@sd-jwt/sd-jwt-vc 0.19.1-next.8 → 0.20.0

package/CHANGELOG.md

@@ -0,0 +1,28 @@
+# Change Log
+
+All notable changes to this project will be documented in this file.
+See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
+
+# [0.20.0](https://github.com/openwallet-foundation/sd-jwt-js/compare/v0.1.0...v0.20.0) (2026-06-29)
+
+
+### Features
+
+* version fixing to current 0.19.0 ([#382](https://github.com/openwallet-foundation/sd-jwt-js/issues/382)) ([d88c631](https://github.com/openwallet-foundation/sd-jwt-js/commit/d88c631fe4c3cefcbc96f268cb9d340296facbba))
+
+
+
+
+
+# [0.1.0](https://github.com/openwallet-foundation/sd-jwt-js/compare/v0.19.0...v0.1.0) (2026-06-29)
+
+
+### Bug Fixes
+
+* **core:** reject tampered/unreferenced disclosures and reserved claims ([#380](https://github.com/openwallet-foundation/sd-jwt-js/issues/380)) ([3d8a72a](https://github.com/openwallet-foundation/sd-jwt-js/commit/3d8a72a0a279d67439db038c9c2b52621568b866))
+* **sd-jwt-vc:** config param type override in SDJwtVcInstance ([#379](https://github.com/openwallet-foundation/sd-jwt-js/issues/379)) ([fe18c35](https://github.com/openwallet-foundation/sd-jwt-js/commit/fe18c3572055c3307d05f43f738c1d3c3f15de38))
+
+
+### Features
+
+* allow disabling status verification ([#381](https://github.com/openwallet-foundation/sd-jwt-js/issues/381)) ([c9d73e4](https://github.com/openwallet-foundation/sd-jwt-js/commit/c9d73e4db2a925e5096988fffe7eded62db1b6a7))

package/dist/index.d.mts

@@ -986,10 +986,10 @@ declare class SDJwtVcInstance extends SDJwtInstance<SdJwtVcPayload> {
     protected userConfig: SDJWTVCConfig;
     constructor(userConfig?: SDJWTVCConfig);
     /**
-     * Validates if the disclosureFrame contains any reserved fields. If so it will throw an error.
+     * Validates if the disclosure frame attempts to selectively disclose protected SD-JWT-VC claims.
      * @param disclosureFrame
      */
-    protected validateReservedFields(disclosureFrame: DisclosureFrame<SdJwtVcPayload>): void;
+    protected validateDisclosureFrame(disclosureFrame?: DisclosureFrame<SdJwtVcPayload>): void;
     /**
      * Fetches the status list from the uri with a timeout of 10 seconds.
      * @param uri The URI to fetch from.
@@ -1100,6 +1100,7 @@ declare class SDJwtVcInstance extends SDJwtInstance<SdJwtVcPayload> {
      * @param options
      */
     private verifyStatus;
+    config(newConfig: SDJWTVCConfig): void;
 }
 
 export { type BackgroundImage, BackgroundImageSchema, type Claim, type ClaimDisplay, ClaimDisplaySchema, type ClaimPath, ClaimPathSchema, ClaimSchema, type ClaimSelectiveDisclosure, ClaimSelectiveDisclosureSchema, ColorSchemeSchema, ContrastSchema, type Display, DisplaySchema, type Logo, LogoSchema, OrientationSchema, type Rendering, RenderingSchema, type ResolvedTypeMetadata, type SDJWTVCConfig, type SDJWTVCStatusReference, SDJwtVcInstance, type SdJwtVcPayload, type SimpleRendering, SimpleRenderingSchema, type StatusListFetcher, type StatusValidator, type SvgTemplateProperties, SvgTemplatePropertiesSchema, type SvgTemplateRendering, SvgTemplateRenderingSchema, type TypeMetadataFormat, TypeMetadataFormatSchema, type VCTFetcher, type VerificationResult };

package/dist/index.d.ts

@@ -986,10 +986,10 @@ declare class SDJwtVcInstance extends SDJwtInstance<SdJwtVcPayload> {
     protected userConfig: SDJWTVCConfig;
     constructor(userConfig?: SDJWTVCConfig);
     /**
-     * Validates if the disclosureFrame contains any reserved fields. If so it will throw an error.
+     * Validates if the disclosure frame attempts to selectively disclose protected SD-JWT-VC claims.
      * @param disclosureFrame
      */
-    protected validateReservedFields(disclosureFrame: DisclosureFrame<SdJwtVcPayload>): void;
+    protected validateDisclosureFrame(disclosureFrame?: DisclosureFrame<SdJwtVcPayload>): void;
     /**
      * Fetches the status list from the uri with a timeout of 10 seconds.
      * @param uri The URI to fetch from.
@@ -1100,6 +1100,7 @@ declare class SDJwtVcInstance extends SDJwtInstance<SdJwtVcPayload> {
      * @param options
      */
     private verifyStatus;
+    config(newConfig: SDJWTVCConfig): void;
 }
 
 export { type BackgroundImage, BackgroundImageSchema, type Claim, type ClaimDisplay, ClaimDisplaySchema, type ClaimPath, ClaimPathSchema, ClaimSchema, type ClaimSelectiveDisclosure, ClaimSelectiveDisclosureSchema, ColorSchemeSchema, ContrastSchema, type Display, DisplaySchema, type Logo, LogoSchema, OrientationSchema, type Rendering, RenderingSchema, type ResolvedTypeMetadata, type SDJWTVCConfig, type SDJWTVCStatusReference, SDJwtVcInstance, type SdJwtVcPayload, type SimpleRendering, SimpleRenderingSchema, type StatusListFetcher, type StatusValidator, type SvgTemplateProperties, SvgTemplatePropertiesSchema, type SvgTemplateRendering, SvgTemplateRenderingSchema, type TypeMetadataFormat, TypeMetadataFormatSchema, type VCTFetcher, type VerificationResult };

package/dist/index.js

@@ -280,10 +280,10 @@ var SDJwtVcInstance = class _SDJwtVcInstance extends import_core.SDJwtInstance {
     }
   }
   /**
-   * Validates if the disclosureFrame contains any reserved fields. If so it will throw an error.
+   * Validates if the disclosure frame attempts to selectively disclose protected SD-JWT-VC claims.
    * @param disclosureFrame
    */
-  validateReservedFields(disclosureFrame) {
+  validateDisclosureFrame(disclosureFrame) {
     if ((disclosureFrame == null ? void 0 : disclosureFrame._sd) && Array.isArray(disclosureFrame._sd) && disclosureFrame._sd.length > 0) {
       const reservedNames = ["iss", "nbf", "exp", "cnf", "vct", "status"];
       const reservedNamesInDisclosureFrame = disclosureFrame._sd.filter(
@@ -716,6 +716,9 @@ ${import_zod2.default.prettifyError(validated.error)}`
   verifyStatus(result, options) {
     return __async(this, null, function* () {
       var _a, _b, _c;
+      if (options == null ? void 0 : options.disableStatusVerification) {
+        return;
+      }
       if (result.payload.status) {
         if (result.payload.status.status_list) {
           const fetcher = (_a = this.userConfig.statusListFetcher) != null ? _a : this.statusListFetcher.bind(this);
@@ -745,6 +748,9 @@ ${import_zod2.default.prettifyError(validated.error)}`
       }
     });
   }
+  config(newConfig) {
+    super.config(newConfig);
+  }
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/index.mjs

@@ -242,10 +242,10 @@ var SDJwtVcInstance = class _SDJwtVcInstance extends SDJwtInstance {
     }
   }
   /**
-   * Validates if the disclosureFrame contains any reserved fields. If so it will throw an error.
+   * Validates if the disclosure frame attempts to selectively disclose protected SD-JWT-VC claims.
    * @param disclosureFrame
    */
-  validateReservedFields(disclosureFrame) {
+  validateDisclosureFrame(disclosureFrame) {
     if ((disclosureFrame == null ? void 0 : disclosureFrame._sd) && Array.isArray(disclosureFrame._sd) && disclosureFrame._sd.length > 0) {
       const reservedNames = ["iss", "nbf", "exp", "cnf", "vct", "status"];
       const reservedNamesInDisclosureFrame = disclosureFrame._sd.filter(
@@ -678,6 +678,9 @@ ${z2.prettifyError(validated.error)}`
   verifyStatus(result, options) {
     return __async(this, null, function* () {
       var _a, _b, _c;
+      if (options == null ? void 0 : options.disableStatusVerification) {
+        return;
+      }
       if (result.payload.status) {
         if (result.payload.status.status_list) {
           const fetcher = (_a = this.userConfig.statusListFetcher) != null ? _a : this.statusListFetcher.bind(this);
@@ -707,6 +710,9 @@ ${z2.prettifyError(validated.error)}`
       }
     });
   }
+  config(newConfig) {
+    super.config(newConfig);
+  }
 };
 export {
   BackgroundImageSchema,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sd-jwt/sd-jwt-vc",
-  "version": "0.19.1-next.8+24addee",
+  "version": "0.20.0",
   "description": "sd-jwt draft 7 implementation in typescript",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -39,7 +39,7 @@
   "license": "Apache-2.0",
   "dependencies": {
     "@owf/token-status-list": "^0.1.0-alpha-20260312123226",
-    "@sd-jwt/core": "0.19.1-next.8+24addee",
+    "@sd-jwt/core": "0.20.0",
     "zod": "^4.3.5"
   },
   "devDependencies": {
@@ -63,5 +63,5 @@
       "esm"
     ]
   },
-  "gitHead": "24addee9fb8f5b12ac98b24b3ca527639b28c711"
+  "gitHead": "af170ace9b42984f8c6447caf23256fde6204b31"
 }

package/src/sd-jwt-vc-instance.ts

@@ -48,20 +48,18 @@ export class SDJwtVcInstance extends SDJwtInstance<SdJwtVcPayload> {
   }
 
   /**
-   * Validates if the disclosureFrame contains any reserved fields. If so it will throw an error.
+   * Validates if the disclosure frame attempts to selectively disclose protected SD-JWT-VC claims.
    * @param disclosureFrame
    */
-  protected validateReservedFields(
-    disclosureFrame: DisclosureFrame<SdJwtVcPayload>,
+  protected validateDisclosureFrame(
+    disclosureFrame?: DisclosureFrame<SdJwtVcPayload>,
   ): void {
-    //validate disclosureFrame according to https://www.ietf.org/archive/id/draft-ietf-oauth-sd-jwt-vc-08.html#section-3.2.2.2
     if (
       disclosureFrame?._sd &&
       Array.isArray(disclosureFrame._sd) &&
       disclosureFrame._sd.length > 0
     ) {
       const reservedNames = ['iss', 'nbf', 'exp', 'cnf', 'vct', 'status'];
-      // check if there is any reserved names in the disclosureFrame._sd array
       const reservedNamesInDisclosureFrame = disclosureFrame._sd.filter((key) =>
         reservedNames.includes(String(key)),
       );
@@ -625,6 +623,10 @@ export class SDJwtVcInstance extends SDJwtInstance<SdJwtVcPayload> {
     result: VerificationResult,
     options?: VerifierOptions,
   ): Promise<void> {
+    if (options?.disableStatusVerification) {
+      return;
+    }
+
     if (result.payload.status) {
       //checks if a status field is present in the payload based on https://www.ietf.org/archive/id/draft-ietf-oauth-status-list-02.html
       if (result.payload.status.status_list) {
@@ -670,4 +672,8 @@ export class SDJwtVcInstance extends SDJwtInstance<SdJwtVcPayload> {
       }
     }
   }
+
+  public config(newConfig: SDJWTVCConfig) {
+    super.config(newConfig);
+  }
 }

package/src/test/index.spec.ts

@@ -120,7 +120,7 @@ describe('Revocation', () => {
     },
   });
 
-  test('Test with a non revcoked credential', async () => {
+  test('Test with a non revoked credential', async () => {
     const claims = {
       firstname: 'John',
       status: {
@@ -152,6 +152,24 @@ describe('Revocation', () => {
     await expect(result).rejects.toThrowError('Status is not valid');
   });
 
+  test('Test with a revoked credential but status verification disabled', async () => {
+    const claims = {
+      firstname: 'John',
+      status: {
+        status_list: {
+          uri: 'https://example.com/status-list',
+          idx: 1,
+        },
+      },
+    };
+    const expectedPayload: SdJwtVcPayload = { iat, iss, vct, ...claims };
+    const encodedSdjwt = await sdjwt.issue(expectedPayload);
+    const result = await sdjwt.verify(encodedSdjwt, {
+      disableStatusVerification: true,
+    });
+    expect(result).toBeDefined();
+  });
+
   test('test to fetch the statuslist', async () => {
     //TODO: not implemented yet since we need to either mock the fetcher or use a real fetcher
   });