@sd-jwt/sd-jwt-vc 0.7.2-next.0 → 0.7.2-next.10

package/CHANGELOG.md

@@ -3,6 +3,14 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [0.7.2](https://github.com/openwallet-foundation-labs/sd-jwt-js/compare/v0.7.1...v0.7.2) (2024-07-19)
+
+**Note:** Version bump only for package @sd-jwt/sd-jwt-vc
+
+
+
+
+
 ## [0.7.1](https://github.com/openwallet-foundation-labs/sd-jwt-js/compare/v0.7.0...v0.7.1) (2024-05-21)
 
 **Note:** Version bump only for package @sd-jwt/sd-jwt-vc

package/README.md

@@ -84,8 +84,28 @@ const verified = await sdjwt.verify(presentation);
 Check out more details in our [documentation](https://github.com/openwallet-foundation-labs/sd-jwt-js/tree/main/docs) or [examples](https://github.com/openwallet-foundation-labs/sd-jwt-js/tree/main/examples)
 
 ### Revocation
+
 To add revocation capabilities, you can use the `@sd-jwt/jwt-status-list` library to create a JWT Status List and include it in the SD-JWT-VC.
 
+### Type Metadata
+
+By setting the `loadTypeMetadataFormat` to `true` like this:
+
+```typescript
+const sdjwt = new SDJwtVcInstance({
+  signer,
+  signAlg: 'EdDSA',
+  verifier,
+  hasher: digest,
+  hashAlg: 'SHA-256',
+  saltGenerator: generateSalt,
+  loadTypeMetadataFormat: true,
+});
+```
+
+The library will load load the type metadata format based on the `vct` value according to the [SD-JWT-VC specification](https://www.ietf.org/archive/id/draft-ietf-oauth-sd-jwt-vc-04.html#name-type-metadata) and validate this schema.
+
+Since at this point the display is not yet implemented, the library will only validate the schema and return the type metadata format. In the future the values of the type metadata can be fetched via a function call.
 
 ### Dependencies
 

package/dist/index.d.mts

@@ -1,12 +1,32 @@
-import { SDJWTConfig, DisclosureFrame } from '@sd-jwt/types';
+import { SDJWTConfig, kbPayload, kbHeader, DisclosureFrame } from '@sd-jwt/types';
 import { SdJwtPayload, SDJwtInstance } from '@sd-jwt/core';
 
+/**
+ * https://www.ietf.org/archive/id/draft-ietf-oauth-sd-jwt-vc-04.html#name-type-metadata-format
+ */
+type TypeMetadataFormat = {
+    vct: string;
+    name?: string;
+    description?: string;
+    extends?: string;
+    'extends#Integrity'?: string;
+    schema?: object;
+    schema_uri?: string;
+    'schema_uri#Integrity'?: string;
+};
+
+type VcTFetcher = (uri: string, integrity?: string) => Promise<TypeMetadataFormat>;
+
+type StatusListFetcher = (uri: string) => Promise<string>;
+type StatusValidator = (status: number) => Promise<void>;
 /**
  * Configuration for SD-JWT-VC
  */
 type SDJWTVCConfig = SDJWTConfig & {
-    statusListFetcher?: (uri: string) => Promise<string>;
-    statusValidator?: (status: number) => Promise<void>;
+    statusListFetcher?: StatusListFetcher;
+    statusValidator?: StatusValidator;
+    vctFetcher?: VcTFetcher;
+    loadTypeMetadataFormat?: boolean;
 };
 
 interface SDJWTVCStatusReference {
@@ -22,11 +42,22 @@ interface SdJwtVcPayload extends SdJwtPayload {
     exp?: number;
     cnf?: unknown;
     vct: string;
+    'vct#Integrity'?: string;
     status?: SDJWTVCStatusReference;
     sub?: string;
     iat?: number;
 }
 
+type VerificationResult = {
+    payload: SdJwtVcPayload;
+    header: Record<string, unknown> | undefined;
+    kb: {
+        payload: kbPayload;
+        header: kbHeader;
+    } | undefined;
+    typeMetadataFormat?: TypeMetadataFormat;
+};
+
 declare class SDJwtVcInstance extends SDJwtInstance<SdJwtVcPayload> {
     /**
      * The type of the SD-JWT-VC set in the header.typ field.
@@ -52,12 +83,44 @@ declare class SDJwtVcInstance extends SDJwtInstance<SdJwtVcPayload> {
      */
     private statusValidator;
     /**
-     * Verifies the SD-JWT-VC.
+     * Verifies the SD-JWT-VC. It will validate the signature, the keybindings when required, the status, and the VCT.
+     */
+    verify(encodedSDJwt: string, requiredClaimKeys?: string[], requireKeyBindings?: boolean): Promise<VerificationResult>;
+    /**
+     * Default function to fetch the VCT from the uri. We assume that the vct is a URL that is used to fetch the VCT.
+     * @param uri
+     * @returns
+     */
+    private vctFetcher;
+    /**
+     * Validates the integrity of the response if the integrity is passed. If the integrity does not match, an error is thrown.
+     * @param integrity
+     * @param response
+     */
+    private validateIntegrity;
+    /**
+     * Fetches the content from the url with a timeout of 10 seconds.
+     * @param url
+     * @returns
+     */
+    private fetch;
+    /**
+     * Loads the schema either from the object or as fallback from the uri.
+     * @param typeMetadataFormat
+     * @returns
+     */
+    private loadSchema;
+    /**
+     * Verifies the VCT of the SD-JWT-VC. Returns the type metadata format. If the schema does not match, an error is thrown. If it matches, it will return the type metadata format.
+     * @param result
+     * @returns
+     */
+    private verifyVct;
+    /**
+     * Verifies the status of the SD-JWT-VC.
+     * @param result
      */
-    verify(encodedSDJwt: string, requiredClaimKeys?: string[], requireKeyBindings?: boolean): Promise<{
-        payload: SdJwtVcPayload;
-        header: Record<string, unknown> | undefined;
-    }>;
+    private verifyStatus;
 }
 
-export { type SDJWTVCConfig, type SDJWTVCStatusReference, SDJwtVcInstance, type SdJwtVcPayload };
+export { type SDJWTVCConfig, type SDJWTVCStatusReference, SDJwtVcInstance, type SdJwtVcPayload, type StatusListFetcher, type StatusValidator };

package/dist/index.d.ts

@@ -1,12 +1,32 @@
-import { SDJWTConfig, DisclosureFrame } from '@sd-jwt/types';
+import { SDJWTConfig, kbPayload, kbHeader, DisclosureFrame } from '@sd-jwt/types';
 import { SdJwtPayload, SDJwtInstance } from '@sd-jwt/core';
 
+/**
+ * https://www.ietf.org/archive/id/draft-ietf-oauth-sd-jwt-vc-04.html#name-type-metadata-format
+ */
+type TypeMetadataFormat = {
+    vct: string;
+    name?: string;
+    description?: string;
+    extends?: string;
+    'extends#Integrity'?: string;
+    schema?: object;
+    schema_uri?: string;
+    'schema_uri#Integrity'?: string;
+};
+
+type VcTFetcher = (uri: string, integrity?: string) => Promise<TypeMetadataFormat>;
+
+type StatusListFetcher = (uri: string) => Promise<string>;
+type StatusValidator = (status: number) => Promise<void>;
 /**
  * Configuration for SD-JWT-VC
  */
 type SDJWTVCConfig = SDJWTConfig & {
-    statusListFetcher?: (uri: string) => Promise<string>;
-    statusValidator?: (status: number) => Promise<void>;
+    statusListFetcher?: StatusListFetcher;
+    statusValidator?: StatusValidator;
+    vctFetcher?: VcTFetcher;
+    loadTypeMetadataFormat?: boolean;
 };
 
 interface SDJWTVCStatusReference {
@@ -22,11 +42,22 @@ interface SdJwtVcPayload extends SdJwtPayload {
     exp?: number;
     cnf?: unknown;
     vct: string;
+    'vct#Integrity'?: string;
     status?: SDJWTVCStatusReference;
     sub?: string;
     iat?: number;
 }
 
+type VerificationResult = {
+    payload: SdJwtVcPayload;
+    header: Record<string, unknown> | undefined;
+    kb: {
+        payload: kbPayload;
+        header: kbHeader;
+    } | undefined;
+    typeMetadataFormat?: TypeMetadataFormat;
+};
+
 declare class SDJwtVcInstance extends SDJwtInstance<SdJwtVcPayload> {
     /**
      * The type of the SD-JWT-VC set in the header.typ field.
@@ -52,12 +83,44 @@ declare class SDJwtVcInstance extends SDJwtInstance<SdJwtVcPayload> {
      */
     private statusValidator;
     /**
-     * Verifies the SD-JWT-VC.
+     * Verifies the SD-JWT-VC. It will validate the signature, the keybindings when required, the status, and the VCT.
+     */
+    verify(encodedSDJwt: string, requiredClaimKeys?: string[], requireKeyBindings?: boolean): Promise<VerificationResult>;
+    /**
+     * Default function to fetch the VCT from the uri. We assume that the vct is a URL that is used to fetch the VCT.
+     * @param uri
+     * @returns
+     */
+    private vctFetcher;
+    /**
+     * Validates the integrity of the response if the integrity is passed. If the integrity does not match, an error is thrown.
+     * @param integrity
+     * @param response
+     */
+    private validateIntegrity;
+    /**
+     * Fetches the content from the url with a timeout of 10 seconds.
+     * @param url
+     * @returns
+     */
+    private fetch;
+    /**
+     * Loads the schema either from the object or as fallback from the uri.
+     * @param typeMetadataFormat
+     * @returns
+     */
+    private loadSchema;
+    /**
+     * Verifies the VCT of the SD-JWT-VC. Returns the type metadata format. If the schema does not match, an error is thrown. If it matches, it will return the type metadata format.
+     * @param result
+     * @returns
+     */
+    private verifyVct;
+    /**
+     * Verifies the status of the SD-JWT-VC.
+     * @param result
      */
-    verify(encodedSDJwt: string, requiredClaimKeys?: string[], requireKeyBindings?: boolean): Promise<{
-        payload: SdJwtVcPayload;
-        header: Record<string, unknown> | undefined;
-    }>;
+    private verifyStatus;
 }
 
-export { type SDJWTVCConfig, type SDJWTVCStatusReference, SDJwtVcInstance, type SdJwtVcPayload };
+export { type SDJWTVCConfig, type SDJWTVCStatusReference, SDJwtVcInstance, type SdJwtVcPayload, type StatusListFetcher, type StatusValidator };

package/dist/index.js

@@ -1,4 +1,5 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -17,6 +18,14 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var __superGet = (cls, obj, key) => __reflectGet(__getProtoOf(cls), key, obj);
 var __async = (__this, __arguments, generator) => {
@@ -51,6 +60,8 @@ module.exports = __toCommonJS(src_exports);
 var import_core = require("@sd-jwt/core");
 var import_utils = require("@sd-jwt/utils");
 var import_jwt_status_list = require("@sd-jwt/jwt-status-list");
+var import_ajv = __toESM(require("ajv"));
+var import_ajv_formats = __toESM(require("ajv-formats"));
 var SDJwtVcInstance = class _SDJwtVcInstance extends import_core.SDJwtInstance {
   constructor(userConfig) {
     super(userConfig);
@@ -83,6 +94,7 @@ var SDJwtVcInstance = class _SDJwtVcInstance extends import_core.SDJwtInstance {
    */
   statusListFetcher(uri) {
     return __async(this, null, function* () {
+      var _a;
       const controller = new AbortController();
       const timeoutId = setTimeout(() => controller.abort(), 1e4);
       try {
@@ -95,7 +107,7 @@ var SDJwtVcInstance = class _SDJwtVcInstance extends import_core.SDJwtInstance {
             `Error fetching status list: ${response.status} ${yield response.text()}`
           );
         }
-        if (response.headers.get("content-type") !== "application/statuslist+jwt") {
+        if (!((_a = response.headers.get("content-type")) == null ? void 0 : _a.includes("application/statuslist+jwt"))) {
           throw new Error("Invalid content type");
         }
         return response.text();
@@ -117,17 +129,156 @@ var SDJwtVcInstance = class _SDJwtVcInstance extends import_core.SDJwtInstance {
     });
   }
   /**
-   * Verifies the SD-JWT-VC.
+   * Verifies the SD-JWT-VC. It will validate the signature, the keybindings when required, the status, and the VCT.
    */
   verify(encodedSDJwt, requiredClaimKeys, requireKeyBindings) {
     return __async(this, null, function* () {
-      var _a, _b, _c;
       const result = yield __superGet(_SDJwtVcInstance.prototype, this, "verify").call(this, encodedSDJwt, requiredClaimKeys, requireKeyBindings).then((res) => {
-        return { payload: res.payload, header: res.header };
+        return {
+          payload: res.payload,
+          header: res.header,
+          kb: res.kb
+        };
+      });
+      yield this.verifyStatus(result);
+      if (this.userConfig.loadTypeMetadataFormat) {
+        yield this.verifyVct(result);
+      }
+      return result;
+    });
+  }
+  /**
+   * Default function to fetch the VCT from the uri. We assume that the vct is a URL that is used to fetch the VCT.
+   * @param uri
+   * @returns
+   */
+  vctFetcher(uri, integrity) {
+    return __async(this, null, function* () {
+      const elements = uri.split("/");
+      elements.splice(3, 0, ".well-known/vct");
+      const url = elements.join("/");
+      return this.fetch(url, integrity);
+    });
+  }
+  /**
+   * Validates the integrity of the response if the integrity is passed. If the integrity does not match, an error is thrown.
+   * @param integrity
+   * @param response
+   */
+  validateIntegrity(response, url, integrity) {
+    return __async(this, null, function* () {
+      if (integrity) {
+        const arrayBuffer = yield response.arrayBuffer();
+        const alg = integrity.split("-")[0];
+        const hashBuffer = yield this.userConfig.hasher(
+          arrayBuffer,
+          alg
+        );
+        const integrityHash = integrity.split("-")[1];
+        const hash = Array.from(new Uint8Array(hashBuffer)).map((byte) => byte.toString(16).padStart(2, "0")).join("");
+        if (hash !== integrityHash) {
+          throw new Error(
+            `Integrity check for ${url} failed: is ${hash}, but expected ${integrityHash}`
+          );
+        }
+      }
+    });
+  }
+  /**
+   * Fetches the content from the url with a timeout of 10 seconds.
+   * @param url
+   * @returns
+   */
+  fetch(url, integrity) {
+    return __async(this, null, function* () {
+      const controller = new AbortController();
+      const timeoutId = setTimeout(() => controller.abort(), 1e4);
+      try {
+        const response = yield fetch(url, {
+          signal: controller.signal
+        });
+        if (!response.ok) {
+          throw new Error(yield response.text());
+        }
+        yield this.validateIntegrity(response.clone(), url, integrity);
+        return response.json();
+      } finally {
+        clearTimeout(timeoutId);
+      }
+    });
+  }
+  /**
+   * Loads the schema either from the object or as fallback from the uri.
+   * @param typeMetadataFormat
+   * @returns
+   */
+  loadSchema(typeMetadataFormat) {
+    return __async(this, null, function* () {
+      if (typeMetadataFormat.schema)
+        return typeMetadataFormat.schema;
+      if (typeMetadataFormat.schema_uri) {
+        const schema = yield this.fetch(
+          typeMetadataFormat.schema_uri,
+          typeMetadataFormat["schema_uri#Integrity"]
+        );
+        return schema;
+      }
+      throw new Error("No schema or schema_uri found");
+    });
+  }
+  /**
+   * Verifies the VCT of the SD-JWT-VC. Returns the type metadata format. If the schema does not match, an error is thrown. If it matches, it will return the type metadata format.
+   * @param result
+   * @returns
+   */
+  verifyVct(result) {
+    return __async(this, null, function* () {
+      var _a;
+      const fetcher = (_a = this.userConfig.vctFetcher) != null ? _a : this.vctFetcher.bind(this);
+      const typeMetadataFormat = yield fetcher(
+        result.payload.vct,
+        result.payload["vct#Integrity"]
+      );
+      if (typeMetadataFormat.extends) {
+      }
+      const schema = yield this.loadSchema(typeMetadataFormat);
+      const loadedSchemas = /* @__PURE__ */ new Set();
+      const ajv = new import_ajv.default({
+        loadSchema: (uri) => __async(this, null, function* () {
+          if (loadedSchemas.has(uri)) {
+            return {};
+          }
+          const response = yield fetch(uri);
+          if (!response.ok) {
+            throw new Error(
+              `Error fetching schema: ${response.status} ${yield response.text()}`
+            );
+          }
+          loadedSchemas.add(uri);
+          return response.json();
+        })
       });
+      (0, import_ajv_formats.default)(ajv);
+      const validate = yield ajv.compileAsync(schema);
+      const valid = validate(result.payload);
+      if (!valid) {
+        throw new import_utils.SDJWTException(
+          `Payload does not match the schema: ${JSON.stringify(validate.errors)}`
+        );
+      }
+      return typeMetadataFormat;
+    });
+  }
+  /**
+   * Verifies the status of the SD-JWT-VC.
+   * @param result
+   */
+  verifyStatus(result) {
+    return __async(this, null, function* () {
+      var _a, _b, _c;
       if (result.payload.status) {
         if (result.payload.status.status_list) {
-          const fetcher = (_a = this.userConfig.statusListFetcher) != null ? _a : this.statusListFetcher;
+          const fetcher = (_a = this.userConfig.statusListFetcher) != null ? _a : this.statusListFetcher.bind(this);
           const statusListJWT = yield fetcher(
             result.payload.status.status_list.uri
           );
@@ -140,11 +291,10 @@ var SDJwtVcInstance = class _SDJwtVcInstance extends import_core.SDJwtInstance {
           const status = statusList.getStatus(
             result.payload.status.status_list.idx
           );
-          const statusValidator = (_c = this.userConfig.statusValidator) != null ? _c : this.statusValidator;
+          const statusValidator = (_c = this.userConfig.statusValidator) != null ? _c : this.statusValidator.bind(this);
           yield statusValidator(status);
         }
       }
-      return result;
     });
   }
 };

package/dist/index.mjs

@@ -28,6 +28,8 @@ import { SDJWTException } from "@sd-jwt/utils";
 import {
   getListFromStatusListJWT
 } from "@sd-jwt/jwt-status-list";
+import Ajv from "ajv";
+import addFormats from "ajv-formats";
 var SDJwtVcInstance = class _SDJwtVcInstance extends SDJwtInstance {
   constructor(userConfig) {
     super(userConfig);
@@ -60,6 +62,7 @@ var SDJwtVcInstance = class _SDJwtVcInstance extends SDJwtInstance {
    */
   statusListFetcher(uri) {
     return __async(this, null, function* () {
+      var _a;
       const controller = new AbortController();
       const timeoutId = setTimeout(() => controller.abort(), 1e4);
       try {
@@ -72,7 +75,7 @@ var SDJwtVcInstance = class _SDJwtVcInstance extends SDJwtInstance {
             `Error fetching status list: ${response.status} ${yield response.text()}`
           );
         }
-        if (response.headers.get("content-type") !== "application/statuslist+jwt") {
+        if (!((_a = response.headers.get("content-type")) == null ? void 0 : _a.includes("application/statuslist+jwt"))) {
           throw new Error("Invalid content type");
         }
         return response.text();
@@ -94,17 +97,156 @@ var SDJwtVcInstance = class _SDJwtVcInstance extends SDJwtInstance {
     });
   }
   /**
-   * Verifies the SD-JWT-VC.
+   * Verifies the SD-JWT-VC. It will validate the signature, the keybindings when required, the status, and the VCT.
    */
   verify(encodedSDJwt, requiredClaimKeys, requireKeyBindings) {
     return __async(this, null, function* () {
-      var _a, _b, _c;
       const result = yield __superGet(_SDJwtVcInstance.prototype, this, "verify").call(this, encodedSDJwt, requiredClaimKeys, requireKeyBindings).then((res) => {
-        return { payload: res.payload, header: res.header };
+        return {
+          payload: res.payload,
+          header: res.header,
+          kb: res.kb
+        };
+      });
+      yield this.verifyStatus(result);
+      if (this.userConfig.loadTypeMetadataFormat) {
+        yield this.verifyVct(result);
+      }
+      return result;
+    });
+  }
+  /**
+   * Default function to fetch the VCT from the uri. We assume that the vct is a URL that is used to fetch the VCT.
+   * @param uri
+   * @returns
+   */
+  vctFetcher(uri, integrity) {
+    return __async(this, null, function* () {
+      const elements = uri.split("/");
+      elements.splice(3, 0, ".well-known/vct");
+      const url = elements.join("/");
+      return this.fetch(url, integrity);
+    });
+  }
+  /**
+   * Validates the integrity of the response if the integrity is passed. If the integrity does not match, an error is thrown.
+   * @param integrity
+   * @param response
+   */
+  validateIntegrity(response, url, integrity) {
+    return __async(this, null, function* () {
+      if (integrity) {
+        const arrayBuffer = yield response.arrayBuffer();
+        const alg = integrity.split("-")[0];
+        const hashBuffer = yield this.userConfig.hasher(
+          arrayBuffer,
+          alg
+        );
+        const integrityHash = integrity.split("-")[1];
+        const hash = Array.from(new Uint8Array(hashBuffer)).map((byte) => byte.toString(16).padStart(2, "0")).join("");
+        if (hash !== integrityHash) {
+          throw new Error(
+            `Integrity check for ${url} failed: is ${hash}, but expected ${integrityHash}`
+          );
+        }
+      }
+    });
+  }
+  /**
+   * Fetches the content from the url with a timeout of 10 seconds.
+   * @param url
+   * @returns
+   */
+  fetch(url, integrity) {
+    return __async(this, null, function* () {
+      const controller = new AbortController();
+      const timeoutId = setTimeout(() => controller.abort(), 1e4);
+      try {
+        const response = yield fetch(url, {
+          signal: controller.signal
+        });
+        if (!response.ok) {
+          throw new Error(yield response.text());
+        }
+        yield this.validateIntegrity(response.clone(), url, integrity);
+        return response.json();
+      } finally {
+        clearTimeout(timeoutId);
+      }
+    });
+  }
+  /**
+   * Loads the schema either from the object or as fallback from the uri.
+   * @param typeMetadataFormat
+   * @returns
+   */
+  loadSchema(typeMetadataFormat) {
+    return __async(this, null, function* () {
+      if (typeMetadataFormat.schema)
+        return typeMetadataFormat.schema;
+      if (typeMetadataFormat.schema_uri) {
+        const schema = yield this.fetch(
+          typeMetadataFormat.schema_uri,
+          typeMetadataFormat["schema_uri#Integrity"]
+        );
+        return schema;
+      }
+      throw new Error("No schema or schema_uri found");
+    });
+  }
+  /**
+   * Verifies the VCT of the SD-JWT-VC. Returns the type metadata format. If the schema does not match, an error is thrown. If it matches, it will return the type metadata format.
+   * @param result
+   * @returns
+   */
+  verifyVct(result) {
+    return __async(this, null, function* () {
+      var _a;
+      const fetcher = (_a = this.userConfig.vctFetcher) != null ? _a : this.vctFetcher.bind(this);
+      const typeMetadataFormat = yield fetcher(
+        result.payload.vct,
+        result.payload["vct#Integrity"]
+      );
+      if (typeMetadataFormat.extends) {
+      }
+      const schema = yield this.loadSchema(typeMetadataFormat);
+      const loadedSchemas = /* @__PURE__ */ new Set();
+      const ajv = new Ajv({
+        loadSchema: (uri) => __async(this, null, function* () {
+          if (loadedSchemas.has(uri)) {
+            return {};
+          }
+          const response = yield fetch(uri);
+          if (!response.ok) {
+            throw new Error(
+              `Error fetching schema: ${response.status} ${yield response.text()}`
+            );
+          }
+          loadedSchemas.add(uri);
+          return response.json();
+        })
       });
+      addFormats(ajv);
+      const validate = yield ajv.compileAsync(schema);
+      const valid = validate(result.payload);
+      if (!valid) {
+        throw new SDJWTException(
+          `Payload does not match the schema: ${JSON.stringify(validate.errors)}`
+        );
+      }
+      return typeMetadataFormat;
+    });
+  }
+  /**
+   * Verifies the status of the SD-JWT-VC.
+   * @param result
+   */
+  verifyStatus(result) {
+    return __async(this, null, function* () {
+      var _a, _b, _c;
       if (result.payload.status) {
         if (result.payload.status.status_list) {
-          const fetcher = (_a = this.userConfig.statusListFetcher) != null ? _a : this.statusListFetcher;
+          const fetcher = (_a = this.userConfig.statusListFetcher) != null ? _a : this.statusListFetcher.bind(this);
           const statusListJWT = yield fetcher(
             result.payload.status.status_list.uri
           );
@@ -117,11 +259,10 @@ var SDJwtVcInstance = class _SDJwtVcInstance extends SDJwtInstance {
           const status = statusList.getStatus(
             result.payload.status.status_list.idx
           );
-          const statusValidator = (_c = this.userConfig.statusValidator) != null ? _c : this.statusValidator;
+          const statusValidator = (_c = this.userConfig.statusValidator) != null ? _c : this.statusValidator.bind(this);
           yield statusValidator(status);
         }
       }
-      return result;
     });
   }
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sd-jwt/sd-jwt-vc",
-  "version": "0.7.2-next.0+5f57edc",
+  "version": "0.7.2-next.10+a1474fd",
   "description": "sd-jwt draft 7 implementation in typescript",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -15,7 +15,7 @@
     "build": "rm -rf **/dist && tsup",
     "lint": "biome lint ./src",
     "test": "pnpm run test:node && pnpm run test:browser && pnpm run test:e2e && pnpm run test:cov",
-    "test:node": "vitest run ./src/test/*.spec.ts && vitest run ./src/test/*.spec.ts --environment jsdom",
+    "test:node": "vitest run ./src/test/*.spec.ts",
     "test:browser": "vitest run ./src/test/*.spec.ts --environment jsdom",
     "test:e2e": "vitest run ./test/*e2e.spec.ts --environment node",
     "test:cov": "vitest run --coverage"
@@ -39,14 +39,17 @@
   },
   "license": "Apache-2.0",
   "dependencies": {
-    "@sd-jwt/core": "0.7.2-next.0+5f57edc",
-    "@sd-jwt/jwt-status-list": "0.7.2-next.0+5f57edc",
-    "@sd-jwt/utils": "0.7.2-next.0+5f57edc"
+    "@sd-jwt/core": "0.7.2-next.10+a1474fd",
+    "@sd-jwt/jwt-status-list": "0.7.2-next.10+a1474fd",
+    "@sd-jwt/utils": "0.7.2-next.10+a1474fd",
+    "ajv": "^8.17.1",
+    "ajv-formats": "^3.0.1"
   },
   "devDependencies": {
-    "@sd-jwt/crypto-nodejs": "0.7.2-next.0+5f57edc",
-    "@sd-jwt/types": "0.7.2-next.0+5f57edc",
-    "jose": "^5.2.2"
+    "@sd-jwt/crypto-nodejs": "0.7.2-next.10+a1474fd",
+    "@sd-jwt/types": "0.7.2-next.10+a1474fd",
+    "jose": "^5.2.2",
+    "msw": "^2.3.5"
   },
   "publishConfig": {
     "access": "public"
@@ -64,5 +67,5 @@
       "esm"
     ]
   },
-  "gitHead": "5f57edcee454c51a4dd2e34bcd845a54554ee2b3"
+  "gitHead": "a1474fde96ce566138c08dd548a0d7a4a0984158"
 }

package/src/sd-jwt-vc-config.ts

@@ -1,11 +1,19 @@
 import type { SDJWTConfig } from '@sd-jwt/types';
+import type { VcTFetcher } from './sd-jwt-vc-vct';
+
+export type StatusListFetcher = (uri: string) => Promise<string>;
+export type StatusValidator = (status: number) => Promise<void>;
 
 /**
  * Configuration for SD-JWT-VC
  */
 export type SDJWTVCConfig = SDJWTConfig & {
   // A function that fetches the status list from the uri. If not provided, the library will assume that the response is a compact JWT.
-  statusListFetcher?: (uri: string) => Promise<string>;
+  statusListFetcher?: StatusListFetcher;
   // validte the status and decide if the status is valid or not. If not provided, the code will continue if it is 0, otherwise it will throw an error.
-  statusValidator?: (status: number) => Promise<void>;
+  statusValidator?: StatusValidator;
+  // a function that fetches the type metadata format from the uri. If not provided, the library will assume that the response is a TypeMetadataFormat. Caching has to be implemented in this function. If the integrity value is passed, it to be validated according to https://www.w3.org/TR/SRI/
+  vctFetcher?: VcTFetcher;
+  // if set to true, it will load the metadata format based on the vct value. If not provided, it will default to false.
+  loadTypeMetadataFormat?: boolean;
 };

package/src/sd-jwt-vc-instance.ts

@@ -1,13 +1,23 @@
 import { Jwt, SDJwtInstance } from '@sd-jwt/core';
-import type { DisclosureFrame, Verifier } from '@sd-jwt/types';
+import type { DisclosureFrame, Hasher, Verifier } from '@sd-jwt/types';
 import { SDJWTException } from '@sd-jwt/utils';
 import type { SdJwtVcPayload } from './sd-jwt-vc-payload';
-import type { SDJWTVCConfig } from './sd-jwt-vc-config';
+import type {
+  SDJWTVCConfig,
+  StatusListFetcher,
+  StatusValidator,
+} from './sd-jwt-vc-config';
 import {
   type StatusListJWTPayload,
   getListFromStatusListJWT,
+  type StatusListJWTHeaderParameters,
 } from '@sd-jwt/jwt-status-list';
-import type { StatusListJWTHeaderParameters } from '@sd-jwt/jwt-status-list';
+import type { TypeMetadataFormat } from './sd-jwt-vc-type-metadata-format';
+import Ajv, { type SchemaObject } from 'ajv';
+import type { VerificationResult } from './verification-result';
+import addFormats from 'ajv-formats';
+import type { VcTFetcher } from './sd-jwt-vc-vct';
+
 export class SDJwtVcInstance extends SDJwtInstance<SdJwtVcPayload> {
   /**
    * The type of the SD-JWT-VC set in the header.typ field.
@@ -71,7 +81,9 @@ export class SDJwtVcInstance extends SDJwtInstance<SdJwtVcPayload> {
 
       // according to the spec the content type should be application/statuslist+jwt
       if (
-        response.headers.get('content-type') !== 'application/statuslist+jwt'
+        !response.headers
+          .get('content-type')
+          ?.includes('application/statuslist+jwt')
       ) {
         throw new Error('Invalid content type');
       }
@@ -93,7 +105,7 @@ export class SDJwtVcInstance extends SDJwtInstance<SdJwtVcPayload> {
   }
 
   /**
-   * Verifies the SD-JWT-VC.
+   * Verifies the SD-JWT-VC. It will validate the signature, the keybindings when required, the status, and the VCT.
    */
   async verify(
     encodedSDJwt: string,
@@ -101,18 +113,177 @@ export class SDJwtVcInstance extends SDJwtInstance<SdJwtVcPayload> {
     requireKeyBindings?: boolean,
   ) {
     // Call the parent class's verify method
-    const result = await super
+    const result: VerificationResult = await super
       .verify(encodedSDJwt, requiredClaimKeys, requireKeyBindings)
       .then((res) => {
-        return { payload: res.payload as SdJwtVcPayload, header: res.header };
+        return {
+          payload: res.payload as SdJwtVcPayload,
+          header: res.header,
+          kb: res.kb,
+        };
       });
 
+    await this.verifyStatus(result);
+    if (this.userConfig.loadTypeMetadataFormat) {
+      await this.verifyVct(result);
+    }
+    return result;
+  }
+
+  /**
+   * Default function to fetch the VCT from the uri. We assume that the vct is a URL that is used to fetch the VCT.
+   * @param uri
+   * @returns
+   */
+  private async vctFetcher(
+    uri: string,
+    integrity?: string,
+  ): Promise<TypeMetadataFormat> {
+    // modify the uri based on https://www.ietf.org/archive/id/draft-ietf-oauth-sd-jwt-vc-04.html#section-6.3.1
+    const elements = uri.split('/');
+    //insert a new element on the thrid position, but not replace it
+    elements.splice(3, 0, '.well-known/vct');
+    const url = elements.join('/');
+    return this.fetch<TypeMetadataFormat>(url, integrity);
+  }
+
+  /**
+   * Validates the integrity of the response if the integrity is passed. If the integrity does not match, an error is thrown.
+   * @param integrity
+   * @param response
+   */
+  private async validateIntegrity(
+    response: Response,
+    url: string,
+    integrity?: string,
+  ) {
+    if (integrity) {
+      // validate the integrity of the response according to https://www.w3.org/TR/SRI/
+      const arrayBuffer = await response.arrayBuffer();
+      const alg = integrity.split('-')[0];
+      //TODO: error handling when a hasher is passed that is not supporting the required algorithm acording to the spec
+      const hashBuffer = await (this.userConfig.hasher as Hasher)(
+        arrayBuffer,
+        alg,
+      );
+      const integrityHash = integrity.split('-')[1];
+      const hash = Array.from(new Uint8Array(hashBuffer))
+        .map((byte) => byte.toString(16).padStart(2, '0'))
+        .join('');
+      if (hash !== integrityHash) {
+        throw new Error(
+          `Integrity check for ${url} failed: is ${hash}, but expected ${integrityHash}`,
+        );
+      }
+    }
+  }
+
+  /**
+   * Fetches the content from the url with a timeout of 10 seconds.
+   * @param url
+   * @returns
+   */
+  private async fetch<T>(url: string, integrity?: string) {
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), 10000);
+    try {
+      const response = await fetch(url, {
+        signal: controller.signal,
+      });
+      if (!response.ok) {
+        throw new Error(await response.text());
+      }
+      await this.validateIntegrity(response.clone(), url, integrity);
+      return response.json() as Promise<T>;
+    } finally {
+      clearTimeout(timeoutId);
+    }
+  }
+
+  /**
+   * Loads the schema either from the object or as fallback from the uri.
+   * @param typeMetadataFormat
+   * @returns
+   */
+  private async loadSchema(typeMetadataFormat: TypeMetadataFormat) {
+    //if schema is present, return it
+    if (typeMetadataFormat.schema) return typeMetadataFormat.schema;
+    if (typeMetadataFormat.schema_uri) {
+      const schema = await this.fetch<SchemaObject>(
+        typeMetadataFormat.schema_uri,
+        typeMetadataFormat['schema_uri#Integrity'],
+      );
+      return schema;
+    }
+    throw new Error('No schema or schema_uri found');
+  }
+
+  /**
+   * Verifies the VCT of the SD-JWT-VC. Returns the type metadata format. If the schema does not match, an error is thrown. If it matches, it will return the type metadata format.
+   * @param result
+   * @returns
+   */
+  private async verifyVct(
+    result: VerificationResult,
+  ): Promise<TypeMetadataFormat | undefined> {
+    const fetcher: VcTFetcher =
+      this.userConfig.vctFetcher ?? this.vctFetcher.bind(this);
+    const typeMetadataFormat = await fetcher(
+      result.payload.vct,
+      result.payload['vct#Integrity'],
+    );
+
+    if (typeMetadataFormat.extends) {
+      // implement based on https://www.ietf.org/archive/id/draft-ietf-oauth-sd-jwt-vc-04.html#name-extending-type-metadata
+      //TODO: needs to be implemented. Unclear at this point which values will overwrite the values from the extended type metadata format
+    }
+
+    //init the json schema validator, load referenced schemas on demand
+    const schema = await this.loadSchema(typeMetadataFormat);
+    const loadedSchemas = new Set<string>();
+    // init the json schema validator
+    const ajv = new Ajv({
+      loadSchema: async (uri: string) => {
+        if (loadedSchemas.has(uri)) {
+          return {};
+        }
+        const response = await fetch(uri);
+        if (!response.ok) {
+          throw new Error(
+            `Error fetching schema: ${
+              response.status
+            } ${await response.text()}`,
+          );
+        }
+        loadedSchemas.add(uri);
+        return response.json();
+      },
+    });
+    addFormats(ajv);
+    const validate = await ajv.compileAsync(schema);
+    const valid = validate(result.payload);
+
+    if (!valid) {
+      throw new SDJWTException(
+        `Payload does not match the schema: ${JSON.stringify(validate.errors)}`,
+      );
+    }
+
+    return typeMetadataFormat;
+  }
+
+  /**
+   * Verifies the status of the SD-JWT-VC.
+   * @param result
+   */
+  private async verifyStatus(result: VerificationResult): Promise<void> {
     if (result.payload.status) {
       //checks if a status field is present in the payload based on https://www.ietf.org/archive/id/draft-ietf-oauth-status-list-02.html
       if (result.payload.status.status_list) {
         // fetch the status list from the uri
-        const fetcher =
-          this.userConfig.statusListFetcher ?? this.statusListFetcher;
+        const fetcher: StatusListFetcher =
+          this.userConfig.statusListFetcher ??
+          this.statusListFetcher.bind(this);
         // fetch the status list from the uri
         const statusListJWT = await fetcher(
           result.payload.status.status_list.uri,
@@ -140,12 +311,10 @@ export class SDJwtVcInstance extends SDJwtInstance<SdJwtVcPayload> {
         );
 
         // validate the status
-        const statusValidator =
-          this.userConfig.statusValidator ?? this.statusValidator;
+        const statusValidator: StatusValidator =
+          this.userConfig.statusValidator ?? this.statusValidator.bind(this);
         await statusValidator(status);
       }
     }
-
-    return result;
   }
 }

package/src/sd-jwt-vc-payload.ts

@@ -12,6 +12,8 @@ export interface SdJwtVcPayload extends SdJwtPayload {
   cnf?: unknown;
   // REQUIRED. The type of the Verifiable Credential, e.g., https://credentials.example.com/identity_credential, as defined in Section 3.2.2.1.1.
   vct: string;
+  // OPTIONAL. If passed, the loaded type metadata format has to be validated according to https://www.w3.org/TR/SRI/
+  'vct#Integrity'?: string;
   // OPTIONAL. The information on how to read the status of the Verifiable Credential. See [https://www.ietf.org/archive/id/draft-ietf-oauth-status-list-02.html] for more information.
   status?: SDJWTVCStatusReference;
   // OPTIONAL. The identifier of the Subject of the Verifiable Credential. The Issuer MAY use it to provide the Subject identifier known by the Issuer. There is no requirement for a binding to exist between sub and cnf claims.

package/src/sd-jwt-vc-type-metadata-format.ts

@@ -0,0 +1,13 @@
+/**
+ * https://www.ietf.org/archive/id/draft-ietf-oauth-sd-jwt-vc-04.html#name-type-metadata-format
+ */
+export type TypeMetadataFormat = {
+  vct: string; // REQUIRED. A URI that uniquely identifies the type. This URI MUST be dereferenceable to a JSON document that describes the type.
+  name?: string; // OPTIONAL. A human-readable name for the type, intended for developers reading the JSON document.
+  description?: string; // OPTIONAL. A human-readable description for the type, intended for developers reading the JSON document.
+  extends?: string; // OPTIONAL. A URI of another type that this type extends, as described in Section 6.4.
+  'extends#Integrity'?: string; // OPTIONAL. Validating the ingegrity of the extends field
+  schema?: object; // OPTIONAL. An embedded JSON Schema document describing the structure of the Verifiable Credential as described in Section 6.5.1. schema MUST NOT be used if schema_uri is present.
+  schema_uri?: string; // OPTIONAL. A URL pointing to a JSON Schema document describing the structure of the Verifiable Credential as described in Section 6.5.1. schema_uri MUST NOT be used if schema is present.
+  'schema_uri#Integrity'?: string; // OPTIONAL. Validating the integrity of the schema_uri field.
+};

package/src/sd-jwt-vc-vct.ts

@@ -0,0 +1,6 @@
+import type { TypeMetadataFormat } from './sd-jwt-vc-type-metadata-format';
+
+export type VcTFetcher = (
+  uri: string,
+  integrity?: string,
+) => Promise<TypeMetadataFormat>;

package/src/test/index.spec.ts

@@ -17,10 +17,13 @@ import {
 import { SignJWT } from 'jose';
 
 const iss = 'ExampleIssuer';
-const vct = 'https://example.com/schema/1';
+const vct = 'ExampleCredentialType';
 const iat = new Date().getTime() / 1000;
 
 const { privateKey, publicKey } = Crypto.generateKeyPairSync('ed25519');
+
+//TODO: to simulate a hosted status list, use the same appraoch as in vct.spec.ts
+
 const createSignerVerifier = () => {
   const signer: Signer = async (data: string) => {
     const sig = Crypto.sign(null, Buffer.from(data), privateKey);

package/src/test/vct.spec.ts

@@ -0,0 +1,128 @@
+import { digest, generateSalt } from '@sd-jwt/crypto-nodejs';
+import type { DisclosureFrame, Signer, Verifier } from '@sd-jwt/types';
+import { describe, test, beforeAll, afterAll } from 'vitest';
+import { SDJwtVcInstance } from '..';
+import type { SdJwtVcPayload } from '../sd-jwt-vc-payload';
+import Crypto from 'node:crypto';
+import { setupServer } from 'msw/node';
+import { HttpResponse, http } from 'msw';
+import { afterEach } from 'node:test';
+import type { TypeMetadataFormat } from '../sd-jwt-vc-type-metadata-format';
+
+const restHandlers = [
+  http.get('http://example.com/schema/example', () => {
+    const res = {
+      $schema: 'https://json-schema.org/draft/2020-12/schema',
+      type: 'object',
+      properties: {
+        vct: {
+          type: 'string',
+        },
+        iss: {
+          type: 'string',
+        },
+        nbf: {
+          type: 'number',
+        },
+        exp: {
+          type: 'number',
+        },
+        cnf: {
+          type: 'object',
+        },
+        status: {
+          type: 'object',
+        },
+        firstName: {
+          type: 'string',
+        },
+      },
+      required: ['iss', 'vct'],
+    };
+    return HttpResponse.json(res);
+  }),
+  http.get('http://exmaple.com/.well-known/vct/example', () => {
+    const res: TypeMetadataFormat = {
+      vct: 'http://example.com/example',
+      name: 'ExampleCredentialType',
+      description: 'An example credential type',
+      schema_uri: 'http://example.com/schema/example',
+      //this value could be generated on demand to make it easier when changing the values
+      'schema_uri#Integrity':
+        'sha256-48a61b283ded3b55e8d9a9b063327641dc4c53f76bd5daa96c23f232822167ae',
+    };
+    return HttpResponse.json(res);
+  }),
+];
+
+//this value could be generated on demand to make it easier when changing the values
+const vctIntegrity =
+  'sha256-96bed58130a44af05ae8970aa9caa0bf0135cd15afe721ea29f553394692acef';
+
+const server = setupServer(...restHandlers);
+
+const iss = 'ExampleIssuer';
+const vct = 'http://exmaple.com/example';
+const iat = new Date().getTime() / 1000;
+
+const { privateKey, publicKey } = Crypto.generateKeyPairSync('ed25519');
+
+const createSignerVerifier = () => {
+  const signer: Signer = async (data: string) => {
+    const sig = Crypto.sign(null, Buffer.from(data), privateKey);
+    return Buffer.from(sig).toString('base64url');
+  };
+  const verifier: Verifier = async (data: string, sig: string) => {
+    return Crypto.verify(
+      null,
+      Buffer.from(data),
+      publicKey,
+      Buffer.from(sig, 'base64url'),
+    );
+  };
+  return { signer, verifier };
+};
+
+describe('App', () => {
+  beforeAll(() => server.listen({ onUnhandledRequest: 'warn' }));
+
+  afterAll(() => server.close());
+
+  afterEach(() => server.resetHandlers());
+
+  test('VCT Validation', async () => {
+    const { signer, verifier } = createSignerVerifier();
+    const sdjwt = new SDJwtVcInstance({
+      signer,
+      signAlg: 'EdDSA',
+      verifier,
+      hasher: digest,
+      hashAlg: 'SHA-256',
+      saltGenerator: generateSalt,
+      loadTypeMetadataFormat: true,
+    });
+
+    const claims = {
+      firstname: 'John',
+    };
+    const disclosureFrame = {
+      _sd: ['firstname'],
+    };
+
+    const expectedPayload: SdJwtVcPayload = {
+      iat,
+      iss,
+      vct,
+      'vct#Integrity': vctIntegrity,
+      ...claims,
+    };
+    const encodedSdjwt = await sdjwt.issue(
+      expectedPayload,
+      disclosureFrame as unknown as DisclosureFrame<SdJwtVcPayload>,
+    );
+
+    await sdjwt.verify(encodedSdjwt);
+  });
+
+  //TODO: we need tests with an embedded schema, extended and maybe also to test the errors when schema information is not available or the integrity is not valid
+});

package/src/verification-result.ts

@@ -0,0 +1,15 @@
+import type { kbPayload, kbHeader } from '@sd-jwt/types';
+import type { SdJwtVcPayload } from './sd-jwt-vc-payload';
+import type { TypeMetadataFormat } from './sd-jwt-vc-type-metadata-format';
+
+export type VerificationResult = {
+  payload: SdJwtVcPayload;
+  header: Record<string, unknown> | undefined;
+  kb:
+    | {
+        payload: kbPayload;
+        header: kbHeader;
+      }
+    | undefined;
+  typeMetadataFormat?: TypeMetadataFormat;
+};

package/test/app-e2e.spec.ts

@@ -1,5 +1,5 @@
 import Crypto from 'node:crypto';
-import { SDJwtVcInstance, SdJwtVcPayload } from '../src/index';
+import { SDJwtVcInstance } from '../src/index';
 import type {
   DisclosureFrame,
   PresentationFrame,
@@ -29,7 +29,7 @@ const createSignerVerifier = () => {
 };
 
 const iss = 'ExampleIssuer';
-const vct = 'https://example.com/schema/1';
+const vct = 'ExampleCredentials';
 const iat = new Date().getTime() / 1000;
 
 describe('App', () => {
@@ -260,6 +260,7 @@ async function JSONtest(filename: string) {
   expect(verified).toBeDefined();
   expect(verified).toStrictEqual({
     header: { alg: 'EdDSA', typ: 'vc+sd-jwt' },
+    kb: undefined,
     payload,
   });
 }