@sd-jwt/core 0.20.1 → 0.21.0-alpha-20260916100413

package/dist/index.js

@@ -1,2100 +0,0 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __defProps = Object.defineProperties;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropDescs = Object.getOwnPropertyDescriptors;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getOwnPropSymbols = Object.getOwnPropertySymbols;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __propIsEnum = Object.prototype.propertyIsEnumerable;
-var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __spreadValues = (a, b) => {
-  for (var prop in b || (b = {}))
-    if (__hasOwnProp.call(b, prop))
-      __defNormalProp(a, prop, b[prop]);
-  if (__getOwnPropSymbols)
-    for (var prop of __getOwnPropSymbols(b)) {
-      if (__propIsEnum.call(b, prop))
-        __defNormalProp(a, prop, b[prop]);
-    }
-  return a;
-};
-var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));
-var __objRest = (source, exclude) => {
-  var target = {};
-  for (var prop in source)
-    if (__hasOwnProp.call(source, prop) && exclude.indexOf(prop) < 0)
-      target[prop] = source[prop];
-  if (source != null && __getOwnPropSymbols)
-    for (var prop of __getOwnPropSymbols(source)) {
-      if (exclude.indexOf(prop) < 0 && __propIsEnum.call(source, prop))
-        target[prop] = source[prop];
-    }
-  return target;
-};
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var __async = (__this, __arguments, generator) => {
-  return new Promise((resolve, reject) => {
-    var fulfilled = (value) => {
-      try {
-        step(generator.next(value));
-      } catch (e) {
-        reject(e);
-      }
-    };
-    var rejected = (value) => {
-      try {
-        step(generator.throw(value));
-      } catch (e) {
-        reject(e);
-      }
-    };
-    var step = (x) => x.done ? resolve(x.value) : Promise.resolve(x.value).then(fulfilled, rejected);
-    step((generator = generator.apply(__this, __arguments)).next());
-  });
-};
-
-// src/index.ts
-var index_exports = {};
-__export(index_exports, {
-  DEFAULT_SECURE_HASH_ALGORITHMS: () => DEFAULT_SECURE_HASH_ALGORITHMS,
-  Disclosure: () => Disclosure,
-  FlattenJSON: () => FlattenJSON,
-  GeneralJSON: () => GeneralJSON,
-  IANA_HASH_ALGORITHMS: () => IANA_HASH_ALGORITHMS,
-  Jwt: () => Jwt,
-  KBJwt: () => KBJwt,
-  KB_JWT_TYP: () => KB_JWT_TYP,
-  SDJWTException: () => SDJWTException,
-  SDJwt: () => SDJwt,
-  SDJwtGeneralJSONInstance: () => SDJwtGeneralJSONInstance,
-  SDJwtInstance: () => SDJwtInstance,
-  SD_DECOY: () => SD_DECOY,
-  SD_DIGEST: () => SD_DIGEST,
-  SD_LIST_KEY: () => SD_LIST_KEY,
-  SD_SEPARATOR: () => SD_SEPARATOR,
-  base64UrlToUint8Array: () => import_identity_common.base64UrlToUint8Array,
-  base64urlDecode: () => import_identity_common.base64urlDecode,
-  base64urlEncode: () => import_identity_common.base64urlEncode,
-  createDecoy: () => createDecoy,
-  createHashMapping: () => createHashMapping,
-  createHashMappingForSerializedDisclosure: () => createHashMappingForSerializedDisclosure,
-  createHashMappingSync: () => createHashMappingSync,
-  decodeJwt: () => decodeJwt,
-  decodeSdJwt: () => decodeSdJwt,
-  decodeSdJwtSync: () => decodeSdJwtSync,
-  encodePath: () => encodePath,
-  encodePathSegment: () => encodePathSegment,
-  ensureError: () => ensureError,
-  getClaims: () => getClaims,
-  getClaimsSync: () => getClaimsSync,
-  getSDAlgAndPayload: () => getSDAlgAndPayload,
-  listKeys: () => listKeys,
-  pack: () => pack,
-  present: () => present,
-  presentSync: () => presentSync,
-  presentableKeys: () => presentableKeys,
-  presentableKeysSync: () => presentableKeysSync,
-  selectDisclosures: () => selectDisclosures,
-  splitSdJwt: () => splitSdJwt,
-  transformPresentationFrame: () => transformPresentationFrame,
-  uint8ArrayToBase64Url: () => import_identity_common.uint8ArrayToBase64Url,
-  unpack: () => unpack,
-  unpackObj: () => unpackObj,
-  unpackSync: () => unpackSync,
-  validateJwtPayload: () => validateJwtPayload
-});
-module.exports = __toCommonJS(index_exports);
-
-// src/types/type.ts
-var SD_SEPARATOR = "~";
-var SD_LIST_KEY = "...";
-var SD_DIGEST = "_sd";
-var SD_DECOY = "_sd_decoy";
-var KB_JWT_TYP = "kb+jwt";
-var encodePathSegment = (segment) => segment.replace(/~/g, "~0").replace(/\./g, "~1");
-var encodePath = (segments) => segments.map(encodePathSegment).join(".");
-var IANA_HASH_ALGORITHMS = [
-  "sha-256",
-  "sha-256-128",
-  "sha-256-120",
-  "sha-256-96",
-  "sha-256-64",
-  "sha-256-32",
-  "sha-384",
-  "sha-512",
-  "sha3-224",
-  "sha3-256",
-  "sha3-384",
-  "sha3-512",
-  "blake2s-256",
-  "blake2b-256",
-  "blake2b-512",
-  "k12-256",
-  "k12-512"
-];
-var DEFAULT_SECURE_HASH_ALGORITHMS = [
-  "sha-256",
-  "sha-384",
-  "sha-512",
-  "sha3-256",
-  "sha3-384",
-  "sha3-512",
-  "blake2s-256",
-  "blake2b-256",
-  "blake2b-512",
-  "k12-256",
-  "k12-512"
-];
-
-// src/utils/base64url.ts
-var import_identity_common = require("@owf/identity-common");
-
-// src/utils/error.ts
-var SDJWTException = class _SDJWTException extends Error {
-  constructor(message, details) {
-    super(message);
-    Object.setPrototypeOf(this, _SDJWTException.prototype);
-    this.name = "SDJWTException";
-    this.details = details;
-  }
-  getFullMessage() {
-    return `${this.name}: ${this.message} ${this.details ? `- ${JSON.stringify(this.details)}` : ""}`;
-  }
-};
-function ensureError(value) {
-  if (value instanceof Error) return value;
-  if (typeof value === "string") return new Error(value);
-  return new Error(String(value));
-}
-
-// src/utils/strict-json.ts
-var utf8Decoder = new TextDecoder("utf-8", { fatal: true });
-var decodeBase64urlJsonStrict = (encoded, errorMessage) => {
-  try {
-    const bytes = (0, import_identity_common.base64UrlToUint8Array)(encoded);
-    const decoded = utf8Decoder.decode(bytes);
-    return JSON.parse(decoded);
-  } catch (e) {
-    throw new SDJWTException(errorMessage);
-  }
-};
-
-// src/utils/disclosure.ts
-var Disclosure = class _Disclosure {
-  constructor(data, _meta) {
-    if (!Array.isArray(data) || data.length !== 2 && data.length !== 3) {
-      throw new SDJWTException("Invalid disclosure data");
-    }
-    if (typeof data[0] !== "string") {
-      throw new SDJWTException("Invalid disclosure salt");
-    }
-    this._digest = _meta == null ? void 0 : _meta.digest;
-    this._encoded = _meta == null ? void 0 : _meta.encoded;
-    if (data.length === 2) {
-      this.salt = data[0];
-      this.value = data[1];
-      return;
-    }
-    if (data.length === 3) {
-      if (typeof data[1] !== "string") {
-        throw new SDJWTException("Invalid disclosure claim name");
-      }
-      if (data[1] === SD_DIGEST || data[1] === SD_LIST_KEY) {
-        throw new SDJWTException(
-          `Reserved disclosure claim name "${data[1]}" is not allowed`
-        );
-      }
-      this.salt = data[0];
-      this.key = data[1];
-      this.value = data[2];
-      return;
-    }
-  }
-  // We need to digest of the original encoded data.
-  // After decode process, we use JSON.stringify to encode the data.
-  // This can be different from the original encoded data.
-  static fromEncode(s, hash) {
-    return __async(this, null, function* () {
-      const { hasher, alg } = hash;
-      const digest = yield hasher(s, alg);
-      const digestStr = (0, import_identity_common.uint8ArrayToBase64Url)(digest);
-      const item = decodeBase64urlJsonStrict(
-        s,
-        "Invalid disclosure data"
-      );
-      return _Disclosure.fromArray(item, { digest: digestStr, encoded: s });
-    });
-  }
-  static fromEncodeSync(s, hash) {
-    const { hasher, alg } = hash;
-    const digest = hasher(s, alg);
-    const digestStr = (0, import_identity_common.uint8ArrayToBase64Url)(digest);
-    const item = decodeBase64urlJsonStrict(
-      s,
-      "Invalid disclosure data"
-    );
-    return _Disclosure.fromArray(item, { digest: digestStr, encoded: s });
-  }
-  static fromArray(item, _meta) {
-    return new _Disclosure(item, _meta);
-  }
-  encode() {
-    if (!this._encoded) {
-      this._encoded = (0, import_identity_common.base64urlEncode)(JSON.stringify(this.decode()));
-    }
-    return this._encoded;
-  }
-  decode() {
-    return this.key ? [this.salt, this.key, this.value] : [this.salt, this.value];
-  }
-  digest(hash) {
-    return __async(this, null, function* () {
-      const { hasher, alg } = hash;
-      if (!this._digest) {
-        const hash2 = yield hasher(this.encode(), alg);
-        this._digest = (0, import_identity_common.uint8ArrayToBase64Url)(hash2);
-      }
-      return this._digest;
-    });
-  }
-  digestSync(hash) {
-    const { hasher, alg } = hash;
-    if (!this._digest) {
-      const hash2 = hasher(this.encode(), alg);
-      this._digest = (0, import_identity_common.uint8ArrayToBase64Url)(hash2);
-    }
-    return this._digest;
-  }
-};
-
-// src/decode/decode.ts
-var decodeJwt = (jwt) => {
-  const { 0: header, 1: payload, 2: signature, length } = jwt.split(".");
-  if (length !== 3) {
-    throw new SDJWTException("Invalid JWT as input");
-  }
-  return {
-    header: decodeBase64urlJsonStrict(header, "Invalid JWT as input"),
-    payload: decodeBase64urlJsonStrict(payload, "Invalid JWT as input"),
-    signature
-  };
-};
-var splitSdJwt = (sdjwt) => {
-  const [encodedJwt, ...encodedDisclosures] = sdjwt.split(SD_SEPARATOR);
-  if (encodedDisclosures.length === 0) {
-    throw new SDJWTException("Invalid SD-JWT: missing SD-JWT separator");
-  }
-  const encodedKeyBindingJwt = encodedDisclosures.pop();
-  return {
-    jwt: encodedJwt,
-    disclosures: encodedDisclosures,
-    kbJwt: encodedKeyBindingJwt || void 0
-  };
-};
-var decodeSdJwt = (sdjwt, hasher) => __async(null, null, function* () {
-  const [encodedJwt, ...encodedDisclosures] = sdjwt.split(SD_SEPARATOR);
-  const jwt = decodeJwt(encodedJwt);
-  if (encodedDisclosures.length === 0) {
-    throw new SDJWTException("Invalid SD-JWT: missing SD-JWT separator");
-  }
-  const encodedKeyBindingJwt = encodedDisclosures.pop();
-  const kbJwt = encodedKeyBindingJwt ? decodeJwt(encodedKeyBindingJwt) : void 0;
-  const { _sd_alg } = getSDAlgAndPayload(jwt.payload);
-  const disclosures = yield Promise.all(
-    encodedDisclosures.map(
-      (ed) => Disclosure.fromEncode(ed, { alg: _sd_alg, hasher })
-    )
-  );
-  return {
-    jwt,
-    disclosures,
-    kbJwt
-  };
-});
-var decodeSdJwtSync = (sdjwt, hasher) => {
-  const [encodedJwt, ...encodedDisclosures] = sdjwt.split(SD_SEPARATOR);
-  const jwt = decodeJwt(encodedJwt);
-  if (encodedDisclosures.length === 0) {
-    throw new SDJWTException("Invalid SD-JWT: missing SD-JWT separator");
-  }
-  const encodedKeyBindingJwt = encodedDisclosures.pop();
-  const kbJwt = encodedKeyBindingJwt ? decodeJwt(encodedKeyBindingJwt) : void 0;
-  const { _sd_alg } = getSDAlgAndPayload(jwt.payload);
-  const disclosures = encodedDisclosures.map(
-    (ed) => Disclosure.fromEncodeSync(ed, { alg: _sd_alg, hasher })
-  );
-  return {
-    jwt,
-    disclosures,
-    kbJwt
-  };
-};
-var getClaims = (rawPayload, disclosures, hasher) => __async(null, null, function* () {
-  const { unpackedObj } = yield unpack(rawPayload, disclosures, hasher);
-  return unpackedObj;
-});
-var getClaimsSync = (rawPayload, disclosures, hasher) => {
-  const { unpackedObj } = unpackSync(rawPayload, disclosures, hasher);
-  return unpackedObj;
-};
-var isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
-var unpackArray = (arr, map, prefix = "", seenDigests) => {
-  const keys = {};
-  const unpackedArray = [];
-  arr.forEach((item, idx) => {
-    if (isRecord(item)) {
-      const hash = item[SD_LIST_KEY];
-      if (SD_LIST_KEY in item) {
-        if (Object.keys(item).length !== 1 || typeof hash !== "string") {
-          throw new SDJWTException("Invalid array disclosure placeholder");
-        }
-        if (seenDigests) {
-          if (seenDigests.has(hash)) {
-            throw new SDJWTException(
-              "Duplicate digest found in SD-JWT payload"
-            );
-          }
-          seenDigests.add(hash);
-        }
-        const disclosed = map[hash];
-        if (disclosed) {
-          if (typeof disclosed.key === "string") {
-            throw new SDJWTException(
-              "Object-property disclosure cannot be used as an array element"
-            );
-          }
-          const presentKey = prefix ? `${prefix}.${idx}` : `${idx}`;
-          keys[presentKey] = hash;
-          const { unpackedObj, disclosureKeymap: disclosureKeys } = unpackObjInternal(disclosed.value, map, presentKey, seenDigests);
-          unpackedArray.push(unpackedObj);
-          Object.assign(keys, disclosureKeys);
-        }
-      } else {
-        const newKey = prefix ? `${prefix}.${idx}` : `${idx}`;
-        const { unpackedObj, disclosureKeymap: disclosureKeys } = unpackObjInternal(item, map, newKey, seenDigests);
-        unpackedArray.push(unpackedObj);
-        Object.assign(keys, disclosureKeys);
-      }
-    } else if (Array.isArray(item)) {
-      const newKey = prefix ? `${prefix}.${idx}` : `${idx}`;
-      const { unpackedObj, disclosureKeymap: disclosureKeys } = unpackObjInternal(item, map, newKey, seenDigests);
-      unpackedArray.push(unpackedObj);
-      Object.assign(keys, disclosureKeys);
-    } else {
-      unpackedArray.push(item);
-    }
-  });
-  return { unpackedObj: unpackedArray, disclosureKeymap: keys };
-};
-var unpackObj = (obj, map) => {
-  const copiedObj = JSON.parse(JSON.stringify(obj));
-  const seenDigests = /* @__PURE__ */ new Set();
-  const result = unpackObjInternal(copiedObj, map, "", seenDigests);
-  const mapDigests = Object.keys(map);
-  const unusedDigests = mapDigests.filter((d) => !seenDigests.has(d));
-  if (unusedDigests.length > 0) {
-    throw new SDJWTException("Unreferenced disclosure(s) detected in SD-JWT");
-  }
-  return result;
-};
-var unpackObjInternal = (obj, map, prefix = "", seenDigests) => {
-  const keys = {};
-  if (typeof obj === "object" && obj !== null) {
-    if (Array.isArray(obj)) {
-      return unpackArray(obj, map, prefix, seenDigests);
-    }
-    const record = obj;
-    for (const key in record) {
-      if (prefix && key === "_sd_alg") {
-        throw new SDJWTException("Nested _sd_alg is not allowed");
-      }
-      if (key !== SD_DIGEST && key !== SD_LIST_KEY && typeof record[key] === "object") {
-        const escapedKey = encodePathSegment(key);
-        const newKey = prefix ? `${prefix}.${escapedKey}` : escapedKey;
-        const { unpackedObj: unpackedObj2, disclosureKeymap: disclosureKeys } = unpackObjInternal(record[key], map, newKey, seenDigests);
-        record[key] = unpackedObj2;
-        Object.assign(keys, disclosureKeys);
-      }
-    }
-    const _a = record, { _sd } = _a, payload = __objRest(_a, ["_sd"]);
-    const claims = {};
-    if (_sd !== void 0) {
-      if (!Array.isArray(_sd) || !_sd.every((hash) => typeof hash === "string")) {
-        throw new SDJWTException(
-          "Invalid _sd claim: expected array of strings"
-        );
-      }
-      for (const hash of _sd) {
-        if (seenDigests) {
-          if (seenDigests.has(hash)) {
-            throw new SDJWTException(
-              "Duplicate digest found in SD-JWT payload"
-            );
-          }
-          seenDigests.add(hash);
-        }
-        const disclosed = map[hash];
-        if (disclosed) {
-          if (typeof disclosed.key !== "string") {
-            throw new SDJWTException(
-              "Array disclosure cannot be used as an object property"
-            );
-          }
-          if (disclosed.key in payload) {
-            throw new SDJWTException(
-              `Disclosed claim name "${disclosed.key}" conflicts with existing payload key`
-            );
-          }
-          if (disclosed.key in claims) {
-            throw new SDJWTException(
-              `Disclosed claim name "${disclosed.key}" conflicts with another disclosure`
-            );
-          }
-          const escapedKey = encodePathSegment(disclosed.key);
-          const presentKey = prefix ? `${prefix}.${escapedKey}` : escapedKey;
-          keys[presentKey] = hash;
-          const { unpackedObj: unpackedObj2, disclosureKeymap: disclosureKeys } = unpackObjInternal(disclosed.value, map, presentKey, seenDigests);
-          claims[disclosed.key] = unpackedObj2;
-          Object.assign(keys, disclosureKeys);
-        }
-      }
-    }
-    const unpackedObj = Object.assign(payload, claims);
-    return { unpackedObj, disclosureKeymap: keys };
-  }
-  return { unpackedObj: obj, disclosureKeymap: keys };
-};
-var createHashMapping = (disclosures, hash) => __async(null, null, function* () {
-  const map = {};
-  for (let i = 0; i < disclosures.length; i++) {
-    const disclosure = disclosures[i];
-    const digest = yield disclosure.digest(hash);
-    if (digest in map) {
-      throw new SDJWTException("Duplicate disclosure digest detected");
-    }
-    map[digest] = disclosure;
-  }
-  return map;
-});
-var createHashMappingSync = (disclosures, hash) => {
-  const map = {};
-  for (let i = 0; i < disclosures.length; i++) {
-    const disclosure = disclosures[i];
-    const digest = disclosure.digestSync(hash);
-    if (digest in map) {
-      throw new SDJWTException("Duplicate disclosure digest detected");
-    }
-    map[digest] = disclosure;
-  }
-  return map;
-};
-var getSDAlgAndPayload = (SdJwtPayload, allowedAlgorithms = DEFAULT_SECURE_HASH_ALGORITHMS) => {
-  const _a = SdJwtPayload, { _sd_alg } = _a, payload = __objRest(_a, ["_sd_alg"]);
-  if (_sd_alg === void 0) {
-    return { _sd_alg: "sha-256", payload };
-  }
-  if (typeof _sd_alg !== "string") {
-    throw new SDJWTException("Invalid _sd_alg: expected string");
-  }
-  if (!IANA_HASH_ALGORITHMS.includes(
-    _sd_alg
-  )) {
-    throw new SDJWTException(`Invalid _sd_alg: ${_sd_alg}`);
-  }
-  if (!allowedAlgorithms.includes(_sd_alg)) {
-    throw new SDJWTException(`Disallowed _sd_alg: ${_sd_alg}`);
-  }
-  return { _sd_alg, payload };
-};
-var unpack = (SdJwtPayload, disclosures, hasher) => __async(null, null, function* () {
-  const { _sd_alg, payload } = getSDAlgAndPayload(SdJwtPayload);
-  const hash = { hasher, alg: _sd_alg };
-  const map = yield createHashMapping(disclosures, hash);
-  return unpackObj(payload, map);
-});
-var unpackSync = (SdJwtPayload, disclosures, hasher) => {
-  const { _sd_alg, payload } = getSDAlgAndPayload(SdJwtPayload);
-  const hash = { hasher, alg: _sd_alg };
-  const map = createHashMappingSync(disclosures, hash);
-  return unpackObj(payload, map);
-};
-
-// src/flattenJSON.ts
-var FlattenJSON = class _FlattenJSON {
-  constructor(data) {
-    this.disclosures = data.disclosures;
-    this.kb_jwt = data.kb_jwt;
-    this.payload = data.jwtData.payload;
-    this.signature = data.jwtData.signature;
-    this.protected = data.jwtData.protected;
-  }
-  static fromEncode(encodedSdJwt) {
-    const { jwt, disclosures, kbJwt } = splitSdJwt(encodedSdJwt);
-    const { 0: protectedHeader, 1: payload, 2: signature } = jwt.split(".");
-    if (!protectedHeader || !payload || !signature) {
-      throw new SDJWTException("Invalid JWT");
-    }
-    return new _FlattenJSON({
-      jwtData: {
-        protected: protectedHeader,
-        payload,
-        signature
-      },
-      disclosures,
-      kb_jwt: kbJwt
-    });
-  }
-  static fromSerialized(json) {
-    return new _FlattenJSON({
-      jwtData: {
-        protected: json.protected,
-        payload: json.payload,
-        signature: json.signature
-      },
-      disclosures: json.header.disclosures,
-      kb_jwt: json.header.kb_jwt
-    });
-  }
-  toJson() {
-    return {
-      payload: this.payload,
-      signature: this.signature,
-      protected: this.protected,
-      header: {
-        disclosures: this.disclosures,
-        kb_jwt: this.kb_jwt
-      }
-    };
-  }
-  toEncoded() {
-    var _a;
-    const data = [];
-    const jwt = `${this.protected}.${this.payload}.${this.signature}`;
-    data.push(jwt);
-    if (this.disclosures && this.disclosures.length > 0) {
-      const disclosures = this.disclosures.join(SD_SEPARATOR);
-      data.push(disclosures);
-    }
-    const kb_jwt = (_a = this.kb_jwt) != null ? _a : "";
-    data.push(kb_jwt);
-    return data.join(SD_SEPARATOR);
-  }
-};
-
-// src/generalJSON.ts
-var GeneralJSON = class _GeneralJSON {
-  constructor(data) {
-    this.payload = data.payload;
-    this.disclosures = data.disclosures;
-    this.kb_jwt = data.kb_jwt;
-    this.signatures = data.signatures;
-  }
-  static fromEncode(encodedSdJwt) {
-    const { jwt, disclosures, kbJwt } = splitSdJwt(encodedSdJwt);
-    const { 0: protectedHeader, 1: payload, 2: signature } = jwt.split(".");
-    if (!protectedHeader || !payload || !signature) {
-      throw new SDJWTException("Invalid JWT");
-    }
-    return new _GeneralJSON({
-      payload,
-      disclosures,
-      kb_jwt: kbJwt,
-      signatures: [
-        {
-          protected: protectedHeader,
-          signature
-        }
-      ]
-    });
-  }
-  static fromSerialized(json) {
-    var _a, _b, _c;
-    if (!json.signatures[0]) {
-      throw new SDJWTException("Invalid JSON");
-    }
-    for (let index = 1; index < json.signatures.length; index++) {
-      const header = json.signatures[index].header;
-      if (header && ("disclosures" in header || "kb_jwt" in header)) {
-        throw new SDJWTException(
-          "disclosures and kb_jwt MUST only appear in the first unprotected header"
-        );
-      }
-    }
-    const disclosures = (_b = (_a = json.signatures[0].header) == null ? void 0 : _a.disclosures) != null ? _b : [];
-    const kb_jwt = (_c = json.signatures[0].header) == null ? void 0 : _c.kb_jwt;
-    return new _GeneralJSON({
-      payload: json.payload,
-      disclosures,
-      kb_jwt,
-      signatures: json.signatures.map((s) => {
-        var _a2;
-        return {
-          protected: s.protected,
-          signature: s.signature,
-          kid: (_a2 = s.header) == null ? void 0 : _a2.kid
-        };
-      })
-    });
-  }
-  toJson() {
-    return {
-      payload: this.payload,
-      signatures: this.signatures.map((s, i) => {
-        if (i !== 0) {
-          return {
-            header: {
-              kid: s.kid
-            },
-            protected: s.protected,
-            signature: s.signature
-          };
-        }
-        return {
-          header: {
-            disclosures: this.disclosures,
-            kid: s.kid,
-            kb_jwt: this.kb_jwt
-          },
-          protected: s.protected,
-          signature: s.signature
-        };
-      })
-    };
-  }
-  toEncoded(index) {
-    var _a;
-    if (index < 0 || index >= this.signatures.length) {
-      throw new SDJWTException("Index out of bounds");
-    }
-    const data = [];
-    const { protected: protectedHeader, signature } = this.signatures[index];
-    const jwt = `${protectedHeader}.${this.payload}.${signature}`;
-    data.push(jwt);
-    if (this.disclosures && this.disclosures.length > 0) {
-      const disclosures = this.disclosures.join(SD_SEPARATOR);
-      data.push(disclosures);
-    }
-    const kb = (_a = this.kb_jwt) != null ? _a : "";
-    data.push(kb);
-    return data.join(SD_SEPARATOR);
-  }
-  addSignature(protectedHeader, signer, kid) {
-    return __async(this, null, function* () {
-      const header = (0, import_identity_common.base64urlEncode)(JSON.stringify(protectedHeader));
-      const signature = yield signer(`${header}.${this.payload}`);
-      this.signatures.push({
-        protected: header,
-        signature,
-        kid
-      });
-    });
-  }
-};
-
-// src/jwt.ts
-var isStringArray = (value) => Array.isArray(value) && value.every((item) => typeof item === "string");
-var validateNumericDate = (payload, claim) => {
-  const value = payload[claim];
-  if (value === void 0) return void 0;
-  if (typeof value !== "number" || !Number.isFinite(value)) {
-    throw new SDJWTException(`Verify Error: JWT ${claim} must be a number`);
-  }
-  return value;
-};
-var getAudiences = (audience) => {
-  if (typeof audience === "string") return [audience];
-  if (isStringArray(audience)) return audience;
-  return void 0;
-};
-var validateAudience = (payload, expectedAudience) => {
-  if (expectedAudience === void 0) return;
-  const expectedAudiences = Array.isArray(expectedAudience) ? expectedAudience : [expectedAudience];
-  const audiences = getAudiences(payload.aud);
-  if (!audiences || !expectedAudiences.some((expected) => audiences.includes(expected))) {
-    throw new SDJWTException("Verify Error: Invalid audience");
-  }
-};
-var validateJwtPayload = (payload, options) => {
-  var _a;
-  if (!payload) {
-    throw new SDJWTException("Verify Error: JWT payload is missing");
-  }
-  const skew = (options == null ? void 0 : options.skewSeconds) ? options.skewSeconds : 0;
-  const currentDate = (_a = options == null ? void 0 : options.currentDate) != null ? _a : Math.floor(Date.now() / 1e3);
-  const iat = validateNumericDate(payload, "iat");
-  const nbf = validateNumericDate(payload, "nbf");
-  const exp = validateNumericDate(payload, "exp");
-  if (iat !== void 0 && iat - skew > currentDate) {
-    throw new SDJWTException("Verify Error: JWT is not yet valid");
-  }
-  if (nbf !== void 0 && nbf - skew > currentDate) {
-    throw new SDJWTException("Verify Error: JWT is not yet valid");
-  }
-  if (exp !== void 0 && exp + skew <= currentDate) {
-    throw new SDJWTException("Verify Error: JWT is expired");
-  }
-  validateAudience(payload, options == null ? void 0 : options.expectedAudience);
-};
-var Jwt = class _Jwt {
-  constructor(data) {
-    this.header = data == null ? void 0 : data.header;
-    this.payload = data == null ? void 0 : data.payload;
-    this.signature = data == null ? void 0 : data.signature;
-    this.encoded = data == null ? void 0 : data.encoded;
-  }
-  static decodeJWT(jwt) {
-    return decodeJwt(jwt);
-  }
-  static fromEncode(encodedJwt) {
-    const { header, payload, signature } = _Jwt.decodeJWT(
-      encodedJwt
-    );
-    const jwt = new _Jwt({
-      header,
-      payload,
-      signature,
-      encoded: encodedJwt
-    });
-    return jwt;
-  }
-  setHeader(header) {
-    this.header = header;
-    this.encoded = void 0;
-    return this;
-  }
-  setPayload(payload) {
-    this.payload = payload;
-    this.encoded = void 0;
-    return this;
-  }
-  getUnsignedToken() {
-    if (!this.header || !this.payload) {
-      throw new SDJWTException("Serialize Error: Invalid JWT");
-    }
-    if (this.encoded) {
-      const parts = this.encoded.split(".");
-      if (parts.length !== 3) {
-        throw new SDJWTException(`Invalid JWT format: ${this.encoded}`);
-      }
-      const unsignedToken = parts.slice(0, 2).join(".");
-      return unsignedToken;
-    }
-    const header = (0, import_identity_common.base64urlEncode)(JSON.stringify(this.header));
-    const payload = (0, import_identity_common.base64urlEncode)(JSON.stringify(this.payload));
-    return `${header}.${payload}`;
-  }
-  sign(signer) {
-    return __async(this, null, function* () {
-      if (!this.header || this.header.alg === "none") {
-        throw new SDJWTException('Sign Error: alg "none" is not allowed');
-      }
-      const data = this.getUnsignedToken();
-      this.signature = yield signer(data);
-      return this.encodeJwt();
-    });
-  }
-  encodeJwt() {
-    if (this.encoded) {
-      return this.encoded;
-    }
-    if (!this.header || !this.payload || !this.signature) {
-      throw new SDJWTException("Serialize Error: Invalid JWT");
-    }
-    const header = (0, import_identity_common.base64urlEncode)(JSON.stringify(this.header));
-    const payload = (0, import_identity_common.base64urlEncode)(JSON.stringify(this.payload));
-    const signature = this.signature;
-    const compact = `${header}.${payload}.${signature}`;
-    this.encoded = compact;
-    return compact;
-  }
-  /**
-   * Verify the JWT using the provided verifier function.
-   * It checks the signature and validates the iat, nbf, and exp claims if they are present.
-   * @param verifier
-   * @param options - Options for verification, such as current date and skew seconds
-   * @returns
-   */
-  verify(verifier, options) {
-    return __async(this, null, function* () {
-      var _a;
-      const alg = (_a = this.header) == null ? void 0 : _a.alg;
-      if (typeof alg !== "string" || alg === "none") {
-        throw new SDJWTException('Verify Error: alg "none" is not allowed');
-      }
-      if ((options == null ? void 0 : options.allowedIssuerAlgorithms) && !options.allowedIssuerAlgorithms.includes(alg)) {
-        throw new SDJWTException(`Verify Error: Disallowed alg ${alg}`);
-      }
-      if (!(options == null ? void 0 : options.skipJwtClaimValidation)) {
-        validateJwtPayload(this.payload, options);
-      }
-      if (!this.signature) {
-        throw new SDJWTException("Verify Error: no signature in JWT");
-      }
-      const data = this.getUnsignedToken();
-      const verified = yield verifier(data, this.signature, options);
-      if (!verified) {
-        throw new SDJWTException("Verify Error: Invalid JWT Signature");
-      }
-      return { payload: this.payload, header: this.header };
-    });
-  }
-};
-
-// src/kbjwt.ts
-var KBJwt = class _KBJwt extends Jwt {
-  // Checking the validity of the key binding jwt
-  // the type unknown is not good, but we don't know at this point how to get the public key of the signer, this is defined in the kbVerifier
-  verifyKB(values) {
-    return __async(this, null, function* () {
-      var _a, _b, _c, _d;
-      if (!this.header || !this.payload || !this.signature) {
-        throw new SDJWTException("Verify Error: Invalid JWT");
-      }
-      if (typeof this.header.alg !== "string" || this.header.alg === "none" || typeof this.header.typ !== "string" || this.header.typ !== KB_JWT_TYP || typeof this.payload.iat !== "number" || typeof this.payload.aud !== "string" || typeof this.payload.nonce !== "string" || typeof this.payload.sd_hash !== "string" || this.payload.sd_hash.length === 0) {
-        throw new SDJWTException("Invalid Key Binding Jwt");
-      }
-      if (this.payload.nonce !== values.nonce) {
-        throw new SDJWTException("Verify Error: Invalid Nonce");
-      }
-      if (((_a = values.options) == null ? void 0 : _a.expectedKeyBindingAudience) !== void 0) {
-        const expectedAudiences = Array.isArray(
-          values.options.expectedKeyBindingAudience
-        ) ? values.options.expectedKeyBindingAudience : [values.options.expectedKeyBindingAudience];
-        if (!expectedAudiences.includes(this.payload.aud)) {
-          throw new SDJWTException("Verify Error: Invalid Key Binding audience");
-        }
-      }
-      if (((_b = values.options) == null ? void 0 : _b.keyBindingMaxAgeSeconds) !== void 0) {
-        const currentDate = (_c = values.options.currentDate) != null ? _c : Math.floor(Date.now() / 1e3);
-        const skew = (_d = values.options.skewSeconds) != null ? _d : 0;
-        if (this.payload.iat + values.options.keyBindingMaxAgeSeconds + skew < currentDate) {
-          throw new SDJWTException("Verify Error: Key Binding JWT is too old");
-        }
-      }
-      yield this.verify(
-        (data, sig) => values.verifier(data, sig, values.payload),
-        values.options
-      );
-      return { payload: this.payload, header: this.header };
-    });
-  }
-  // This function is for creating KBJwt object for verify properly
-  static fromKBEncode(encodedJwt) {
-    const { header, payload, signature } = Jwt.decodeJWT(
-      encodedJwt
-    );
-    const jwt = new _KBJwt({
-      header,
-      payload,
-      signature,
-      encoded: encodedJwt
-    });
-    return jwt;
-  }
-};
-
-// src/decoy.ts
-var createDecoy = (hash, saltGenerator) => __async(null, null, function* () {
-  const { hasher, alg } = hash;
-  const salt = yield saltGenerator(16);
-  const decoy = yield hasher(salt, alg);
-  return (0, import_identity_common.uint8ArrayToBase64Url)(decoy);
-});
-
-// src/present/present.ts
-var presentableKeys = (rawPayload, disclosures, hasher) => __async(null, null, function* () {
-  const { disclosureKeymap } = yield unpack(rawPayload, disclosures, hasher);
-  return Object.keys(disclosureKeymap).sort();
-});
-var presentableKeysSync = (rawPayload, disclosures, hasher) => {
-  const { disclosureKeymap } = unpackSync(rawPayload, disclosures, hasher);
-  return Object.keys(disclosureKeymap).sort();
-};
-var present = (sdJwt, presentFrame, hasher) => __async(null, null, function* () {
-  const { jwt, kbJwt } = splitSdJwt(sdJwt);
-  const {
-    jwt: { payload },
-    disclosures
-  } = yield decodeSdJwt(sdJwt, hasher);
-  const { _sd_alg: alg } = getSDAlgAndPayload(payload);
-  const hash = { alg, hasher };
-  const keys = transformPresentationFrame(presentFrame);
-  const hashmap = yield createHashMapping(disclosures, hash);
-  const { disclosureKeymap } = yield unpack(payload, disclosures, hasher);
-  const presentedDisclosures = keys.map((k) => hashmap[disclosureKeymap[k]]).filter((d) => d !== void 0);
-  return [
-    jwt,
-    ...presentedDisclosures.map((d) => d.encode()),
-    kbJwt != null ? kbJwt : ""
-  ].join(SD_SEPARATOR);
-});
-var presentSync = (sdJwt, presentFrame, hasher) => {
-  const { jwt, kbJwt } = splitSdJwt(sdJwt);
-  const {
-    jwt: { payload },
-    disclosures
-  } = decodeSdJwtSync(sdJwt, hasher);
-  const { _sd_alg: alg } = getSDAlgAndPayload(payload);
-  const hash = { alg, hasher };
-  const keys = transformPresentationFrame(presentFrame);
-  const hashmap = createHashMappingSync(disclosures, hash);
-  const { disclosureKeymap } = unpackSync(payload, disclosures, hasher);
-  const presentedDisclosures = keys.map((k) => hashmap[disclosureKeymap[k]]).filter((d) => d !== void 0);
-  return [
-    jwt,
-    ...presentedDisclosures.map((d) => d.encode()),
-    kbJwt != null ? kbJwt : ""
-  ].join(SD_SEPARATOR);
-};
-var transformPresentationFrame = (obj, prefix = []) => {
-  return Object.entries(obj).reduce((acc, [key, value]) => {
-    const newPrefix = [...prefix, key];
-    const encodedPrefix = encodePath(newPrefix);
-    if (typeof value === "boolean") {
-      if (value) {
-        acc.push(encodedPrefix);
-      }
-    } else if (typeof value === "object" && value !== null) {
-      acc.push(
-        encodedPrefix,
-        ...transformPresentationFrame(
-          value,
-          newPrefix
-        )
-      );
-    }
-    return acc;
-  }, []);
-};
-var createHashMappingForSerializedDisclosure = (disclosures) => {
-  const map = {};
-  for (let i = 0; i < disclosures.length; i++) {
-    const disclosure = disclosures[i];
-    const { digest, encoded, key, salt, value } = disclosure;
-    map[digest] = Disclosure.fromArray(
-      key ? [salt, key, value] : [salt, value],
-      { digest, encoded }
-    );
-  }
-  return map;
-};
-var selectDisclosures = (payload, disclosures, presentationFrame) => {
-  if (disclosures.length === 0) {
-    return [];
-  }
-  const hashmap = createHashMappingForSerializedDisclosure(disclosures);
-  const { disclosureKeymap } = unpackObj(payload, hashmap);
-  const keys = transformPresentationFrame(presentationFrame);
-  const presentedDisclosures = keys.map((k) => hashmap[disclosureKeymap[k]]).filter((d) => d !== void 0);
-  const selectedDisclosures = presentedDisclosures.map(
-    (d) => {
-      const { salt, key, value, _digest } = d;
-      if (!_digest) {
-        throw new SDJWTException(
-          "Implementation error: _digest is not defined"
-        );
-      }
-      return {
-        digest: _digest,
-        encoded: d.encode(),
-        salt,
-        key,
-        value
-      };
-    }
-  );
-  return selectedDisclosures;
-};
-
-// src/sdjwt.ts
-var createDisclosureSalt = (saltGenerator, seenSalts) => __async(null, null, function* () {
-  const salt = yield saltGenerator(16);
-  if (typeof salt !== "string") {
-    throw new SDJWTException("SaltGenerator must return a string");
-  }
-  if (seenSalts.has(salt)) {
-    throw new SDJWTException("Duplicate disclosure salt detected");
-  }
-  seenSalts.add(salt);
-  return salt;
-});
-var addDisclosureDigest = (digest, seenDigests) => {
-  if (seenDigests.has(digest)) {
-    throw new SDJWTException("Duplicate disclosure digest detected");
-  }
-  seenDigests.add(digest);
-};
-var SDJwt = class _SDJwt {
-  constructor(data) {
-    this.jwt = data == null ? void 0 : data.jwt;
-    this.disclosures = data == null ? void 0 : data.disclosures;
-    this.kbJwt = data == null ? void 0 : data.kbJwt;
-  }
-  static decodeSDJwt(sdjwt, hasher) {
-    return __async(this, null, function* () {
-      const [encodedJwt, ...encodedDisclosures] = sdjwt.split(SD_SEPARATOR);
-      if (encodedDisclosures.length === 0) {
-        throw new SDJWTException("Invalid SD-JWT: missing SD-JWT separator");
-      }
-      const jwt = Jwt.fromEncode(encodedJwt);
-      if (!jwt.payload) {
-        throw new Error("Payload is undefined on the JWT. Invalid state reached");
-      }
-      const encodedKeyBindingJwt = encodedDisclosures.pop();
-      const kbJwt = encodedKeyBindingJwt ? KBJwt.fromKBEncode(encodedKeyBindingJwt) : void 0;
-      const { _sd_alg } = getSDAlgAndPayload(jwt.payload);
-      const disclosures = yield Promise.all(
-        encodedDisclosures.map(
-          (ed) => Disclosure.fromEncode(ed, { alg: _sd_alg, hasher })
-        )
-      );
-      return {
-        jwt,
-        disclosures,
-        kbJwt
-      };
-    });
-  }
-  static extractJwt(encodedSdJwt) {
-    return __async(this, null, function* () {
-      const [encodedJwt, ..._encodedDisclosures] = encodedSdJwt.split(SD_SEPARATOR);
-      return Jwt.fromEncode(encodedJwt);
-    });
-  }
-  static fromEncode(encodedSdJwt, hasher) {
-    return __async(this, null, function* () {
-      const { jwt, disclosures, kbJwt } = yield _SDJwt.decodeSDJwt(encodedSdJwt, hasher);
-      return new _SDJwt({
-        jwt,
-        disclosures,
-        kbJwt
-      });
-    });
-  }
-  present(presentFrame, hasher) {
-    return __async(this, null, function* () {
-      const disclosures = yield this.getPresentDisclosures(presentFrame, hasher);
-      const presentSDJwt = new _SDJwt({
-        jwt: this.jwt,
-        disclosures,
-        kbJwt: this.kbJwt
-      });
-      return presentSDJwt.encodeSDJwt();
-    });
-  }
-  getPresentDisclosures(presentFrame, hasher) {
-    return __async(this, null, function* () {
-      var _a;
-      if (!((_a = this.jwt) == null ? void 0 : _a.payload) || !this.disclosures) {
-        throw new SDJWTException("Invalid sd-jwt: jwt or disclosures is missing");
-      }
-      const { _sd_alg: alg } = getSDAlgAndPayload(this.jwt.payload);
-      const hash = { alg, hasher };
-      const hashmap = yield createHashMapping(this.disclosures, hash);
-      const { disclosureKeymap } = yield unpack(
-        this.jwt.payload,
-        this.disclosures,
-        hasher
-      );
-      const keys = presentFrame ? transformPresentationFrame(presentFrame) : yield this.presentableKeys(hasher);
-      const disclosures = keys.map((k) => hashmap[disclosureKeymap[k]]).filter((d) => d !== void 0);
-      return disclosures;
-    });
-  }
-  encodeSDJwt() {
-    const data = [];
-    if (!this.jwt) {
-      throw new SDJWTException("Invalid sd-jwt: jwt is missing");
-    }
-    const encodedJwt = this.jwt.encodeJwt();
-    data.push(encodedJwt);
-    if (this.disclosures && this.disclosures.length > 0) {
-      const encodeddisclosures = this.disclosures.map((dc) => dc.encode()).join(SD_SEPARATOR);
-      data.push(encodeddisclosures);
-    }
-    data.push(this.kbJwt ? this.kbJwt.encodeJwt() : "");
-    return data.join(SD_SEPARATOR);
-  }
-  keys(hasher) {
-    return __async(this, null, function* () {
-      return listKeys(yield this.getClaims(hasher)).sort();
-    });
-  }
-  presentableKeys(hasher) {
-    return __async(this, null, function* () {
-      var _a, _b;
-      if (!((_a = this.jwt) == null ? void 0 : _a.payload) || !this.disclosures) {
-        throw new SDJWTException("Invalid sd-jwt: jwt or disclosures is missing");
-      }
-      const { disclosureKeymap } = yield unpack(
-        (_b = this.jwt) == null ? void 0 : _b.payload,
-        this.disclosures,
-        hasher
-      );
-      return Object.keys(disclosureKeymap).sort();
-    });
-  }
-  getClaims(hasher) {
-    return __async(this, null, function* () {
-      var _a;
-      if (!((_a = this.jwt) == null ? void 0 : _a.payload) || !this.disclosures) {
-        throw new SDJWTException("Invalid sd-jwt: jwt or disclosures is missing");
-      }
-      const { unpackedObj } = yield unpack(
-        this.jwt.payload,
-        this.disclosures,
-        hasher
-      );
-      return unpackedObj;
-    });
-  }
-};
-var listKeys = (obj, prefix = "") => {
-  const keys = [];
-  for (const key in obj) {
-    if (obj[key] === void 0) continue;
-    const escapedKey = encodePathSegment(key);
-    const newKey = prefix ? `${prefix}.${escapedKey}` : escapedKey;
-    keys.push(newKey);
-    const value = obj[key];
-    if (value && typeof value === "object") {
-      keys.push(...listKeys(value, newKey));
-    }
-  }
-  return keys;
-};
-var pack = (_0, _1, _2, _3, ..._4) => __async(null, [_0, _1, _2, _3, ..._4], function* (claims, disclosureFrame, hash, saltGenerator, seenSalts = /* @__PURE__ */ new Set(), seenDigests = /* @__PURE__ */ new Set()) {
-  var _a, _b;
-  if (!disclosureFrame) {
-    return {
-      packedClaims: claims,
-      disclosures: []
-    };
-  }
-  const sd = (_a = disclosureFrame[SD_DIGEST]) != null ? _a : [];
-  const decoyCount = (_b = disclosureFrame[SD_DECOY]) != null ? _b : 0;
-  if (Array.isArray(claims)) {
-    const packedClaims2 = [];
-    const disclosures2 = [];
-    const recursivePackedClaims2 = {};
-    for (const key in disclosureFrame) {
-      if (key !== SD_DIGEST) {
-        const idx = Number.parseInt(key, 10);
-        const packed = yield pack(
-          claims[idx],
-          disclosureFrame[idx],
-          hash,
-          saltGenerator,
-          seenSalts,
-          seenDigests
-        );
-        recursivePackedClaims2[idx] = packed.packedClaims;
-        disclosures2.push(...packed.disclosures);
-      }
-    }
-    for (let i = 0; i < claims.length; i++) {
-      const claim = recursivePackedClaims2[i] ? recursivePackedClaims2[i] : claims[i];
-      if (sd.includes(i)) {
-        const salt = yield createDisclosureSalt(saltGenerator, seenSalts);
-        const disclosure = new Disclosure([salt, claim]);
-        const digest = yield disclosure.digest(hash);
-        addDisclosureDigest(digest, seenDigests);
-        packedClaims2.push({ [SD_LIST_KEY]: digest });
-        disclosures2.push(disclosure);
-      } else {
-        packedClaims2.push(claim);
-      }
-    }
-    for (let j = 0; j < decoyCount; j++) {
-      const decoyDigest = yield createDecoy(hash, saltGenerator);
-      addDisclosureDigest(decoyDigest, seenDigests);
-      packedClaims2.push({ [SD_LIST_KEY]: decoyDigest });
-    }
-    return { packedClaims: packedClaims2, disclosures: disclosures2 };
-  }
-  const packedClaims = {};
-  const disclosures = [];
-  const recursivePackedClaims = {};
-  for (const key in disclosureFrame) {
-    if (key !== SD_DIGEST) {
-      const packed = yield pack(
-        // @ts-expect-error
-        claims[key],
-        disclosureFrame[key],
-        hash,
-        saltGenerator,
-        seenSalts,
-        seenDigests
-      );
-      recursivePackedClaims[key] = packed.packedClaims;
-      disclosures.push(...packed.disclosures);
-    }
-  }
-  const _sd = [];
-  for (const key in claims) {
-    const claim = recursivePackedClaims[key] ? recursivePackedClaims[key] : claims[key];
-    if (sd.includes(key)) {
-      const salt = yield createDisclosureSalt(saltGenerator, seenSalts);
-      const disclosure = new Disclosure([salt, key, claim]);
-      const digest = yield disclosure.digest(hash);
-      addDisclosureDigest(digest, seenDigests);
-      _sd.push(digest);
-      disclosures.push(disclosure);
-    } else {
-      packedClaims[key] = claim;
-    }
-  }
-  for (let j = 0; j < decoyCount; j++) {
-    const decoyDigest = yield createDecoy(hash, saltGenerator);
-    addDisclosureDigest(decoyDigest, seenDigests);
-    _sd.push(decoyDigest);
-  }
-  if (_sd.length > 0) {
-    packedClaims[SD_DIGEST] = _sd.sort();
-  }
-  return { packedClaims, disclosures };
-});
-
-// src/index.ts
-function validateReservedFieldsInternal(payload) {
-  const reservedFields = /* @__PURE__ */ new Set([SD_DIGEST, "_sd_alg", SD_DECOY, SD_LIST_KEY]);
-  const visit = (node) => {
-    if (!node || typeof node !== "object") {
-      return;
-    }
-    for (const [key, value] of Object.entries(
-      node
-    )) {
-      if (reservedFields.has(key)) {
-        throw new SDJWTException(`Reserved field name "${key}" is not allowed`);
-      }
-      visit(value);
-    }
-  };
-  visit(payload);
-}
-var _SDJwtInstance = class _SDJwtInstance {
-  constructor(userConfig) {
-    this.userConfig = {};
-    var _a;
-    if (userConfig) {
-      if (userConfig.hashAlg && !IANA_HASH_ALGORITHMS.includes(userConfig.hashAlg)) {
-        throw new SDJWTException(
-          `Invalid hash algorithm: ${userConfig.hashAlg}`
-        );
-      }
-      const allowedDisclosureHashAlgorithms = (_a = userConfig.allowedDisclosureHashAlgorithms) != null ? _a : DEFAULT_SECURE_HASH_ALGORITHMS;
-      if (userConfig.hashAlg && !allowedDisclosureHashAlgorithms.includes(userConfig.hashAlg)) {
-        throw new SDJWTException(
-          `Disallowed hash algorithm: ${userConfig.hashAlg}`
-        );
-      }
-      this.userConfig = userConfig;
-    }
-  }
-  createKBJwt(options, sdHash) {
-    return __async(this, null, function* () {
-      if (!this.userConfig.kbSigner) {
-        throw new SDJWTException("Key Binding Signer not found");
-      }
-      if (!this.userConfig.kbSignAlg) {
-        throw new SDJWTException("Key Binding sign algorithm not specified");
-      }
-      const { payload } = options;
-      const kbJwt = new KBJwt({
-        header: {
-          typ: KB_JWT_TYP,
-          alg: this.userConfig.kbSignAlg
-        },
-        payload: __spreadProps(__spreadValues({}, payload), { sd_hash: sdHash })
-      });
-      yield kbJwt.sign(this.userConfig.kbSigner);
-      return kbJwt;
-    });
-  }
-  SignJwt(jwt) {
-    return __async(this, null, function* () {
-      if (!this.userConfig.signer) {
-        throw new SDJWTException("Signer not found");
-      }
-      yield jwt.sign(this.userConfig.signer);
-      return jwt;
-    });
-  }
-  VerifyJwt(jwt, options) {
-    return __async(this, null, function* () {
-      if (!this.userConfig.verifier) {
-        throw new SDJWTException("Verifier not found");
-      }
-      return jwt.verify(this.userConfig.verifier, options);
-    });
-  }
-  issue(payload, disclosureFrame, options) {
-    return __async(this, null, function* () {
-      var _a, _b, _c;
-      if (!this.userConfig.hasher) {
-        throw new SDJWTException("Hasher not found");
-      }
-      if (!this.userConfig.saltGenerator) {
-        throw new SDJWTException("SaltGenerator not found");
-      }
-      if (!this.userConfig.signAlg) {
-        throw new SDJWTException("sign alogrithm not specified");
-      }
-      if (this.userConfig.signAlg === "none") {
-        throw new SDJWTException('sign algorithm "none" is not allowed');
-      }
-      this.validateReservedFields(payload);
-      this.validateDisclosureFrame(disclosureFrame);
-      const hasher = this.userConfig.hasher;
-      const hashAlg = (_a = this.userConfig.hashAlg) != null ? _a : _SDJwtInstance.DEFAULT_hashAlg;
-      const allowedDisclosureHashAlgorithms = (_b = this.userConfig.allowedDisclosureHashAlgorithms) != null ? _b : DEFAULT_SECURE_HASH_ALGORITHMS;
-      if (!allowedDisclosureHashAlgorithms.includes(hashAlg)) {
-        throw new SDJWTException(`Disallowed hash algorithm: ${hashAlg}`);
-      }
-      const { packedClaims, disclosures } = yield pack(
-        payload,
-        disclosureFrame,
-        { hasher, alg: hashAlg },
-        this.userConfig.saltGenerator
-      );
-      const alg = this.userConfig.signAlg;
-      const OptionHeader = (_c = options == null ? void 0 : options.header) != null ? _c : {};
-      const CustomHeader = this.userConfig.omitTyp ? OptionHeader : __spreadValues({ typ: this.type }, OptionHeader);
-      const header = __spreadProps(__spreadValues({}, CustomHeader), { alg });
-      const jwt = new Jwt({
-        header,
-        payload: __spreadProps(__spreadValues({}, packedClaims), {
-          _sd_alg: disclosureFrame ? hashAlg : void 0
-        })
-      });
-      yield this.SignJwt(jwt);
-      const sdJwt = new SDJwt({
-        jwt,
-        disclosures
-      });
-      return sdJwt.encodeSDJwt();
-    });
-  }
-  /**
-   * Validates if the payload contains any reserved claim names. If so it will throw an error.
-   * @param payload
-   * @returns
-   */
-  validateReservedFields(payload) {
-    validateReservedFieldsInternal(payload);
-  }
-  validateDisclosureFrame(_disclosureFrame) {
-    return;
-  }
-  present(encodedSDJwt, presentationFrame, options) {
-    return __async(this, null, function* () {
-      var _a;
-      if (!this.userConfig.hasher) {
-        throw new SDJWTException("Hasher not found");
-      }
-      const hasher = this.userConfig.hasher;
-      const sdjwt = yield SDJwt.fromEncode(encodedSDJwt, hasher);
-      if (sdjwt.kbJwt) {
-        throw new SDJWTException("Holder cannot present an SD-JWT with KB-JWT");
-      }
-      if (!((_a = sdjwt.jwt) == null ? void 0 : _a.payload)) throw new SDJWTException("Payload not found");
-      const presentSdJwtWithoutKb = yield sdjwt.present(
-        presentationFrame,
-        hasher
-      );
-      if (!(options == null ? void 0 : options.kb)) {
-        return presentSdJwtWithoutKb;
-      }
-      const sdHashStr = yield this.calculateSDHash(
-        presentSdJwtWithoutKb,
-        sdjwt,
-        hasher
-      );
-      sdjwt.kbJwt = yield this.createKBJwt(options.kb, sdHashStr);
-      return sdjwt.present(presentationFrame, hasher);
-    });
-  }
-  // This function is for verifying the SD JWT
-  // If requiredClaimKeys is provided, it will check if the required claim keys are presentation in the SD JWT
-  // If requireKeyBindings is true, it will check if the key binding JWT is presentation and verify it
-  verify(encodedSDJwt, options) {
-    return __async(this, null, function* () {
-      var _a;
-      if (!this.userConfig.hasher) {
-        throw new SDJWTException("Hasher not found");
-      }
-      const hasher = this.userConfig.hasher;
-      const sdjwt = yield SDJwt.fromEncode(encodedSDJwt, hasher);
-      if (!((_a = sdjwt.jwt) == null ? void 0 : _a.payload)) {
-        throw new SDJWTException("Invalid SD JWT");
-      }
-      const { payload, header } = yield this.validate(encodedSDJwt, options);
-      if (options == null ? void 0 : options.requiredClaimKeys) {
-        const keys = yield sdjwt.keys(hasher);
-        const missingKeys = options.requiredClaimKeys.filter(
-          (k) => !keys.includes(k)
-        );
-        if (missingKeys.length > 0) {
-          throw new SDJWTException(
-            `Missing required claim keys: ${missingKeys.join(", ")}`
-          );
-        }
-      }
-      if (!(options == null ? void 0 : options.keyBindingNonce)) {
-        return { payload, header };
-      }
-      if (!sdjwt.kbJwt) {
-        throw new SDJWTException("Key Binding JWT not exist");
-      }
-      if (!this.userConfig.kbVerifier) {
-        throw new SDJWTException("Key Binding Verifier not found");
-      }
-      const kb = yield sdjwt.kbJwt.verifyKB({
-        verifier: this.userConfig.kbVerifier,
-        payload,
-        nonce: options.keyBindingNonce,
-        options
-      });
-      if (!kb) {
-        throw new Error("signature is not valid");
-      }
-      const sdHashfromKb = kb.payload.sd_hash;
-      const sdjwtWithoutKb = new SDJwt({
-        jwt: sdjwt.jwt,
-        disclosures: sdjwt.disclosures
-      });
-      const presentSdJwtWithoutKb = sdjwtWithoutKb.encodeSDJwt();
-      const sdHashStr = yield this.calculateSDHash(
-        presentSdJwtWithoutKb,
-        sdjwt,
-        hasher
-      );
-      if (sdHashStr !== sdHashfromKb) {
-        throw new SDJWTException("Invalid sd_hash in Key Binding JWT");
-      }
-      return { payload, header, kb };
-    });
-  }
-  /**
-   * Safe verification that collects all errors instead of failing fast.
-   * Returns a result object with either the verified data or an array of all errors.
-   *
-   * @param encodedSDJwt - The encoded SD-JWT to verify
-   * @param options - Verification options
-   * @returns A SafeVerifyResult containing either success data or collected errors
-   */
-  safeVerify(encodedSDJwt, options) {
-    return __async(this, null, function* () {
-      var _a;
-      const errors = [];
-      const addError = (code, message, details) => {
-        errors.push({ code, message, details });
-      };
-      const exceptionToCode = (error) => {
-        const message = error.message.toLowerCase();
-        if (message.includes("hasher not found")) return "HASHER_NOT_FOUND";
-        if (message.includes("verifier not found")) return "VERIFIER_NOT_FOUND";
-        if (message.includes("invalid sd jwt") || message.includes("invalid jwt"))
-          return "INVALID_SD_JWT";
-        if (message.includes("not yet valid")) return "JWT_NOT_YET_VALID";
-        if (message.includes("expired")) return "JWT_EXPIRED";
-        if (message.includes("signature")) return "INVALID_JWT_SIGNATURE";
-        if (message.includes("missing required claim"))
-          return "MISSING_REQUIRED_CLAIMS";
-        if (message.includes("key binding jwt not exist"))
-          return "KEY_BINDING_JWT_MISSING";
-        if (message.includes("key binding verifier not found"))
-          return "KEY_BINDING_VERIFIER_NOT_FOUND";
-        if (message.includes("sd_hash")) return "KEY_BINDING_SD_HASH_INVALID";
-        return "UNKNOWN_ERROR";
-      };
-      if (!this.userConfig.hasher) {
-        addError("HASHER_NOT_FOUND", "Hasher not found");
-      }
-      if (!this.userConfig.verifier) {
-        addError("VERIFIER_NOT_FOUND", "Verifier not found");
-      }
-      if (errors.length > 0) {
-        return { success: false, errors };
-      }
-      if (!this.userConfig.hasher) {
-        throw new SDJWTException("Hasher not found");
-      }
-      const hasher = this.userConfig.hasher;
-      let sdjwt;
-      let payload;
-      let header;
-      try {
-        sdjwt = yield SDJwt.fromEncode(encodedSDJwt, hasher);
-        if (!((_a = sdjwt.jwt) == null ? void 0 : _a.payload)) {
-          addError("INVALID_SD_JWT", "Invalid SD JWT: missing JWT or payload");
-        }
-      } catch (e) {
-        const error = ensureError(e);
-        addError(
-          "INVALID_SD_JWT",
-          `Failed to decode SD-JWT: ${error.message}`,
-          error
-        );
-      }
-      if (sdjwt == null ? void 0 : sdjwt.jwt) {
-        try {
-          const result = yield this.VerifyJwt(sdjwt.jwt, __spreadProps(__spreadValues({}, options), {
-            skipJwtClaimValidation: true
-          }));
-          header = result.header;
-          const claims = yield sdjwt.getClaims(hasher);
-          payload = claims;
-          validateJwtPayload(payload, options);
-        } catch (e) {
-          const error = ensureError(e);
-          const code = exceptionToCode(error);
-          addError(code, error.message, error);
-        }
-      }
-      if (sdjwt && (options == null ? void 0 : options.requiredClaimKeys)) {
-        try {
-          const keys = yield sdjwt.keys(hasher);
-          const missingKeys = options.requiredClaimKeys.filter(
-            (k) => !keys.includes(k)
-          );
-          if (missingKeys.length > 0) {
-            addError(
-              "MISSING_REQUIRED_CLAIMS",
-              `Missing required claim keys: ${missingKeys.join(", ")}`,
-              { missingKeys }
-            );
-          }
-        } catch (e) {
-          const error = ensureError(e);
-          addError(
-            "UNKNOWN_ERROR",
-            `Failed to check required claims: ${error.message}`,
-            error
-          );
-        }
-      }
-      let kb;
-      if ((options == null ? void 0 : options.keyBindingNonce) && sdjwt) {
-        if (!sdjwt.kbJwt) {
-          addError("KEY_BINDING_JWT_MISSING", "Key Binding JWT not exist");
-        } else if (!this.userConfig.kbVerifier) {
-          addError(
-            "KEY_BINDING_VERIFIER_NOT_FOUND",
-            "Key Binding Verifier not found"
-          );
-        } else if (payload) {
-          try {
-            const kbResult = yield sdjwt.kbJwt.verifyKB({
-              verifier: this.userConfig.kbVerifier,
-              payload,
-              nonce: options.keyBindingNonce,
-              options
-            });
-            if (!kbResult) {
-              addError(
-                "KEY_BINDING_SIGNATURE_INVALID",
-                "Key binding signature is not valid"
-              );
-            } else {
-              kb = kbResult;
-              const sdjwtWithoutKb = new SDJwt({
-                jwt: sdjwt.jwt,
-                disclosures: sdjwt.disclosures
-              });
-              const presentSdJwtWithoutKb = sdjwtWithoutKb.encodeSDJwt();
-              const sdHashStr = yield this.calculateSDHash(
-                presentSdJwtWithoutKb,
-                sdjwt,
-                hasher
-              );
-              if (sdHashStr !== kbResult.payload.sd_hash) {
-                addError(
-                  "KEY_BINDING_SD_HASH_INVALID",
-                  "Invalid sd_hash in Key Binding JWT",
-                  {
-                    expected: sdHashStr,
-                    received: kbResult.payload.sd_hash
-                  }
-                );
-              }
-            }
-          } catch (e) {
-            const error = ensureError(e);
-            addError(
-              "KEY_BINDING_SIGNATURE_INVALID",
-              `Key binding verification failed: ${error.message}`,
-              error
-            );
-          }
-        }
-      }
-      if (errors.length > 0) {
-        return { success: false, errors };
-      }
-      return {
-        success: true,
-        data: {
-          payload,
-          header,
-          kb
-        }
-      };
-    });
-  }
-  calculateSDHash(presentSdJwtWithoutKb, sdjwt, hasher) {
-    return __async(this, null, function* () {
-      var _a;
-      if (!((_a = sdjwt.jwt) == null ? void 0 : _a.payload)) {
-        throw new SDJWTException("Invalid SD JWT");
-      }
-      const { _sd_alg } = getSDAlgAndPayload(sdjwt.jwt.payload);
-      const sdHash = yield hasher(presentSdJwtWithoutKb, _sd_alg);
-      const sdHashStr = (0, import_identity_common.uint8ArrayToBase64Url)(sdHash);
-      return sdHashStr;
-    });
-  }
-  /**
-   * This function is for validating the SD JWT
-   * Checking signature, if provided the iat and exp when provided and return its the claims
-   * @param encodedSDJwt
-   * @param options
-   * @returns
-   */
-  validate(encodedSDJwt, options) {
-    return __async(this, null, function* () {
-      if (!this.userConfig.hasher) {
-        throw new SDJWTException("Hasher not found");
-      }
-      const hasher = this.userConfig.hasher;
-      const sdjwt = yield SDJwt.fromEncode(encodedSDJwt, hasher);
-      if (!sdjwt.jwt) {
-        throw new SDJWTException("Invalid SD JWT");
-      }
-      const verifiedPayloads = yield this.VerifyJwt(sdjwt.jwt, __spreadProps(__spreadValues({}, options), {
-        skipJwtClaimValidation: true
-      }));
-      const claims = yield sdjwt.getClaims(hasher);
-      validateReservedFieldsInternal(claims);
-      validateJwtPayload(claims, options);
-      return { payload: claims, header: verifiedPayloads.header };
-    });
-  }
-  config(newConfig) {
-    this.userConfig = __spreadValues(__spreadValues({}, this.userConfig), newConfig);
-  }
-  encode(sdJwt) {
-    return sdJwt.encodeSDJwt();
-  }
-  decode(endcodedSDJwt) {
-    if (!this.userConfig.hasher) {
-      throw new SDJWTException("Hasher not found");
-    }
-    return SDJwt.fromEncode(endcodedSDJwt, this.userConfig.hasher);
-  }
-  keys(endcodedSDJwt) {
-    return __async(this, null, function* () {
-      if (!this.userConfig.hasher) {
-        throw new SDJWTException("Hasher not found");
-      }
-      const sdjwt = yield SDJwt.fromEncode(endcodedSDJwt, this.userConfig.hasher);
-      return sdjwt.keys(this.userConfig.hasher);
-    });
-  }
-  presentableKeys(endcodedSDJwt) {
-    return __async(this, null, function* () {
-      if (!this.userConfig.hasher) {
-        throw new SDJWTException("Hasher not found");
-      }
-      const sdjwt = yield SDJwt.fromEncode(endcodedSDJwt, this.userConfig.hasher);
-      return sdjwt.presentableKeys(this.userConfig.hasher);
-    });
-  }
-  getClaims(endcodedSDJwt) {
-    return __async(this, null, function* () {
-      if (!this.userConfig.hasher) {
-        throw new SDJWTException("Hasher not found");
-      }
-      const sdjwt = yield SDJwt.fromEncode(endcodedSDJwt, this.userConfig.hasher);
-      return sdjwt.getClaims(this.userConfig.hasher);
-    });
-  }
-  toFlattenJSON(endcodedSDJwt) {
-    return FlattenJSON.fromEncode(endcodedSDJwt);
-  }
-  toGeneralJSON(endcodedSDJwt) {
-    return GeneralJSON.fromEncode(endcodedSDJwt);
-  }
-};
-_SDJwtInstance.DEFAULT_hashAlg = "sha-256";
-var SDJwtInstance = _SDJwtInstance;
-var SDJwtGeneralJSONInstance = class {
-  constructor(userConfig) {
-    this.userConfig = {};
-    var _a;
-    if (userConfig) {
-      if (userConfig.hashAlg && !IANA_HASH_ALGORITHMS.includes(userConfig.hashAlg)) {
-        throw new SDJWTException(
-          `Invalid hash algorithm: ${userConfig.hashAlg}`
-        );
-      }
-      const allowedDisclosureHashAlgorithms = (_a = userConfig.allowedDisclosureHashAlgorithms) != null ? _a : DEFAULT_SECURE_HASH_ALGORITHMS;
-      if (userConfig.hashAlg && !allowedDisclosureHashAlgorithms.includes(userConfig.hashAlg)) {
-        throw new SDJWTException(
-          `Disallowed hash algorithm: ${userConfig.hashAlg}`
-        );
-      }
-      this.userConfig = userConfig;
-    }
-  }
-  createKBJwt(options, sdHash) {
-    return __async(this, null, function* () {
-      if (!this.userConfig.kbSigner) {
-        throw new SDJWTException("Key Binding Signer not found");
-      }
-      if (!this.userConfig.kbSignAlg) {
-        throw new SDJWTException("Key Binding sign algorithm not specified");
-      }
-      const { payload } = options;
-      const kbJwt = new KBJwt({
-        header: {
-          typ: KB_JWT_TYP,
-          alg: this.userConfig.kbSignAlg
-        },
-        payload: __spreadProps(__spreadValues({}, payload), { sd_hash: sdHash })
-      });
-      yield kbJwt.sign(this.userConfig.kbSigner);
-      return kbJwt;
-    });
-  }
-  encodeObj(obj) {
-    return (0, import_identity_common.base64urlEncode)(JSON.stringify(obj));
-  }
-  issue(payload, disclosureFrame, options) {
-    return __async(this, null, function* () {
-      var _a;
-      if (!this.userConfig.hasher) {
-        throw new SDJWTException("Hasher not found");
-      }
-      if (!this.userConfig.saltGenerator) {
-        throw new SDJWTException("SaltGenerator not found");
-      }
-      this.validateReservedFields(payload);
-      this.validateDisclosureFrame(disclosureFrame);
-      const hasher = this.userConfig.hasher;
-      const hashAlg = (_a = this.userConfig.hashAlg) != null ? _a : SDJwtInstance.DEFAULT_hashAlg;
-      const { packedClaims, disclosures } = yield pack(
-        payload,
-        disclosureFrame,
-        { hasher, alg: hashAlg },
-        this.userConfig.saltGenerator
-      );
-      const encodedSDJwtPayload = this.encodeObj(__spreadProps(__spreadValues({}, packedClaims), {
-        _sd_alg: disclosureFrame ? hashAlg : void 0
-      }));
-      const encodedDisclosures = disclosures.map(
-        (disclosure) => disclosure.encode()
-      );
-      const signatures = yield Promise.all(
-        options.sigs.map((s) => __async(this, null, function* () {
-          const { signer, alg, kid, header } = s;
-          const protectedHeader = __spreadValues({ typ: this.type, alg, kid }, header);
-          const encodedProtectedHeader = this.encodeObj(protectedHeader);
-          const signature = yield signer(
-            `${encodedProtectedHeader}.${encodedSDJwtPayload}`
-          );
-          return {
-            protected: encodedProtectedHeader,
-            signature
-          };
-        }))
-      );
-      const generalJson = new GeneralJSON({
-        payload: encodedSDJwtPayload,
-        disclosures: encodedDisclosures,
-        signatures
-      });
-      return generalJson;
-    });
-  }
-  /**
-   * Validates if the payload contains any reserved claim names. If so it will throw an error.
-   * @param payload
-   * @returns
-   */
-  validateReservedFields(payload) {
-    validateReservedFieldsInternal(payload);
-  }
-  validateDisclosureFrame(_disclosureFrame) {
-    return;
-  }
-  present(generalJSON, presentationFrame, options) {
-    return __async(this, null, function* () {
-      var _a;
-      if (!this.userConfig.hasher) {
-        throw new SDJWTException("Hasher not found");
-      }
-      const hasher = this.userConfig.hasher;
-      const encodedSDJwt = generalJSON.toEncoded(0);
-      const sdjwt = yield SDJwt.fromEncode(encodedSDJwt, hasher);
-      if (sdjwt.kbJwt) {
-        throw new SDJWTException("Holder cannot present an SD-JWT with KB-JWT");
-      }
-      if (!((_a = sdjwt.jwt) == null ? void 0 : _a.payload)) throw new SDJWTException("Payload not found");
-      const disclosures = yield sdjwt.getPresentDisclosures(
-        presentationFrame,
-        hasher
-      );
-      const encodedDisclosures = disclosures.map((d) => d.encode());
-      const presentedGeneralJSON = new GeneralJSON({
-        payload: generalJSON.payload,
-        disclosures: encodedDisclosures,
-        signatures: generalJSON.signatures
-      });
-      if (!(options == null ? void 0 : options.kb)) {
-        return presentedGeneralJSON;
-      }
-      const presentSdJwtWithoutKb = yield sdjwt.present(
-        presentationFrame,
-        hasher
-      );
-      const sdHashStr = yield this.calculateSDHash(
-        presentSdJwtWithoutKb,
-        sdjwt,
-        hasher
-      );
-      const kbJwt = yield this.createKBJwt(options.kb, sdHashStr);
-      const encodedKbJwt = kbJwt.encodeJwt();
-      presentedGeneralJSON.kb_jwt = encodedKbJwt;
-      return presentedGeneralJSON;
-    });
-  }
-  // This function is for verifying the SD JWT
-  // If requiredClaimKeys is provided, it will check if the required claim keys are presentation in the SD JWT
-  // If requireKeyBindings is true, it will check if the key binding JWT is presentation and verify it
-  verify(generalJSON, options) {
-    return __async(this, null, function* () {
-      var _a;
-      if (!this.userConfig.hasher) {
-        throw new SDJWTException("Hasher not found");
-      }
-      const hasher = this.userConfig.hasher;
-      const { payload, headers } = yield this.validate(generalJSON, options);
-      const encodedSDJwt = generalJSON.toEncoded(0);
-      const sdjwt = yield SDJwt.fromEncode(encodedSDJwt, hasher);
-      if (!((_a = sdjwt.jwt) == null ? void 0 : _a.payload)) {
-        throw new SDJWTException("Invalid SD JWT");
-      }
-      if (options == null ? void 0 : options.requiredClaimKeys) {
-        const keys = yield sdjwt.keys(hasher);
-        const missingKeys = options == null ? void 0 : options.requiredClaimKeys.filter(
-          (k) => !keys.includes(k)
-        );
-        if (missingKeys.length > 0) {
-          throw new SDJWTException(
-            `Missing required claim keys: ${missingKeys.join(", ")}`
-          );
-        }
-      }
-      if (!(options == null ? void 0 : options.keyBindingNonce)) {
-        return { payload, headers };
-      }
-      if (!sdjwt.kbJwt) {
-        throw new SDJWTException("Key Binding JWT not exist");
-      }
-      if (!this.userConfig.kbVerifier) {
-        throw new SDJWTException("Key Binding Verifier not found");
-      }
-      const kb = yield sdjwt.kbJwt.verifyKB({
-        verifier: this.userConfig.kbVerifier,
-        payload,
-        nonce: options.keyBindingNonce,
-        options
-      });
-      if (!kb) {
-        throw new Error("signature is not valid");
-      }
-      const sdHashfromKb = kb.payload.sd_hash;
-      const sdjwtWithoutKb = new SDJwt({
-        jwt: sdjwt.jwt,
-        disclosures: sdjwt.disclosures
-      });
-      const presentSdJwtWithoutKb = sdjwtWithoutKb.encodeSDJwt();
-      const sdHashStr = yield this.calculateSDHash(
-        presentSdJwtWithoutKb,
-        sdjwt,
-        hasher
-      );
-      if (sdHashStr !== sdHashfromKb) {
-        throw new SDJWTException("Invalid sd_hash in Key Binding JWT");
-      }
-      return { payload, headers, kb };
-    });
-  }
-  calculateSDHash(presentSdJwtWithoutKb, sdjwt, hasher) {
-    return __async(this, null, function* () {
-      var _a;
-      if (!((_a = sdjwt.jwt) == null ? void 0 : _a.payload)) {
-        throw new SDJWTException("Invalid SD JWT");
-      }
-      const { _sd_alg } = getSDAlgAndPayload(sdjwt.jwt.payload);
-      const sdHash = yield hasher(presentSdJwtWithoutKb, _sd_alg);
-      const sdHashStr = (0, import_identity_common.uint8ArrayToBase64Url)(sdHash);
-      return sdHashStr;
-    });
-  }
-  // This function is for validating the SD JWT
-  // Just checking signature and return its the claims
-  validate(generalJSON, options) {
-    return __async(this, null, function* () {
-      if (!this.userConfig.hasher) {
-        throw new SDJWTException("Hasher not found");
-      }
-      if (!this.userConfig.verifier) {
-        throw new SDJWTException("Verifier not found");
-      }
-      const hasher = this.userConfig.hasher;
-      const verifier = this.userConfig.verifier;
-      const { payload, signatures } = generalJSON;
-      const results = yield Promise.all(
-        signatures.map((s) => __async(this, null, function* () {
-          const { protected: encodedHeader, signature } = s;
-          const verified2 = yield verifier(
-            `${encodedHeader}.${payload}`,
-            signature,
-            __spreadProps(__spreadValues({}, options), { skipJwtClaimValidation: true })
-          );
-          const header = decodeBase64urlJsonStrict(
-            encodedHeader,
-            "Invalid JWT"
-          );
-          if (typeof header.alg !== "string" || header.alg === "none") {
-            throw new SDJWTException('Verify Error: alg "none" is not allowed');
-          }
-          if ((options == null ? void 0 : options.allowedIssuerAlgorithms) && !options.allowedIssuerAlgorithms.includes(header.alg)) {
-            throw new SDJWTException(
-              `Verify Error: Disallowed alg ${header.alg}`
-            );
-          }
-          return { verified: verified2, header };
-        }))
-      );
-      const verified = results.every((r) => r.verified);
-      if (!verified) {
-        throw new SDJWTException("Signature is not valid");
-      }
-      const encodedSDJwt = generalJSON.toEncoded(0);
-      const sdjwt = yield SDJwt.fromEncode(encodedSDJwt, hasher);
-      if (!sdjwt.jwt) {
-        throw new SDJWTException("Invalid SD JWT");
-      }
-      const claims = yield sdjwt.getClaims(hasher);
-      validateReservedFieldsInternal(claims);
-      validateJwtPayload(claims, options);
-      return { payload: claims, headers: results.map((r) => r.header) };
-    });
-  }
-  config(newConfig) {
-    this.userConfig = __spreadValues(__spreadValues({}, this.userConfig), newConfig);
-  }
-  encode(sdJwt, index) {
-    return sdJwt.toEncoded(index);
-  }
-  decode(endcodedSDJwt) {
-    return GeneralJSON.fromEncode(endcodedSDJwt);
-  }
-  keys(generalSdjwt) {
-    return __async(this, null, function* () {
-      if (!this.userConfig.hasher) {
-        throw new SDJWTException("Hasher not found");
-      }
-      const endcodedSDJwt = generalSdjwt.toEncoded(0);
-      const sdjwt = yield SDJwt.fromEncode(endcodedSDJwt, this.userConfig.hasher);
-      return sdjwt.keys(this.userConfig.hasher);
-    });
-  }
-  presentableKeys(generalSdjwt) {
-    return __async(this, null, function* () {
-      if (!this.userConfig.hasher) {
-        throw new SDJWTException("Hasher not found");
-      }
-      const endcodedSDJwt = generalSdjwt.toEncoded(0);
-      const sdjwt = yield SDJwt.fromEncode(endcodedSDJwt, this.userConfig.hasher);
-      return sdjwt.presentableKeys(this.userConfig.hasher);
-    });
-  }
-  getClaims(generalSdjwt) {
-    return __async(this, null, function* () {
-      if (!this.userConfig.hasher) {
-        throw new SDJWTException("Hasher not found");
-      }
-      const endcodedSDJwt = generalSdjwt.toEncoded(0);
-      const sdjwt = yield SDJwt.fromEncode(endcodedSDJwt, this.userConfig.hasher);
-      return sdjwt.getClaims(this.userConfig.hasher);
-    });
-  }
-};
-SDJwtGeneralJSONInstance.DEFAULT_hashAlg = "sha-256";
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  DEFAULT_SECURE_HASH_ALGORITHMS,
-  Disclosure,
-  FlattenJSON,
-  GeneralJSON,
-  IANA_HASH_ALGORITHMS,
-  Jwt,
-  KBJwt,
-  KB_JWT_TYP,
-  SDJWTException,
-  SDJwt,
-  SDJwtGeneralJSONInstance,
-  SDJwtInstance,
-  SD_DECOY,
-  SD_DIGEST,
-  SD_LIST_KEY,
-  SD_SEPARATOR,
-  base64UrlToUint8Array,
-  base64urlDecode,
-  base64urlEncode,
-  createDecoy,
-  createHashMapping,
-  createHashMappingForSerializedDisclosure,
-  createHashMappingSync,
-  decodeJwt,
-  decodeSdJwt,
-  decodeSdJwtSync,
-  encodePath,
-  encodePathSegment,
-  ensureError,
-  getClaims,
-  getClaimsSync,
-  getSDAlgAndPayload,
-  listKeys,
-  pack,
-  present,
-  presentSync,
-  presentableKeys,
-  presentableKeysSync,
-  selectDisclosures,
-  splitSdJwt,
-  transformPresentationFrame,
-  uint8ArrayToBase64Url,
-  unpack,
-  unpackObj,
-  unpackSync,
-  validateJwtPayload
-});