@solidus-network/sdk 0.2.0 → 0.3.0

package/dist/index.d.ts

@@ -4,10 +4,11 @@ export type { DID, DIDDocument, VerifiableCredential, IssueCredentialParams, Ver
 export { runMigrations, closeConnection } from './stub/db.js';
 export { generateKeypair, decodePublicKey } from './stub/crypto.js';
 export type { ChainConfig } from './chain/index.js';
+export { createChainClient } from './chain/index.js';
 export type { BbsDisclosedMessage, BbsCredentialProofResult, BbsCredentialRecord, } from './chain/bbs.js';
 export { utf8ToHex, toHex } from './chain/bbs.js';
-export { issueSdJwtVc, verifySdJwtVc, } from './sdjwt/index.js';
-export type { IssueSdJwtVcParams, IssuedSdJwtVc, VerifySdJwtVcParams, VerificationResult as SdJwtVerificationResult, } from './sdjwt/index.js';
+export { issueSdJwtVc, verifySdJwtVc, presentSdJwtVc, createStatusListJwt, ed25519PublicKeyToJwk, ed25519PublicKeyFromJwk, } from './sdjwt/index.js';
+export type { IssueSdJwtVcParams, IssuedSdJwtVc, VerifySdJwtVcParams, PresentSdJwtVcParams, PresentationResult, CreateStatusListJwtParams, Ed25519Jwk, VerificationResult as SdJwtVerificationResult, } from './sdjwt/index.js';
 export interface SolidusSDK {
     did: {
         create(publicKey: string): Promise<DID>;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,GAAG,EAAE,WAAW,EAAE,oBAAoB,EACtC,qBAAqB,EAAE,kBAAkB,EAAE,UAAU,EACtD,MAAM,gBAAgB,CAAA;AAKvB,OAAO,KAAK,EACV,mBAAmB,EACnB,wBAAwB,EAEzB,MAAM,gBAAgB,CAAA;AAEvB,YAAY,EACV,GAAG,EAAE,WAAW,EAAE,oBAAoB,EACtC,qBAAqB,EAAE,kBAAkB,EAAE,UAAU,GACtD,CAAA;AACD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC7D,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AACnE,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACnD,YAAY,EACV,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAA;AAIjD,OAAO,EACL,YAAY,EACZ,aAAa,GACd,MAAM,kBAAkB,CAAA;AACzB,YAAY,EACV,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,kBAAkB,IAAI,uBAAuB,GAC9C,MAAM,kBAAkB,CAAA;AAEzB,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE;QACH,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QACvC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;QACjD,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;KAC1D,CAAA;IACD,WAAW,EAAE;QACX,KAAK,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;QACnE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;QACjD,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9D,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAA;KAC3D,CAAA;IACD,IAAI,EAAE;QACJ,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;QAChD,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;KACvF,CAAA;IACD;;;OAGG;IACH,GAAG,CAAC,EAAE;QACJ,eAAe,CAAC,MAAM,EAAE;YACtB,gBAAgB,EAAE,MAAM,CAAA;YACxB,UAAU,EAAE,MAAM,CAAA;YAClB,cAAc,EAAE,MAAM,CAAA;YACtB,WAAW,EAAE,UAAU,CAAA;YACvB,SAAS,EAAE,UAAU,CAAA;YACrB,eAAe,EAAE,MAAM,CAAA;SACxB,GAAG,OAAO,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,OAAO,CAAA;SAAE,CAAC,CAAA;QACvE,WAAW,CAAC,MAAM,EAAE;YAClB,QAAQ,EAAE,MAAM,CAAA;YAChB,SAAS,EAAE,MAAM,CAAA;YACjB,SAAS,CAAC,EAAE,MAAM,CAAA;YAClB,KAAK,CAAC,EAAE,MAAM,CAAA;YACd,iBAAiB,EAAE,mBAAmB,EAAE,CAAA;YACxC,iBAAiB,EAAE,MAAM,CAAA;SAC1B,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;QACpB,qBAAqB,CAAC,MAAM,EAAE;YAC5B,YAAY,EAAE,MAAM,CAAA;YACpB,QAAQ,EAAE,MAAM,CAAA;YAChB,SAAS,CAAC,EAAE,MAAM,CAAA;YAClB,KAAK,CAAC,EAAE,MAAM,CAAA;YACd,iBAAiB,EAAE,mBAAmB,EAAE,CAAA;SACzC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAA;KACtC,CAAA;CACF;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAA;IACpC,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,gEAAgE;IAChE,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAkCD,wBAAgB,SAAS,CAAC,MAAM,EAAE,aAAa,GAAG,UAAU,CAiB3D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,GAAG,EAAE,WAAW,EAAE,oBAAoB,EACtC,qBAAqB,EAAE,kBAAkB,EAAE,UAAU,EACtD,MAAM,gBAAgB,CAAA;AAKvB,OAAO,KAAK,EACV,mBAAmB,EACnB,wBAAwB,EAEzB,MAAM,gBAAgB,CAAA;AAEvB,YAAY,EACV,GAAG,EAAE,WAAW,EAAE,oBAAoB,EACtC,qBAAqB,EAAE,kBAAkB,EAAE,UAAU,GACtD,CAAA;AACD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC7D,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AACnE,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACpD,YAAY,EACV,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAA;AAMjD,OAAO,EACL,YAAY,EACZ,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EACV,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,yBAAyB,EACzB,UAAU,EACV,kBAAkB,IAAI,uBAAuB,GAC9C,MAAM,kBAAkB,CAAA;AAEzB,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE;QACH,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QACvC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;QACjD,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;KAC1D,CAAA;IACD,WAAW,EAAE;QACX,KAAK,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;QACnE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;QACjD,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9D,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAA;KAC3D,CAAA;IACD,IAAI,EAAE;QACJ,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;QAChD,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;KACvF,CAAA;IACD;;;OAGG;IACH,GAAG,CAAC,EAAE;QACJ,eAAe,CAAC,MAAM,EAAE;YACtB,gBAAgB,EAAE,MAAM,CAAA;YACxB,UAAU,EAAE,MAAM,CAAA;YAClB,cAAc,EAAE,MAAM,CAAA;YACtB,WAAW,EAAE,UAAU,CAAA;YACvB,SAAS,EAAE,UAAU,CAAA;YACrB,eAAe,EAAE,MAAM,CAAA;SACxB,GAAG,OAAO,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,OAAO,CAAA;SAAE,CAAC,CAAA;QACvE,WAAW,CAAC,MAAM,EAAE;YAClB,QAAQ,EAAE,MAAM,CAAA;YAChB,SAAS,EAAE,MAAM,CAAA;YACjB,SAAS,CAAC,EAAE,MAAM,CAAA;YAClB,KAAK,CAAC,EAAE,MAAM,CAAA;YACd,iBAAiB,EAAE,mBAAmB,EAAE,CAAA;YACxC,iBAAiB,EAAE,MAAM,CAAA;SAC1B,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;QACpB,qBAAqB,CAAC,MAAM,EAAE;YAC5B,YAAY,EAAE,MAAM,CAAA;YACpB,QAAQ,EAAE,MAAM,CAAA;YAChB,SAAS,CAAC,EAAE,MAAM,CAAA;YAClB,KAAK,CAAC,EAAE,MAAM,CAAA;YACd,iBAAiB,EAAE,mBAAmB,EAAE,CAAA;SACzC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAA;KACtC,CAAA;CACF;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAA;IACpC,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,gEAAgE;IAChE,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAkCD,wBAAgB,SAAS,CAAC,MAAM,EAAE,aAAa,GAAG,UAAU,CAiB3D"}

package/dist/index.js

@@ -5,10 +5,13 @@ import { getSql } from './stub/db.js';
 import { createChainClient } from './chain/index.js';
 export { runMigrations, closeConnection } from './stub/db.js';
 export { generateKeypair, decodePublicKey } from './stub/crypto.js';
+export { createChainClient } from './chain/index.js';
 export { utf8ToHex, toHex } from './chain/bbs.js';
 // SD-JWT VC (selective-disclosure JWT, VC profile) — required for
-// EUDI Wallet interop. Phase 1: issue + verify on flat subjects.
-export { issueSdJwtVc, verifySdJwtVc, } from './sdjwt/index.js';
+// EUDI Wallet interop.
+//   Phase 1: issue + verify on flat subjects.
+//   Phase 2: holder presentation API + Key-Binding JWT.
+export { issueSdJwtVc, verifySdJwtVc, presentSdJwtVc, createStatusListJwt, ed25519PublicKeyToJwk, ed25519PublicKeyFromJwk, } from './sdjwt/index.js';
 function createStubSdk() {
     return {
         did: {

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAKxC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AACpE,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAChH,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,OAAO,EAAE,iBAAiB,EAAoB,MAAM,kBAAkB,CAAA;AAWtE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC7D,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAOnE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAA;AAEjD,kEAAkE;AAClE,iEAAiE;AACjE,OAAO,EACL,YAAY,EACZ,aAAa,GACd,MAAM,kBAAkB,CAAA;AA+DzB,SAAS,aAAa;IACpB,OAAO;QACL,GAAG,EAAE;YACH,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,aAAa;SAC1B;QACD,WAAW,EAAE;YACX,KAAK,EAAE,gBAAgB;YACvB,MAAM,EAAE,iBAAiB;YACzB,MAAM,EAAE,iBAAiB;YACzB,KAAK,EAAE,gBAAgB;SACxB;QACD,IAAI,EAAE;YACJ,KAAK,CAAC,eAAe,CAAC,MAAc;gBAClC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAA;gBACpB,MAAM,SAAS,GAAG,UAAU,EAAE,CAAA;gBAC9B,MAAM,GAAG,CAAA,2DAA2D,SAAS,KAAK,MAAM,GAAG,CAAA;gBAC3F,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,KAAK,CAAC,kBAAkB,CACtB,GAAW,EACX,UAAkB,EAClB,OAAe;gBAEf,qDAAqD;gBACrD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;YACpC,CAAC;SACF;KACF,CAAA;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,MAAqB;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,CAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAgD,IAAI,MAAM,CAAC,CAAA;IAEvH,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,SAAS,CAAC;QACf,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,uBAAuB,CAAA;YACzF,MAAM,SAAS,GAAG,MAAM,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAA;YACpF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAA;YAC3F,CAAC;YACD,OAAO,iBAAiB,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QAClF,CAAC;QACD,KAAK,MAAM,CAAC;QACZ;YACE,OAAO,aAAa,EAAE,CAAA;IAC1B,CAAC;AACH,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAKxC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AACpE,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAChH,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,OAAO,EAAE,iBAAiB,EAAoB,MAAM,kBAAkB,CAAA;AAWtE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC7D,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAEnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAMpD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAA;AAEjD,kEAAkE;AAClE,uBAAuB;AACvB,8CAA8C;AAC9C,wDAAwD;AACxD,OAAO,EACL,YAAY,EACZ,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,kBAAkB,CAAA;AAmEzB,SAAS,aAAa;IACpB,OAAO;QACL,GAAG,EAAE;YACH,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,aAAa;SAC1B;QACD,WAAW,EAAE;YACX,KAAK,EAAE,gBAAgB;YACvB,MAAM,EAAE,iBAAiB;YACzB,MAAM,EAAE,iBAAiB;YACzB,KAAK,EAAE,gBAAgB;SACxB;QACD,IAAI,EAAE;YACJ,KAAK,CAAC,eAAe,CAAC,MAAc;gBAClC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAA;gBACpB,MAAM,SAAS,GAAG,UAAU,EAAE,CAAA;gBAC9B,MAAM,GAAG,CAAA,2DAA2D,SAAS,KAAK,MAAM,GAAG,CAAA;gBAC3F,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,KAAK,CAAC,kBAAkB,CACtB,GAAW,EACX,UAAkB,EAClB,OAAe;gBAEf,qDAAqD;gBACrD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;YACpC,CAAC;SACF;KACF,CAAA;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,MAAqB;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,CAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAgD,IAAI,MAAM,CAAC,CAAA;IAEvH,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,SAAS,CAAC;QACf,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,uBAAuB,CAAA;YACzF,MAAM,SAAS,GAAG,MAAM,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAA;YACpF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAA;YAC3F,CAAC;YACD,OAAO,iBAAiB,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QAClF,CAAC;QACD,KAAK,MAAM,CAAC;QACZ;YACE,OAAO,aAAa,EAAE,CAAA;IAC1B,CAAC;AACH,CAAC"}

package/dist/sdjwt/index.d.ts

@@ -1,4 +1,8 @@
-export type { IssueSdJwtVcParams, IssuedSdJwtVc, VerifySdJwtVcParams, VerificationResult, } from './types.js';
+export type { IssueSdJwtVcParams, IssuedSdJwtVc, VerifySdJwtVcParams, VerificationResult, PresentSdJwtVcParams, PresentationResult, } from './types.js';
 export { issueSdJwtVc } from './issue.js';
 export { verifySdJwtVc } from './verify.js';
+export { presentSdJwtVc } from './present.js';
+export { createStatusListJwt } from './status-list.js';
+export type { CreateStatusListJwtParams } from './status-list.js';
+export { ed25519PublicKeyToJwk, ed25519PublicKeyFromJwk, type Ed25519Jwk, } from './signer.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/sdjwt/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sdjwt/index.ts"],"names":[],"mappings":"AAGA,YAAY,EACV,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sdjwt/index.ts"],"names":[],"mappings":"AAGA,YAAY,EACV,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AACtD,YAAY,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAA;AACjE,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,UAAU,GAChB,MAAM,aAAa,CAAA"}

package/dist/sdjwt/index.js

@@ -2,4 +2,7 @@
 // See `.claude/plans/2026-05-09-sdjwt-vc-implementation.md`.
 export { issueSdJwtVc } from './issue.js';
 export { verifySdJwtVc } from './verify.js';
+export { presentSdJwtVc } from './present.js';
+export { createStatusListJwt } from './status-list.js';
+export { ed25519PublicKeyToJwk, ed25519PublicKeyFromJwk, } from './signer.js';
 //# sourceMappingURL=index.js.map

package/dist/sdjwt/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sdjwt/index.ts"],"names":[],"mappings":"AAAA,qCAAqC;AACrC,6DAA6D;AAS7D,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sdjwt/index.ts"],"names":[],"mappings":"AAAA,qCAAqC;AACrC,6DAA6D;AAW7D,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAEtD,OAAO,EACL,qBAAqB,EACrB,uBAAuB,GAExB,MAAM,aAAa,CAAA"}

package/dist/sdjwt/issue.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"issue.d.ts","sourceRoot":"","sources":["../../src/sdjwt/issue.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAWH,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAgBnE,wBAAsB,YAAY,CAChC,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,aAAa,CAAC,CAmExB"}
+{"version":3,"file":"issue.d.ts","sourceRoot":"","sources":["../../src/sdjwt/issue.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAYH,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAuDnE,wBAAsB,YAAY,CAChC,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,aAAa,CAAC,CA+ExB"}

package/dist/sdjwt/issue.js

@@ -9,15 +9,44 @@
  */
 import { SDJwtVcInstance } from '@sd-jwt/sd-jwt-vc';
 import * as ed from '@noble/ed25519';
-import { makeEd25519Signer, sdJwtHasher, sdJwtSaltGenerator, } from './signer.js';
+import { ed25519PublicKeyToJwk, makeEd25519Signer, sdJwtHasher, sdJwtSaltGenerator, } from './signer.js';
+/**
+ * Build a sd-jwt-js DisclosureFrame from a list of disclosable claim
+ * paths (Phase 2c). Each path is a dot-separated string like
+ * `address.street`. The resulting frame is recursive — nested `_sd`
+ * arrays per object level — matching sd-jwt-js's DisclosureFrame type.
+ *
+ * Default behaviour (when `disclosable` is undefined): every top-level
+ * key except `id` is disclosable. Nested objects are NOT auto-expanded
+ * — callers who want nested disclosure must pass explicit paths.
+ */
 function buildDisclosureFrame(subject, disclosable) {
-    // Only flat top-level subject keys are disclosable in Phase 1.
-    // Nested-path disclosure (sd-jwt-js supports it via recursive _sd
-    // arrays) is deferred. Default: every key except `id` is disclosable.
-    const keys = disclosable ?? Object.keys(subject).filter((k) => k !== 'id');
-    // sd-jwt-js types the _sd array as (keyof Payload)[]; we keep the
-    // payload generic so the runtime list of strings has to be cast.
-    return { _sd: keys };
+    const paths = disclosable ?? Object.keys(subject).filter((k) => k !== 'id');
+    // Flat fast path: no dotted paths → original Phase 1 behaviour.
+    if (paths.every((p) => !p.includes('.'))) {
+        return { _sd: paths };
+    }
+    const root = { _sd: [] };
+    for (const path of paths) {
+        const segments = path.split('.');
+        let cursor = root;
+        for (let i = 0; i < segments.length; i++) {
+            const seg = segments[i];
+            if (i === segments.length - 1) {
+                cursor._sd.push(seg);
+            }
+            else {
+                const existing = cursor[seg];
+                if (existing === undefined ||
+                    Array.isArray(existing) ||
+                    seg === '_sd') {
+                    cursor[seg] = { _sd: [] };
+                }
+                cursor = cursor[seg];
+            }
+        }
+    }
+    return root;
 }
 export async function issueSdJwtVc(params) {
     if (params.issuerPrivateKey.length !== 32) {
@@ -58,6 +87,18 @@ export async function issueSdJwtVc(params) {
     if (params.validUntil !== undefined) {
         payload['exp'] = Math.floor(new Date(params.validUntil).getTime() / 1000);
     }
+    // When a holder public key is supplied, bind the credential to that
+    // key via the W3C `cnf` claim (RFC 7800). The verifier checks the
+    // KB-JWT's signature against this key at presentation time.
+    if (params.holderPublicKey !== undefined) {
+        payload['cnf'] = { jwk: ed25519PublicKeyToJwk(params.holderPublicKey) };
+    }
+    // Optional status-list reference per draft-ietf-oauth-status-list.
+    if (params.status !== undefined) {
+        payload['status'] = {
+            status_list: { uri: params.status.uri, idx: params.status.idx },
+        };
+    }
     const disclosureFrame = buildDisclosureFrame(subject, params.disclosable);
     const compact = await sdjwt.issue(payload, disclosureFrame);
     // Quick sanity check that we can derive a count of disclosures from

package/dist/sdjwt/issue.js.map

@@ -1 +1 @@
-{"version":3,"file":"issue.js","sourceRoot":"","sources":["../../src/sdjwt/issue.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAA;AAEpC,OAAO,EACL,iBAAiB,EACjB,WAAW,EACX,kBAAkB,GACnB,MAAM,aAAa,CAAA;AAGpB,SAAS,oBAAoB,CAC3B,OAAgC,EAChC,WAAsB;IAEtB,+DAA+D;IAC/D,kEAAkE;IAClE,sEAAsE;IACtE,MAAM,IAAI,GACR,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAA;IAC/D,kEAAkE;IAClE,iEAAiE;IACjE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAyD,CAAA;AAC7E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAA0B;IAE1B,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,0CAA0C,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAC3E,CAAA;IACH,CAAC;IAED,6DAA6D;IAC7D,qEAAqE;IACrE,sDAAsD;IACtD,MAAM,eAAe,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA;IAE3E,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC;QAChC,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAClD,OAAO,EAAE,OAAO;QAChB,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,SAAS;QAClB,aAAa,EAAE,kBAAkB;QACjC,+DAA+D;QAC/D,8DAA8D;QAC9D,qDAAqD;QACrD,sBAAsB,EAAE,KAAK;KAC9B,CAAC,CAAA;IAEF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAA;IACrC,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC/E,qEAAqE;IACrE,2CAA2C;IAC3C,OAAO,OAAO,CAAC,IAAI,CAAC,CAAA;IAEpB,MAAM,OAAO,GAA4B;QACvC,GAAG,EAAE,MAAM,CAAC,MAAM;QAClB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,GAAG;QACR,GAAG,OAAO;KACX,CAAA;IACD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,CAAC,KAAK,CAAC,GAAG,SAAS,CAAA;IACvD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAA;IAC1E,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAA;IAC3E,CAAC;IAED,MAAM,eAAe,GAAG,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;IACzE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,KAAK,CAC/B,OAA4C,EAC5C,eAAoD,CACrD,CAAA;IAED,oEAAoE;IACpE,gEAAgE;IAChE,+DAA+D;IAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAChC,MAAM,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,CAAA;IAEzE,gEAAgE;IAChE,kEAAkE;IAClE,sDAAsD;IACtD,KAAK,eAAe,CAAA;IAEpB,OAAO;QACL,OAAO;QACP,OAAO;QACP,eAAe;KAChB,CAAA;AACH,CAAC"}
+{"version":3,"file":"issue.js","sourceRoot":"","sources":["../../src/sdjwt/issue.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAA;AAEpC,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,WAAW,EACX,kBAAkB,GACnB,MAAM,aAAa,CAAA;AAGpB;;;;;;;;;GASG;AACH,SAAS,oBAAoB,CAC3B,OAAgC,EAChC,WAAsB;IAEtB,MAAM,KAAK,GACT,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAA;IAE/D,gEAAgE;IAChE,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACzC,OAAO,EAAE,GAAG,EAAE,KAAK,EAElB,CAAA;IACH,CAAC;IAOD,MAAM,IAAI,GAAc,EAAE,GAAG,EAAE,EAAE,EAAE,CAAA;IACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,MAAM,GAAc,IAAI,CAAA;QAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAA;YACxB,IAAI,CAAC,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACtB,CAAC;iBAAM,CAAC;gBACN,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;gBAC5B,IACE,QAAQ,KAAK,SAAS;oBACtB,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;oBACvB,GAAG,KAAK,KAAK,EACb,CAAC;oBACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAe,CAAA;gBACxC,CAAC;gBACD,MAAM,GAAG,MAAM,CAAC,GAAG,CAAc,CAAA;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAA2D,CAAA;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAA0B;IAE1B,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,0CAA0C,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAC3E,CAAA;IACH,CAAC;IAED,6DAA6D;IAC7D,qEAAqE;IACrE,sDAAsD;IACtD,MAAM,eAAe,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA;IAE3E,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC;QAChC,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAClD,OAAO,EAAE,OAAO;QAChB,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,SAAS;QAClB,aAAa,EAAE,kBAAkB;QACjC,+DAA+D;QAC/D,8DAA8D;QAC9D,qDAAqD;QACrD,sBAAsB,EAAE,KAAK;KAC9B,CAAC,CAAA;IAEF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAA;IACrC,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC/E,qEAAqE;IACrE,2CAA2C;IAC3C,OAAO,OAAO,CAAC,IAAI,CAAC,CAAA;IAEpB,MAAM,OAAO,GAA4B;QACvC,GAAG,EAAE,MAAM,CAAC,MAAM;QAClB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,GAAG;QACR,GAAG,OAAO;KACX,CAAA;IACD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,CAAC,KAAK,CAAC,GAAG,SAAS,CAAA;IACvD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAA;IAC1E,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAA;IAC3E,CAAC;IACD,oEAAoE;IACpE,kEAAkE;IAClE,4DAA4D;IAC5D,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,qBAAqB,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAA;IACzE,CAAC;IACD,mEAAmE;IACnE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,CAAC,QAAQ,CAAC,GAAG;YAClB,WAAW,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE;SAChE,CAAA;IACH,CAAC;IAED,MAAM,eAAe,GAAG,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;IACzE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,KAAK,CAC/B,OAA4C,EAC5C,eAAoD,CACrD,CAAA;IAED,oEAAoE;IACpE,gEAAgE;IAChE,+DAA+D;IAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAChC,MAAM,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,CAAA;IAEzE,gEAAgE;IAChE,kEAAkE;IAClE,sDAAsD;IACtD,KAAK,eAAe,CAAA;IAEpB,OAAO;QACL,OAAO;QACP,OAAO;QACP,eAAe;KAChB,CAAA;AACH,CAAC"}

package/dist/sdjwt/present.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Holder-side presentation API for SD-JWT VC.
+ *
+ * Phase 2. Takes an issued SD-JWT VC (with all disclosures attached)
+ * and returns a presentation that:
+ *   - reveals only the disclosures the holder consents to,
+ *   - is bound to a Key-Binding JWT signed by the holder's private key.
+ *
+ * The KB-JWT proves the holder controls the key referenced by the
+ * issuer-set `cnf.jwk` claim — without it, anyone with a copy of the
+ * compact form could replay the credential to a different verifier.
+ */
+import type { PresentSdJwtVcParams, PresentationResult } from './types.js';
+export declare function presentSdJwtVc(params: PresentSdJwtVcParams): Promise<PresentationResult>;
+//# sourceMappingURL=present.d.ts.map

package/dist/sdjwt/present.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"present.d.ts","sourceRoot":"","sources":["../../src/sdjwt/present.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAUH,OAAO,KAAK,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AA6C1E,wBAAsB,cAAc,CAClC,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CAmC7B"}

package/dist/sdjwt/present.js

@@ -0,0 +1,80 @@
+/**
+ * Holder-side presentation API for SD-JWT VC.
+ *
+ * Phase 2. Takes an issued SD-JWT VC (with all disclosures attached)
+ * and returns a presentation that:
+ *   - reveals only the disclosures the holder consents to,
+ *   - is bound to a Key-Binding JWT signed by the holder's private key.
+ *
+ * The KB-JWT proves the holder controls the key referenced by the
+ * issuer-set `cnf.jwk` claim — without it, anyone with a copy of the
+ * compact form could replay the credential to a different verifier.
+ */
+import { SDJwtVcInstance } from '@sd-jwt/sd-jwt-vc';
+import { makeEd25519Signer, sdJwtHasher, sdJwtSaltGenerator, } from './signer.js';
+/**
+ * Build a sd-jwt-js PresentationFrame from a list of claim paths
+ * (Phase 2c — supports nested paths via dot notation). Each path is
+ * either a top-level key (`'firstName'`) or a dotted path into a
+ * nested object (`'address.street'`). Result is a recursive map
+ * `{ key: true | { nestedKey: true } }` matching sd-jwt-js's
+ * PresentationFrame type.
+ */
+function buildPresentationFrame(reveal) {
+    // Flat fast path — preserves the original Phase 2 behaviour.
+    if (reveal.every((p) => !p.includes('.'))) {
+        const flat = {};
+        for (const k of reveal)
+            flat[k] = true;
+        return flat;
+    }
+    const root = {};
+    for (const path of reveal) {
+        const segments = path.split('.');
+        let cursor = root;
+        for (let i = 0; i < segments.length; i++) {
+            const seg = segments[i];
+            if (i === segments.length - 1) {
+                cursor[seg] = true;
+            }
+            else {
+                // If a previous path already pinned this segment as `true`,
+                // upgrade to an object so we can attach the nested key.
+                const existing = cursor[seg];
+                if (existing === true || existing === undefined) {
+                    cursor[seg] = {};
+                }
+                cursor = cursor[seg];
+            }
+        }
+    }
+    return root;
+}
+export async function presentSdJwtVc(params) {
+    if (params.holderPrivateKey.length !== 32) {
+        throw new Error(`holderPrivateKey must be 32 bytes, got ${params.holderPrivateKey.length}`);
+    }
+    // Holder uses its own key as the KB-JWT signer. The issuer-side
+    // signer is irrelevant here — present() does not re-sign the SD-JWT,
+    // only the new KB-JWT.
+    const sdjwt = new SDJwtVcInstance({
+        hasher: sdJwtHasher,
+        saltGenerator: sdJwtSaltGenerator,
+        hashAlg: 'sha-256',
+        kbSigner: makeEd25519Signer(params.holderPrivateKey),
+        kbSignAlg: 'EdDSA',
+        loadTypeMetadataFormat: false,
+    });
+    const presentationFrame = buildPresentationFrame(params.claimsToReveal);
+    const compact = await sdjwt.present(params.compact, presentationFrame, {
+        kb: {
+            payload: {
+                iat: Math.floor(Date.now() / 1000),
+                aud: params.audience,
+                nonce: params.nonce,
+            },
+        },
+    });
+    return { compact };
+}
+//# sourceMappingURL=present.js.map

package/dist/sdjwt/present.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"present.js","sourceRoot":"","sources":["../../src/sdjwt/present.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAGnD,OAAO,EACL,iBAAiB,EACjB,WAAW,EACX,kBAAkB,GACnB,MAAM,aAAa,CAAA;AAGpB;;;;;;;GAOG;AACH,SAAS,sBAAsB,CAC7B,MAAgB;IAEhB,6DAA6D;IAC7D,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAyB,EAAE,CAAA;QACrC,KAAK,MAAM,CAAC,IAAI,MAAM;YAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAA;QACtC,OAAO,IAA6D,CAAA;IACtE,CAAC;IAKD,MAAM,IAAI,GAAc,EAAE,CAAA;IAC1B,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,MAAM,GAAc,IAAI,CAAA;QAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAA;YACxB,IAAI,CAAC,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAA;YACpB,CAAC;iBAAM,CAAC;gBACN,4DAA4D;gBAC5D,wDAAwD;gBACxD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;gBAC5B,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAChD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAA;gBAClB,CAAC;gBACD,MAAM,GAAG,MAAM,CAAC,GAAG,CAAc,CAAA;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAA6D,CAAA;AACtE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAA4B;IAE5B,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,0CAA0C,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAC3E,CAAA;IACH,CAAC;IAED,gEAAgE;IAChE,qEAAqE;IACrE,uBAAuB;IACvB,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC;QAChC,MAAM,EAAE,WAAW;QACnB,aAAa,EAAE,kBAAkB;QACjC,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,iBAAiB,CAAC,MAAM,CAAC,gBAAgB,CAAC;QACpD,SAAS,EAAE,OAAO;QAClB,sBAAsB,EAAE,KAAK;KAC9B,CAAC,CAAA;IAEF,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;IACvE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,CACjC,MAAM,CAAC,OAAO,EACd,iBAAiB,EACjB;QACE,EAAE,EAAE;YACF,OAAO,EAAE;gBACP,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;gBAClC,GAAG,EAAE,MAAM,CAAC,QAAQ;gBACpB,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB;SACF;KACF,CACF,CAAA;IAED,OAAO,EAAE,OAAO,EAAE,CAAA;AACpB,CAAC"}

package/dist/sdjwt/signer.d.ts

@@ -40,4 +40,20 @@ export declare function sdJwtHasher(data: string | ArrayBuffer, alg: string): Ui
  * sd-jwt-js calls this with `length = 16` by default.
  */
 export declare function sdJwtSaltGenerator(length: number): string;
+/**
+ * JWK shape used in the SD-JWT VC `cnf` claim for an Ed25519 holder
+ * key. Matches RFC 8037 — Ed25519 → OKP curve, no `d` (private)
+ * component. The verifier reconstructs the raw 32-byte public key from
+ * `x`.
+ */
+export interface Ed25519Jwk {
+    kty: 'OKP';
+    crv: 'Ed25519';
+    x: string;
+    alg: 'EdDSA';
+}
+/** Convert a 32-byte Ed25519 public key into the canonical JWK form. */
+export declare function ed25519PublicKeyToJwk(publicKey: Uint8Array): Ed25519Jwk;
+/** Recover a 32-byte Ed25519 public key from its canonical JWK form. */
+export declare function ed25519PublicKeyFromJwk(jwk: unknown): Uint8Array;
 //# sourceMappingURL=signer.d.ts.map

package/dist/sdjwt/signer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signer.d.ts","sourceRoot":"","sources":["../../src/sdjwt/signer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAqBH;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,UAAU,IAIxC,MAAM,MAAM,KAAG,OAAO,CAAC,MAAM,CAAC,CAI7C;AAED,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,UAAU,IAIzC,MAAM,MAAM,EAAE,WAAW,MAAM,KAAG,OAAO,CAAC,OAAO,CAAC,CAWjE;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,GAAG,WAAW,EAC1B,GAAG,EAAE,MAAM,GACV,UAAU,CASZ;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAQzD"}
+{"version":3,"file":"signer.d.ts","sourceRoot":"","sources":["../../src/sdjwt/signer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAqBH;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,UAAU,IAIxC,MAAM,MAAM,KAAG,OAAO,CAAC,MAAM,CAAC,CAI7C;AAED,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,UAAU,IAIzC,MAAM,MAAM,EAAE,WAAW,MAAM,KAAG,OAAO,CAAC,OAAO,CAAC,CAWjE;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,GAAG,WAAW,EAC1B,GAAG,EAAE,MAAM,GACV,UAAU,CASZ;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAQzD;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,KAAK,CAAA;IACV,GAAG,EAAE,SAAS,CAAA;IACd,CAAC,EAAE,MAAM,CAAA;IACT,GAAG,EAAE,OAAO,CAAA;CACb;AAED,wEAAwE;AACxE,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,UAAU,GAAG,UAAU,CAUvE;AAED,wEAAwE;AACxE,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,OAAO,GAAG,UAAU,CAehE"}

package/dist/sdjwt/signer.js

@@ -89,4 +89,31 @@ export function sdJwtSaltGenerator(length) {
         .replace(/\//g, '_')
         .replace(/=/g, '');
 }
+/** Convert a 32-byte Ed25519 public key into the canonical JWK form. */
+export function ed25519PublicKeyToJwk(publicKey) {
+    if (publicKey.length !== 32) {
+        throw new Error(`publicKey must be 32 bytes, got ${publicKey.length}`);
+    }
+    return {
+        kty: 'OKP',
+        crv: 'Ed25519',
+        x: toBase64Url(publicKey),
+        alg: 'EdDSA',
+    };
+}
+/** Recover a 32-byte Ed25519 public key from its canonical JWK form. */
+export function ed25519PublicKeyFromJwk(jwk) {
+    if (!jwk ||
+        typeof jwk !== 'object' ||
+        jwk.kty !== 'OKP' ||
+        jwk.crv !== 'Ed25519' ||
+        typeof jwk.x !== 'string') {
+        throw new Error('not an Ed25519 OKP JWK');
+    }
+    const bytes = fromBase64Url(jwk.x);
+    if (bytes.length !== 32) {
+        throw new Error(`JWK x must decode to 32 bytes, got ${bytes.length}`);
+    }
+    return bytes;
+}
 //# sourceMappingURL=signer.js.map

package/dist/sdjwt/signer.js.map

@@ -1 +1 @@
-{"version":3,"file":"signer.js","sourceRoot":"","sources":["../../src/sdjwt/signer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAA;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAE3C,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,CAC/D,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAC7C,GAAG,CACJ,CAAA;IACD,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;AACtD,CAAC;AAED,SAAS,WAAW,CAAC,KAAiB;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SACtB,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;AACtB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAsB;IACtD,IAAI,UAAU,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,oCAAoC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;IAC1E,CAAC;IACD,OAAO,KAAK,EAAE,IAAY,EAAmB,EAAE;QAC7C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,CAAA;QAC1E,OAAO,WAAW,CAAC,GAAG,CAAC,CAAA;IACzB,CAAC,CAAA;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB,CAAC,SAAqB;IACvD,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,mCAAmC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAA;IACxE,CAAC;IACD,OAAO,KAAK,EAAE,IAAY,EAAE,SAAiB,EAAoB,EAAE;QACjE,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,WAAW,CACzB,aAAa,CAAC,SAAS,CAAC,EACxB,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAC9B,SAAS,CACV,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CACzB,IAA0B,EAC1B,GAAW;IAEX,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,EAAE,CAAC,CAAA;IAC9D,CAAC;IACD,MAAM,KAAK,GACT,OAAO,IAAI,KAAK,QAAQ;QACtB,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;QAChC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAA;IAC1B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;AACtB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;IACpC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;IAC7B,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SACtB,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;AACtB,CAAC"}
+{"version":3,"file":"signer.js","sourceRoot":"","sources":["../../src/sdjwt/signer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAA;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAE3C,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,CAC/D,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAC7C,GAAG,CACJ,CAAA;IACD,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;AACtD,CAAC;AAED,SAAS,WAAW,CAAC,KAAiB;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SACtB,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;AACtB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAsB;IACtD,IAAI,UAAU,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,oCAAoC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;IAC1E,CAAC;IACD,OAAO,KAAK,EAAE,IAAY,EAAmB,EAAE;QAC7C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,CAAA;QAC1E,OAAO,WAAW,CAAC,GAAG,CAAC,CAAA;IACzB,CAAC,CAAA;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB,CAAC,SAAqB;IACvD,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,mCAAmC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAA;IACxE,CAAC;IACD,OAAO,KAAK,EAAE,IAAY,EAAE,SAAiB,EAAoB,EAAE;QACjE,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,WAAW,CACzB,aAAa,CAAC,SAAS,CAAC,EACxB,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAC9B,SAAS,CACV,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CACzB,IAA0B,EAC1B,GAAW;IAEX,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,EAAE,CAAC,CAAA;IAC9D,CAAC;IACD,MAAM,KAAK,GACT,OAAO,IAAI,KAAK,QAAQ;QACtB,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;QAChC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAA;IAC1B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;AACtB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;IACpC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;IAC7B,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SACtB,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;AACtB,CAAC;AAeD,wEAAwE;AACxE,MAAM,UAAU,qBAAqB,CAAC,SAAqB;IACzD,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,mCAAmC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAA;IACxE,CAAC;IACD,OAAO;QACL,GAAG,EAAE,KAAK;QACV,GAAG,EAAE,SAAS;QACd,CAAC,EAAE,WAAW,CAAC,SAAS,CAAC;QACzB,GAAG,EAAE,OAAO;KACb,CAAA;AACH,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,uBAAuB,CAAC,GAAY;IAClD,IACE,CAAC,GAAG;QACJ,OAAO,GAAG,KAAK,QAAQ;QACtB,GAAyB,CAAC,GAAG,KAAK,KAAK;QACvC,GAAyB,CAAC,GAAG,KAAK,SAAS;QAC5C,OAAQ,GAAuB,CAAC,CAAC,KAAK,QAAQ,EAC9C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;IAC3C,CAAC;IACD,MAAM,KAAK,GAAG,aAAa,CAAE,GAAqB,CAAC,CAAC,CAAC,CAAA;IACrD,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,sCAAsC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;IACvE,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/sdjwt/status-list.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Status list (draft-ietf-oauth-status-list) helper for issuers.
+ *
+ * The lifecycle:
+ *   1. Issuer creates a `StatusList` (a bitstring of N statuses,
+ *      typically 1 bit per credential — 0 = active, 1 = revoked).
+ *   2. Issuer wraps it in a JWT signed by the issuer's key, served at
+ *      a stable URL (e.g., `/status-lists/<id>`).
+ *   3. Each issued SD-JWT VC carries a `status.status_list.{uri, idx}`
+ *      pointing at one bit in the list.
+ *   4. To revoke a credential, the issuer flips its bit and republishes
+ *      the (now-updated) JWT at the same URL.
+ *   5. Verifiers refetch the list (cache-respecting) and check the bit.
+ *
+ * `createStatusListJwt` is a thin wrapper around `@sd-jwt/jwt-status-list`
+ * that uses Ed25519 / EdDSA to match the rest of Solidus's signing
+ * conventions.
+ */
+import { type BitsPerStatus } from '@sd-jwt/jwt-status-list';
+export interface CreateStatusListJwtParams {
+    /** Issuer's raw 32-byte Ed25519 private key. */
+    issuerPrivateKey: Uint8Array;
+    /** Issuer DID — becomes the `iss` claim on the status-list JWT. */
+    issuer: string;
+    /**
+     * The URL where this status-list JWT will be served. Becomes the
+     * `sub` claim per draft-ietf-oauth-status-list §6.2 and is what
+     * issued credentials reference via `status.status_list.uri`.
+     */
+    uri: string;
+    /**
+     * Total number of statuses in the list. Determines the bitstring
+     * size. Choose with growth in mind — once published, callers cannot
+     * shrink the list without breaking existing references.
+     */
+    totalStatuses: number;
+    /**
+     * Bits per status. 1 = boolean (active/revoked); 2/4/8 add finer
+     * granularity (suspended, expired, etc.) per spec §6. Default 1.
+     */
+    bitsPerStatus?: BitsPerStatus;
+    /**
+     * Indexes whose status should be set to non-zero. With `bitsPerStatus
+     * = 1`, listing an index here means "revoked". For higher bit
+     * widths, pass `[index, value]` tuples.
+     */
+    revoked?: Array<number | [number, number]>;
+    /**
+     * Optional time-to-live in seconds — verifiers MAY use this to
+     * decide how long to cache the list. Per draft-ietf-oauth-status-list.
+     */
+    ttlSeconds?: number;
+}
+/**
+ * Build a signed status-list JWT.
+ *
+ * Returns the JWT in compact form. Issuers serve this at the URL
+ * embedded in their issued SD-JWT VCs' `status.status_list.uri` claim.
+ */
+export declare function createStatusListJwt(params: CreateStatusListJwtParams): Promise<string>;
+//# sourceMappingURL=status-list.d.ts.map

package/dist/sdjwt/status-list.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-list.d.ts","sourceRoot":"","sources":["../../src/sdjwt/status-list.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,yBAAyB,CAAA;AAUhC,MAAM,WAAW,yBAAyB;IACxC,gDAAgD;IAChD,gBAAgB,EAAE,UAAU,CAAA;IAE5B,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAA;IAEd;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAA;IAEX;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAA;IAErB;;;OAGG;IACH,aAAa,CAAC,EAAE,aAAa,CAAA;IAE7B;;;;OAIG;IACH,OAAO,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAE1C;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,yBAAyB,GAChC,OAAO,CAAC,MAAM,CAAC,CA8CjB"}

package/dist/sdjwt/status-list.js

@@ -0,0 +1,63 @@
+/**
+ * Status list (draft-ietf-oauth-status-list) helper for issuers.
+ *
+ * The lifecycle:
+ *   1. Issuer creates a `StatusList` (a bitstring of N statuses,
+ *      typically 1 bit per credential — 0 = active, 1 = revoked).
+ *   2. Issuer wraps it in a JWT signed by the issuer's key, served at
+ *      a stable URL (e.g., `/status-lists/<id>`).
+ *   3. Each issued SD-JWT VC carries a `status.status_list.{uri, idx}`
+ *      pointing at one bit in the list.
+ *   4. To revoke a credential, the issuer flips its bit and republishes
+ *      the (now-updated) JWT at the same URL.
+ *   5. Verifiers refetch the list (cache-respecting) and check the bit.
+ *
+ * `createStatusListJwt` is a thin wrapper around `@sd-jwt/jwt-status-list`
+ * that uses Ed25519 / EdDSA to match the rest of Solidus's signing
+ * conventions.
+ */
+import * as ed from '@noble/ed25519';
+import { StatusList, createHeaderAndPayload, } from '@sd-jwt/jwt-status-list';
+function toBase64Url(bytes) {
+    return Buffer.from(bytes)
+        .toString('base64')
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=/g, '');
+}
+/**
+ * Build a signed status-list JWT.
+ *
+ * Returns the JWT in compact form. Issuers serve this at the URL
+ * embedded in their issued SD-JWT VCs' `status.status_list.uri` claim.
+ */
+export async function createStatusListJwt(params) {
+    if (params.issuerPrivateKey.length !== 32) {
+        throw new Error(`issuerPrivateKey must be 32 bytes, got ${params.issuerPrivateKey.length}`);
+    }
+    const bitsPerStatus = params.bitsPerStatus ?? 1;
+    const list = new StatusList(new Array(params.totalStatuses).fill(0), bitsPerStatus);
+    for (const entry of params.revoked ?? []) {
+        if (typeof entry === 'number') {
+            list.setStatus(entry, 1);
+        }
+        else {
+            list.setStatus(entry[0], entry[1]);
+        }
+    }
+    const now = Math.floor(Date.now() / 1000);
+    const basePayload = {
+        iss: params.issuer,
+        sub: params.uri,
+        iat: now,
+    };
+    if (params.ttlSeconds !== undefined)
+        basePayload['ttl'] = params.ttlSeconds;
+    const { header, payload } = createHeaderAndPayload(list, basePayload, { alg: 'EdDSA', typ: 'statuslist+jwt' });
+    const headerSegment = toBase64Url(new TextEncoder().encode(JSON.stringify(header)));
+    const payloadSegment = toBase64Url(new TextEncoder().encode(JSON.stringify(payload)));
+    const signingInput = `${headerSegment}.${payloadSegment}`;
+    const signature = await ed.signAsync(new TextEncoder().encode(signingInput), params.issuerPrivateKey);
+    return `${signingInput}.${toBase64Url(signature)}`;
+}
+//# sourceMappingURL=status-list.js.map

package/dist/sdjwt/status-list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-list.js","sourceRoot":"","sources":["../../src/sdjwt/status-list.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAA;AACpC,OAAO,EACL,UAAU,EACV,sBAAsB,GAEvB,MAAM,yBAAyB,CAAA;AAEhC,SAAS,WAAW,CAAC,KAAiB;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SACtB,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;AACtB,CAAC;AA2CD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAiC;IAEjC,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,0CAA0C,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAC3E,CAAA;IACH,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,CAAC,CAAA;IAC/C,MAAM,IAAI,GAAG,IAAI,UAAU,CACzB,IAAI,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EACvC,aAAa,CACd,CAAA;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;QAC1B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QACpC,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,MAAM,WAAW,GAA4B;QAC3C,GAAG,EAAE,MAAM,CAAC,MAAM;QAClB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,GAAG;KACT,CAAA;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;QAAE,WAAW,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,UAAU,CAAA;IAE3E,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,sBAAsB,CAChD,IAAI,EACJ,WAAoB,EACpB,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,gBAAgB,EAAE,CACxC,CAAA;IAED,MAAM,aAAa,GAAG,WAAW,CAC/B,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CACjD,CAAA;IACD,MAAM,cAAc,GAAG,WAAW,CAChC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAClD,CAAA;IACD,MAAM,YAAY,GAAG,GAAG,aAAa,IAAI,cAAc,EAAE,CAAA;IACzD,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,SAAS,CAClC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EACtC,MAAM,CAAC,gBAAgB,CACxB,CAAA;IACD,OAAO,GAAG,YAAY,IAAI,WAAW,CAAC,SAAS,CAAC,EAAE,CAAA;AACpD,CAAC"}

package/dist/sdjwt/types.d.ts

@@ -33,18 +33,38 @@ export interface IssueSdJwtVcParams {
      */
     issuerPrivateKey: Uint8Array;
     /**
-     * Subject-claim paths that should be disclosable. Each entry is a
-     * top-level subject key (Phase 1 supports flat structures only;
-     * nested disclosure comes in Phase 2). If omitted, every subject
-     * claim is disclosable.
+     * Subject-claim paths that should be disclosable. Each entry is
+     * either a top-level key (`'birthdate'`) or a dotted path into a
+     * nested object (`'address.street'`). If omitted, every top-level
+     * subject claim except `id` is disclosable; nested objects are not
+     * auto-expanded — pass explicit paths to selectively disclose them.
      *
-     * @example ['birthdate', 'address']
+     * @example ['birthdate', 'address.street', 'address.city']
      */
     disclosable?: string[];
     /** RFC 3339 timestamp; sd-jwt-vc maps this to `nbf`. Defaults to now. */
     validFrom?: string;
     /** RFC 3339 timestamp; sd-jwt-vc maps this to `exp`. Optional. */
     validUntil?: string;
+    /**
+     * Optional 32-byte Ed25519 public key of the *holder*. When provided,
+     * the issued SD-JWT embeds a `cnf.jwk` claim binding the credential
+     * to this key — required if the verifier is going to enforce a
+     * Key-Binding JWT at presentation time. Omit to issue a bearer
+     * credential (Phase 1 default).
+     */
+    holderPublicKey?: Uint8Array;
+    /**
+     * Optional reference into a status list (draft-ietf-oauth-status-list).
+     * When set, the issued SD-JWT carries `status: { status_list: { uri,
+     * idx } }`; verifiers that supply a `statusListFetcher` will fetch
+     * the list, look up bit `idx`, and reject the credential if the
+     * status indicates revocation.
+     */
+    status?: {
+        uri: string;
+        idx: number;
+    };
 }
 /**
  * The compact-serialised SD-JWT VC, plus metadata. The `compact` field
@@ -70,6 +90,77 @@ export interface VerifySdJwtVcParams {
      * from the chain client.
      */
     issuerPublicKey: Uint8Array;
+    /**
+     * If provided, the verifier requires a valid Key-Binding JWT and
+     * checks the KB-JWT's `aud` claim against this value. Use this to
+     * stop a stolen presentation from being replayed against a different
+     * verifier.
+     */
+    expectedAudience?: string;
+    /**
+     * If provided, the verifier requires a valid Key-Binding JWT and
+     * checks the KB-JWT's `nonce` claim against this value. The verifier
+     * is responsible for generating a fresh nonce per presentation
+     * request and remembering it for the duration of the round-trip.
+     */
+    expectedNonce?: string;
+    /**
+     * Callback that fetches the status-list JWT at a given URI. Required
+     * to enable revocation checking; if absent the verifier skips the
+     * status check (treats every credential as live). In production the
+     * caller usually wires this to `fetch()`; tests can use an in-memory
+     * map.
+     */
+    statusListFetcher?: (uri: string) => Promise<string>;
+    /**
+     * Verifier callback for the *status list JWT*'s signature. The
+     * status list JWT is signed by the issuer (or a status-list-specific
+     * key); pass the public key here. If omitted, the same issuerPublicKey
+     * used for the SD-JWT is reused — appropriate when the issuer signs
+     * its own status lists.
+     */
+    statusListIssuerPublicKey?: Uint8Array;
+}
+/** Parameters accepted by [`presentSdJwtVc`]. */
+export interface PresentSdJwtVcParams {
+    /** Compact-serialised SD-JWT VC as issued (with all disclosures attached). */
+    compact: string;
+    /**
+     * Paths of the subject claims to reveal in this presentation. Each
+     * entry is either a top-level key (`'firstName'`) or a dotted path
+     * into a nested object (`'address.street'`). Any disclosure not
+     * listed here is omitted from the presented compact form; the
+     * verifier still sees the hash but cannot recover the value.
+     *
+     * @example ['firstName', 'address.street']
+     */
+    claimsToReveal: string[];
+    /**
+     * Holder's raw 32-byte Ed25519 *private* key. Must be the partner of
+     * the `holderPublicKey` that was bound at issuance time via `cnf.jwk`.
+     * Required because Phase 2 always emits a Key-Binding JWT — bearer
+     * presentations stay on the Phase-1 verify path with no `aud`/`nonce`.
+     */
+    holderPrivateKey: Uint8Array;
+    /**
+     * Audience identifier for the verifier (typically the verifier's
+     * client_id or origin). Becomes the `aud` claim of the KB-JWT.
+     */
+    audience: string;
+    /**
+     * Fresh, single-use nonce supplied by the verifier. Becomes the
+     * `nonce` claim of the KB-JWT.
+     */
+    nonce: string;
+}
+/** Result of [`presentSdJwtVc`]. */
+export interface PresentationResult {
+    /**
+     * Compact-serialised presentation:
+     * `<jws>~<revealed_d1>~<revealed_d2>~<kb-jwt>`. Note that the trailing
+     * `~` before the KB-JWT is part of the spec.
+     */
+    compact: string;
 }
 export interface VerificationResult {
     /** True if signature, hashes, and freshness all check out. */

package/dist/sdjwt/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sdjwt/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAA;IAEd;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAA;IAEX;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAEhC;;;OAGG;IACH,gBAAgB,EAAE,UAAU,CAAA;IAE5B;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IAEtB,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAA;IAEf,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAEhC,4CAA4C;IAC5C,eAAe,EAAE,MAAM,CAAA;CACxB;AAED,gDAAgD;AAChD,MAAM,WAAW,mBAAmB;IAClC,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAA;IAEf;;;;;OAKG;IACH,eAAe,EAAE,UAAU,CAAA;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,8DAA8D;IAC9D,KAAK,EAAE,OAAO,CAAA;IAEd;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAE/B,oCAAoC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,CAAA;IAEZ,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAA;CACf"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sdjwt/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAA;IAEd;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAA;IAEX;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAEhC;;;OAGG;IACH,gBAAgB,EAAE,UAAU,CAAA;IAE5B;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IAEtB,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,UAAU,CAAA;IAE5B;;;;;;OAMG;IACH,MAAM,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;CACtC;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAA;IAEf,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAEhC,4CAA4C;IAC5C,eAAe,EAAE,MAAM,CAAA;CACxB;AAED,gDAAgD;AAChD,MAAM,WAAW,mBAAmB;IAClC,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAA;IAEf;;;;;OAKG;IACH,eAAe,EAAE,UAAU,CAAA;IAE3B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAEzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IAEtB;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IAEpD;;;;;;OAMG;IACH,yBAAyB,CAAC,EAAE,UAAU,CAAA;CACvC;AAED,iDAAiD;AACjD,MAAM,WAAW,oBAAoB;IACnC,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAA;IAEf;;;;;;;;OAQG;IACH,cAAc,EAAE,MAAM,EAAE,CAAA;IAExB;;;;;OAKG;IACH,gBAAgB,EAAE,UAAU,CAAA;IAE5B;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAA;IAEhB;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAA;CACd;AAED,oCAAoC;AACpC,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,8DAA8D;IAC9D,KAAK,EAAE,OAAO,CAAA;IAEd;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAE/B,oCAAoC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,CAAA;IAEZ,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAA;CACf"}

package/dist/sdjwt/verify.d.ts

@@ -1,9 +1,22 @@
 /**
- * Verify an SD-JWT VC.
+ * Verify an SD-JWT VC, optionally including a Key-Binding JWT.
  *
- * Phase 1 verifies signature, freshness (`iat`/`nbf`/`exp`), and
- * reconstructs the disclosed claims. Status-list and KB-JWT
- * verification land in Phase 2.
+ * Phase 1 verified just the issuer's signature + freshness; Phase 2
+ * adds an optional KB-JWT path. When the caller supplies
+ * `expectedAudience` and/or `expectedNonce`, the verifier:
+ *   - requires a KB-JWT to be present in the compact form,
+ *   - extracts the holder's public key from the SD-JWT's `cnf.jwk`,
+ *   - verifies the KB-JWT signature against that key,
+ *   - checks `aud` and `nonce` match the caller's expectations,
+ *   - confirms `sd_hash` matches the hash of the SD-JWT being presented.
+ *
+ * If neither expected* is set, the verifier behaves as Phase 1 — bearer
+ * presentations remain accepted.
+ *
+ * KB-JWT parsing is done in this module rather than via sd-jwt-js's
+ * `verify()` because sd-jwt-js conflates "extract KB-JWT" and "check
+ * nonce" in a single option, leaving us no clean way to surface
+ * `aud mismatch` separately from `nonce mismatch`.
  */
 import type { VerifySdJwtVcParams, VerificationResult } from './types.js';
 export declare function verifySdJwtVc(params: VerifySdJwtVcParams): Promise<VerificationResult>;

package/dist/sdjwt/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/sdjwt/verify.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAEzE,wBAAsB,aAAa,CACjC,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CAyC7B"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/sdjwt/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAWH,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AA4EzE,wBAAsB,aAAa,CACjC,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CAuI7B"}

package/dist/sdjwt/verify.js

@@ -1,12 +1,81 @@
 /**
- * Verify an SD-JWT VC.
+ * Verify an SD-JWT VC, optionally including a Key-Binding JWT.
  *
- * Phase 1 verifies signature, freshness (`iat`/`nbf`/`exp`), and
- * reconstructs the disclosed claims. Status-list and KB-JWT
- * verification land in Phase 2.
+ * Phase 1 verified just the issuer's signature + freshness; Phase 2
+ * adds an optional KB-JWT path. When the caller supplies
+ * `expectedAudience` and/or `expectedNonce`, the verifier:
+ *   - requires a KB-JWT to be present in the compact form,
+ *   - extracts the holder's public key from the SD-JWT's `cnf.jwk`,
+ *   - verifies the KB-JWT signature against that key,
+ *   - checks `aud` and `nonce` match the caller's expectations,
+ *   - confirms `sd_hash` matches the hash of the SD-JWT being presented.
+ *
+ * If neither expected* is set, the verifier behaves as Phase 1 — bearer
+ * presentations remain accepted.
+ *
+ * KB-JWT parsing is done in this module rather than via sd-jwt-js's
+ * `verify()` because sd-jwt-js conflates "extract KB-JWT" and "check
+ * nonce" in a single option, leaving us no clean way to surface
+ * `aud mismatch` separately from `nonce mismatch`.
  */
 import { SDJwtVcInstance } from '@sd-jwt/sd-jwt-vc';
-import { makeEd25519Verifier, sdJwtHasher } from './signer.js';
+import * as ed from '@noble/ed25519';
+import { sha256 } from '@noble/hashes/sha2';
+import { ed25519PublicKeyFromJwk, makeEd25519Verifier, sdJwtHasher, } from './signer.js';
+function fromBase64Url(input) {
+    const padded = input
+        .replace(/-/g, '+')
+        .replace(/_/g, '/')
+        .padEnd(input.length + ((4 - (input.length % 4)) % 4), '=');
+    return new Uint8Array(Buffer.from(padded, 'base64'));
+}
+function toBase64Url(input) {
+    return Buffer.from(input)
+        .toString('base64')
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=/g, '');
+}
+/**
+ * Decode (without verifying) the KB-JWT off the end of a compact SD-JWT.
+ *
+ * The compact form is `<jws>~<d1>~<d2>~<kb-jwt>`. The KB-JWT is the
+ * final non-empty segment; the `<jws>~<d1>~...~` prefix (with the
+ * trailing `~` retained) is what `sd_hash` covers per spec §3.3.
+ */
+function extractKbJwt(compact) {
+    const lastTilde = compact.lastIndexOf('~');
+    if (lastTilde < 0)
+        return null;
+    const kbCompact = compact.slice(lastTilde + 1);
+    if (kbCompact.length === 0)
+        return null;
+    const sdJwtBody = compact.slice(0, lastTilde + 1); // includes trailing `~`
+    const segments = kbCompact.split('.');
+    if (segments.length !== 3)
+        return null;
+    let payload;
+    try {
+        payload = JSON.parse(new TextDecoder().decode(fromBase64Url(segments[1])));
+    }
+    catch {
+        return null;
+    }
+    return { kbCompact, sdJwtBody, payload };
+}
+async function verifyKbSignature(kbCompact, holderPublicKey) {
+    const segments = kbCompact.split('.');
+    if (segments.length !== 3)
+        return false;
+    const signingInput = `${segments[0]}.${segments[1]}`;
+    const signature = fromBase64Url(segments[2]);
+    try {
+        return await ed.verifyAsync(signature, new TextEncoder().encode(signingInput), holderPublicKey);
+    }
+    catch {
+        return false;
+    }
+}
 export async function verifySdJwtVc(params) {
     if (params.issuerPublicKey.length !== 32) {
         return {
@@ -15,31 +84,31 @@ export async function verifySdJwtVc(params) {
             error: `issuerPublicKey must be 32 bytes, got ${params.issuerPublicKey.length}`,
         };
     }
+    const requireKb = params.expectedAudience !== undefined ||
+        params.expectedNonce !== undefined;
+    const statusListVerifier = params.statusListIssuerPublicKey
+        ? makeEd25519Verifier(params.statusListIssuerPublicKey)
+        : makeEd25519Verifier(params.issuerPublicKey);
     const sdjwt = new SDJwtVcInstance({
         verifier: makeEd25519Verifier(params.issuerPublicKey),
         hasher: sdJwtHasher,
         hashAlg: 'sha-256',
         loadTypeMetadataFormat: false,
+        // Wire status-list lookup if the caller supplied a fetcher.
+        // sd-jwt-vc fetches the status-list JWT, verifies its signature,
+        // looks up `idx`, and (by default) treats any non-zero status as
+        // revoked.
+        ...(params.statusListFetcher !== undefined
+            ? {
+                statusListFetcher: params.statusListFetcher,
+                statusVerifier: statusListVerifier,
+            }
+            : {}),
     });
+    let payload;
     try {
         const result = await sdjwt.verify(params.compact);
-        const payload = result.payload;
-        // sd-jwt-js's verify() reconstructs the disclosed claims and merges
-        // them into the payload, dropping the `_sd` arrays. So
-        // `result.payload` is already the full revealed claim set.
-        const claims = {};
-        for (const [k, v] of Object.entries(payload)) {
-            // Drop SD-JWT housekeeping fields from the user-facing claim set.
-            if (k === '_sd' || k === '_sd_alg' || k === 'cnf')
-                continue;
-            claims[k] = v;
-        }
-        const out = { valid: true, claims };
-        if (typeof payload['iss'] === 'string')
-            out.issuer = payload['iss'];
-        if (typeof payload['vct'] === 'string')
-            out.vct = payload['vct'];
-        return out;
+        payload = result.payload;
     }
     catch (e) {
         return {
@@ -48,5 +117,85 @@ export async function verifySdJwtVc(params) {
             error: e instanceof Error ? e.message : String(e),
         };
     }
+    if (requireKb) {
+        const parsed = extractKbJwt(params.compact);
+        if (!parsed) {
+            return {
+                valid: false,
+                claims: {},
+                error: 'KB-JWT required but not present in compact form',
+            };
+        }
+        const cnf = payload.cnf;
+        if (!cnf?.jwk) {
+            return {
+                valid: false,
+                claims: {},
+                error: 'SD-JWT does not bind a holder key (`cnf.jwk` missing)',
+            };
+        }
+        let holderPk;
+        try {
+            holderPk = ed25519PublicKeyFromJwk(cnf.jwk);
+        }
+        catch (e) {
+            return {
+                valid: false,
+                claims: {},
+                error: `cnf.jwk invalid: ${e instanceof Error ? e.message : String(e)}`,
+            };
+        }
+        const sigOk = await verifyKbSignature(parsed.kbCompact, holderPk);
+        if (!sigOk) {
+            return {
+                valid: false,
+                claims: {},
+                error: 'KB-JWT signature does not match the holder key from cnf.jwk',
+            };
+        }
+        if (params.expectedAudience !== undefined &&
+            parsed.payload.aud !== params.expectedAudience) {
+            return {
+                valid: false,
+                claims: {},
+                error: `KB-JWT aud mismatch: expected ${params.expectedAudience}, got ${parsed.payload.aud ?? '<missing>'}`,
+            };
+        }
+        if (params.expectedNonce !== undefined &&
+            parsed.payload.nonce !== params.expectedNonce) {
+            return {
+                valid: false,
+                claims: {},
+                error: `KB-JWT nonce mismatch: expected ${params.expectedNonce}, got ${parsed.payload.nonce ?? '<missing>'}`,
+            };
+        }
+        // Confirm sd_hash matches the SHA-256 of the SD-JWT body (everything
+        // before the KB-JWT, with the trailing `~` retained per spec).
+        if (parsed.payload.sd_hash !== undefined) {
+            const expectedHash = toBase64Url(sha256(new TextEncoder().encode(parsed.sdJwtBody)));
+            if (parsed.payload.sd_hash !== expectedHash) {
+                return {
+                    valid: false,
+                    claims: {},
+                    error: 'KB-JWT sd_hash does not cover the presented SD-JWT body',
+                };
+            }
+        }
+    }
+    // sd-jwt-js's verify() reconstructs disclosed claims and merges
+    // them into the payload, dropping the `_sd` arrays. The caller
+    // should never see SD-JWT housekeeping fields.
+    const claims = {};
+    for (const [k, v] of Object.entries(payload)) {
+        if (k === '_sd' || k === '_sd_alg' || k === 'cnf')
+            continue;
+        claims[k] = v;
+    }
+    const out = { valid: true, claims };
+    if (typeof payload['iss'] === 'string')
+        out.issuer = payload['iss'];
+    if (typeof payload['vct'] === 'string')
+        out.vct = payload['vct'];
+    return out;
 }
 //# sourceMappingURL=verify.js.map

package/dist/sdjwt/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/sdjwt/verify.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAG9D,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAA2B;IAE3B,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACzC,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,EAAE;YACV,KAAK,EAAE,yCAAyC,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE;SAChF,CAAA;IACH,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC;QAChC,QAAQ,EAAE,mBAAmB,CAAC,MAAM,CAAC,eAAe,CAAC;QACrD,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,SAAS;QAClB,sBAAsB,EAAE,KAAK;KAC9B,CAAC,CAAA;IAEF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QACjD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAkC,CAAA;QAEzD,oEAAoE;QACpE,uDAAuD;QACvD,2DAA2D;QAC3D,MAAM,MAAM,GAA4B,EAAE,CAAA;QAC1C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,kEAAkE;YAClE,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,KAAK;gBAAE,SAAQ;YAC3D,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QACf,CAAC;QAED,MAAM,GAAG,GAAuB,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;QACvD,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ;YAAE,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;QACnE,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ;YAAE,GAAG,CAAC,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;QAChE,OAAO,GAAG,CAAA;IACZ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,EAAE;YACV,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;SAClD,CAAA;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/sdjwt/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAA;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAC3C,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,WAAW,GACZ,MAAM,aAAa,CAAA;AAGpB,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,MAAM,GAAG,KAAK;SACjB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC7D,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;AACtD,CAAC;AAED,SAAS,WAAW,CAAC,KAAiB;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SACtB,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;AACtB,CAAC;AAeD;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IAC1C,IAAI,SAAS,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAC9B,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAA;IAC9C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACvC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,CAAA,CAAC,wBAAwB;IAC1E,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACtC,IAAI,OAAqB,CAAA;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAClB,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,CACtC,CAAA;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,CAAA;AAC1C,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,SAAiB,EACjB,eAA2B;IAE3B,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACvC,MAAM,YAAY,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAE,IAAI,QAAQ,CAAC,CAAC,CAAE,EAAE,CAAA;IACtD,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAA;IAC7C,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,WAAW,CACzB,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EACtC,eAAe,CAChB,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAA2B;IAE3B,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACzC,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,EAAE;YACV,KAAK,EAAE,yCAAyC,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE;SAChF,CAAA;IACH,CAAC;IAED,MAAM,SAAS,GACb,MAAM,CAAC,gBAAgB,KAAK,SAAS;QACrC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAA;IAEpC,MAAM,kBAAkB,GAAG,MAAM,CAAC,yBAAyB;QACzD,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,yBAAyB,CAAC;QACvD,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;IAE/C,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC;QAChC,QAAQ,EAAE,mBAAmB,CAAC,MAAM,CAAC,eAAe,CAAC;QACrD,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,SAAS;QAClB,sBAAsB,EAAE,KAAK;QAC7B,4DAA4D;QAC5D,iEAAiE;QACjE,iEAAiE;QACjE,WAAW;QACX,GAAG,CAAC,MAAM,CAAC,iBAAiB,KAAK,SAAS;YACxC,CAAC,CAAC;gBACE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBAC3C,cAAc,EAAE,kBAAkB;aACnC;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAA;IAEF,IAAI,OAAgC,CAAA;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QACjD,OAAO,GAAG,MAAM,CAAC,OAAkC,CAAA;IACrD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,EAAE;YACV,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;SAClD,CAAA;IACH,CAAC;IAED,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,iDAAiD;aACzD,CAAA;QACH,CAAC;QAED,MAAM,GAAG,GAAI,OAAuC,CAAC,GAAG,CAAA;QACxD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;YACd,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,uDAAuD;aAC/D,CAAA;QACH,CAAC;QACD,IAAI,QAAoB,CAAA;QACxB,IAAI,CAAC;YACH,QAAQ,GAAG,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC7C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,oBAAoB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;aACxE,CAAA;QACH,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;QACjE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,6DAA6D;aACrE,CAAA;QACH,CAAC;QAED,IACE,MAAM,CAAC,gBAAgB,KAAK,SAAS;YACrC,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,gBAAgB,EAC9C,CAAC;YACD,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,iCAAiC,MAAM,CAAC,gBAAgB,SAAS,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,WAAW,EAAE;aAC5G,CAAA;QACH,CAAC;QAED,IACE,MAAM,CAAC,aAAa,KAAK,SAAS;YAClC,MAAM,CAAC,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,aAAa,EAC7C,CAAC;YACD,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,mCAAmC,MAAM,CAAC,aAAa,SAAS,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,WAAW,EAAE;aAC7G,CAAA;QACH,CAAC;QAED,qEAAqE;QACrE,+DAA+D;QAC/D,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACzC,MAAM,YAAY,GAAG,WAAW,CAC9B,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CACnD,CAAA;YACD,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;gBAC5C,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,EAAE;oBACV,KAAK,EAAE,yDAAyD;iBACjE,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,+DAA+D;IAC/D,+CAA+C;IAC/C,MAAM,MAAM,GAA4B,EAAE,CAAA;IAC1C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,KAAK;YAAE,SAAQ;QAC3D,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IACf,CAAC;IAED,MAAM,GAAG,GAAuB,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IACvD,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ;QAAE,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;IACnE,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ;QAAE,GAAG,CAAC,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;IAChE,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solidus-network/sdk",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Solidus Network SDK — DID resolution, verifiable credential issuance and verification, SD-JWT VC (EUDI-compatible), and on-chain queries via JSON-RPC.",
   "type": "module",
   "main": "./dist/index.js",
@@ -17,8 +17,8 @@
     "@noble/hashes": "^1.5.0",
     "@sd-jwt/sd-jwt-vc": "^0.19.0",
     "@sd-jwt/types": "^0.19.0",
-    "@solidus-network/auth": "0.2.0",
-    "@solidus-network/types": "0.2.0",
+    "@solidus-network/auth": "0.3.0",
+    "@solidus-network/types": "0.3.0",
     "bs58": "^6.0.0",
     "postgres": "^3.4.4"
   },