@sd-jwt/core 0.20.1-next.5 → 0.20.1-next.6

package/dist/index.d.mts

@@ -8,12 +8,16 @@ declare const KB_JWT_TYP = "kb+jwt";
 type SDJWTCompact = string;
 type Base64urlString = string;
 type DisclosureData<T> = [string, string, T] | [string, T];
+declare const encodePathSegment: (segment: string) => string;
+declare const encodePath: (segments: string[]) => string;
 declare const IANA_HASH_ALGORITHMS: readonly ["sha-256", "sha-256-128", "sha-256-120", "sha-256-96", "sha-256-64", "sha-256-32", "sha-384", "sha-512", "sha3-224", "sha3-256", "sha3-384", "sha3-512", "blake2s-256", "blake2b-256", "blake2b-512", "k12-256", "k12-512"];
 type HashAlgorithm = (typeof IANA_HASH_ALGORITHMS)[number];
+declare const DEFAULT_SECURE_HASH_ALGORITHMS: readonly ["sha-256", "sha-384", "sha-512", "sha3-256", "sha3-384", "sha3-512", "blake2s-256", "blake2b-256", "blake2b-512", "k12-256", "k12-512"];
 type SDJWTConfig<T = unknown> = {
     omitTyp?: boolean;
     hasher?: Hasher;
     hashAlg?: HashAlgorithm;
+    allowedDisclosureHashAlgorithms?: ReadonlyArray<HashAlgorithm>;
     saltGenerator?: SaltGenerator;
     signer?: Signer;
     signAlg?: string;
@@ -268,6 +272,7 @@ type GeneralJSONSerialized = {
             disclosures?: Array<string>;
             kid?: string;
             kb_jwt?: string;
+            [key: string]: unknown;
         };
         protected: string;
         signature: string;
@@ -332,10 +337,31 @@ type VerifierOptions = {
      * If the payload does not contain these keys, the verification will fail.
      */
     requiredClaimKeys?: string[];
+    /**
+     * Expected audience for the processed SD-JWT payload.
+     */
+    expectedAudience?: string | string[];
+    /**
+     * Allowed JOSE algorithms for issuer-signed JWTs. `none` is always rejected.
+     */
+    allowedIssuerAlgorithms?: string[];
     /**
      * nonce used to verify the key binding jwt to prevent replay attacks.
      */
     keyBindingNonce?: string;
+    /**
+     * Expected audience for the Key Binding JWT.
+     */
+    expectedKeyBindingAudience?: string | string[];
+    /**
+     * Maximum acceptable age of the Key Binding JWT, in seconds.
+     */
+    keyBindingMaxAgeSeconds?: number;
+    /**
+     * Internal option used by SD-JWT validation to defer claim checks until after
+     * disclosures are processed.
+     */
+    skipJwtClaimValidation?: boolean;
     /**
      * disable the verification of the status claim in the payload.
      *
@@ -347,6 +373,7 @@ type VerifierOptions = {
      */
     [key: string]: unknown;
 };
+declare const validateJwtPayload: (payload: Record<string, unknown> | undefined, options?: VerifierOptions) => void;
 declare class Jwt<Header extends Record<string, unknown> = Record<string, unknown>, Payload extends Record<string, unknown> = Record<string, unknown>> {
     header?: Header;
     payload?: Payload;
@@ -451,7 +478,7 @@ declare class SDJwt<Header extends Record<string, unknown> = Record<string, unkn
     getClaims<T>(hasher: Hasher): Promise<T>;
 }
 declare const listKeys: (obj: Record<string, unknown>, prefix?: string) => string[];
-declare const pack: <T extends Record<string, unknown>>(claims: T, disclosureFrame: DisclosureFrame<T> | undefined, hash: HasherAndAlg, saltGenerator: SaltGenerator) => Promise<{
+declare const pack: <T extends Record<string, unknown>>(claims: T, disclosureFrame: DisclosureFrame<T> | undefined, hash: HasherAndAlg, saltGenerator: SaltGenerator, seenSalts?: Set<string>, seenDigests?: Set<string>) => Promise<{
     packedClaims: Record<string, unknown> | Array<Record<string, unknown>>;
     disclosures: Array<Disclosure>;
 }>;
@@ -476,7 +503,7 @@ declare const unpackObj: (obj: unknown, map: Record<string, Disclosure>) => {
 };
 declare const createHashMapping: (disclosures: Array<Disclosure>, hash: HasherAndAlg) => Promise<Record<string, Disclosure<unknown>>>;
 declare const createHashMappingSync: (disclosures: Array<Disclosure>, hash: HasherAndAlgSync) => Record<string, Disclosure<unknown>>;
-declare const getSDAlgAndPayload: (SdJwtPayload: Record<string, unknown>) => {
+declare const getSDAlgAndPayload: (SdJwtPayload: Record<string, unknown>, allowedAlgorithms?: ReadonlyArray<HashAlgorithm>) => {
     _sd_alg: string;
     payload: {
         [x: string]: unknown;
@@ -516,7 +543,7 @@ declare const presentSync: <T extends Record<string, unknown>>(sdJwt: string, pr
  * @param prefix The prefix to add to the keys
  * @returns
  */
-declare const transformPresentationFrame: (obj: PresentationFrame<Extensible>, prefix?: string) => string[];
+declare const transformPresentationFrame: (obj: PresentationFrame<Extensible>, prefix?: string[]) => string[];
 type SerializedDisclosure = {
     digest: string;
     encoded: string;
@@ -633,20 +660,20 @@ declare class SDJwtGeneralJSONInstance<ExtendedPayload extends SdJwtPayload> {
     }): Promise<GeneralJSON>;
     verify(generalJSON: GeneralJSON, options?: VerifierOptions): Promise<{
         payload: ExtendedPayload;
-        headers: unknown[];
+        headers: Record<string, unknown>[];
         kb?: undefined;
     } | {
         payload: ExtendedPayload;
-        headers: unknown[];
+        headers: Record<string, unknown>[];
         kb: {
             payload: kbPayload;
             header: kbHeader;
         };
     }>;
     private calculateSDHash;
-    validate(generalJSON: GeneralJSON): Promise<{
+    validate(generalJSON: GeneralJSON, options?: VerifierOptions): Promise<{
         payload: ExtendedPayload;
-        headers: unknown[];
+        headers: Record<string, unknown>[];
     }>;
     config(newConfig: SDJWTConfig): void;
     encode(sdJwt: GeneralJSON, index: number): SDJWTCompact;
@@ -656,4 +683,4 @@ declare class SDJwtGeneralJSONInstance<ExtendedPayload extends SdJwtPayload> {
     getClaims(generalSdjwt: GeneralJSON): Promise<unknown>;
 }
 
-export { type Base64urlString, type DECOY, type DecodedSDJwt, Disclosure, type DisclosureData, type DisclosureFrame, type Extensible, FlattenJSON, type FlattenJSONData, type FlattenJSONSerialized, GeneralJSON, type GeneralJSONData, type GeneralJSONSerialized, type HashAlgorithm, type Hasher, type HasherAndAlg, type HasherAndAlgSync, type HasherSync, IANA_HASH_ALGORITHMS, Jwt, type JwtData, type JwtPayload, KBJwt, type KBOptions, KB_JWT_TYP, type KbVerifier, type OrPromise, type PresentationFrame, type SD, type SDJWTCompact, type SDJWTConfig, SDJWTException, SDJwt, type SDJwtData, SDJwtGeneralJSONInstance, SDJwtInstance, SD_DECOY, SD_DIGEST, SD_LIST_KEY, SD_SEPARATOR, type SafeVerifyResult, type SaltGenerator, type SaltGeneratorSync, type SdJwtPayload, type SerializedDisclosure, type Signer, type SignerSync, type VerificationError, type VerificationErrorCode, type Verifier, type VerifierOptions, type VerifierSync, createDecoy, createHashMapping, createHashMappingForSerializedDisclosure, createHashMappingSync, decodeJwt, decodeSdJwt, decodeSdJwtSync, ensureError, getClaims, getClaimsSync, getSDAlgAndPayload, type kbHeader, type kbPayload, listKeys, pack, present, presentSync, presentableKeys, presentableKeysSync, selectDisclosures, splitSdJwt, transformPresentationFrame, unpack, unpackObj, unpackSync };
+export { type Base64urlString, type DECOY, DEFAULT_SECURE_HASH_ALGORITHMS, type DecodedSDJwt, Disclosure, type DisclosureData, type DisclosureFrame, type Extensible, FlattenJSON, type FlattenJSONData, type FlattenJSONSerialized, GeneralJSON, type GeneralJSONData, type GeneralJSONSerialized, type HashAlgorithm, type Hasher, type HasherAndAlg, type HasherAndAlgSync, type HasherSync, IANA_HASH_ALGORITHMS, Jwt, type JwtData, type JwtPayload, KBJwt, type KBOptions, KB_JWT_TYP, type KbVerifier, type OrPromise, type PresentationFrame, type SD, type SDJWTCompact, type SDJWTConfig, SDJWTException, SDJwt, type SDJwtData, SDJwtGeneralJSONInstance, SDJwtInstance, SD_DECOY, SD_DIGEST, SD_LIST_KEY, SD_SEPARATOR, type SafeVerifyResult, type SaltGenerator, type SaltGeneratorSync, type SdJwtPayload, type SerializedDisclosure, type Signer, type SignerSync, type VerificationError, type VerificationErrorCode, type Verifier, type VerifierOptions, type VerifierSync, createDecoy, createHashMapping, createHashMappingForSerializedDisclosure, createHashMappingSync, decodeJwt, decodeSdJwt, decodeSdJwtSync, encodePath, encodePathSegment, ensureError, getClaims, getClaimsSync, getSDAlgAndPayload, type kbHeader, type kbPayload, listKeys, pack, present, presentSync, presentableKeys, presentableKeysSync, selectDisclosures, splitSdJwt, transformPresentationFrame, unpack, unpackObj, unpackSync, validateJwtPayload };

package/dist/index.d.ts

@@ -8,12 +8,16 @@ declare const KB_JWT_TYP = "kb+jwt";
 type SDJWTCompact = string;
 type Base64urlString = string;
 type DisclosureData<T> = [string, string, T] | [string, T];
+declare const encodePathSegment: (segment: string) => string;
+declare const encodePath: (segments: string[]) => string;
 declare const IANA_HASH_ALGORITHMS: readonly ["sha-256", "sha-256-128", "sha-256-120", "sha-256-96", "sha-256-64", "sha-256-32", "sha-384", "sha-512", "sha3-224", "sha3-256", "sha3-384", "sha3-512", "blake2s-256", "blake2b-256", "blake2b-512", "k12-256", "k12-512"];
 type HashAlgorithm = (typeof IANA_HASH_ALGORITHMS)[number];
+declare const DEFAULT_SECURE_HASH_ALGORITHMS: readonly ["sha-256", "sha-384", "sha-512", "sha3-256", "sha3-384", "sha3-512", "blake2s-256", "blake2b-256", "blake2b-512", "k12-256", "k12-512"];
 type SDJWTConfig<T = unknown> = {
     omitTyp?: boolean;
     hasher?: Hasher;
     hashAlg?: HashAlgorithm;
+    allowedDisclosureHashAlgorithms?: ReadonlyArray<HashAlgorithm>;
     saltGenerator?: SaltGenerator;
     signer?: Signer;
     signAlg?: string;
@@ -268,6 +272,7 @@ type GeneralJSONSerialized = {
             disclosures?: Array<string>;
             kid?: string;
             kb_jwt?: string;
+            [key: string]: unknown;
         };
         protected: string;
         signature: string;
@@ -332,10 +337,31 @@ type VerifierOptions = {
      * If the payload does not contain these keys, the verification will fail.
      */
     requiredClaimKeys?: string[];
+    /**
+     * Expected audience for the processed SD-JWT payload.
+     */
+    expectedAudience?: string | string[];
+    /**
+     * Allowed JOSE algorithms for issuer-signed JWTs. `none` is always rejected.
+     */
+    allowedIssuerAlgorithms?: string[];
     /**
      * nonce used to verify the key binding jwt to prevent replay attacks.
      */
     keyBindingNonce?: string;
+    /**
+     * Expected audience for the Key Binding JWT.
+     */
+    expectedKeyBindingAudience?: string | string[];
+    /**
+     * Maximum acceptable age of the Key Binding JWT, in seconds.
+     */
+    keyBindingMaxAgeSeconds?: number;
+    /**
+     * Internal option used by SD-JWT validation to defer claim checks until after
+     * disclosures are processed.
+     */
+    skipJwtClaimValidation?: boolean;
     /**
      * disable the verification of the status claim in the payload.
      *
@@ -347,6 +373,7 @@ type VerifierOptions = {
      */
     [key: string]: unknown;
 };
+declare const validateJwtPayload: (payload: Record<string, unknown> | undefined, options?: VerifierOptions) => void;
 declare class Jwt<Header extends Record<string, unknown> = Record<string, unknown>, Payload extends Record<string, unknown> = Record<string, unknown>> {
     header?: Header;
     payload?: Payload;
@@ -451,7 +478,7 @@ declare class SDJwt<Header extends Record<string, unknown> = Record<string, unkn
     getClaims<T>(hasher: Hasher): Promise<T>;
 }
 declare const listKeys: (obj: Record<string, unknown>, prefix?: string) => string[];
-declare const pack: <T extends Record<string, unknown>>(claims: T, disclosureFrame: DisclosureFrame<T> | undefined, hash: HasherAndAlg, saltGenerator: SaltGenerator) => Promise<{
+declare const pack: <T extends Record<string, unknown>>(claims: T, disclosureFrame: DisclosureFrame<T> | undefined, hash: HasherAndAlg, saltGenerator: SaltGenerator, seenSalts?: Set<string>, seenDigests?: Set<string>) => Promise<{
     packedClaims: Record<string, unknown> | Array<Record<string, unknown>>;
     disclosures: Array<Disclosure>;
 }>;
@@ -476,7 +503,7 @@ declare const unpackObj: (obj: unknown, map: Record<string, Disclosure>) => {
 };
 declare const createHashMapping: (disclosures: Array<Disclosure>, hash: HasherAndAlg) => Promise<Record<string, Disclosure<unknown>>>;
 declare const createHashMappingSync: (disclosures: Array<Disclosure>, hash: HasherAndAlgSync) => Record<string, Disclosure<unknown>>;
-declare const getSDAlgAndPayload: (SdJwtPayload: Record<string, unknown>) => {
+declare const getSDAlgAndPayload: (SdJwtPayload: Record<string, unknown>, allowedAlgorithms?: ReadonlyArray<HashAlgorithm>) => {
     _sd_alg: string;
     payload: {
         [x: string]: unknown;
@@ -516,7 +543,7 @@ declare const presentSync: <T extends Record<string, unknown>>(sdJwt: string, pr
  * @param prefix The prefix to add to the keys
  * @returns
  */
-declare const transformPresentationFrame: (obj: PresentationFrame<Extensible>, prefix?: string) => string[];
+declare const transformPresentationFrame: (obj: PresentationFrame<Extensible>, prefix?: string[]) => string[];
 type SerializedDisclosure = {
     digest: string;
     encoded: string;
@@ -633,20 +660,20 @@ declare class SDJwtGeneralJSONInstance<ExtendedPayload extends SdJwtPayload> {
     }): Promise<GeneralJSON>;
     verify(generalJSON: GeneralJSON, options?: VerifierOptions): Promise<{
         payload: ExtendedPayload;
-        headers: unknown[];
+        headers: Record<string, unknown>[];
         kb?: undefined;
     } | {
         payload: ExtendedPayload;
-        headers: unknown[];
+        headers: Record<string, unknown>[];
         kb: {
             payload: kbPayload;
             header: kbHeader;
         };
     }>;
     private calculateSDHash;
-    validate(generalJSON: GeneralJSON): Promise<{
+    validate(generalJSON: GeneralJSON, options?: VerifierOptions): Promise<{
         payload: ExtendedPayload;
-        headers: unknown[];
+        headers: Record<string, unknown>[];
     }>;
     config(newConfig: SDJWTConfig): void;
     encode(sdJwt: GeneralJSON, index: number): SDJWTCompact;
@@ -656,4 +683,4 @@ declare class SDJwtGeneralJSONInstance<ExtendedPayload extends SdJwtPayload> {
     getClaims(generalSdjwt: GeneralJSON): Promise<unknown>;
 }
 
-export { type Base64urlString, type DECOY, type DecodedSDJwt, Disclosure, type DisclosureData, type DisclosureFrame, type Extensible, FlattenJSON, type FlattenJSONData, type FlattenJSONSerialized, GeneralJSON, type GeneralJSONData, type GeneralJSONSerialized, type HashAlgorithm, type Hasher, type HasherAndAlg, type HasherAndAlgSync, type HasherSync, IANA_HASH_ALGORITHMS, Jwt, type JwtData, type JwtPayload, KBJwt, type KBOptions, KB_JWT_TYP, type KbVerifier, type OrPromise, type PresentationFrame, type SD, type SDJWTCompact, type SDJWTConfig, SDJWTException, SDJwt, type SDJwtData, SDJwtGeneralJSONInstance, SDJwtInstance, SD_DECOY, SD_DIGEST, SD_LIST_KEY, SD_SEPARATOR, type SafeVerifyResult, type SaltGenerator, type SaltGeneratorSync, type SdJwtPayload, type SerializedDisclosure, type Signer, type SignerSync, type VerificationError, type VerificationErrorCode, type Verifier, type VerifierOptions, type VerifierSync, createDecoy, createHashMapping, createHashMappingForSerializedDisclosure, createHashMappingSync, decodeJwt, decodeSdJwt, decodeSdJwtSync, ensureError, getClaims, getClaimsSync, getSDAlgAndPayload, type kbHeader, type kbPayload, listKeys, pack, present, presentSync, presentableKeys, presentableKeysSync, selectDisclosures, splitSdJwt, transformPresentationFrame, unpack, unpackObj, unpackSync };
+export { type Base64urlString, type DECOY, DEFAULT_SECURE_HASH_ALGORITHMS, type DecodedSDJwt, Disclosure, type DisclosureData, type DisclosureFrame, type Extensible, FlattenJSON, type FlattenJSONData, type FlattenJSONSerialized, GeneralJSON, type GeneralJSONData, type GeneralJSONSerialized, type HashAlgorithm, type Hasher, type HasherAndAlg, type HasherAndAlgSync, type HasherSync, IANA_HASH_ALGORITHMS, Jwt, type JwtData, type JwtPayload, KBJwt, type KBOptions, KB_JWT_TYP, type KbVerifier, type OrPromise, type PresentationFrame, type SD, type SDJWTCompact, type SDJWTConfig, SDJWTException, SDJwt, type SDJwtData, SDJwtGeneralJSONInstance, SDJwtInstance, SD_DECOY, SD_DIGEST, SD_LIST_KEY, SD_SEPARATOR, type SafeVerifyResult, type SaltGenerator, type SaltGeneratorSync, type SdJwtPayload, type SerializedDisclosure, type Signer, type SignerSync, type VerificationError, type VerificationErrorCode, type Verifier, type VerifierOptions, type VerifierSync, createDecoy, createHashMapping, createHashMappingForSerializedDisclosure, createHashMappingSync, decodeJwt, decodeSdJwt, decodeSdJwtSync, encodePath, encodePathSegment, ensureError, getClaims, getClaimsSync, getSDAlgAndPayload, type kbHeader, type kbPayload, listKeys, pack, present, presentSync, presentableKeys, presentableKeysSync, selectDisclosures, splitSdJwt, transformPresentationFrame, unpack, unpackObj, unpackSync, validateJwtPayload };