@solidus-network/sdk 0.1.0 → 0.3.0

package/dist/sdjwt/status-list.js

@@ -0,0 +1,63 @@
+/**
+ * Status list (draft-ietf-oauth-status-list) helper for issuers.
+ *
+ * The lifecycle:
+ *   1. Issuer creates a `StatusList` (a bitstring of N statuses,
+ *      typically 1 bit per credential — 0 = active, 1 = revoked).
+ *   2. Issuer wraps it in a JWT signed by the issuer's key, served at
+ *      a stable URL (e.g., `/status-lists/<id>`).
+ *   3. Each issued SD-JWT VC carries a `status.status_list.{uri, idx}`
+ *      pointing at one bit in the list.
+ *   4. To revoke a credential, the issuer flips its bit and republishes
+ *      the (now-updated) JWT at the same URL.
+ *   5. Verifiers refetch the list (cache-respecting) and check the bit.
+ *
+ * `createStatusListJwt` is a thin wrapper around `@sd-jwt/jwt-status-list`
+ * that uses Ed25519 / EdDSA to match the rest of Solidus's signing
+ * conventions.
+ */
+import * as ed from '@noble/ed25519';
+import { StatusList, createHeaderAndPayload, } from '@sd-jwt/jwt-status-list';
+function toBase64Url(bytes) {
+    return Buffer.from(bytes)
+        .toString('base64')
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=/g, '');
+}
+/**
+ * Build a signed status-list JWT.
+ *
+ * Returns the JWT in compact form. Issuers serve this at the URL
+ * embedded in their issued SD-JWT VCs' `status.status_list.uri` claim.
+ */
+export async function createStatusListJwt(params) {
+    if (params.issuerPrivateKey.length !== 32) {
+        throw new Error(`issuerPrivateKey must be 32 bytes, got ${params.issuerPrivateKey.length}`);
+    }
+    const bitsPerStatus = params.bitsPerStatus ?? 1;
+    const list = new StatusList(new Array(params.totalStatuses).fill(0), bitsPerStatus);
+    for (const entry of params.revoked ?? []) {
+        if (typeof entry === 'number') {
+            list.setStatus(entry, 1);
+        }
+        else {
+            list.setStatus(entry[0], entry[1]);
+        }
+    }
+    const now = Math.floor(Date.now() / 1000);
+    const basePayload = {
+        iss: params.issuer,
+        sub: params.uri,
+        iat: now,
+    };
+    if (params.ttlSeconds !== undefined)
+        basePayload['ttl'] = params.ttlSeconds;
+    const { header, payload } = createHeaderAndPayload(list, basePayload, { alg: 'EdDSA', typ: 'statuslist+jwt' });
+    const headerSegment = toBase64Url(new TextEncoder().encode(JSON.stringify(header)));
+    const payloadSegment = toBase64Url(new TextEncoder().encode(JSON.stringify(payload)));
+    const signingInput = `${headerSegment}.${payloadSegment}`;
+    const signature = await ed.signAsync(new TextEncoder().encode(signingInput), params.issuerPrivateKey);
+    return `${signingInput}.${toBase64Url(signature)}`;
+}
+//# sourceMappingURL=status-list.js.map

package/dist/sdjwt/status-list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-list.js","sourceRoot":"","sources":["../../src/sdjwt/status-list.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAA;AACpC,OAAO,EACL,UAAU,EACV,sBAAsB,GAEvB,MAAM,yBAAyB,CAAA;AAEhC,SAAS,WAAW,CAAC,KAAiB;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SACtB,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;AACtB,CAAC;AA2CD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAiC;IAEjC,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,0CAA0C,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAC3E,CAAA;IACH,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,CAAC,CAAA;IAC/C,MAAM,IAAI,GAAG,IAAI,UAAU,CACzB,IAAI,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EACvC,aAAa,CACd,CAAA;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;QAC1B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QACpC,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,MAAM,WAAW,GAA4B;QAC3C,GAAG,EAAE,MAAM,CAAC,MAAM;QAClB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,GAAG;KACT,CAAA;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;QAAE,WAAW,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,UAAU,CAAA;IAE3E,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,sBAAsB,CAChD,IAAI,EACJ,WAAoB,EACpB,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,gBAAgB,EAAE,CACxC,CAAA;IAED,MAAM,aAAa,GAAG,WAAW,CAC/B,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CACjD,CAAA;IACD,MAAM,cAAc,GAAG,WAAW,CAChC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAClD,CAAA;IACD,MAAM,YAAY,GAAG,GAAG,aAAa,IAAI,cAAc,EAAE,CAAA;IACzD,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,SAAS,CAClC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EACtC,MAAM,CAAC,gBAAgB,CACxB,CAAA;IACD,OAAO,GAAG,YAAY,IAAI,WAAW,CAAC,SAAS,CAAC,EAAE,CAAA;AACpD,CAAC"}

package/dist/sdjwt/types.d.ts

@@ -0,0 +1,181 @@
+/**
+ * Public interfaces for the SD-JWT VC integration.
+ *
+ * SD-JWT VC (draft-ietf-oauth-sd-jwt-vc) is one of two W3C VC formats
+ * accepted by the EUDI Wallet ARF; the other is ISO mDoc. This module
+ * exposes a thin, opinionated wrapper around `@sd-jwt/sd-jwt-vc` that
+ * matches Solidus's Ed25519 / DID conventions.
+ *
+ * For background, see `.claude/plans/2026-05-09-sdjwt-vc-implementation.md`.
+ */
+/** Parameters accepted by [`issueSdJwtVc`]. */
+export interface IssueSdJwtVcParams {
+    /**
+     * Issuer DID (e.g., `did:solidus:testnet:...`). Becomes the `iss` claim
+     * and surfaces the issuer's chain-resolved verification key to verifiers.
+     */
+    issuer: string;
+    /**
+     * Verifiable credential type — an opaque URN per SD-JWT VC §3.2.2.2.
+     * Use `https://docs.solidus.network/credentials/{type}` for Solidus
+     * native types, or any externally-defined URN for interop.
+     */
+    vct: string;
+    /**
+     * The credential subject. Typically `{ id: did, ...claims }`. The
+     * subject `id` is conventionally a holder DID; if absent, the SD-JWT
+     * is bearer.
+     */
+    subject: Record<string, unknown>;
+    /**
+     * Issuer's raw 32-byte Ed25519 private key. Same key material used
+     * elsewhere in Solidus (chain transactions, `@solidus-network/jwt`).
+     */
+    issuerPrivateKey: Uint8Array;
+    /**
+     * Subject-claim paths that should be disclosable. Each entry is
+     * either a top-level key (`'birthdate'`) or a dotted path into a
+     * nested object (`'address.street'`). If omitted, every top-level
+     * subject claim except `id` is disclosable; nested objects are not
+     * auto-expanded — pass explicit paths to selectively disclose them.
+     *
+     * @example ['birthdate', 'address.street', 'address.city']
+     */
+    disclosable?: string[];
+    /** RFC 3339 timestamp; sd-jwt-vc maps this to `nbf`. Defaults to now. */
+    validFrom?: string;
+    /** RFC 3339 timestamp; sd-jwt-vc maps this to `exp`. Optional. */
+    validUntil?: string;
+    /**
+     * Optional 32-byte Ed25519 public key of the *holder*. When provided,
+     * the issued SD-JWT embeds a `cnf.jwk` claim binding the credential
+     * to this key — required if the verifier is going to enforce a
+     * Key-Binding JWT at presentation time. Omit to issue a bearer
+     * credential (Phase 1 default).
+     */
+    holderPublicKey?: Uint8Array;
+    /**
+     * Optional reference into a status list (draft-ietf-oauth-status-list).
+     * When set, the issued SD-JWT carries `status: { status_list: { uri,
+     * idx } }`; verifiers that supply a `statusListFetcher` will fetch
+     * the list, look up bit `idx`, and reject the credential if the
+     * status indicates revocation.
+     */
+    status?: {
+        uri: string;
+        idx: number;
+    };
+}
+/**
+ * The compact-serialised SD-JWT VC, plus metadata. The `compact` field
+ * is the wire format consumed by holders and verifiers:
+ * `<jws>~<disclosure1>~<disclosure2>~`.
+ */
+export interface IssuedSdJwtVc {
+    /** Compact-serialised SD-JWT VC: `<jws>~<d1>~...~`. */
+    compact: string;
+    /** Decoded JWS payload (claims minus the disclosed-but-hashed values). */
+    payload: Record<string, unknown>;
+    /** Number of disclosable claims encoded. */
+    disclosureCount: number;
+}
+/** Parameters accepted by [`verifySdJwtVc`]. */
+export interface VerifySdJwtVcParams {
+    /** Compact-serialised SD-JWT VC. */
+    compact: string;
+    /**
+     * Issuer's raw 32-byte Ed25519 *public* key. In production the
+     * verifier resolves this from the issuer DID's chain document; this
+     * Phase-1 API takes the key explicitly to keep the module decoupled
+     * from the chain client.
+     */
+    issuerPublicKey: Uint8Array;
+    /**
+     * If provided, the verifier requires a valid Key-Binding JWT and
+     * checks the KB-JWT's `aud` claim against this value. Use this to
+     * stop a stolen presentation from being replayed against a different
+     * verifier.
+     */
+    expectedAudience?: string;
+    /**
+     * If provided, the verifier requires a valid Key-Binding JWT and
+     * checks the KB-JWT's `nonce` claim against this value. The verifier
+     * is responsible for generating a fresh nonce per presentation
+     * request and remembering it for the duration of the round-trip.
+     */
+    expectedNonce?: string;
+    /**
+     * Callback that fetches the status-list JWT at a given URI. Required
+     * to enable revocation checking; if absent the verifier skips the
+     * status check (treats every credential as live). In production the
+     * caller usually wires this to `fetch()`; tests can use an in-memory
+     * map.
+     */
+    statusListFetcher?: (uri: string) => Promise<string>;
+    /**
+     * Verifier callback for the *status list JWT*'s signature. The
+     * status list JWT is signed by the issuer (or a status-list-specific
+     * key); pass the public key here. If omitted, the same issuerPublicKey
+     * used for the SD-JWT is reused — appropriate when the issuer signs
+     * its own status lists.
+     */
+    statusListIssuerPublicKey?: Uint8Array;
+}
+/** Parameters accepted by [`presentSdJwtVc`]. */
+export interface PresentSdJwtVcParams {
+    /** Compact-serialised SD-JWT VC as issued (with all disclosures attached). */
+    compact: string;
+    /**
+     * Paths of the subject claims to reveal in this presentation. Each
+     * entry is either a top-level key (`'firstName'`) or a dotted path
+     * into a nested object (`'address.street'`). Any disclosure not
+     * listed here is omitted from the presented compact form; the
+     * verifier still sees the hash but cannot recover the value.
+     *
+     * @example ['firstName', 'address.street']
+     */
+    claimsToReveal: string[];
+    /**
+     * Holder's raw 32-byte Ed25519 *private* key. Must be the partner of
+     * the `holderPublicKey` that was bound at issuance time via `cnf.jwk`.
+     * Required because Phase 2 always emits a Key-Binding JWT — bearer
+     * presentations stay on the Phase-1 verify path with no `aud`/`nonce`.
+     */
+    holderPrivateKey: Uint8Array;
+    /**
+     * Audience identifier for the verifier (typically the verifier's
+     * client_id or origin). Becomes the `aud` claim of the KB-JWT.
+     */
+    audience: string;
+    /**
+     * Fresh, single-use nonce supplied by the verifier. Becomes the
+     * `nonce` claim of the KB-JWT.
+     */
+    nonce: string;
+}
+/** Result of [`presentSdJwtVc`]. */
+export interface PresentationResult {
+    /**
+     * Compact-serialised presentation:
+     * `<jws>~<revealed_d1>~<revealed_d2>~<kb-jwt>`. Note that the trailing
+     * `~` before the KB-JWT is part of the spec.
+     */
+    compact: string;
+}
+export interface VerificationResult {
+    /** True if signature, hashes, and freshness all check out. */
+    valid: boolean;
+    /**
+     * Reconstructed claims after applying disclosures. Includes hidden
+     * fields *only if* the corresponding disclosure was present in the
+     * compact form.
+     */
+    claims: Record<string, unknown>;
+    /** Issuer DID (the `iss` claim). */
+    issuer?: string;
+    /** Verifiable credential type (`vct` claim). */
+    vct?: string;
+    /** Reason for verification failure, if any. */
+    error?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/sdjwt/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sdjwt/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAA;IAEd;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAA;IAEX;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAEhC;;;OAGG;IACH,gBAAgB,EAAE,UAAU,CAAA;IAE5B;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IAEtB,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,UAAU,CAAA;IAE5B;;;;;;OAMG;IACH,MAAM,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;CACtC;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAA;IAEf,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAEhC,4CAA4C;IAC5C,eAAe,EAAE,MAAM,CAAA;CACxB;AAED,gDAAgD;AAChD,MAAM,WAAW,mBAAmB;IAClC,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAA;IAEf;;;;;OAKG;IACH,eAAe,EAAE,UAAU,CAAA;IAE3B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAEzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IAEtB;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IAEpD;;;;;;OAMG;IACH,yBAAyB,CAAC,EAAE,UAAU,CAAA;CACvC;AAED,iDAAiD;AACjD,MAAM,WAAW,oBAAoB;IACnC,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAA;IAEf;;;;;;;;OAQG;IACH,cAAc,EAAE,MAAM,EAAE,CAAA;IAExB;;;;;OAKG;IACH,gBAAgB,EAAE,UAAU,CAAA;IAE5B;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAA;IAEhB;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAA;CACd;AAED,oCAAoC;AACpC,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,8DAA8D;IAC9D,KAAK,EAAE,OAAO,CAAA;IAEd;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAE/B,oCAAoC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,CAAA;IAEZ,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAA;CACf"}

package/dist/sdjwt/types.js

@@ -0,0 +1,12 @@
+/**
+ * Public interfaces for the SD-JWT VC integration.
+ *
+ * SD-JWT VC (draft-ietf-oauth-sd-jwt-vc) is one of two W3C VC formats
+ * accepted by the EUDI Wallet ARF; the other is ISO mDoc. This module
+ * exposes a thin, opinionated wrapper around `@sd-jwt/sd-jwt-vc` that
+ * matches Solidus's Ed25519 / DID conventions.
+ *
+ * For background, see `.claude/plans/2026-05-09-sdjwt-vc-implementation.md`.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/sdjwt/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/sdjwt/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}

package/dist/sdjwt/verify.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Verify an SD-JWT VC, optionally including a Key-Binding JWT.
+ *
+ * Phase 1 verified just the issuer's signature + freshness; Phase 2
+ * adds an optional KB-JWT path. When the caller supplies
+ * `expectedAudience` and/or `expectedNonce`, the verifier:
+ *   - requires a KB-JWT to be present in the compact form,
+ *   - extracts the holder's public key from the SD-JWT's `cnf.jwk`,
+ *   - verifies the KB-JWT signature against that key,
+ *   - checks `aud` and `nonce` match the caller's expectations,
+ *   - confirms `sd_hash` matches the hash of the SD-JWT being presented.
+ *
+ * If neither expected* is set, the verifier behaves as Phase 1 — bearer
+ * presentations remain accepted.
+ *
+ * KB-JWT parsing is done in this module rather than via sd-jwt-js's
+ * `verify()` because sd-jwt-js conflates "extract KB-JWT" and "check
+ * nonce" in a single option, leaving us no clean way to surface
+ * `aud mismatch` separately from `nonce mismatch`.
+ */
+import type { VerifySdJwtVcParams, VerificationResult } from './types.js';
+export declare function verifySdJwtVc(params: VerifySdJwtVcParams): Promise<VerificationResult>;
+//# sourceMappingURL=verify.d.ts.map

package/dist/sdjwt/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/sdjwt/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAWH,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AA4EzE,wBAAsB,aAAa,CACjC,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CAuI7B"}

package/dist/sdjwt/verify.js

@@ -0,0 +1,201 @@
+/**
+ * Verify an SD-JWT VC, optionally including a Key-Binding JWT.
+ *
+ * Phase 1 verified just the issuer's signature + freshness; Phase 2
+ * adds an optional KB-JWT path. When the caller supplies
+ * `expectedAudience` and/or `expectedNonce`, the verifier:
+ *   - requires a KB-JWT to be present in the compact form,
+ *   - extracts the holder's public key from the SD-JWT's `cnf.jwk`,
+ *   - verifies the KB-JWT signature against that key,
+ *   - checks `aud` and `nonce` match the caller's expectations,
+ *   - confirms `sd_hash` matches the hash of the SD-JWT being presented.
+ *
+ * If neither expected* is set, the verifier behaves as Phase 1 — bearer
+ * presentations remain accepted.
+ *
+ * KB-JWT parsing is done in this module rather than via sd-jwt-js's
+ * `verify()` because sd-jwt-js conflates "extract KB-JWT" and "check
+ * nonce" in a single option, leaving us no clean way to surface
+ * `aud mismatch` separately from `nonce mismatch`.
+ */
+import { SDJwtVcInstance } from '@sd-jwt/sd-jwt-vc';
+import * as ed from '@noble/ed25519';
+import { sha256 } from '@noble/hashes/sha2';
+import { ed25519PublicKeyFromJwk, makeEd25519Verifier, sdJwtHasher, } from './signer.js';
+function fromBase64Url(input) {
+    const padded = input
+        .replace(/-/g, '+')
+        .replace(/_/g, '/')
+        .padEnd(input.length + ((4 - (input.length % 4)) % 4), '=');
+    return new Uint8Array(Buffer.from(padded, 'base64'));
+}
+function toBase64Url(input) {
+    return Buffer.from(input)
+        .toString('base64')
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=/g, '');
+}
+/**
+ * Decode (without verifying) the KB-JWT off the end of a compact SD-JWT.
+ *
+ * The compact form is `<jws>~<d1>~<d2>~<kb-jwt>`. The KB-JWT is the
+ * final non-empty segment; the `<jws>~<d1>~...~` prefix (with the
+ * trailing `~` retained) is what `sd_hash` covers per spec §3.3.
+ */
+function extractKbJwt(compact) {
+    const lastTilde = compact.lastIndexOf('~');
+    if (lastTilde < 0)
+        return null;
+    const kbCompact = compact.slice(lastTilde + 1);
+    if (kbCompact.length === 0)
+        return null;
+    const sdJwtBody = compact.slice(0, lastTilde + 1); // includes trailing `~`
+    const segments = kbCompact.split('.');
+    if (segments.length !== 3)
+        return null;
+    let payload;
+    try {
+        payload = JSON.parse(new TextDecoder().decode(fromBase64Url(segments[1])));
+    }
+    catch {
+        return null;
+    }
+    return { kbCompact, sdJwtBody, payload };
+}
+async function verifyKbSignature(kbCompact, holderPublicKey) {
+    const segments = kbCompact.split('.');
+    if (segments.length !== 3)
+        return false;
+    const signingInput = `${segments[0]}.${segments[1]}`;
+    const signature = fromBase64Url(segments[2]);
+    try {
+        return await ed.verifyAsync(signature, new TextEncoder().encode(signingInput), holderPublicKey);
+    }
+    catch {
+        return false;
+    }
+}
+export async function verifySdJwtVc(params) {
+    if (params.issuerPublicKey.length !== 32) {
+        return {
+            valid: false,
+            claims: {},
+            error: `issuerPublicKey must be 32 bytes, got ${params.issuerPublicKey.length}`,
+        };
+    }
+    const requireKb = params.expectedAudience !== undefined ||
+        params.expectedNonce !== undefined;
+    const statusListVerifier = params.statusListIssuerPublicKey
+        ? makeEd25519Verifier(params.statusListIssuerPublicKey)
+        : makeEd25519Verifier(params.issuerPublicKey);
+    const sdjwt = new SDJwtVcInstance({
+        verifier: makeEd25519Verifier(params.issuerPublicKey),
+        hasher: sdJwtHasher,
+        hashAlg: 'sha-256',
+        loadTypeMetadataFormat: false,
+        // Wire status-list lookup if the caller supplied a fetcher.
+        // sd-jwt-vc fetches the status-list JWT, verifies its signature,
+        // looks up `idx`, and (by default) treats any non-zero status as
+        // revoked.
+        ...(params.statusListFetcher !== undefined
+            ? {
+                statusListFetcher: params.statusListFetcher,
+                statusVerifier: statusListVerifier,
+            }
+            : {}),
+    });
+    let payload;
+    try {
+        const result = await sdjwt.verify(params.compact);
+        payload = result.payload;
+    }
+    catch (e) {
+        return {
+            valid: false,
+            claims: {},
+            error: e instanceof Error ? e.message : String(e),
+        };
+    }
+    if (requireKb) {
+        const parsed = extractKbJwt(params.compact);
+        if (!parsed) {
+            return {
+                valid: false,
+                claims: {},
+                error: 'KB-JWT required but not present in compact form',
+            };
+        }
+        const cnf = payload.cnf;
+        if (!cnf?.jwk) {
+            return {
+                valid: false,
+                claims: {},
+                error: 'SD-JWT does not bind a holder key (`cnf.jwk` missing)',
+            };
+        }
+        let holderPk;
+        try {
+            holderPk = ed25519PublicKeyFromJwk(cnf.jwk);
+        }
+        catch (e) {
+            return {
+                valid: false,
+                claims: {},
+                error: `cnf.jwk invalid: ${e instanceof Error ? e.message : String(e)}`,
+            };
+        }
+        const sigOk = await verifyKbSignature(parsed.kbCompact, holderPk);
+        if (!sigOk) {
+            return {
+                valid: false,
+                claims: {},
+                error: 'KB-JWT signature does not match the holder key from cnf.jwk',
+            };
+        }
+        if (params.expectedAudience !== undefined &&
+            parsed.payload.aud !== params.expectedAudience) {
+            return {
+                valid: false,
+                claims: {},
+                error: `KB-JWT aud mismatch: expected ${params.expectedAudience}, got ${parsed.payload.aud ?? '<missing>'}`,
+            };
+        }
+        if (params.expectedNonce !== undefined &&
+            parsed.payload.nonce !== params.expectedNonce) {
+            return {
+                valid: false,
+                claims: {},
+                error: `KB-JWT nonce mismatch: expected ${params.expectedNonce}, got ${parsed.payload.nonce ?? '<missing>'}`,
+            };
+        }
+        // Confirm sd_hash matches the SHA-256 of the SD-JWT body (everything
+        // before the KB-JWT, with the trailing `~` retained per spec).
+        if (parsed.payload.sd_hash !== undefined) {
+            const expectedHash = toBase64Url(sha256(new TextEncoder().encode(parsed.sdJwtBody)));
+            if (parsed.payload.sd_hash !== expectedHash) {
+                return {
+                    valid: false,
+                    claims: {},
+                    error: 'KB-JWT sd_hash does not cover the presented SD-JWT body',
+                };
+            }
+        }
+    }
+    // sd-jwt-js's verify() reconstructs disclosed claims and merges
+    // them into the payload, dropping the `_sd` arrays. The caller
+    // should never see SD-JWT housekeeping fields.
+    const claims = {};
+    for (const [k, v] of Object.entries(payload)) {
+        if (k === '_sd' || k === '_sd_alg' || k === 'cnf')
+            continue;
+        claims[k] = v;
+    }
+    const out = { valid: true, claims };
+    if (typeof payload['iss'] === 'string')
+        out.issuer = payload['iss'];
+    if (typeof payload['vct'] === 'string')
+        out.vct = payload['vct'];
+    return out;
+}
+//# sourceMappingURL=verify.js.map

package/dist/sdjwt/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/sdjwt/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAA;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAC3C,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,WAAW,GACZ,MAAM,aAAa,CAAA;AAGpB,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,MAAM,GAAG,KAAK;SACjB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC7D,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;AACtD,CAAC;AAED,SAAS,WAAW,CAAC,KAAiB;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SACtB,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;AACtB,CAAC;AAeD;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IAC1C,IAAI,SAAS,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAC9B,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAA;IAC9C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACvC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,CAAA,CAAC,wBAAwB;IAC1E,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACtC,IAAI,OAAqB,CAAA;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAClB,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,CACtC,CAAA;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,CAAA;AAC1C,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,SAAiB,EACjB,eAA2B;IAE3B,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACvC,MAAM,YAAY,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAE,IAAI,QAAQ,CAAC,CAAC,CAAE,EAAE,CAAA;IACtD,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAA;IAC7C,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,WAAW,CACzB,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EACtC,eAAe,CAChB,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAA2B;IAE3B,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACzC,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,EAAE;YACV,KAAK,EAAE,yCAAyC,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE;SAChF,CAAA;IACH,CAAC;IAED,MAAM,SAAS,GACb,MAAM,CAAC,gBAAgB,KAAK,SAAS;QACrC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAA;IAEpC,MAAM,kBAAkB,GAAG,MAAM,CAAC,yBAAyB;QACzD,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,yBAAyB,CAAC;QACvD,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;IAE/C,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC;QAChC,QAAQ,EAAE,mBAAmB,CAAC,MAAM,CAAC,eAAe,CAAC;QACrD,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,SAAS;QAClB,sBAAsB,EAAE,KAAK;QAC7B,4DAA4D;QAC5D,iEAAiE;QACjE,iEAAiE;QACjE,WAAW;QACX,GAAG,CAAC,MAAM,CAAC,iBAAiB,KAAK,SAAS;YACxC,CAAC,CAAC;gBACE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBAC3C,cAAc,EAAE,kBAAkB;aACnC;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAA;IAEF,IAAI,OAAgC,CAAA;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QACjD,OAAO,GAAG,MAAM,CAAC,OAAkC,CAAA;IACrD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,EAAE;YACV,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;SAClD,CAAA;IACH,CAAC;IAED,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,iDAAiD;aACzD,CAAA;QACH,CAAC;QAED,MAAM,GAAG,GAAI,OAAuC,CAAC,GAAG,CAAA;QACxD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;YACd,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,uDAAuD;aAC/D,CAAA;QACH,CAAC;QACD,IAAI,QAAoB,CAAA;QACxB,IAAI,CAAC;YACH,QAAQ,GAAG,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC7C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,oBAAoB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;aACxE,CAAA;QACH,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;QACjE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,6DAA6D;aACrE,CAAA;QACH,CAAC;QAED,IACE,MAAM,CAAC,gBAAgB,KAAK,SAAS;YACrC,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,gBAAgB,EAC9C,CAAC;YACD,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,iCAAiC,MAAM,CAAC,gBAAgB,SAAS,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,WAAW,EAAE;aAC5G,CAAA;QACH,CAAC;QAED,IACE,MAAM,CAAC,aAAa,KAAK,SAAS;YAClC,MAAM,CAAC,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,aAAa,EAC7C,CAAC;YACD,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,mCAAmC,MAAM,CAAC,aAAa,SAAS,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,WAAW,EAAE;aAC7G,CAAA;QACH,CAAC;QAED,qEAAqE;QACrE,+DAA+D;QAC/D,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACzC,MAAM,YAAY,GAAG,WAAW,CAC9B,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CACnD,CAAA;YACD,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;gBAC5C,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,EAAE;oBACV,KAAK,EAAE,yDAAyD;iBACjE,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,+DAA+D;IAC/D,+CAA+C;IAC/C,MAAM,MAAM,GAA4B,EAAE,CAAA;IAC1C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,KAAK;YAAE,SAAQ;QAC3D,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IACf,CAAC;IAED,MAAM,GAAG,GAAuB,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IACvD,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ;QAAE,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;IACnE,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ;QAAE,GAAG,CAAC,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;IAChE,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/stub/credentials.js

@@ -3,12 +3,12 @@ import { getSql } from './db.js';
 import { sign, verify as cryptoVerify } from './crypto.js';
 function rowToVC(row) {
     return {
-        '@context': ['https://www.w3.org/2018/credentials/v1'],
+        '@context': ['https://www.w3.org/ns/credentials/v2'],
         id: row.credential_id,
         type: row.type,
         issuer: row.issuer_did,
-        issuanceDate: row.issued_at.toISOString(),
-        ...(row.expires_at && { expirationDate: row.expires_at.toISOString() }),
+        validFrom: row.issued_at.toISOString(),
+        ...(row.expires_at && { validUntil: row.expires_at.toISOString() }),
         credentialSubject: { id: row.subject_did, ...row.claims },
         proof: {
             type: 'Ed25519Signature2020',

package/dist/stub/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/stub/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAGxC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,IAAI,YAAY,EAAE,MAAM,aAAa,CAAA;AAc1D,SAAS,OAAO,CAAC,GAAkB;IACjC,OAAO;QACL,UAAU,EAAE,CAAC,wCAAwC,CAAC;QACtD,EAAE,EAAE,GAAG,CAAC,aAAa;QACrB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,MAAM,EAAE,GAAG,CAAC,UAAU;QACtB,YAAY,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;QACzC,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,cAAc,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;QACvE,iBAAiB,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE;QACzD,KAAK,EAAE;YACL,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;YACpC,kBAAkB,EAAE,GAAG,GAAG,CAAC,UAAU,QAAQ;YAC7C,YAAY,EAAE,iBAAiB;YAC/B,UAAU,EAAE,GAAG,CAAC,WAAW;SAC5B;KACF,CAAA;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAMrB;IACC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAC7B,IAAI,CAAC,SAAS,CAAC;QACb,EAAE,EAAE,MAAM,CAAC,YAAY;QACvB,OAAO,EAAE,MAAM,CAAC,UAAU;QAC1B,MAAM,EAAE,MAAM,CAAC,SAAS;QACxB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC,CACH,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAA6B;IAClE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAA;IACpB,MAAM,YAAY,GAAG,mBAAmB,UAAU,EAAE,EAAE,CAAA;IACtD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa;QACpC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,aAAa,GAAG,UAAU,CAAC;QAC7D,CAAC,CAAC,IAAI,CAAA;IAER,MAAM,OAAO,GAAG,YAAY,CAAC;QAC3B,YAAY;QACZ,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,GAAG,CAAC,WAAW,EAAE;KAC5B,CAAC,CAAA;IACF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAA;IAE/D,MAAM,GAAG,CAAA;;;;QAIH,YAAY,KAAK,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,SAAS;QACvD,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAA4B,CAAC;QACxE,UAAU,KAAK,GAAG,KAAK,SAAS;;GAErC,CAAA;IAED,OAAO,OAAO,CAAC;QACb,aAAa,EAAE,YAAY;QAC3B,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,UAAU,EAAE,MAAM,CAAC,SAAS;QAC5B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,UAAU;QACvB,SAAS,EAAE,GAAG;QACd,UAAU,EAAE,SAAS;QACrB,OAAO,EAAE,KAAK;KACf,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAClD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAA;IACpB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAiB;2DACkB,IAAI;GAC5D,CAAA;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,sBAAsB;YAC7B,MAAM,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE;SAC/D,CAAA;IACH,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAA;IAEpB,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,OAAO,CAAA;IAC/B,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAA;IAEjE,MAAM,UAAU,GAAG,MAAM,GAAG,CAA+B;mDACV,GAAG,CAAC,UAAU;GAC9D,CAAA;IAED,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,YAAY,CAAC;YAC3B,YAAY,EAAE,GAAG,CAAC,aAAa;YAC/B,UAAU,EAAE,GAAG,CAAC,WAAW;YAC3B,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;SACtC,CAAC,CAAA;QACF,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,CAAA;IACpF,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,IAAI,UAAU,IAAI,UAAU,CAAA;IAClD,OAAO;QACL,KAAK;QACL,YAAY,EAAE,IAAI;QAClB,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE;KAC5E,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,YAAoB,EAAE,UAAkB;IAC9E,MAAM,GAAG,GAAG,MAAM,EAAE,CAAA;IACpB,MAAM,GAAG,CAAA;;4BAEiB,YAAY;GACrC,CAAA;IACD,MAAM,GAAG,CAAA;2DACgD,YAAY;;GAEpE,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,UAAkB;IACvD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAA;IACpB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAiB;;0BAEf,UAAU;;GAEjC,CAAA;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;AAC1B,CAAC"}
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/stub/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAGxC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,IAAI,YAAY,EAAE,MAAM,aAAa,CAAA;AAc1D,SAAS,OAAO,CAAC,GAAkB;IACjC,OAAO;QACL,UAAU,EAAE,CAAC,sCAAsC,CAAC;QACpD,EAAE,EAAE,GAAG,CAAC,aAAa;QACrB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,MAAM,EAAE,GAAG,CAAC,UAAU;QACtB,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;QACtC,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;QACnE,iBAAiB,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE;QACzD,KAAK,EAAE;YACL,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;YACpC,kBAAkB,EAAE,GAAG,GAAG,CAAC,UAAU,QAAQ;YAC7C,YAAY,EAAE,iBAAiB;YAC/B,UAAU,EAAE,GAAG,CAAC,WAAW;SAC5B;KACF,CAAA;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAMrB;IACC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAC7B,IAAI,CAAC,SAAS,CAAC;QACb,EAAE,EAAE,MAAM,CAAC,YAAY;QACvB,OAAO,EAAE,MAAM,CAAC,UAAU;QAC1B,MAAM,EAAE,MAAM,CAAC,SAAS;QACxB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC,CACH,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAA6B;IAClE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAA;IACpB,MAAM,YAAY,GAAG,mBAAmB,UAAU,EAAE,EAAE,CAAA;IACtD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa;QACpC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,aAAa,GAAG,UAAU,CAAC;QAC7D,CAAC,CAAC,IAAI,CAAA;IAER,MAAM,OAAO,GAAG,YAAY,CAAC;QAC3B,YAAY;QACZ,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,GAAG,CAAC,WAAW,EAAE;KAC5B,CAAC,CAAA;IACF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAA;IAE/D,MAAM,GAAG,CAAA;;;;QAIH,YAAY,KAAK,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,SAAS;QACvD,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAA4B,CAAC;QACxE,UAAU,KAAK,GAAG,KAAK,SAAS;;GAErC,CAAA;IAED,OAAO,OAAO,CAAC;QACb,aAAa,EAAE,YAAY;QAC3B,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,UAAU,EAAE,MAAM,CAAC,SAAS;QAC5B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,UAAU;QACvB,SAAS,EAAE,GAAG;QACd,UAAU,EAAE,SAAS;QACrB,OAAO,EAAE,KAAK;KACf,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAClD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAA;IACpB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAiB;2DACkB,IAAI;GAC5D,CAAA;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,sBAAsB;YAC7B,MAAM,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE;SAC/D,CAAA;IACH,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAA;IAEpB,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,OAAO,CAAA;IAC/B,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAA;IAEjE,MAAM,UAAU,GAAG,MAAM,GAAG,CAA+B;mDACV,GAAG,CAAC,UAAU;GAC9D,CAAA;IAED,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,YAAY,CAAC;YAC3B,YAAY,EAAE,GAAG,CAAC,aAAa;YAC/B,UAAU,EAAE,GAAG,CAAC,WAAW;YAC3B,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;SACtC,CAAC,CAAA;QACF,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,CAAA;IACpF,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,IAAI,UAAU,IAAI,UAAU,CAAA;IAClD,OAAO;QACL,KAAK;QACL,YAAY,EAAE,IAAI;QAClB,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE;KAC5E,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,YAAoB,EAAE,UAAkB;IAC9E,MAAM,GAAG,GAAG,MAAM,EAAE,CAAA;IACpB,MAAM,GAAG,CAAA;;4BAEiB,YAAY;GACrC,CAAA;IACD,MAAM,GAAG,CAAA;2DACgD,YAAY;;GAEpE,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,UAAkB;IACvD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAA;IACpB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAiB;;0BAEf,UAAU;;GAEjC,CAAA;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;AAC1B,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@solidus-network/sdk",
-  "version": "0.1.0",
-  "description": "Solidus Network SDK — DID resolution, verifiable credential issuance and verification, and on-chain queries via JSON-RPC.",
+  "version": "0.3.0",
+  "description": "Solidus Network SDK — DID resolution, verifiable credential issuance and verification, SD-JWT VC (EUDI-compatible), and on-chain queries via JSON-RPC.",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -15,12 +15,14 @@
   "dependencies": {
     "@noble/ed25519": "^2.1.0",
     "@noble/hashes": "^1.5.0",
-    "@solidus-network/auth": "0.1.0",
-    "@solidus-network/types": "0.1.0",
+    "@sd-jwt/sd-jwt-vc": "^0.19.0",
+    "@sd-jwt/types": "^0.19.0",
+    "@solidus-network/auth": "0.3.0",
+    "@solidus-network/types": "0.3.0",
     "bs58": "^6.0.0",
     "postgres": "^3.4.4"
   },
-  "keywords": ["solidus", "did", "verifiable-credentials", "vc", "blockchain", "decentralized-identity", "sdk"],
+  "keywords": ["solidus", "did", "verifiable-credentials", "vc", "sd-jwt", "sd-jwt-vc", "eudi", "blockchain", "decentralized-identity", "sdk"],
   "author": "Solidus Network (https://solidus.network)",
   "license": "Apache-2.0",
   "homepage": "https://solidus.network",