@sd-jwt/core 0.19.1-next.1 → 0.19.1-next.11

package/dist/index.js

@@ -20,6 +20,18 @@ var __spreadValues = (a, b) => {
   return a;
 };
 var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));
+var __objRest = (source, exclude) => {
+  var target = {};
+  for (var prop in source)
+    if (__hasOwnProp.call(source, prop) && exclude.indexOf(prop) < 0)
+      target[prop] = source[prop];
+  if (source != null && __getOwnPropSymbols)
+    for (var prop of __getOwnPropSymbols(source)) {
+      if (exclude.indexOf(prop) < 0 && __propIsEnum.call(source, prop))
+        target[prop] = source[prop];
+    }
+  return target;
+};
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -57,26 +69,384 @@ var __async = (__this, __arguments, generator) => {
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  Disclosure: () => Disclosure,
   FlattenJSON: () => FlattenJSON,
   GeneralJSON: () => GeneralJSON,
+  IANA_HASH_ALGORITHMS: () => IANA_HASH_ALGORITHMS,
   Jwt: () => Jwt,
   KBJwt: () => KBJwt,
+  KB_JWT_TYP: () => KB_JWT_TYP,
+  SDJWTException: () => SDJWTException,
   SDJwt: () => SDJwt,
   SDJwtGeneralJSONInstance: () => SDJwtGeneralJSONInstance,
   SDJwtInstance: () => SDJwtInstance,
+  SD_DECOY: () => SD_DECOY,
+  SD_DIGEST: () => SD_DIGEST,
+  SD_LIST_KEY: () => SD_LIST_KEY,
+  SD_SEPARATOR: () => SD_SEPARATOR,
+  base64UrlToUint8Array: () => import_identity_common.base64UrlToUint8Array,
+  base64urlDecode: () => import_identity_common.base64urlDecode,
+  base64urlEncode: () => import_identity_common.base64urlEncode,
   createDecoy: () => createDecoy,
+  createHashMapping: () => createHashMapping,
+  createHashMappingForSerializedDisclosure: () => createHashMappingForSerializedDisclosure,
+  createHashMappingSync: () => createHashMappingSync,
+  decodeJwt: () => decodeJwt,
+  decodeSdJwt: () => decodeSdJwt,
+  decodeSdJwtSync: () => decodeSdJwtSync,
+  ensureError: () => ensureError,
+  getClaims: () => getClaims,
+  getClaimsSync: () => getClaimsSync,
+  getSDAlgAndPayload: () => getSDAlgAndPayload,
   listKeys: () => listKeys,
-  pack: () => pack
+  pack: () => pack,
+  present: () => present,
+  presentSync: () => presentSync,
+  presentableKeys: () => presentableKeys,
+  presentableKeysSync: () => presentableKeysSync,
+  selectDisclosures: () => selectDisclosures,
+  splitSdJwt: () => splitSdJwt,
+  transformPresentationFrame: () => transformPresentationFrame,
+  uint8ArrayToBase64Url: () => import_identity_common.uint8ArrayToBase64Url,
+  unpack: () => unpack,
+  unpackObj: () => unpackObj,
+  unpackSync: () => unpackSync
 });
 module.exports = __toCommonJS(index_exports);
-var import_decode5 = require("@sd-jwt/decode");
-var import_types5 = require("@sd-jwt/types");
-var import_utils7 = require("@sd-jwt/utils");
+
+// src/types/type.ts
+var SD_SEPARATOR = "~";
+var SD_LIST_KEY = "...";
+var SD_DIGEST = "_sd";
+var SD_DECOY = "_sd_decoy";
+var KB_JWT_TYP = "kb+jwt";
+var IANA_HASH_ALGORITHMS = [
+  "sha-256",
+  "sha-256-128",
+  "sha-256-120",
+  "sha-256-96",
+  "sha-256-64",
+  "sha-256-32",
+  "sha-384",
+  "sha-512",
+  "sha3-224",
+  "sha3-256",
+  "sha3-384",
+  "sha3-512",
+  "blake2s-256",
+  "blake2b-256",
+  "blake2b-512",
+  "k12-256",
+  "k12-512"
+];
+
+// src/utils/base64url.ts
+var import_identity_common = require("@owf/identity-common");
+
+// src/utils/error.ts
+var SDJWTException = class _SDJWTException extends Error {
+  constructor(message, details) {
+    super(message);
+    Object.setPrototypeOf(this, _SDJWTException.prototype);
+    this.name = "SDJWTException";
+    this.details = details;
+  }
+  getFullMessage() {
+    return `${this.name}: ${this.message} ${this.details ? `- ${JSON.stringify(this.details)}` : ""}`;
+  }
+};
+function ensureError(value) {
+  if (value instanceof Error) return value;
+  if (typeof value === "string") return new Error(value);
+  return new Error(String(value));
+}
+
+// src/utils/disclosure.ts
+var Disclosure = class _Disclosure {
+  constructor(data, _meta) {
+    this._digest = _meta == null ? void 0 : _meta.digest;
+    this._encoded = _meta == null ? void 0 : _meta.encoded;
+    if (data.length === 2) {
+      this.salt = data[0];
+      this.value = data[1];
+      return;
+    }
+    if (data.length === 3) {
+      this.salt = data[0];
+      this.key = data[1];
+      this.value = data[2];
+      return;
+    }
+    throw new SDJWTException("Invalid disclosure data");
+  }
+  // We need to digest of the original encoded data.
+  // After decode process, we use JSON.stringify to encode the data.
+  // This can be different from the original encoded data.
+  static fromEncode(s, hash) {
+    return __async(this, null, function* () {
+      const { hasher, alg } = hash;
+      const digest = yield hasher(s, alg);
+      const digestStr = (0, import_identity_common.uint8ArrayToBase64Url)(digest);
+      const item = JSON.parse((0, import_identity_common.base64urlDecode)(s));
+      return _Disclosure.fromArray(item, { digest: digestStr, encoded: s });
+    });
+  }
+  static fromEncodeSync(s, hash) {
+    const { hasher, alg } = hash;
+    const digest = hasher(s, alg);
+    const digestStr = (0, import_identity_common.uint8ArrayToBase64Url)(digest);
+    const item = JSON.parse((0, import_identity_common.base64urlDecode)(s));
+    return _Disclosure.fromArray(item, { digest: digestStr, encoded: s });
+  }
+  static fromArray(item, _meta) {
+    return new _Disclosure(item, _meta);
+  }
+  encode() {
+    if (!this._encoded) {
+      this._encoded = (0, import_identity_common.base64urlEncode)(JSON.stringify(this.decode()));
+    }
+    return this._encoded;
+  }
+  decode() {
+    return this.key ? [this.salt, this.key, this.value] : [this.salt, this.value];
+  }
+  digest(hash) {
+    return __async(this, null, function* () {
+      const { hasher, alg } = hash;
+      if (!this._digest) {
+        const hash2 = yield hasher(this.encode(), alg);
+        this._digest = (0, import_identity_common.uint8ArrayToBase64Url)(hash2);
+      }
+      return this._digest;
+    });
+  }
+  digestSync(hash) {
+    const { hasher, alg } = hash;
+    if (!this._digest) {
+      const hash2 = hasher(this.encode(), alg);
+      this._digest = (0, import_identity_common.uint8ArrayToBase64Url)(hash2);
+    }
+    return this._digest;
+  }
+};
+
+// src/decode/decode.ts
+var decodeJwt = (jwt) => {
+  const { 0: header, 1: payload, 2: signature, length } = jwt.split(".");
+  if (length !== 3) {
+    throw new SDJWTException("Invalid JWT as input");
+  }
+  return {
+    header: JSON.parse((0, import_identity_common.base64urlDecode)(header)),
+    payload: JSON.parse((0, import_identity_common.base64urlDecode)(payload)),
+    signature
+  };
+};
+var splitSdJwt = (sdjwt) => {
+  const [encodedJwt, ...encodedDisclosures] = sdjwt.split(SD_SEPARATOR);
+  if (encodedDisclosures.length === 0) {
+    return {
+      jwt: encodedJwt,
+      disclosures: []
+    };
+  }
+  const encodedKeyBindingJwt = encodedDisclosures.pop();
+  return {
+    jwt: encodedJwt,
+    disclosures: encodedDisclosures,
+    kbJwt: encodedKeyBindingJwt || void 0
+  };
+};
+var decodeSdJwt = (sdjwt, hasher) => __async(null, null, function* () {
+  const [encodedJwt, ...encodedDisclosures] = sdjwt.split(SD_SEPARATOR);
+  const jwt = decodeJwt(encodedJwt);
+  if (encodedDisclosures.length === 0) {
+    return {
+      jwt,
+      disclosures: []
+    };
+  }
+  const encodedKeyBindingJwt = encodedDisclosures.pop();
+  const kbJwt = encodedKeyBindingJwt ? decodeJwt(encodedKeyBindingJwt) : void 0;
+  const { _sd_alg } = getSDAlgAndPayload(jwt.payload);
+  const disclosures = yield Promise.all(
+    encodedDisclosures.map(
+      (ed) => Disclosure.fromEncode(ed, { alg: _sd_alg, hasher })
+    )
+  );
+  return {
+    jwt,
+    disclosures,
+    kbJwt
+  };
+});
+var decodeSdJwtSync = (sdjwt, hasher) => {
+  const [encodedJwt, ...encodedDisclosures] = sdjwt.split(SD_SEPARATOR);
+  const jwt = decodeJwt(encodedJwt);
+  if (encodedDisclosures.length === 0) {
+    return {
+      jwt,
+      disclosures: []
+    };
+  }
+  const encodedKeyBindingJwt = encodedDisclosures.pop();
+  const kbJwt = encodedKeyBindingJwt ? decodeJwt(encodedKeyBindingJwt) : void 0;
+  const { _sd_alg } = getSDAlgAndPayload(jwt.payload);
+  const disclosures = encodedDisclosures.map(
+    (ed) => Disclosure.fromEncodeSync(ed, { alg: _sd_alg, hasher })
+  );
+  return {
+    jwt,
+    disclosures,
+    kbJwt
+  };
+};
+var getClaims = (rawPayload, disclosures, hasher) => __async(null, null, function* () {
+  const { unpackedObj } = yield unpack(rawPayload, disclosures, hasher);
+  return unpackedObj;
+});
+var getClaimsSync = (rawPayload, disclosures, hasher) => {
+  const { unpackedObj } = unpackSync(rawPayload, disclosures, hasher);
+  return unpackedObj;
+};
+var isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var unpackArray = (arr, map, prefix = "", seenDigests) => {
+  const keys = {};
+  const unpackedArray = [];
+  arr.forEach((item, idx) => {
+    if (isRecord(item)) {
+      const hash = item[SD_LIST_KEY];
+      if (typeof hash === "string") {
+        if (seenDigests) {
+          if (seenDigests.has(hash)) {
+            throw new SDJWTException(
+              "Duplicate digest found in SD-JWT payload"
+            );
+          }
+          seenDigests.add(hash);
+        }
+        const disclosed = map[hash];
+        if (disclosed) {
+          const presentKey = prefix ? `${prefix}.${idx}` : `${idx}`;
+          keys[presentKey] = hash;
+          const { unpackedObj, disclosureKeymap: disclosureKeys } = unpackObjInternal(disclosed.value, map, presentKey, seenDigests);
+          unpackedArray.push(unpackedObj);
+          Object.assign(keys, disclosureKeys);
+        }
+      } else {
+        const newKey = prefix ? `${prefix}.${idx}` : `${idx}`;
+        const { unpackedObj, disclosureKeymap: disclosureKeys } = unpackObjInternal(item, map, newKey, seenDigests);
+        unpackedArray.push(unpackedObj);
+        Object.assign(keys, disclosureKeys);
+      }
+    } else if (Array.isArray(item)) {
+      const newKey = prefix ? `${prefix}.${idx}` : `${idx}`;
+      const { unpackedObj, disclosureKeymap: disclosureKeys } = unpackObjInternal(item, map, newKey, seenDigests);
+      unpackedArray.push(unpackedObj);
+      Object.assign(keys, disclosureKeys);
+    } else {
+      unpackedArray.push(item);
+    }
+  });
+  return { unpackedObj: unpackedArray, disclosureKeymap: keys };
+};
+var unpackObj = (obj, map) => {
+  const copiedObj = JSON.parse(JSON.stringify(obj));
+  const seenDigests = /* @__PURE__ */ new Set();
+  const result = unpackObjInternal(copiedObj, map, "", seenDigests);
+  const mapDigests = Object.keys(map);
+  const unusedDigests = mapDigests.filter((d) => !seenDigests.has(d));
+  if (unusedDigests.length > 0) {
+    throw new SDJWTException("Unreferenced disclosure(s) detected in SD-JWT");
+  }
+  return result;
+};
+var unpackObjInternal = (obj, map, prefix = "", seenDigests) => {
+  const keys = {};
+  if (typeof obj === "object" && obj !== null) {
+    if (Array.isArray(obj)) {
+      return unpackArray(obj, map, prefix, seenDigests);
+    }
+    const record = obj;
+    for (const key in record) {
+      if (key !== SD_DIGEST && key !== SD_LIST_KEY && typeof record[key] === "object") {
+        const newKey = prefix ? `${prefix}.${key}` : key;
+        const { unpackedObj: unpackedObj2, disclosureKeymap: disclosureKeys } = unpackObjInternal(record[key], map, newKey, seenDigests);
+        record[key] = unpackedObj2;
+        Object.assign(keys, disclosureKeys);
+      }
+    }
+    const _a = record, { _sd } = _a, payload = __objRest(_a, ["_sd"]);
+    const claims = {};
+    if (_sd) {
+      for (const hash of _sd) {
+        if (seenDigests) {
+          if (seenDigests.has(hash)) {
+            throw new SDJWTException(
+              "Duplicate digest found in SD-JWT payload"
+            );
+          }
+          seenDigests.add(hash);
+        }
+        const disclosed = map[hash];
+        if (disclosed == null ? void 0 : disclosed.key) {
+          if (disclosed.key in payload) {
+            throw new SDJWTException(
+              `Disclosed claim name "${disclosed.key}" conflicts with existing payload key`
+            );
+          }
+          const presentKey = prefix ? `${prefix}.${disclosed.key}` : disclosed.key;
+          keys[presentKey] = hash;
+          const { unpackedObj: unpackedObj2, disclosureKeymap: disclosureKeys } = unpackObjInternal(disclosed.value, map, presentKey, seenDigests);
+          claims[disclosed.key] = unpackedObj2;
+          Object.assign(keys, disclosureKeys);
+        }
+      }
+    }
+    const unpackedObj = Object.assign(payload, claims);
+    return { unpackedObj, disclosureKeymap: keys };
+  }
+  return { unpackedObj: obj, disclosureKeymap: keys };
+};
+var createHashMapping = (disclosures, hash) => __async(null, null, function* () {
+  const map = {};
+  for (let i = 0; i < disclosures.length; i++) {
+    const disclosure = disclosures[i];
+    const digest = yield disclosure.digest(hash);
+    map[digest] = disclosure;
+  }
+  return map;
+});
+var createHashMappingSync = (disclosures, hash) => {
+  const map = {};
+  for (let i = 0; i < disclosures.length; i++) {
+    const disclosure = disclosures[i];
+    const digest = disclosure.digestSync(hash);
+    map[digest] = disclosure;
+  }
+  return map;
+};
+var getSDAlgAndPayload = (SdJwtPayload) => {
+  const _a = SdJwtPayload, { _sd_alg } = _a, payload = __objRest(_a, ["_sd_alg"]);
+  if (typeof _sd_alg !== "string") {
+    return { _sd_alg: "sha-256", payload };
+  }
+  return { _sd_alg, payload };
+};
+var unpack = (SdJwtPayload, disclosures, hasher) => __async(null, null, function* () {
+  const { _sd_alg, payload } = getSDAlgAndPayload(SdJwtPayload);
+  const hash = { hasher, alg: _sd_alg };
+  const map = yield createHashMapping(disclosures, hash);
+  return unpackObj(payload, map);
+});
+var unpackSync = (SdJwtPayload, disclosures, hasher) => {
+  const { _sd_alg, payload } = getSDAlgAndPayload(SdJwtPayload);
+  const hash = { hasher, alg: _sd_alg };
+  const map = createHashMappingSync(disclosures, hash);
+  return unpackObj(payload, map);
+};
 
 // src/flattenJSON.ts
-var import_decode = require("@sd-jwt/decode");
-var import_types = require("@sd-jwt/types");
-var import_utils = require("@sd-jwt/utils");
 var FlattenJSON = class _FlattenJSON {
   constructor(data) {
     this.disclosures = data.disclosures;
@@ -86,10 +456,10 @@ var FlattenJSON = class _FlattenJSON {
     this.protected = data.jwtData.protected;
   }
   static fromEncode(encodedSdJwt) {
-    const { jwt, disclosures, kbJwt } = (0, import_decode.splitSdJwt)(encodedSdJwt);
+    const { jwt, disclosures, kbJwt } = splitSdJwt(encodedSdJwt);
     const { 0: protectedHeader, 1: payload, 2: signature } = jwt.split(".");
     if (!protectedHeader || !payload || !signature) {
-      throw new import_utils.SDJWTException("Invalid JWT");
+      throw new SDJWTException("Invalid JWT");
     }
     return new _FlattenJSON({
       jwtData: {
@@ -129,19 +499,16 @@ var FlattenJSON = class _FlattenJSON {
     const jwt = `${this.protected}.${this.payload}.${this.signature}`;
     data.push(jwt);
     if (this.disclosures && this.disclosures.length > 0) {
-      const disclosures = this.disclosures.join(import_types.SD_SEPARATOR);
+      const disclosures = this.disclosures.join(SD_SEPARATOR);
       data.push(disclosures);
     }
     const kb_jwt = (_a = this.kb_jwt) != null ? _a : "";
     data.push(kb_jwt);
-    return data.join(import_types.SD_SEPARATOR);
+    return data.join(SD_SEPARATOR);
   }
 };
 
 // src/generalJSON.ts
-var import_decode2 = require("@sd-jwt/decode");
-var import_types2 = require("@sd-jwt/types");
-var import_utils2 = require("@sd-jwt/utils");
 var GeneralJSON = class _GeneralJSON {
   constructor(data) {
     this.payload = data.payload;
@@ -150,10 +517,10 @@ var GeneralJSON = class _GeneralJSON {
     this.signatures = data.signatures;
   }
   static fromEncode(encodedSdJwt) {
-    const { jwt, disclosures, kbJwt } = (0, import_decode2.splitSdJwt)(encodedSdJwt);
+    const { jwt, disclosures, kbJwt } = splitSdJwt(encodedSdJwt);
     const { 0: protectedHeader, 1: payload, 2: signature } = jwt.split(".");
     if (!protectedHeader || !payload || !signature) {
-      throw new import_utils2.SDJWTException("Invalid JWT");
+      throw new SDJWTException("Invalid JWT");
     }
     return new _GeneralJSON({
       payload,
@@ -170,7 +537,7 @@ var GeneralJSON = class _GeneralJSON {
   static fromSerialized(json) {
     var _a, _b, _c;
     if (!json.signatures[0]) {
-      throw new import_utils2.SDJWTException("Invalid JSON");
+      throw new SDJWTException("Invalid JSON");
     }
     const disclosures = (_b = (_a = json.signatures[0].header) == null ? void 0 : _a.disclosures) != null ? _b : [];
     const kb_jwt = (_c = json.signatures[0].header) == null ? void 0 : _c.kb_jwt;
@@ -216,23 +583,23 @@ var GeneralJSON = class _GeneralJSON {
   toEncoded(index) {
     var _a;
     if (index < 0 || index >= this.signatures.length) {
-      throw new import_utils2.SDJWTException("Index out of bounds");
+      throw new SDJWTException("Index out of bounds");
     }
     const data = [];
     const { protected: protectedHeader, signature } = this.signatures[index];
     const jwt = `${protectedHeader}.${this.payload}.${signature}`;
     data.push(jwt);
     if (this.disclosures && this.disclosures.length > 0) {
-      const disclosures = this.disclosures.join(import_types2.SD_SEPARATOR);
+      const disclosures = this.disclosures.join(SD_SEPARATOR);
       data.push(disclosures);
     }
     const kb = (_a = this.kb_jwt) != null ? _a : "";
     data.push(kb);
-    return data.join(import_types2.SD_SEPARATOR);
+    return data.join(SD_SEPARATOR);
   }
   addSignature(protectedHeader, signer, kid) {
     return __async(this, null, function* () {
-      const header = (0, import_utils2.base64urlEncode)(JSON.stringify(protectedHeader));
+      const header = (0, import_identity_common.base64urlEncode)(JSON.stringify(protectedHeader));
       const signature = yield signer(`${header}.${this.payload}`);
       this.signatures.push({
         protected: header,
@@ -244,8 +611,6 @@ var GeneralJSON = class _GeneralJSON {
 };
 
 // src/jwt.ts
-var import_decode3 = require("@sd-jwt/decode");
-var import_utils3 = require("@sd-jwt/utils");
 var Jwt = class _Jwt {
   constructor(data) {
     this.header = data == null ? void 0 : data.header;
@@ -254,7 +619,7 @@ var Jwt = class _Jwt {
     this.encoded = data == null ? void 0 : data.encoded;
   }
   static decodeJWT(jwt) {
-    return (0, import_decode3.decodeJwt)(jwt);
+    return decodeJwt(jwt);
   }
   static fromEncode(encodedJwt) {
     const { header, payload, signature } = _Jwt.decodeJWT(
@@ -280,18 +645,18 @@ var Jwt = class _Jwt {
   }
   getUnsignedToken() {
     if (!this.header || !this.payload) {
-      throw new import_utils3.SDJWTException("Serialize Error: Invalid JWT");
+      throw new SDJWTException("Serialize Error: Invalid JWT");
     }
     if (this.encoded) {
       const parts = this.encoded.split(".");
       if (parts.length !== 3) {
-        throw new import_utils3.SDJWTException(`Invalid JWT format: ${this.encoded}`);
+        throw new SDJWTException(`Invalid JWT format: ${this.encoded}`);
       }
       const unsignedToken = parts.slice(0, 2).join(".");
       return unsignedToken;
     }
-    const header = (0, import_utils3.base64urlEncode)(JSON.stringify(this.header));
-    const payload = (0, import_utils3.base64urlEncode)(JSON.stringify(this.payload));
+    const header = (0, import_identity_common.base64urlEncode)(JSON.stringify(this.header));
+    const payload = (0, import_identity_common.base64urlEncode)(JSON.stringify(this.payload));
     return `${header}.${payload}`;
   }
   sign(signer) {
@@ -306,10 +671,10 @@ var Jwt = class _Jwt {
       return this.encoded;
     }
     if (!this.header || !this.payload || !this.signature) {
-      throw new import_utils3.SDJWTException("Serialize Error: Invalid JWT");
+      throw new SDJWTException("Serialize Error: Invalid JWT");
     }
-    const header = (0, import_utils3.base64urlEncode)(JSON.stringify(this.header));
-    const payload = (0, import_utils3.base64urlEncode)(JSON.stringify(this.payload));
+    const header = (0, import_identity_common.base64urlEncode)(JSON.stringify(this.header));
+    const payload = (0, import_identity_common.base64urlEncode)(JSON.stringify(this.payload));
     const signature = this.signature;
     const compact = `${header}.${payload}.${signature}`;
     this.encoded = compact;
@@ -327,22 +692,25 @@ var Jwt = class _Jwt {
       var _a, _b, _c, _d;
       const skew = (options == null ? void 0 : options.skewSeconds) ? options.skewSeconds : 0;
       const currentDate = (_a = options == null ? void 0 : options.currentDate) != null ? _a : Math.floor(Date.now() / 1e3);
-      if (((_b = this.payload) == null ? void 0 : _b.iat) && this.payload.iat - skew > currentDate) {
-        throw new import_utils3.SDJWTException("Verify Error: JWT is not yet valid");
+      const iat = (_b = this.payload) == null ? void 0 : _b.iat;
+      const nbf = (_c = this.payload) == null ? void 0 : _c.nbf;
+      const exp = (_d = this.payload) == null ? void 0 : _d.exp;
+      if (typeof iat === "number" && iat - skew > currentDate) {
+        throw new SDJWTException("Verify Error: JWT is not yet valid");
       }
-      if (((_c = this.payload) == null ? void 0 : _c.nbf) && this.payload.nbf - skew > currentDate) {
-        throw new import_utils3.SDJWTException("Verify Error: JWT is not yet valid");
+      if (typeof nbf === "number" && nbf - skew > currentDate) {
+        throw new SDJWTException("Verify Error: JWT is not yet valid");
       }
-      if (((_d = this.payload) == null ? void 0 : _d.exp) && this.payload.exp + skew < currentDate) {
-        throw new import_utils3.SDJWTException("Verify Error: JWT is expired");
+      if (typeof exp === "number" && exp + skew < currentDate) {
+        throw new SDJWTException("Verify Error: JWT is expired");
       }
       if (!this.signature) {
-        throw new import_utils3.SDJWTException("Verify Error: no signature in JWT");
+        throw new SDJWTException("Verify Error: no signature in JWT");
       }
       const data = this.getUnsignedToken();
       const verified = yield verifier(data, this.signature, options);
       if (!verified) {
-        throw new import_utils3.SDJWTException("Verify Error: Invalid JWT Signature");
+        throw new SDJWTException("Verify Error: Invalid JWT Signature");
       }
       return { payload: this.payload, header: this.header };
     });
@@ -350,33 +718,25 @@ var Jwt = class _Jwt {
 };
 
 // src/kbjwt.ts
-var import_types3 = require("@sd-jwt/types");
-var import_utils4 = require("@sd-jwt/utils");
 var KBJwt = class _KBJwt extends Jwt {
   // Checking the validity of the key binding jwt
   // the type unknown is not good, but we don't know at this point how to get the public key of the signer, this is defined in the kbVerifier
   verifyKB(values) {
     return __async(this, null, function* () {
-      var _a;
       if (!this.header || !this.payload || !this.signature) {
-        throw new import_utils4.SDJWTException("Verify Error: Invalid JWT");
+        throw new SDJWTException("Verify Error: Invalid JWT");
       }
-      if (!this.header.alg || this.header.alg === "none" || !this.header.typ || this.header.typ !== import_types3.KB_JWT_TYP || !this.payload.iat || !this.payload.aud || !this.payload.nonce || // this is for backward compatibility with version 06
-      !(this.payload.sd_hash || ((_a = this.payload) == null ? void 0 : _a._sd_hash))) {
-        throw new import_utils4.SDJWTException("Invalid Key Binding Jwt");
-      }
-      const data = this.getUnsignedToken();
-      const verified = yield values.verifier(
-        data,
-        this.signature,
-        values.payload
-      );
-      if (!verified) {
-        throw new import_utils4.SDJWTException("Verify Error: Invalid JWT Signature");
+      if (!this.header.alg || this.header.alg === "none" || !this.header.typ || this.header.typ !== KB_JWT_TYP || !this.payload.iat || !this.payload.aud || !this.payload.nonce || // this is for backward compatibility with version 06
+      !(this.payload.sd_hash || "_sd_hash" in this.payload && this.payload._sd_hash)) {
+        throw new SDJWTException("Invalid Key Binding Jwt");
       }
       if (this.payload.nonce !== values.nonce) {
-        throw new import_utils4.SDJWTException("Verify Error: Invalid Nonce");
+        throw new SDJWTException("Verify Error: Invalid Nonce");
       }
+      yield this.verify(
+        (data, sig) => values.verifier(data, sig, values.payload),
+        values.options
+      );
       return { payload: this.payload, header: this.header };
     });
   }
@@ -395,20 +755,117 @@ var KBJwt = class _KBJwt extends Jwt {
   }
 };
 
-// src/sdjwt.ts
-var import_decode4 = require("@sd-jwt/decode");
-var import_present = require("@sd-jwt/present");
-var import_types4 = require("@sd-jwt/types");
-var import_utils6 = require("@sd-jwt/utils");
-
 // src/decoy.ts
-var import_utils5 = require("@sd-jwt/utils");
 var createDecoy = (hash, saltGenerator) => __async(null, null, function* () {
   const { hasher, alg } = hash;
   const salt = yield saltGenerator(16);
   const decoy = yield hasher(salt, alg);
-  return (0, import_utils5.uint8ArrayToBase64Url)(decoy);
+  return (0, import_identity_common.uint8ArrayToBase64Url)(decoy);
+});
+
+// src/present/present.ts
+var presentableKeys = (rawPayload, disclosures, hasher) => __async(null, null, function* () {
+  const { disclosureKeymap } = yield unpack(rawPayload, disclosures, hasher);
+  return Object.keys(disclosureKeymap).sort();
+});
+var presentableKeysSync = (rawPayload, disclosures, hasher) => {
+  const { disclosureKeymap } = unpackSync(rawPayload, disclosures, hasher);
+  return Object.keys(disclosureKeymap).sort();
+};
+var present = (sdJwt, presentFrame, hasher) => __async(null, null, function* () {
+  const { jwt, kbJwt } = splitSdJwt(sdJwt);
+  const {
+    jwt: { payload },
+    disclosures
+  } = yield decodeSdJwt(sdJwt, hasher);
+  const { _sd_alg: alg } = getSDAlgAndPayload(payload);
+  const hash = { alg, hasher };
+  const keys = transformPresentationFrame(presentFrame);
+  const hashmap = yield createHashMapping(disclosures, hash);
+  const { disclosureKeymap } = yield unpack(payload, disclosures, hasher);
+  const presentedDisclosures = keys.map((k) => hashmap[disclosureKeymap[k]]).filter((d) => d !== void 0);
+  return [
+    jwt,
+    ...presentedDisclosures.map((d) => d.encode()),
+    kbJwt != null ? kbJwt : ""
+  ].join(SD_SEPARATOR);
 });
+var presentSync = (sdJwt, presentFrame, hasher) => {
+  const { jwt, kbJwt } = splitSdJwt(sdJwt);
+  const {
+    jwt: { payload },
+    disclosures
+  } = decodeSdJwtSync(sdJwt, hasher);
+  const { _sd_alg: alg } = getSDAlgAndPayload(payload);
+  const hash = { alg, hasher };
+  const keys = transformPresentationFrame(presentFrame);
+  const hashmap = createHashMappingSync(disclosures, hash);
+  const { disclosureKeymap } = unpackSync(payload, disclosures, hasher);
+  const presentedDisclosures = keys.map((k) => hashmap[disclosureKeymap[k]]).filter((d) => d !== void 0);
+  return [
+    jwt,
+    ...presentedDisclosures.map((d) => d.encode()),
+    kbJwt != null ? kbJwt : ""
+  ].join(SD_SEPARATOR);
+};
+var transformPresentationFrame = (obj, prefix = "") => {
+  return Object.entries(obj).reduce((acc, [key, value]) => {
+    const newPrefix = prefix ? `${prefix}.${key}` : key;
+    if (typeof value === "boolean") {
+      if (value) {
+        acc.push(newPrefix);
+      }
+    } else if (typeof value === "object" && value !== null) {
+      acc.push(
+        newPrefix,
+        ...transformPresentationFrame(
+          value,
+          newPrefix
+        )
+      );
+    }
+    return acc;
+  }, []);
+};
+var createHashMappingForSerializedDisclosure = (disclosures) => {
+  const map = {};
+  for (let i = 0; i < disclosures.length; i++) {
+    const disclosure = disclosures[i];
+    const { digest, encoded, key, salt, value } = disclosure;
+    map[digest] = Disclosure.fromArray(
+      key ? [salt, key, value] : [salt, value],
+      { digest, encoded }
+    );
+  }
+  return map;
+};
+var selectDisclosures = (payload, disclosures, presentationFrame) => {
+  if (disclosures.length === 0) {
+    return [];
+  }
+  const hashmap = createHashMappingForSerializedDisclosure(disclosures);
+  const { disclosureKeymap } = unpackObj(payload, hashmap);
+  const keys = transformPresentationFrame(presentationFrame);
+  const presentedDisclosures = keys.map((k) => hashmap[disclosureKeymap[k]]).filter((d) => d !== void 0);
+  const selectedDisclosures = presentedDisclosures.map(
+    (d) => {
+      const { salt, key, value, _digest } = d;
+      if (!_digest) {
+        throw new SDJWTException(
+          "Implementation error: _digest is not defined"
+        );
+      }
+      return {
+        digest: _digest,
+        encoded: d.encode(),
+        salt,
+        key,
+        value
+      };
+    }
+  );
+  return selectedDisclosures;
+};
 
 // src/sdjwt.ts
 var SDJwt = class _SDJwt {
@@ -419,7 +876,7 @@ var SDJwt = class _SDJwt {
   }
   static decodeSDJwt(sdjwt, hasher) {
     return __async(this, null, function* () {
-      const [encodedJwt, ...encodedDisclosures] = sdjwt.split(import_types4.SD_SEPARATOR);
+      const [encodedJwt, ...encodedDisclosures] = sdjwt.split(SD_SEPARATOR);
       const jwt = Jwt.fromEncode(encodedJwt);
       if (!jwt.payload) {
         throw new Error("Payload is undefined on the JWT. Invalid state reached");
@@ -432,10 +889,10 @@ var SDJwt = class _SDJwt {
       }
       const encodedKeyBindingJwt = encodedDisclosures.pop();
       const kbJwt = encodedKeyBindingJwt ? KBJwt.fromKBEncode(encodedKeyBindingJwt) : void 0;
-      const { _sd_alg } = (0, import_decode4.getSDAlgAndPayload)(jwt.payload);
+      const { _sd_alg } = getSDAlgAndPayload(jwt.payload);
       const disclosures = yield Promise.all(
         encodedDisclosures.map(
-          (ed) => import_utils6.Disclosure.fromEncode(ed, { alg: _sd_alg, hasher })
+          (ed) => Disclosure.fromEncode(ed, { alg: _sd_alg, hasher })
         )
       );
       return {
@@ -447,7 +904,7 @@ var SDJwt = class _SDJwt {
   }
   static extractJwt(encodedSdJwt) {
     return __async(this, null, function* () {
-      const [encodedJwt, ..._encodedDisclosures] = encodedSdJwt.split(import_types4.SD_SEPARATOR);
+      const [encodedJwt, ..._encodedDisclosures] = encodedSdJwt.split(SD_SEPARATOR);
       return Jwt.fromEncode(encodedJwt);
     });
   }
@@ -476,17 +933,17 @@ var SDJwt = class _SDJwt {
     return __async(this, null, function* () {
       var _a;
       if (!((_a = this.jwt) == null ? void 0 : _a.payload) || !this.disclosures) {
-        throw new import_utils6.SDJWTException("Invalid sd-jwt: jwt or disclosures is missing");
+        throw new SDJWTException("Invalid sd-jwt: jwt or disclosures is missing");
       }
-      const { _sd_alg: alg } = (0, import_decode4.getSDAlgAndPayload)(this.jwt.payload);
+      const { _sd_alg: alg } = getSDAlgAndPayload(this.jwt.payload);
       const hash = { alg, hasher };
-      const hashmap = yield (0, import_decode4.createHashMapping)(this.disclosures, hash);
-      const { disclosureKeymap } = yield (0, import_decode4.unpack)(
+      const hashmap = yield createHashMapping(this.disclosures, hash);
+      const { disclosureKeymap } = yield unpack(
         this.jwt.payload,
         this.disclosures,
         hasher
       );
-      const keys = presentFrame ? (0, import_present.transformPresentationFrame)(presentFrame) : yield this.presentableKeys(hasher);
+      const keys = presentFrame ? transformPresentationFrame(presentFrame) : yield this.presentableKeys(hasher);
       const disclosures = keys.map((k) => hashmap[disclosureKeymap[k]]).filter((d) => d !== void 0);
       return disclosures;
     });
@@ -494,16 +951,16 @@ var SDJwt = class _SDJwt {
   encodeSDJwt() {
     const data = [];
     if (!this.jwt) {
-      throw new import_utils6.SDJWTException("Invalid sd-jwt: jwt is missing");
+      throw new SDJWTException("Invalid sd-jwt: jwt is missing");
     }
     const encodedJwt = this.jwt.encodeJwt();
     data.push(encodedJwt);
     if (this.disclosures && this.disclosures.length > 0) {
-      const encodeddisclosures = this.disclosures.map((dc) => dc.encode()).join(import_types4.SD_SEPARATOR);
+      const encodeddisclosures = this.disclosures.map((dc) => dc.encode()).join(SD_SEPARATOR);
       data.push(encodeddisclosures);
     }
     data.push(this.kbJwt ? this.kbJwt.encodeJwt() : "");
-    return data.join(import_types4.SD_SEPARATOR);
+    return data.join(SD_SEPARATOR);
   }
   keys(hasher) {
     return __async(this, null, function* () {
@@ -514,9 +971,9 @@ var SDJwt = class _SDJwt {
     return __async(this, null, function* () {
       var _a, _b;
       if (!((_a = this.jwt) == null ? void 0 : _a.payload) || !this.disclosures) {
-        throw new import_utils6.SDJWTException("Invalid sd-jwt: jwt or disclosures is missing");
+        throw new SDJWTException("Invalid sd-jwt: jwt or disclosures is missing");
       }
-      const { disclosureKeymap } = yield (0, import_decode4.unpack)(
+      const { disclosureKeymap } = yield unpack(
         (_b = this.jwt) == null ? void 0 : _b.payload,
         this.disclosures,
         hasher
@@ -528,9 +985,9 @@ var SDJwt = class _SDJwt {
     return __async(this, null, function* () {
       var _a;
       if (!((_a = this.jwt) == null ? void 0 : _a.payload) || !this.disclosures) {
-        throw new import_utils6.SDJWTException("Invalid sd-jwt: jwt or disclosures is missing");
+        throw new SDJWTException("Invalid sd-jwt: jwt or disclosures is missing");
       }
-      const { unpackedObj } = yield (0, import_decode4.unpack)(
+      const { unpackedObj } = yield unpack(
         this.jwt.payload,
         this.disclosures,
         hasher
@@ -545,8 +1002,9 @@ var listKeys = (obj, prefix = "") => {
     if (obj[key] === void 0) continue;
     const newKey = prefix ? `${prefix}.${key}` : key;
     keys.push(newKey);
-    if (obj[key] && typeof obj[key] === "object" && obj[key] !== null) {
-      keys.push(...listKeys(obj[key], newKey));
+    const value = obj[key];
+    if (value && typeof value === "object") {
+      keys.push(...listKeys(value, newKey));
     }
   }
   return keys;
@@ -559,14 +1017,14 @@ var pack = (claims, disclosureFrame, hash, saltGenerator) => __async(null, null,
       disclosures: []
     };
   }
-  const sd = (_a = disclosureFrame[import_types4.SD_DIGEST]) != null ? _a : [];
-  const decoyCount = (_b = disclosureFrame[import_types4.SD_DECOY]) != null ? _b : 0;
+  const sd = (_a = disclosureFrame[SD_DIGEST]) != null ? _a : [];
+  const decoyCount = (_b = disclosureFrame[SD_DECOY]) != null ? _b : 0;
   if (Array.isArray(claims)) {
     const packedClaims2 = [];
     const disclosures2 = [];
     const recursivePackedClaims2 = {};
     for (const key in disclosureFrame) {
-      if (key !== import_types4.SD_DIGEST) {
+      if (key !== SD_DIGEST) {
         const idx = Number.parseInt(key, 10);
         const packed = yield pack(
           claims[idx],
@@ -582,9 +1040,9 @@ var pack = (claims, disclosureFrame, hash, saltGenerator) => __async(null, null,
       const claim = recursivePackedClaims2[i] ? recursivePackedClaims2[i] : claims[i];
       if (sd.includes(i)) {
         const salt = yield saltGenerator(16);
-        const disclosure = new import_utils6.Disclosure([salt, claim]);
+        const disclosure = new Disclosure([salt, claim]);
         const digest = yield disclosure.digest(hash);
-        packedClaims2.push({ [import_types4.SD_LIST_KEY]: digest });
+        packedClaims2.push({ [SD_LIST_KEY]: digest });
         disclosures2.push(disclosure);
       } else {
         packedClaims2.push(claim);
@@ -592,7 +1050,7 @@ var pack = (claims, disclosureFrame, hash, saltGenerator) => __async(null, null,
     }
     for (let j = 0; j < decoyCount; j++) {
       const decoyDigest = yield createDecoy(hash, saltGenerator);
-      packedClaims2.push({ [import_types4.SD_LIST_KEY]: decoyDigest });
+      packedClaims2.push({ [SD_LIST_KEY]: decoyDigest });
     }
     return { packedClaims: packedClaims2, disclosures: disclosures2 };
   }
@@ -600,7 +1058,7 @@ var pack = (claims, disclosureFrame, hash, saltGenerator) => __async(null, null,
   const disclosures = [];
   const recursivePackedClaims = {};
   for (const key in disclosureFrame) {
-    if (key !== import_types4.SD_DIGEST) {
+    if (key !== SD_DIGEST) {
       const packed = yield pack(
         // @ts-expect-error
         claims[key],
@@ -617,7 +1075,7 @@ var pack = (claims, disclosureFrame, hash, saltGenerator) => __async(null, null,
     const claim = recursivePackedClaims[key] ? recursivePackedClaims[key] : claims[key];
     if (sd.includes(key)) {
       const salt = yield saltGenerator(16);
-      const disclosure = new import_utils6.Disclosure([salt, key, claim]);
+      const disclosure = new Disclosure([salt, key, claim]);
       const digest = yield disclosure.digest(hash);
       _sd.push(digest);
       disclosures.push(disclosure);
@@ -630,7 +1088,7 @@ var pack = (claims, disclosureFrame, hash, saltGenerator) => __async(null, null,
     _sd.push(decoyDigest);
   }
   if (_sd.length > 0) {
-    packedClaims[import_types4.SD_DIGEST] = _sd.sort();
+    packedClaims[SD_DIGEST] = _sd.sort();
   }
   return { packedClaims, disclosures };
 });
@@ -640,8 +1098,8 @@ var _SDJwtInstance = class _SDJwtInstance {
   constructor(userConfig) {
     this.userConfig = {};
     if (userConfig) {
-      if (userConfig.hashAlg && !import_types5.IANA_HASH_ALGORITHMS.includes(userConfig.hashAlg)) {
-        throw new import_utils7.SDJWTException(
+      if (userConfig.hashAlg && !IANA_HASH_ALGORITHMS.includes(userConfig.hashAlg)) {
+        throw new SDJWTException(
           `Invalid hash algorithm: ${userConfig.hashAlg}`
         );
       }
@@ -651,15 +1109,15 @@ var _SDJwtInstance = class _SDJwtInstance {
   createKBJwt(options, sdHash) {
     return __async(this, null, function* () {
       if (!this.userConfig.kbSigner) {
-        throw new import_utils7.SDJWTException("Key Binding Signer not found");
+        throw new SDJWTException("Key Binding Signer not found");
       }
       if (!this.userConfig.kbSignAlg) {
-        throw new import_utils7.SDJWTException("Key Binding sign algorithm not specified");
+        throw new SDJWTException("Key Binding sign algorithm not specified");
       }
       const { payload } = options;
       const kbJwt = new KBJwt({
         header: {
-          typ: import_types5.KB_JWT_TYP,
+          typ: KB_JWT_TYP,
           alg: this.userConfig.kbSignAlg
         },
         payload: __spreadProps(__spreadValues({}, payload), { sd_hash: sdHash })
@@ -671,7 +1129,7 @@ var _SDJwtInstance = class _SDJwtInstance {
   SignJwt(jwt) {
     return __async(this, null, function* () {
       if (!this.userConfig.signer) {
-        throw new import_utils7.SDJWTException("Signer not found");
+        throw new SDJWTException("Signer not found");
       }
       yield jwt.sign(this.userConfig.signer);
       return jwt;
@@ -680,7 +1138,7 @@ var _SDJwtInstance = class _SDJwtInstance {
   VerifyJwt(jwt, options) {
     return __async(this, null, function* () {
       if (!this.userConfig.verifier) {
-        throw new import_utils7.SDJWTException("Verifier not found");
+        throw new SDJWTException("Verifier not found");
       }
       return jwt.verify(this.userConfig.verifier, options);
     });
@@ -689,13 +1147,13 @@ var _SDJwtInstance = class _SDJwtInstance {
     return __async(this, null, function* () {
       var _a, _b;
       if (!this.userConfig.hasher) {
-        throw new import_utils7.SDJWTException("Hasher not found");
+        throw new SDJWTException("Hasher not found");
       }
       if (!this.userConfig.saltGenerator) {
-        throw new import_utils7.SDJWTException("SaltGenerator not found");
+        throw new SDJWTException("SaltGenerator not found");
       }
       if (!this.userConfig.signAlg) {
-        throw new import_utils7.SDJWTException("sign alogrithm not specified");
+        throw new SDJWTException("sign alogrithm not specified");
       }
       if (disclosureFrame) {
         this.validateReservedFields(disclosureFrame);
@@ -738,11 +1196,11 @@ var _SDJwtInstance = class _SDJwtInstance {
     return __async(this, null, function* () {
       var _a;
       if (!this.userConfig.hasher) {
-        throw new import_utils7.SDJWTException("Hasher not found");
+        throw new SDJWTException("Hasher not found");
       }
       const hasher = this.userConfig.hasher;
       const sdjwt = yield SDJwt.fromEncode(encodedSDJwt, hasher);
-      if (!((_a = sdjwt.jwt) == null ? void 0 : _a.payload)) throw new import_utils7.SDJWTException("Payload not found");
+      if (!((_a = sdjwt.jwt) == null ? void 0 : _a.payload)) throw new SDJWTException("Payload not found");
       const presentSdJwtWithoutKb = yield sdjwt.present(
         presentationFrame,
         hasher
@@ -765,12 +1223,12 @@ var _SDJwtInstance = class _SDJwtInstance {
   verify(encodedSDJwt, options) {
     return __async(this, null, function* () {
       if (!this.userConfig.hasher) {
-        throw new import_utils7.SDJWTException("Hasher not found");
+        throw new SDJWTException("Hasher not found");
       }
       const hasher = this.userConfig.hasher;
       const sdjwt = yield SDJwt.fromEncode(encodedSDJwt, hasher);
       if (!sdjwt.jwt || !sdjwt.jwt.payload) {
-        throw new import_utils7.SDJWTException("Invalid SD JWT");
+        throw new SDJWTException("Invalid SD JWT");
       }
       const { payload, header } = yield this.validate(encodedSDJwt, options);
       if (options == null ? void 0 : options.requiredClaimKeys) {
@@ -779,7 +1237,7 @@ var _SDJwtInstance = class _SDJwtInstance {
           (k) => !keys.includes(k)
         );
         if (missingKeys.length > 0) {
-          throw new import_utils7.SDJWTException(
+          throw new SDJWTException(
             `Missing required claim keys: ${missingKeys.join(", ")}`
           );
         }
@@ -788,15 +1246,16 @@ var _SDJwtInstance = class _SDJwtInstance {
         return { payload, header };
       }
       if (!sdjwt.kbJwt) {
-        throw new import_utils7.SDJWTException("Key Binding JWT not exist");
+        throw new SDJWTException("Key Binding JWT not exist");
       }
       if (!this.userConfig.kbVerifier) {
-        throw new import_utils7.SDJWTException("Key Binding Verifier not found");
+        throw new SDJWTException("Key Binding Verifier not found");
       }
       const kb = yield sdjwt.kbJwt.verifyKB({
         verifier: this.userConfig.kbVerifier,
         payload,
-        nonce: options.keyBindingNonce
+        nonce: options.keyBindingNonce,
+        options
       });
       if (!kb) {
         throw new Error("signature is not valid");
@@ -813,19 +1272,182 @@ var _SDJwtInstance = class _SDJwtInstance {
         hasher
       );
       if (sdHashStr !== sdHashfromKb) {
-        throw new import_utils7.SDJWTException("Invalid sd_hash in Key Binding JWT");
+        throw new SDJWTException("Invalid sd_hash in Key Binding JWT");
       }
       return { payload, header, kb };
     });
   }
+  /**
+   * Safe verification that collects all errors instead of failing fast.
+   * Returns a result object with either the verified data or an array of all errors.
+   *
+   * @param encodedSDJwt - The encoded SD-JWT to verify
+   * @param options - Verification options
+   * @returns A SafeVerifyResult containing either success data or collected errors
+   */
+  safeVerify(encodedSDJwt, options) {
+    return __async(this, null, function* () {
+      const errors = [];
+      const addError = (code, message, details) => {
+        errors.push({ code, message, details });
+      };
+      const exceptionToCode = (error) => {
+        const message = error.message.toLowerCase();
+        if (message.includes("hasher not found")) return "HASHER_NOT_FOUND";
+        if (message.includes("verifier not found")) return "VERIFIER_NOT_FOUND";
+        if (message.includes("invalid sd jwt") || message.includes("invalid jwt"))
+          return "INVALID_SD_JWT";
+        if (message.includes("not yet valid")) return "JWT_NOT_YET_VALID";
+        if (message.includes("expired")) return "JWT_EXPIRED";
+        if (message.includes("signature")) return "INVALID_JWT_SIGNATURE";
+        if (message.includes("missing required claim"))
+          return "MISSING_REQUIRED_CLAIMS";
+        if (message.includes("key binding jwt not exist"))
+          return "KEY_BINDING_JWT_MISSING";
+        if (message.includes("key binding verifier not found"))
+          return "KEY_BINDING_VERIFIER_NOT_FOUND";
+        if (message.includes("sd_hash")) return "KEY_BINDING_SD_HASH_INVALID";
+        return "UNKNOWN_ERROR";
+      };
+      if (!this.userConfig.hasher) {
+        addError("HASHER_NOT_FOUND", "Hasher not found");
+      }
+      if (!this.userConfig.verifier) {
+        addError("VERIFIER_NOT_FOUND", "Verifier not found");
+      }
+      if (errors.length > 0) {
+        return { success: false, errors };
+      }
+      if (!this.userConfig.hasher) {
+        throw new SDJWTException("Hasher not found");
+      }
+      const hasher = this.userConfig.hasher;
+      let sdjwt;
+      let payload;
+      let header;
+      try {
+        sdjwt = yield SDJwt.fromEncode(encodedSDJwt, hasher);
+        if (!sdjwt.jwt || !sdjwt.jwt.payload) {
+          addError("INVALID_SD_JWT", "Invalid SD JWT: missing JWT or payload");
+        }
+      } catch (e) {
+        const error = ensureError(e);
+        addError(
+          "INVALID_SD_JWT",
+          `Failed to decode SD-JWT: ${error.message}`,
+          error
+        );
+      }
+      if (sdjwt == null ? void 0 : sdjwt.jwt) {
+        try {
+          const result = yield this.VerifyJwt(sdjwt.jwt, options);
+          header = result.header;
+          const claims = yield sdjwt.getClaims(hasher);
+          payload = claims;
+        } catch (e) {
+          const error = ensureError(e);
+          const code = exceptionToCode(error);
+          addError(code, error.message, error);
+        }
+      }
+      if (sdjwt && (options == null ? void 0 : options.requiredClaimKeys)) {
+        try {
+          const keys = yield sdjwt.keys(hasher);
+          const missingKeys = options.requiredClaimKeys.filter(
+            (k) => !keys.includes(k)
+          );
+          if (missingKeys.length > 0) {
+            addError(
+              "MISSING_REQUIRED_CLAIMS",
+              `Missing required claim keys: ${missingKeys.join(", ")}`,
+              { missingKeys }
+            );
+          }
+        } catch (e) {
+          const error = ensureError(e);
+          addError(
+            "UNKNOWN_ERROR",
+            `Failed to check required claims: ${error.message}`,
+            error
+          );
+        }
+      }
+      let kb;
+      if ((options == null ? void 0 : options.keyBindingNonce) && sdjwt) {
+        if (!sdjwt.kbJwt) {
+          addError("KEY_BINDING_JWT_MISSING", "Key Binding JWT not exist");
+        } else if (!this.userConfig.kbVerifier) {
+          addError(
+            "KEY_BINDING_VERIFIER_NOT_FOUND",
+            "Key Binding Verifier not found"
+          );
+        } else if (payload) {
+          try {
+            const kbResult = yield sdjwt.kbJwt.verifyKB({
+              verifier: this.userConfig.kbVerifier,
+              payload,
+              nonce: options.keyBindingNonce,
+              options
+            });
+            if (!kbResult) {
+              addError(
+                "KEY_BINDING_SIGNATURE_INVALID",
+                "Key binding signature is not valid"
+              );
+            } else {
+              kb = kbResult;
+              const sdjwtWithoutKb = new SDJwt({
+                jwt: sdjwt.jwt,
+                disclosures: sdjwt.disclosures
+              });
+              const presentSdJwtWithoutKb = sdjwtWithoutKb.encodeSDJwt();
+              const sdHashStr = yield this.calculateSDHash(
+                presentSdJwtWithoutKb,
+                sdjwt,
+                hasher
+              );
+              if (sdHashStr !== kbResult.payload.sd_hash) {
+                addError(
+                  "KEY_BINDING_SD_HASH_INVALID",
+                  "Invalid sd_hash in Key Binding JWT",
+                  {
+                    expected: sdHashStr,
+                    received: kbResult.payload.sd_hash
+                  }
+                );
+              }
+            }
+          } catch (e) {
+            const error = ensureError(e);
+            addError(
+              "KEY_BINDING_SIGNATURE_INVALID",
+              `Key binding verification failed: ${error.message}`,
+              error
+            );
+          }
+        }
+      }
+      if (errors.length > 0) {
+        return { success: false, errors };
+      }
+      return {
+        success: true,
+        data: {
+          payload,
+          header,
+          kb
+        }
+      };
+    });
+  }
   calculateSDHash(presentSdJwtWithoutKb, sdjwt, hasher) {
     return __async(this, null, function* () {
       if (!sdjwt.jwt || !sdjwt.jwt.payload) {
-        throw new import_utils7.SDJWTException("Invalid SD JWT");
+        throw new SDJWTException("Invalid SD JWT");
       }
-      const { _sd_alg } = (0, import_decode5.getSDAlgAndPayload)(sdjwt.jwt.payload);
+      const { _sd_alg } = getSDAlgAndPayload(sdjwt.jwt.payload);
       const sdHash = yield hasher(presentSdJwtWithoutKb, _sd_alg);
-      const sdHashStr = (0, import_utils7.uint8ArrayToBase64Url)(sdHash);
+      const sdHashStr = (0, import_identity_common.uint8ArrayToBase64Url)(sdHash);
       return sdHashStr;
     });
   }
@@ -839,12 +1461,12 @@ var _SDJwtInstance = class _SDJwtInstance {
   validate(encodedSDJwt, options) {
     return __async(this, null, function* () {
       if (!this.userConfig.hasher) {
-        throw new import_utils7.SDJWTException("Hasher not found");
+        throw new SDJWTException("Hasher not found");
       }
       const hasher = this.userConfig.hasher;
       const sdjwt = yield SDJwt.fromEncode(encodedSDJwt, hasher);
       if (!sdjwt.jwt) {
-        throw new import_utils7.SDJWTException("Invalid SD JWT");
+        throw new SDJWTException("Invalid SD JWT");
       }
       const verifiedPayloads = yield this.VerifyJwt(sdjwt.jwt, options);
       const claims = yield sdjwt.getClaims(hasher);
@@ -859,14 +1481,14 @@ var _SDJwtInstance = class _SDJwtInstance {
   }
   decode(endcodedSDJwt) {
     if (!this.userConfig.hasher) {
-      throw new import_utils7.SDJWTException("Hasher not found");
+      throw new SDJWTException("Hasher not found");
     }
     return SDJwt.fromEncode(endcodedSDJwt, this.userConfig.hasher);
   }
   keys(endcodedSDJwt) {
     return __async(this, null, function* () {
       if (!this.userConfig.hasher) {
-        throw new import_utils7.SDJWTException("Hasher not found");
+        throw new SDJWTException("Hasher not found");
       }
       const sdjwt = yield SDJwt.fromEncode(endcodedSDJwt, this.userConfig.hasher);
       return sdjwt.keys(this.userConfig.hasher);
@@ -875,7 +1497,7 @@ var _SDJwtInstance = class _SDJwtInstance {
   presentableKeys(endcodedSDJwt) {
     return __async(this, null, function* () {
       if (!this.userConfig.hasher) {
-        throw new import_utils7.SDJWTException("Hasher not found");
+        throw new SDJWTException("Hasher not found");
       }
       const sdjwt = yield SDJwt.fromEncode(endcodedSDJwt, this.userConfig.hasher);
       return sdjwt.presentableKeys(this.userConfig.hasher);
@@ -884,7 +1506,7 @@ var _SDJwtInstance = class _SDJwtInstance {
   getClaims(endcodedSDJwt) {
     return __async(this, null, function* () {
       if (!this.userConfig.hasher) {
-        throw new import_utils7.SDJWTException("Hasher not found");
+        throw new SDJWTException("Hasher not found");
       }
       const sdjwt = yield SDJwt.fromEncode(endcodedSDJwt, this.userConfig.hasher);
       return sdjwt.getClaims(this.userConfig.hasher);
@@ -903,8 +1525,8 @@ var SDJwtGeneralJSONInstance = class {
   constructor(userConfig) {
     this.userConfig = {};
     if (userConfig) {
-      if (userConfig.hashAlg && !import_types5.IANA_HASH_ALGORITHMS.includes(userConfig.hashAlg)) {
-        throw new import_utils7.SDJWTException(
+      if (userConfig.hashAlg && !IANA_HASH_ALGORITHMS.includes(userConfig.hashAlg)) {
+        throw new SDJWTException(
           `Invalid hash algorithm: ${userConfig.hashAlg}`
         );
       }
@@ -914,15 +1536,15 @@ var SDJwtGeneralJSONInstance = class {
   createKBJwt(options, sdHash) {
     return __async(this, null, function* () {
       if (!this.userConfig.kbSigner) {
-        throw new import_utils7.SDJWTException("Key Binding Signer not found");
+        throw new SDJWTException("Key Binding Signer not found");
       }
       if (!this.userConfig.kbSignAlg) {
-        throw new import_utils7.SDJWTException("Key Binding sign algorithm not specified");
+        throw new SDJWTException("Key Binding sign algorithm not specified");
       }
       const { payload } = options;
       const kbJwt = new KBJwt({
         header: {
-          typ: import_types5.KB_JWT_TYP,
+          typ: KB_JWT_TYP,
           alg: this.userConfig.kbSignAlg
         },
         payload: __spreadProps(__spreadValues({}, payload), { sd_hash: sdHash })
@@ -932,16 +1554,16 @@ var SDJwtGeneralJSONInstance = class {
     });
   }
   encodeObj(obj) {
-    return (0, import_utils7.base64urlEncode)(JSON.stringify(obj));
+    return (0, import_identity_common.base64urlEncode)(JSON.stringify(obj));
   }
   issue(payload, disclosureFrame, options) {
     return __async(this, null, function* () {
       var _a;
       if (!this.userConfig.hasher) {
-        throw new import_utils7.SDJWTException("Hasher not found");
+        throw new SDJWTException("Hasher not found");
       }
       if (!this.userConfig.saltGenerator) {
-        throw new import_utils7.SDJWTException("SaltGenerator not found");
+        throw new SDJWTException("SaltGenerator not found");
       }
       if (disclosureFrame) {
         this.validateReservedFields(disclosureFrame);
@@ -993,12 +1615,12 @@ var SDJwtGeneralJSONInstance = class {
     return __async(this, null, function* () {
       var _a;
       if (!this.userConfig.hasher) {
-        throw new import_utils7.SDJWTException("Hasher not found");
+        throw new SDJWTException("Hasher not found");
       }
       const hasher = this.userConfig.hasher;
       const encodedSDJwt = generalJSON.toEncoded(0);
       const sdjwt = yield SDJwt.fromEncode(encodedSDJwt, hasher);
-      if (!((_a = sdjwt.jwt) == null ? void 0 : _a.payload)) throw new import_utils7.SDJWTException("Payload not found");
+      if (!((_a = sdjwt.jwt) == null ? void 0 : _a.payload)) throw new SDJWTException("Payload not found");
       const disclosures = yield sdjwt.getPresentDisclosures(
         presentationFrame,
         hasher
@@ -1033,14 +1655,14 @@ var SDJwtGeneralJSONInstance = class {
   verify(generalJSON, options) {
     return __async(this, null, function* () {
       if (!this.userConfig.hasher) {
-        throw new import_utils7.SDJWTException("Hasher not found");
+        throw new SDJWTException("Hasher not found");
       }
       const hasher = this.userConfig.hasher;
       const { payload, headers } = yield this.validate(generalJSON);
       const encodedSDJwt = generalJSON.toEncoded(0);
       const sdjwt = yield SDJwt.fromEncode(encodedSDJwt, hasher);
       if (!sdjwt.jwt || !sdjwt.jwt.payload) {
-        throw new import_utils7.SDJWTException("Invalid SD JWT");
+        throw new SDJWTException("Invalid SD JWT");
       }
       if (options == null ? void 0 : options.requiredClaimKeys) {
         const keys = yield sdjwt.keys(hasher);
@@ -1048,7 +1670,7 @@ var SDJwtGeneralJSONInstance = class {
           (k) => !keys.includes(k)
         );
         if (missingKeys.length > 0) {
-          throw new import_utils7.SDJWTException(
+          throw new SDJWTException(
             `Missing required claim keys: ${missingKeys.join(", ")}`
           );
         }
@@ -1057,15 +1679,16 @@ var SDJwtGeneralJSONInstance = class {
         return { payload, headers };
       }
       if (!sdjwt.kbJwt) {
-        throw new import_utils7.SDJWTException("Key Binding JWT not exist");
+        throw new SDJWTException("Key Binding JWT not exist");
       }
       if (!this.userConfig.kbVerifier) {
-        throw new import_utils7.SDJWTException("Key Binding Verifier not found");
+        throw new SDJWTException("Key Binding Verifier not found");
       }
       const kb = yield sdjwt.kbJwt.verifyKB({
         verifier: this.userConfig.kbVerifier,
         payload,
-        nonce: options.keyBindingNonce
+        nonce: options.keyBindingNonce,
+        options
       });
       if (!kb) {
         throw new Error("signature is not valid");
@@ -1082,7 +1705,7 @@ var SDJwtGeneralJSONInstance = class {
         hasher
       );
       if (sdHashStr !== sdHashfromKb) {
-        throw new import_utils7.SDJWTException("Invalid sd_hash in Key Binding JWT");
+        throw new SDJWTException("Invalid sd_hash in Key Binding JWT");
       }
       return { payload, headers, kb };
     });
@@ -1090,11 +1713,11 @@ var SDJwtGeneralJSONInstance = class {
   calculateSDHash(presentSdJwtWithoutKb, sdjwt, hasher) {
     return __async(this, null, function* () {
       if (!sdjwt.jwt || !sdjwt.jwt.payload) {
-        throw new import_utils7.SDJWTException("Invalid SD JWT");
+        throw new SDJWTException("Invalid SD JWT");
       }
-      const { _sd_alg } = (0, import_decode5.getSDAlgAndPayload)(sdjwt.jwt.payload);
+      const { _sd_alg } = getSDAlgAndPayload(sdjwt.jwt.payload);
       const sdHash = yield hasher(presentSdJwtWithoutKb, _sd_alg);
-      const sdHashStr = (0, import_utils7.uint8ArrayToBase64Url)(sdHash);
+      const sdHashStr = (0, import_identity_common.uint8ArrayToBase64Url)(sdHash);
       return sdHashStr;
     });
   }
@@ -1103,10 +1726,10 @@ var SDJwtGeneralJSONInstance = class {
   validate(generalJSON) {
     return __async(this, null, function* () {
       if (!this.userConfig.hasher) {
-        throw new import_utils7.SDJWTException("Hasher not found");
+        throw new SDJWTException("Hasher not found");
       }
       if (!this.userConfig.verifier) {
-        throw new import_utils7.SDJWTException("Verifier not found");
+        throw new SDJWTException("Verifier not found");
       }
       const hasher = this.userConfig.hasher;
       const verifier = this.userConfig.verifier;
@@ -1118,18 +1741,18 @@ var SDJwtGeneralJSONInstance = class {
             `${encodedHeader}.${payload}`,
             signature
           );
-          const header = JSON.parse((0, import_utils7.base64urlDecode)(encodedHeader));
+          const header = JSON.parse((0, import_identity_common.base64urlDecode)(encodedHeader));
           return { verified: verified2, header };
         }))
       );
       const verified = results.every((r) => r.verified);
       if (!verified) {
-        throw new import_utils7.SDJWTException("Signature is not valid");
+        throw new SDJWTException("Signature is not valid");
       }
       const encodedSDJwt = generalJSON.toEncoded(0);
       const sdjwt = yield SDJwt.fromEncode(encodedSDJwt, hasher);
       if (!sdjwt.jwt) {
-        throw new import_utils7.SDJWTException("Invalid SD JWT");
+        throw new SDJWTException("Invalid SD JWT");
       }
       const claims = yield sdjwt.getClaims(hasher);
       return { payload: claims, headers: results.map((r) => r.header) };
@@ -1147,7 +1770,7 @@ var SDJwtGeneralJSONInstance = class {
   keys(generalSdjwt) {
     return __async(this, null, function* () {
       if (!this.userConfig.hasher) {
-        throw new import_utils7.SDJWTException("Hasher not found");
+        throw new SDJWTException("Hasher not found");
       }
       const endcodedSDJwt = generalSdjwt.toEncoded(0);
       const sdjwt = yield SDJwt.fromEncode(endcodedSDJwt, this.userConfig.hasher);
@@ -1157,7 +1780,7 @@ var SDJwtGeneralJSONInstance = class {
   presentableKeys(generalSdjwt) {
     return __async(this, null, function* () {
       if (!this.userConfig.hasher) {
-        throw new import_utils7.SDJWTException("Hasher not found");
+        throw new SDJWTException("Hasher not found");
       }
       const endcodedSDJwt = generalSdjwt.toEncoded(0);
       const sdjwt = yield SDJwt.fromEncode(endcodedSDJwt, this.userConfig.hasher);
@@ -1167,7 +1790,7 @@ var SDJwtGeneralJSONInstance = class {
   getClaims(generalSdjwt) {
     return __async(this, null, function* () {
       if (!this.userConfig.hasher) {
-        throw new import_utils7.SDJWTException("Hasher not found");
+        throw new SDJWTException("Hasher not found");
       }
       const endcodedSDJwt = generalSdjwt.toEncoded(0);
       const sdjwt = yield SDJwt.fromEncode(endcodedSDJwt, this.userConfig.hasher);
@@ -1178,14 +1801,46 @@ var SDJwtGeneralJSONInstance = class {
 SDJwtGeneralJSONInstance.DEFAULT_hashAlg = "sha-256";
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  Disclosure,
   FlattenJSON,
   GeneralJSON,
+  IANA_HASH_ALGORITHMS,
   Jwt,
   KBJwt,
+  KB_JWT_TYP,
+  SDJWTException,
   SDJwt,
   SDJwtGeneralJSONInstance,
   SDJwtInstance,
+  SD_DECOY,
+  SD_DIGEST,
+  SD_LIST_KEY,
+  SD_SEPARATOR,
+  base64UrlToUint8Array,
+  base64urlDecode,
+  base64urlEncode,
   createDecoy,
+  createHashMapping,
+  createHashMappingForSerializedDisclosure,
+  createHashMappingSync,
+  decodeJwt,
+  decodeSdJwt,
+  decodeSdJwtSync,
+  ensureError,
+  getClaims,
+  getClaimsSync,
+  getSDAlgAndPayload,
   listKeys,
-  pack
+  pack,
+  present,
+  presentSync,
+  presentableKeys,
+  presentableKeysSync,
+  selectDisclosures,
+  splitSdJwt,
+  transformPresentationFrame,
+  uint8ArrayToBase64Url,
+  unpack,
+  unpackObj,
+  unpackSync
 });