+ * VC の妥当性確認に失敗しました。次の原因で使用されます。
+ *
+ * - データモデルへの適合性確認に失敗した
+ *
+ * */
+declare class VcValidateFailed<T extends VcValidationFailure> extends Error {
+    result: T;
+    static get code(): string;
+    readonly code: string;
+    constructor(message: string, result: T);
+}
+
+/** 未復号 VC */
+type UndecodedJwtVc = {
+    /** JWT */
+    source: string;
+};
+/** 未検証 JWT VC */
+type UnverifiedJwtVc<T extends OpVc> = UndecodedJwtVc & UnverifiedVc<T>;
+/** 検証済み JWT VC */
+type VerifiedJwtVc<T extends OpVc> = UnverifiedJwtVc<T> & VerifiedVc<T>;
+/** JWT VC 復号失敗 */
+type JwtVcDecodingFailure = VcDecodingFailure<UndecodedJwtVc, JWTInvalid | TypeError>;
+/** JWT VC 検証失敗 */
+type JwtVcVerificationFailure = VcVerificationFailure<UndecodedJwtVc, JOSEError>;
+/** JWT VC 妥当性確認結果 */
+type JwtVcValidationResult<T extends OpVc> = VcValidationResult<VerifiedJwtVc<T>, VcValidationFailure<VerifiedJwtVc<T>>>;
+/** JWT VC 復号結果 */
+type JwtVcDecodingResult<T extends OpVc> = VcDecodingResult<UnverifiedJwtVc<T>, JwtVcDecodingFailure>;
+/** JWT VC 検証結果 */
+type JwtVcVerificationResult<T extends OpVc> = VcVerificationResult<VerifiedJwtVc<T>, JwtVcVerificationFailure> | JwtVcValidationResult<T>;
+
+/**
+ * データモデルの復号器の生成
+ * @return 復号器
+ */
+declare function JwtVcDecoder<T extends OpVc>(): (jwt: string) => JwtVcDecodingResult<T>;
+type JwtVcDecoder<T extends OpVc> = ReturnType<typeof JwtVcDecoder<T>>;
+
+declare function toUnverifiedJwtVc<T extends OpVc>(payload: JWTPayload, protectedHeader: ProtectedHeaderParameters, jwt: string): UnverifiedJwtVc<T>;
+declare function toVerifiedJwtVc<T extends OpVc>(payload: JWTPayload, protectedHeader: ProtectedHeaderParameters, jwt: string, key: Jwk): VerifiedJwtVc<T>;
+
+/**
+ * VC への署名
+ * @param cp CoreProfile オブジェクト
+ * @param privateKey プライベート鍵
+ * @return JWT でエンコードされた VC
+ */
+declare function signJwtVc<T extends OpVc>(vc: T, privateKey: Jwk, options: {
+    alg?: string;
+    issuedAt: Date;
+    expiredAt: Date;
+}): Promise<string>;
+
+/** データモデルへの適合性確認のためのバリデーター */
+declare function VcValidator<V extends UnverifiedVc>(jsonSchema: AnySchema): (vc: V) => VcValidationResult<V, VcValidationFailure<V>>;
+/** データモデルへの適合性確認のためのバリデーター */
+type VcValidator<V extends UnverifiedVc> = ReturnType<typeof VcValidator<V>>;
+
+/**
+ * JWT VC の検証者の作成
+ * @param keys 公開鍵
+ * @param issuer 公開鍵の有効な発行者
+ * @param validator バリデーター
+ * @return 検証者
+ */
+declare function JwtVcVerifier<T extends OpVc>(keys: Keys, issuer: string | string[], validator?: VcValidator<VerifiedJwtVc<T>>): (jwt: string) => Promise<JwtVcVerificationResult<T>>;
+type JwtVcVerifier<T extends OpVc> = ReturnType<typeof JwtVcVerifier<T>>;
+
+export { JwtVcDecoder, type JwtVcDecodingFailure, type JwtVcDecodingResult, type JwtVcValidationResult, type JwtVcVerificationFailure, type JwtVcVerificationResult, JwtVcVerifier, type UndecodedJwtVc, type UndecodedVc, type UnverifiedJwtVc, type UnverifiedVc, VcDecodeFailed, type VcDecodingFailure, type VcDecodingResult, VcValidateFailed, type VcValidationFailure, type VcValidationResult, VcValidator, type VcVerificationFailure, type VcVerificationResult, VcVerifyFailed, type VerifiedJwtVc, type VerifiedVc, signJwtVc, toUnverifiedJwtVc, toVerifiedJwtVc };

package/dist/index.d.mts

@@ -0,0 +1,134 @@
+import { OpVc, Jwk } from '@originator-profile/model';
+import { ValidationError, AnySchema } from 'ajv';
+import { JWTInvalid, JOSEError } from 'jose/errors';
+import { JWTPayload, ProtectedHeaderParameters } from 'jose';
+import { Keys } from '@originator-profile/cryptography';
+
+/** 未復号 VC */
+type UndecodedVc = {
+    /** ソース */
+    source: unknown;
+};
+/** 未検証 VC */
+type UnverifiedVc<T extends OpVc = OpVc> = UndecodedVc & {
+    /** VC DM 2.0 文書 */
+    doc: T;
+    /** 発行日 */
+    issuedAt?: Date;
+    /** 有効期限 */
+    expiredAt?: Date;
+    /** メディアタイプ */
+    mediaType?: string;
+    /** 暗号アルゴリズム */
+    algorithm?: string;
+};
+/** 検証済み VC */
+type VerifiedVc<T extends OpVc = OpVc> = UnverifiedVc<T> & {
+    /** 検証鍵 */
+    verificationKey: Jwk;
+    /** 妥当性確認済みか否か */
+    validated: boolean;
+};
+type WithError<V extends object, E extends Error = Error> = V & {
+    error: E;
+};
+/** VC 復号失敗 */
+type VcDecodingFailure<V extends UndecodedVc = UndecodedVc, E extends Error = Error> = WithError<V, E>;
+/** VC 妥当性確認失敗 */
+type VcValidationFailure<V extends UnverifiedVc = UnverifiedVc> = WithError<V, ValidationError>;
+/** VC 検証失敗 */
+type VcVerificationFailure<V extends UndecodedVc = UndecodedVc, E extends Error = Error> = WithError<V, E>;
+/** VC 復号結果 */
+type VcDecodingResult<Success extends UnverifiedVc, Failure extends VcDecodingFailure> = Success | VcDecodeFailed<Failure>;
+/** VC 妥当性確認結果 */
+type VcValidationResult<Success extends UnverifiedVc, Failure extends VcValidationFailure> = Success | VcValidateFailed<VcValidationFailure<Failure>>;
+/** VC 検証結果 */
+type VcVerificationResult<Success extends VerifiedVc, Failure extends VcVerificationFailure> = Success | VcVerifyFailed<VcVerificationFailure<Failure>>;
+
+/** VC 検証失敗 */
+declare class VcVerifyFailed<T extends VcVerificationFailure> extends Error {
+    result: T;
+    static get code(): string;
+    readonly code: string;
+    constructor(message: string, result: T);
+}
+/** VC 復号失敗 */
+declare class VcDecodeFailed<T extends VcDecodingFailure> extends Error {
+    result: T;
+    static get code(): string;
+    readonly code: string;
+    constructor(message: string, result: T);
+}
+/**
+ * VC 妥当性確認失敗
+ *
+ * VC の妥当性確認に失敗しました。次の原因で使用されます。
+ *
+ * - データモデルへの適合性確認に失敗した
+ *
+ * */
+declare class VcValidateFailed<T extends VcValidationFailure> extends Error {
+    result: T;
+    static get code(): string;
+    readonly code: string;
+    constructor(message: string, result: T);
+}
+
+/** 未復号 VC */
+type UndecodedJwtVc = {
+    /** JWT */
+    source: string;
+};
+/** 未検証 JWT VC */
+type UnverifiedJwtVc<T extends OpVc> = UndecodedJwtVc & UnverifiedVc<T>;
+/** 検証済み JWT VC */
+type VerifiedJwtVc<T extends OpVc> = UnverifiedJwtVc<T> & VerifiedVc<T>;
+/** JWT VC 復号失敗 */
+type JwtVcDecodingFailure = VcDecodingFailure<UndecodedJwtVc, JWTInvalid | TypeError>;
+/** JWT VC 検証失敗 */
+type JwtVcVerificationFailure = VcVerificationFailure<UndecodedJwtVc, JOSEError>;
+/** JWT VC 妥当性確認結果 */
+type JwtVcValidationResult<T extends OpVc> = VcValidationResult<VerifiedJwtVc<T>, VcValidationFailure<VerifiedJwtVc<T>>>;
+/** JWT VC 復号結果 */
+type JwtVcDecodingResult<T extends OpVc> = VcDecodingResult<UnverifiedJwtVc<T>, JwtVcDecodingFailure>;
+/** JWT VC 検証結果 */
+type JwtVcVerificationResult<T extends OpVc> = VcVerificationResult<VerifiedJwtVc<T>, JwtVcVerificationFailure> | JwtVcValidationResult<T>;
+
+/**
+ * データモデルの復号器の生成
+ * @return 復号器
+ */
+declare function JwtVcDecoder<T extends OpVc>(): (jwt: string) => JwtVcDecodingResult<T>;
+type JwtVcDecoder<T extends OpVc> = ReturnType<typeof JwtVcDecoder<T>>;
+
+declare function toUnverifiedJwtVc<T extends OpVc>(payload: JWTPayload, protectedHeader: ProtectedHeaderParameters, jwt: string): UnverifiedJwtVc<T>;
+declare function toVerifiedJwtVc<T extends OpVc>(payload: JWTPayload, protectedHeader: ProtectedHeaderParameters, jwt: string, key: Jwk): VerifiedJwtVc<T>;
+
+/**
+ * VC への署名
+ * @param cp CoreProfile オブジェクト
+ * @param privateKey プライベート鍵
+ * @return JWT でエンコードされた VC
+ */
+declare function signJwtVc<T extends OpVc>(vc: T, privateKey: Jwk, options: {
+    alg?: string;
+    issuedAt: Date;
+    expiredAt: Date;
+}): Promise<string>;
+
+/** データモデルへの適合性確認のためのバリデーター */
+declare function VcValidator<V extends UnverifiedVc>(jsonSchema: AnySchema): (vc: V) => VcValidationResult<V, VcValidationFailure<V>>;
+/** データモデルへの適合性確認のためのバリデーター */
+type VcValidator<V extends UnverifiedVc> = ReturnType<typeof VcValidator<V>>;
+
+/**
+ * JWT VC の検証者の作成
+ * @param keys 公開鍵
+ * @param issuer 公開鍵の有効な発行者
+ * @param validator バリデーター
+ * @return 検証者
+ */
+declare function JwtVcVerifier<T extends OpVc>(keys: Keys, issuer: string | string[], validator?: VcValidator<VerifiedJwtVc<T>>): (jwt: string) => Promise<JwtVcVerificationResult<T>>;
+type JwtVcVerifier<T extends OpVc> = ReturnType<typeof JwtVcVerifier<T>>;
+
+export { JwtVcDecoder, type JwtVcDecodingFailure, type JwtVcDecodingResult, type JwtVcValidationResult, type JwtVcVerificationFailure, type JwtVcVerificationResult, JwtVcVerifier, type UndecodedJwtVc, type UndecodedVc, type UnverifiedJwtVc, type UnverifiedVc, VcDecodeFailed, type VcDecodingFailure, type VcDecodingResult, VcValidateFailed, type VcValidationFailure, type VcValidationResult, VcValidator, type VcVerificationFailure, type VcVerificationResult, VcVerifyFailed, type VerifiedJwtVc, type VerifiedVc, signJwtVc, toUnverifiedJwtVc, toVerifiedJwtVc };

package/dist/index.mjs

@@ -0,0 +1,172 @@
+import { decodeJwt, decodeProtectedHeader, importJWK, SignJWT, jwtVerify, exportJWK } from 'jose';
+import { createThumbprint } from '@originator-profile/cryptography';
+import { JOSEError } from 'jose/errors';
+import Ajv, { ValidationError } from 'ajv';
+import addFormats from 'ajv-formats';
+
+class VcVerifyFailed extends Error {
+  constructor(message, result) {
+    super(message);
+    this.result = result;
+  }
+  static get code() {
+    return "ERR_VC_VERIFY_FAILED";
+  }
+  code = VcVerifyFailed.code;
+}
+class VcDecodeFailed extends Error {
+  constructor(message, result) {
+    super(message);
+    this.result = result;
+  }
+  static get code() {
+    return "ERR_VC_DECODE_FAILED";
+  }
+  code = VcDecodeFailed.code;
+}
+class VcValidateFailed extends Error {
+  constructor(message, result) {
+    super(message);
+    this.result = result;
+  }
+  static get code() {
+    return "ERR_VC_VALIDATION_FAILED";
+  }
+  code = VcValidateFailed.code;
+}
+
+const constructFromSymbol = Symbol.for("constructDateFrom");
+
+function constructFrom(date, value) {
+  if (typeof date === "function") return date(value);
+  if (date && typeof date === "object" && constructFromSymbol in date)
+    return date[constructFromSymbol](value);
+  if (date instanceof Date) return new date.constructor(value);
+  return new Date(value);
+}
+
+function toDate(argument, context) {
+  return constructFrom(argument, argument);
+}
+
+function fromUnixTime(unixTime, options) {
+  return toDate(unixTime * 1e3);
+}
+
+function getUnixTime(date) {
+  return Math.trunc(+toDate(date) / 1e3);
+}
+
+function toUnverifiedJwtVc(payload, protectedHeader, jwt) {
+  const {
+    aud: _aud,
+    exp,
+    iat,
+    iss: _iss,
+    jti: _jti,
+    nbf: _nbf,
+    sub: _sub,
+    ...rest
+  } = payload;
+  const { alg, typ } = protectedHeader;
+  const doc = rest;
+  return {
+    doc,
+    issuedAt: iat ? fromUnixTime(iat) : void 0,
+    expiredAt: exp ? fromUnixTime(exp) : void 0,
+    mediaType: typ && `application/${typ}`,
+    algorithm: alg,
+    source: jwt
+  };
+}
+function toVerifiedJwtVc(payload, protectedHeader, jwt, key) {
+  const unverified = toUnverifiedJwtVc(payload, protectedHeader, jwt);
+  const verificationKey = {
+    ...key,
+    kid: protectedHeader.kid
+  };
+  return { ...unverified, verificationKey, validated: false };
+}
+
+function JwtVcDecoder() {
+  function decode(jwt) {
+    let payload;
+    let protectedHeader;
+    try {
+      payload = decodeJwt(jwt);
+      protectedHeader = decodeProtectedHeader(jwt);
+    } catch (e) {
+      const error = e;
+      return new VcDecodeFailed(
+        "JWT VC Decoding Failure",
+        {
+          source: jwt,
+          error
+        }
+      );
+    }
+    return toUnverifiedJwtVc(payload, protectedHeader, jwt);
+  }
+  return decode;
+}
+
+async function signJwtVc(vc, privateKey, options) {
+  const payload = vc;
+  const { alg = "ES256", issuedAt, expiredAt } = options;
+  const header = {
+    alg,
+    kid: privateKey.kid ?? await createThumbprint(privateKey, alg),
+    typ: "vc+jwt",
+    cty: "vc"
+  };
+  const privateKeyImported = await importJWK(privateKey, alg);
+  const jwt = await new SignJWT(payload).setProtectedHeader(header).setIssuer(vc.issuer).setSubject(vc.credentialSubject.id).setIssuedAt(getUnixTime(issuedAt)).setExpirationTime(getUnixTime(expiredAt)).sign(privateKeyImported);
+  return jwt;
+}
+
+function JwtVcVerifier(keys, issuer, validator) {
+  async function verify(jwt) {
+    const verified = await jwtVerify(jwt, keys, { issuer }).catch(
+      (e) => e
+    );
+    if (verified instanceof JOSEError) {
+      return new VcVerifyFailed(
+        "JWT VC Verification Failure",
+        {
+          source: jwt,
+          error: verified
+        }
+      );
+    }
+    const { payload, protectedHeader, key } = verified;
+    const jwk = await exportJWK(key);
+    const vc = toVerifiedJwtVc(payload, protectedHeader, jwt, jwk);
+    if (!validator) return vc;
+    const validated = validator(vc);
+    if (validated instanceof VcValidateFailed) return validated;
+    validated.validated = true;
+    return validated;
+  }
+  return verify;
+}
+
+function VcValidator(jsonSchema) {
+  const ajv = new Ajv();
+  addFormats(ajv);
+  const validateVcPayload = ajv.compile(jsonSchema);
+  function validate(vc) {
+    if (!validateVcPayload(vc.doc)) {
+      return new VcValidateFailed(
+        ajv.errorsText(validateVcPayload.errors),
+        {
+          ...vc,
+          error: new ValidationError(validateVcPayload.errors ?? [])
+        }
+      );
+    }
+    return vc;
+  }
+  return validate;
+}
+
+export { JwtVcDecoder, JwtVcVerifier, VcDecodeFailed, VcValidateFailed, VcValidator, VcVerifyFailed, signJwtVc, toUnverifiedJwtVc, toVerifiedJwtVc };

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "@originator-profile/securing-mechanism",
+  "version": "0.4.0-beta.1",
+  "private": false,
+  "type": "module",
+  "exports": {
+    "require": {
+      "types": "./dist/index.d.cts",
+      "default": "./dist/index.cjs"
+    },
+    "import": {
+      "types": "./dist/index.d.mts",
+      "default": "./dist/index.mjs"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "ajv": "^8.17.1",
+    "ajv-formats": "^3.0.1",
+    "jose": "^6.0.10",
+    "@originator-profile/model": "0.4.0-beta.1",
+    "@originator-profile/cryptography": "0.4.0-beta.1"
+  },
+  "devDependencies": {
+    "date-fns": "^4.1.0",
+    "eslint": "^9.25.1",
+    "pkgroll": "^2.12.2",
+    "typescript": "^5.8.3",
+    "vitest": "^4.0.0",
+    "@originator-profile/tsconfig": "0.4.0-beta.1",
+    "eslint-config-originator-profile": "0.4.0-beta.1"
+  },
+  "scripts": {
+    "build": "pkgroll --clean-dist --target=node20",
+    "test": "vitest run",
+    "lint": "eslint --fix .",
+    "type-check": "tsc --noEmit"
+  }
+}