@sd-jwt/core 0.20.1-next.5 → 0.20.1-next.6

package/src/sdjwt.ts

@@ -5,6 +5,7 @@ import { KBJwt } from './kbjwt';
 import { transformPresentationFrame } from './present';
 import {
   type DisclosureFrame,
+  encodePathSegment,
   type Hasher,
   type HasherAndAlg,
   type kbHeader,
@@ -19,6 +20,28 @@ import {
 } from './types';
 import { Disclosure, SDJWTException } from './utils';
 
+const createDisclosureSalt = async (
+  saltGenerator: SaltGenerator,
+  seenSalts: Set<string>,
+) => {
+  const salt = await saltGenerator(16);
+  if (typeof salt !== 'string') {
+    throw new SDJWTException('SaltGenerator must return a string');
+  }
+  if (seenSalts.has(salt)) {
+    throw new SDJWTException('Duplicate disclosure salt detected');
+  }
+  seenSalts.add(salt);
+  return salt;
+};
+
+const addDisclosureDigest = (digest: string, seenDigests: Set<string>) => {
+  if (seenDigests.has(digest)) {
+    throw new SDJWTException('Duplicate disclosure digest detected');
+  }
+  seenDigests.add(digest);
+};
+
 export type SDJwtData<
   Header extends Record<string, unknown>,
   Payload extends Record<string, unknown>,
@@ -60,19 +83,15 @@ export class SDJwt<
     kbJwt?: KBJwt<KBHeader, KBPayload>;
   }> {
     const [encodedJwt, ...encodedDisclosures] = sdjwt.split(SD_SEPARATOR);
+    if (encodedDisclosures.length === 0) {
+      throw new SDJWTException('Invalid SD-JWT: missing SD-JWT separator');
+    }
     const jwt = Jwt.fromEncode<Header, Payload>(encodedJwt);
 
     if (!jwt.payload) {
       throw new Error('Payload is undefined on the JWT. Invalid state reached');
     }
 
-    if (encodedDisclosures.length === 0) {
-      return {
-        jwt,
-        disclosures: [],
-      };
-    }
-
     const encodedKeyBindingJwt = encodedDisclosures.pop();
     const kbJwt = encodedKeyBindingJwt
       ? KBJwt.fromKBEncode<KBHeader, KBPayload>(encodedKeyBindingJwt)
@@ -218,7 +237,8 @@ export const listKeys = (obj: Record<string, unknown>, prefix = '') => {
   const keys: string[] = [];
   for (const key in obj) {
     if (obj[key] === undefined) continue;
-    const newKey = prefix ? `${prefix}.${key}` : key;
+    const escapedKey = encodePathSegment(key);
+    const newKey = prefix ? `${prefix}.${escapedKey}` : escapedKey;
     keys.push(newKey);
 
     const value = obj[key];
@@ -234,6 +254,8 @@ export const pack = async <T extends Record<string, unknown>>(
   disclosureFrame: DisclosureFrame<T> | undefined,
   hash: HasherAndAlg,
   saltGenerator: SaltGenerator,
+  seenSalts = new Set<string>(),
+  seenDigests = new Set<string>(),
 ): Promise<{
   packedClaims: Record<string, unknown> | Array<Record<string, unknown>>;
   disclosures: Array<Disclosure>;
@@ -261,6 +283,8 @@ export const pack = async <T extends Record<string, unknown>>(
           disclosureFrame[idx],
           hash,
           saltGenerator,
+          seenSalts,
+          seenDigests,
         );
         recursivePackedClaims[idx] = packed.packedClaims;
         disclosures.push(...packed.disclosures);
@@ -290,9 +314,10 @@ export const pack = async <T extends Record<string, unknown>>(
        */
       // @ts-expect-error
       if (sd.includes(i)) {
-        const salt = await saltGenerator(16);
+        const salt = await createDisclosureSalt(saltGenerator, seenSalts);
         const disclosure = new Disclosure([salt, claim]);
         const digest = await disclosure.digest(hash);
+        addDisclosureDigest(digest, seenDigests);
         packedClaims.push({ [SD_LIST_KEY]: digest });
         disclosures.push(disclosure);
       } else {
@@ -301,6 +326,7 @@ export const pack = async <T extends Record<string, unknown>>(
     }
     for (let j = 0; j < decoyCount; j++) {
       const decoyDigest = await createDecoy(hash, saltGenerator);
+      addDisclosureDigest(decoyDigest, seenDigests);
       packedClaims.push({ [SD_LIST_KEY]: decoyDigest });
     }
     return { packedClaims, disclosures };
@@ -318,6 +344,8 @@ export const pack = async <T extends Record<string, unknown>>(
         disclosureFrame[key],
         hash,
         saltGenerator,
+        seenSalts,
+        seenDigests,
       );
       recursivePackedClaims[key] = packed.packedClaims;
       disclosures.push(...packed.disclosures);
@@ -331,9 +359,10 @@ export const pack = async <T extends Record<string, unknown>>(
       ? recursivePackedClaims[key]
       : claims[key];
     if (sd.includes(key)) {
-      const salt = await saltGenerator(16);
+      const salt = await createDisclosureSalt(saltGenerator, seenSalts);
       const disclosure = new Disclosure([salt, key, claim]);
       const digest = await disclosure.digest(hash);
+      addDisclosureDigest(digest, seenDigests);
 
       _sd.push(digest);
       disclosures.push(disclosure);
@@ -344,6 +373,7 @@ export const pack = async <T extends Record<string, unknown>>(
 
   for (let j = 0; j < decoyCount; j++) {
     const decoyDigest = await createDecoy(hash, saltGenerator);
+    addDisclosureDigest(decoyDigest, seenDigests);
     _sd.push(decoyDigest);
   }
 

package/src/test/decode/decode.spec.ts

@@ -39,12 +39,11 @@ describe('decode tests', () => {
     expect(kbJwt).toBeUndefined();
   });
 
-  test('split sdjwt without disclosures', () => {
+  test('split rejects bare jwt without SD-JWT separator', () => {
     const sdjwt = 'h.p.s';
-    const { jwt, disclosures, kbJwt } = splitSdJwt(sdjwt);
-    expect(jwt).toBe('h.p.s');
-    expect(disclosures).toStrictEqual([]);
-    expect(kbJwt).toBeUndefined();
+    expect(() => splitSdJwt(sdjwt)).toThrow(
+      'Invalid SD-JWT: missing SD-JWT separator',
+    );
   });
 
   test('split sdjwt with kbjwt', () => {
@@ -65,14 +64,12 @@ describe('decode tests', () => {
     expect(decodedSdJwt.jwt).toBeDefined();
   });
 
-  test('decode jwt', async () => {
+  test('decode rejects bare jwt without SD-JWT separator', async () => {
     const jwt =
       'eyJhbGciOiJIUzI1NiIsInR5cCI6InNkK2p3dCJ9.eyJsYXN0bmFtZSI6IkRvZSIsInNzbiI6IjEyMy00NS02Nzg5IiwiX3NkIjpbIk4yUXhZV1UxTlRnME1qQmpOR1JpWVRCaU1tRmtaamN5WXpSbFpXUmhaRGd5WkRCbE1qaGhZVGcwTnpJMU9XSXpZek5qWkdNNE1qZG1NVGN6TmpZd05RIiwiWlRSalkyUTVOemRoWkRVM05tWTFZV0UyTmpka01XVmpNRE16WXpOak5qQmtNak5pT0dZelpHSTBOelV4TURsak9EWTRNREEzWm1JeFpUY3daREZqTmciXSwiX3NkX2FsZyI6InNoYS0yNTYifQ.mX14Sw86xy8NFQta7tCfNmhVCqzfaJ_K3VEIhTjbLDY';
-    const decodedSdJwt = await decodeSdJwt(jwt, digest);
-    expect(decodedSdJwt).toBeDefined();
-    expect(decodedSdJwt.kbJwt).toBeUndefined();
-    expect(decodedSdJwt.disclosures.length).toEqual(0);
-    expect(decodedSdJwt.jwt).toBeDefined();
+    await expect(decodeSdJwt(jwt, digest)).rejects.toThrow(
+      'Invalid SD-JWT: missing SD-JWT separator',
+    );
   });
 
   test('decode sdjwt sync', () => {
@@ -85,14 +82,12 @@ describe('decode tests', () => {
     expect(decodedSdJwt.jwt).toBeDefined();
   });
 
-  test('decode jwt sync', () => {
+  test('decode sync rejects bare jwt without SD-JWT separator', () => {
     const jwt =
       'eyJhbGciOiJIUzI1NiIsInR5cCI6InNkK2p3dCJ9.eyJsYXN0bmFtZSI6IkRvZSIsInNzbiI6IjEyMy00NS02Nzg5IiwiX3NkIjpbIk4yUXhZV1UxTlRnME1qQmpOR1JpWVRCaU1tRmtaamN5WXpSbFpXUmhaRGd5WkRCbE1qaGhZVGcwTnpJMU9XSXpZek5qWkdNNE1qZG1NVGN6TmpZd05RIiwiWlRSalkyUTVOemRoWkRVM05tWTFZV0UyTmpka01XVmpNRE16WXpOak5qQmtNak5pT0dZelpHSTBOelV4TURsak9EWTRNREEzWm1JeFpUY3daREZqTmciXSwiX3NkX2FsZyI6InNoYS0yNTYifQ.mX14Sw86xy8NFQta7tCfNmhVCqzfaJ_K3VEIhTjbLDY';
-    const decodedSdJwt = decodeSdJwtSync(jwt, digest);
-    expect(decodedSdJwt).toBeDefined();
-    expect(decodedSdJwt.kbJwt).toBeUndefined();
-    expect(decodedSdJwt.disclosures.length).toEqual(0);
-    expect(decodedSdJwt.jwt).toBeDefined();
+    expect(() => decodeSdJwtSync(jwt, digest)).toThrow(
+      'Invalid SD-JWT: missing SD-JWT separator',
+    );
   });
 
   test('decode sdjwt sync (with KB)', () => {

package/src/test/index.spec.ts

@@ -130,44 +130,11 @@ describe('index', () => {
   test.each([
     '_sd',
     '...',
-  ])('validate rejects disclosure resolving to reserved claim name %s', async (reservedClaimName) => {
-    const { signer, verifier } = createSignerVerifier();
-    const sdjwt = new SDJwtInstance<SdJwtPayload>({
-      signer,
-      signAlg: 'EdDSA',
-      verifier,
-      hasher: digest,
-      saltGenerator: generateSalt,
-    });
-
-    const disclosure = new Disclosure([
-      await generateSalt(16),
-      reservedClaimName,
-      'reserved',
-    ]);
-    const disclosureDigest = await disclosure.digest({
-      hasher: digest,
-      alg: 'sha-256',
-    });
-    const header = Buffer.from(JSON.stringify({ alg: 'EdDSA' })).toString(
-      'base64url',
-    );
-    const payload = Buffer.from(
-      JSON.stringify({
-        _sd: [disclosureDigest],
-        iss: 'Issuer',
-        iat: Math.floor(Date.now() / 1000),
-        vct: '',
-        _sd_alg: 'sha-256',
-      }),
-    ).toString('base64url');
-    const unsignedJwt = `${header}.${payload}`;
-    const signature = await signer(unsignedJwt);
-
-    await expect(
-      sdjwt.validate(`${unsignedJwt}.${signature}~${disclosure.encode()}~`),
-    ).rejects.toThrow(
-      `Reserved field name "${reservedClaimName}" is not allowed`,
+  ])('rejects disclosure resolving to reserved claim name %s', async (reservedClaimName) => {
+    expect(
+      () => new Disclosure(['salt', reservedClaimName, 'reserved']),
+    ).toThrow(
+      `Reserved disclosure claim name "${reservedClaimName}" is not allowed`,
     );
   });
 

package/src/test/kbjwt.spec.ts

@@ -498,7 +498,7 @@ describe('KB JWT', () => {
     expect(verified.payload.exp).toBe(1000);
   });
 
-  test('compatibility test for version 06', async () => {
+  test('rejects draft-era _sd_hash without sd_hash', async () => {
     const { privateKey, publicKey } = Crypto.generateKeyPairSync('ed25519');
     const testSigner: Signer = async (data: string) => {
       const sig = Crypto.sign(null, Buffer.from(data), privateKey);
@@ -544,22 +544,12 @@ describe('KB JWT', () => {
 
     const encodedKbJwt = await kbJwt.sign(testSigner);
     const decoded = KBJwt.fromKBEncode(encodedKbJwt);
-    const verified = await decoded.verifyKB({
-      verifier: testVerifier,
-      payload,
-      nonce: 'nonce',
-    });
-    expect(verified).toStrictEqual({
-      header: {
-        typ: KB_JWT_TYP,
-        alg: 'EdDSA',
-      },
-      payload: {
-        iat: 1,
-        aud: 'aud',
+    await expect(
+      decoded.verifyKB({
+        verifier: testVerifier,
+        payload,
         nonce: 'nonce',
-        _sd_hash: 'hash',
-      },
-    });
+      }),
+    ).rejects.toThrow('Invalid Key Binding Jwt');
   });
 });

package/src/types/type.ts

@@ -9,6 +9,12 @@ export type Base64urlString = string;
 
 export type DisclosureData<T> = [string, string, T] | [string, T];
 
+export const encodePathSegment = (segment: string) =>
+  segment.replace(/~/g, '~0').replace(/\./g, '~1');
+
+export const encodePath = (segments: string[]) =>
+  segments.map(encodePathSegment).join('.');
+
 // based on https://www.iana.org/assignments/named-information/named-information.xhtml
 export const IANA_HASH_ALGORITHMS = [
   'sha-256',
@@ -32,10 +38,25 @@ export const IANA_HASH_ALGORITHMS = [
 
 export type HashAlgorithm = (typeof IANA_HASH_ALGORITHMS)[number];
 
+export const DEFAULT_SECURE_HASH_ALGORITHMS = [
+  'sha-256',
+  'sha-384',
+  'sha-512',
+  'sha3-256',
+  'sha3-384',
+  'sha3-512',
+  'blake2s-256',
+  'blake2b-256',
+  'blake2b-512',
+  'k12-256',
+  'k12-512',
+] as const satisfies ReadonlyArray<HashAlgorithm>;
+
 export type SDJWTConfig<T = unknown> = {
   omitTyp?: boolean;
   hasher?: Hasher;
   hashAlg?: HashAlgorithm;
+  allowedDisclosureHashAlgorithms?: ReadonlyArray<HashAlgorithm>;
   saltGenerator?: SaltGenerator;
   signer?: Signer;
   signAlg?: string;

package/src/utils/disclosure.ts

@@ -1,12 +1,18 @@
-import type { DisclosureData, HasherAndAlg, HasherAndAlgSync } from '../types';
+import {
+  type DisclosureData,
+  type HasherAndAlg,
+  type HasherAndAlgSync,
+  SD_DIGEST,
+  SD_LIST_KEY,
+} from '../types';
 import { base64urlEncode, uint8ArrayToBase64Url } from './base64url';
 import { SDJWTException } from './error';
 import { decodeBase64urlJsonStrict } from './strict-json';
 
 export class Disclosure<T = unknown> {
-  public salt: string;
+  public salt!: string;
   public key?: string;
-  public value: T;
+  public value!: T;
   public _digest: string | undefined;
   private _encoded: string | undefined;
 
@@ -14,6 +20,13 @@ export class Disclosure<T = unknown> {
     data: DisclosureData<T>,
     _meta?: { digest: string; encoded: string },
   ) {
+    if (!Array.isArray(data) || (data.length !== 2 && data.length !== 3)) {
+      throw new SDJWTException('Invalid disclosure data');
+    }
+    if (typeof data[0] !== 'string') {
+      throw new SDJWTException('Invalid disclosure salt');
+    }
+
     // If the meta is provided, then we assume that the data is already encoded and digested
     this._digest = _meta?.digest;
     this._encoded = _meta?.encoded;
@@ -24,12 +37,19 @@ export class Disclosure<T = unknown> {
       return;
     }
     if (data.length === 3) {
+      if (typeof data[1] !== 'string') {
+        throw new SDJWTException('Invalid disclosure claim name');
+      }
+      if (data[1] === SD_DIGEST || data[1] === SD_LIST_KEY) {
+        throw new SDJWTException(
+          `Reserved disclosure claim name "${data[1]}" is not allowed`,
+        );
+      }
       this.salt = data[0];
       this.key = data[1];
       this.value = data[2];
       return;
     }
-    throw new SDJWTException('Invalid disclosure data');
   }
 
   // We need to digest of the original encoded data.

package/test/rfc9901-audit-fixes.spec.ts

@@ -0,0 +1,252 @@
+import Crypto from 'node:crypto';
+import { hasher as digest, generateSalt } from '@owf/crypto';
+import { describe, expect, test } from 'vitest';
+import { unpackObj } from '../src/decode';
+import { GeneralJSON, Jwt, KBJwt, SDJwtInstance } from '../src/index';
+import { selectDisclosures, transformPresentationFrame } from '../src/present';
+import type { Signer, Verifier } from '../src/types';
+import { Disclosure } from '../src/utils';
+
+const createSignerVerifier = () => {
+  const { privateKey, publicKey } = Crypto.generateKeyPairSync('ed25519');
+  const signer: Signer = async (data: string) => {
+    const sig = Crypto.sign(null, Buffer.from(data), privateKey);
+    return Buffer.from(sig).toString('base64url');
+  };
+  const verifier: Verifier = async (data: string, sig: string) => {
+    return Crypto.verify(
+      null,
+      Buffer.from(data),
+      publicKey,
+      Buffer.from(sig, 'base64url'),
+    );
+  };
+  return { signer, verifier };
+};
+
+describe('RFC 9901 audit fixes', () => {
+  test('rejects malformed disclosure containers', () => {
+    const objectDisclosure = Disclosure.fromArray(['salt', 'name', 'Alice'], {
+      digest: 'object-digest',
+      encoded: 'object-disclosure',
+    });
+    const arrayDisclosure = Disclosure.fromArray(['salt', 'Alice'], {
+      digest: 'array-digest',
+      encoded: 'array-disclosure',
+    });
+
+    expect(() => unpackObj({ _sd: 'object-digest' }, {})).toThrow(
+      'Invalid _sd claim: expected array of strings',
+    );
+    expect(() =>
+      unpackObj({ items: [{ '...': 'array-digest', extra: true }] }, {}),
+    ).toThrow('Invalid array disclosure placeholder');
+    expect(() =>
+      unpackObj({ _sd: ['array-digest'] }, { 'array-digest': arrayDisclosure }),
+    ).toThrow('Array disclosure cannot be used as an object property');
+    expect(() =>
+      unpackObj(
+        { items: [{ '...': 'object-digest' }] },
+        { 'object-digest': objectDisclosure },
+      ),
+    ).toThrow('Object-property disclosure cannot be used as an array element');
+  });
+
+  test('rejects disclosed claim name collisions at the same object level', () => {
+    const first = Disclosure.fromArray(['salt-1', 'name', 'Alice'], {
+      digest: 'digest-1',
+      encoded: 'disclosure-1',
+    });
+    const second = Disclosure.fromArray(['salt-2', 'name', 'Mallory'], {
+      digest: 'digest-2',
+      encoded: 'disclosure-2',
+    });
+
+    expect(() =>
+      unpackObj(
+        { _sd: ['digest-1', 'digest-2'] },
+        { 'digest-1': first, 'digest-2': second },
+      ),
+    ).toThrow('Disclosed claim name "name" conflicts with another disclosure');
+  });
+
+  test('validates JWT claims after disclosure processing', async () => {
+    const { signer, verifier } = createSignerVerifier();
+    const sdjwt = new SDJwtInstance({
+      signer,
+      signAlg: 'EdDSA',
+      verifier,
+      hasher: digest,
+      saltGenerator: generateSalt,
+    });
+
+    const disclosure = new Disclosure(['salt', 'exp', 1]);
+    const disclosureDigest = await disclosure.digest({
+      hasher: digest,
+      alg: 'sha-256',
+    });
+    const header = Buffer.from(JSON.stringify({ alg: 'EdDSA' })).toString(
+      'base64url',
+    );
+    const payload = Buffer.from(
+      JSON.stringify({ _sd: [disclosureDigest], _sd_alg: 'sha-256' }),
+    ).toString('base64url');
+    const unsignedJwt = `${header}.${payload}`;
+    const signature = await signer(unsignedJwt);
+
+    await expect(
+      sdjwt.validate(`${unsignedJwt}.${signature}~${disclosure.encode()}~`, {
+        currentDate: 1,
+      }),
+    ).rejects.toThrow('Verify Error: JWT is expired');
+  });
+
+  test('rejects unsafe JWT algorithm and invalid validity claims', async () => {
+    const jwt = new Jwt({
+      header: { alg: 'none' },
+      payload: { exp: 100 },
+      signature: 'signature',
+    });
+
+    await expect(jwt.verify(() => true)).rejects.toThrow(
+      'Verify Error: alg "none" is not allowed',
+    );
+
+    const { signer, verifier } = createSignerVerifier();
+    const signed = new Jwt({
+      header: { alg: 'EdDSA' },
+      payload: { exp: '100' },
+    });
+    await signed.sign(signer);
+
+    await expect(signed.verify(verifier)).rejects.toThrow(
+      'Verify Error: JWT exp must be a number',
+    );
+  });
+
+  test('validates expected issuer audience', async () => {
+    const { signer, verifier } = createSignerVerifier();
+    const jwt = new Jwt({
+      header: { alg: 'EdDSA' },
+      payload: { aud: 'verifier-a' },
+    });
+    await jwt.sign(signer);
+
+    await expect(
+      jwt.verify(verifier, { expectedAudience: 'verifier-b' }),
+    ).rejects.toThrow('Verify Error: Invalid audience');
+  });
+
+  test('validates key binding audience, age, and claim types', async () => {
+    const { signer } = createSignerVerifier();
+    const kbJwt = new KBJwt({
+      header: { typ: 'kb+jwt', alg: 'EdDSA' },
+      payload: { iat: 900, aud: 'verifier-a', nonce: 'nonce', sd_hash: 'hash' },
+    });
+    await kbJwt.sign(signer);
+
+    await expect(
+      kbJwt.verifyKB({
+        verifier: () => true,
+        payload: {},
+        nonce: 'nonce',
+        options: { expectedKeyBindingAudience: 'verifier-b' },
+      }),
+    ).rejects.toThrow('Verify Error: Invalid Key Binding audience');
+
+    await expect(
+      kbJwt.verifyKB({
+        verifier: () => true,
+        payload: {},
+        nonce: 'nonce',
+        options: { currentDate: 1000, keyBindingMaxAgeSeconds: 50 },
+      }),
+    ).rejects.toThrow('Verify Error: Key Binding JWT is too old');
+
+    (kbJwt.payload as Record<string, unknown>).iat = '900';
+    await expect(
+      kbJwt.verifyKB({ verifier: () => true, payload: {}, nonce: 'nonce' }),
+    ).rejects.toThrow('Invalid Key Binding Jwt');
+  });
+
+  test('rejects insecure disclosure hash algorithms by default', () => {
+    const { signer, verifier } = createSignerVerifier();
+
+    expect(
+      () =>
+        new SDJwtInstance({
+          signer,
+          signAlg: 'EdDSA',
+          verifier,
+          hasher: digest,
+          saltGenerator: generateSalt,
+          hashAlg: 'sha-256-32',
+        }),
+    ).toThrow('Disallowed hash algorithm: sha-256-32');
+  });
+
+  test('rejects duplicate salts during issuance', async () => {
+    const { signer, verifier } = createSignerVerifier();
+    const sdjwt = new SDJwtInstance({
+      signer,
+      signAlg: 'EdDSA',
+      verifier,
+      hasher: digest,
+      saltGenerator: () => 'same-salt',
+    });
+
+    await expect(
+      sdjwt.issue({ first: 'a', second: 'b' }, { _sd: ['first', 'second'] }),
+    ).rejects.toThrow('Duplicate disclosure salt detected');
+  });
+
+  test('rejects disclosures and kb_jwt outside the first General JSON header', () => {
+    expect(() =>
+      GeneralJSON.fromSerialized({
+        payload: 'payload',
+        signatures: [
+          { protected: 'header-1', signature: 'sig-1', header: {} },
+          {
+            protected: 'header-2',
+            signature: 'sig-2',
+            header: { disclosures: [] },
+          },
+        ],
+      }),
+    ).toThrow(
+      'disclosures and kb_jwt MUST only appear in the first unprotected header',
+    );
+  });
+
+  test('escapes presentation paths with literal dots in claim names', () => {
+    expect(transformPresentationFrame({ 'a.b': true })).toEqual(['a~1b']);
+    expect(transformPresentationFrame({ a: { b: true } })).toEqual([
+      'a',
+      'a.b',
+    ]);
+
+    const selected = selectDisclosures(
+      { _sd: ['top'], a: { _sd: ['nested'] } },
+      [
+        {
+          digest: 'top',
+          encoded: 'top-disclosure',
+          salt: 'salt-1',
+          key: 'a.b',
+          value: 'top-level',
+        },
+        {
+          digest: 'nested',
+          encoded: 'nested-disclosure',
+          salt: 'salt-2',
+          key: 'b',
+          value: 'nested',
+        },
+      ],
+      { a: { b: true } },
+    );
+
+    expect(selected).toHaveLength(1);
+    expect(selected[0].digest).toBe('nested');
+  });
+});