@solidus-network/sdk 0.2.0 → 0.5.0

package/dist/index.d.ts

@@ -1,15 +1,52 @@
 import type { DID, DIDDocument, VerifiableCredential, IssueCredentialParams, VerificationResult, AuthResult } from '@solidus-network/types';
+import type { ChainTransaction } from './chain/transaction.js';
+export type { ChainTransaction } from './chain/transaction.js';
+export { addressFromPublicKey, getAddressFromKey } from './chain/transaction.js';
 import type { BbsDisclosedMessage, BbsCredentialProofResult } from './chain/bbs.js';
+import type { ChainInfo } from './chain/chainInfo.js';
 export type { DID, DIDDocument, VerifiableCredential, IssueCredentialParams, VerificationResult, AuthResult, };
 export { runMigrations, closeConnection } from './stub/db.js';
 export { generateKeypair, decodePublicKey } from './stub/crypto.js';
 export type { ChainConfig } from './chain/index.js';
+export { createChainClient } from './chain/index.js';
 export type { BbsDisclosedMessage, BbsCredentialProofResult, BbsCredentialRecord, } from './chain/bbs.js';
 export { utf8ToHex, toHex } from './chain/bbs.js';
-export { issueSdJwtVc, verifySdJwtVc, } from './sdjwt/index.js';
-export type { IssueSdJwtVcParams, IssuedSdJwtVc, VerifySdJwtVcParams, VerificationResult as SdJwtVerificationResult, } from './sdjwt/index.js';
+export type { ChainInfo, NativeToken } from './chain/chainInfo.js';
+export { issueSdJwtVc, verifySdJwtVc, presentSdJwtVc, createStatusListJwt, ed25519PublicKeyToJwk, ed25519PublicKeyFromJwk, } from './sdjwt/index.js';
+export type { IssueSdJwtVcParams, IssuedSdJwtVc, VerifySdJwtVcParams, PresentSdJwtVcParams, PresentationResult, CreateStatusListJwtParams, Ed25519Jwk, VerificationResult as SdJwtVerificationResult, } from './sdjwt/index.js';
 export interface SolidusSDK {
     did: {
+        /**
+         * Build (and sign) a `DidCreate` transaction without submitting it.
+         * Returns a content-addressed signed tx that can be relayed by any
+         * party — typically the user signs locally and a backend submits.
+         *
+         * The chain enforces `signer_pubkey == payload.public_key`
+         * (PublicKeyMismatch invariant), so `signerPrivateKey` MUST own the
+         * registered public key. When `publicKey` is omitted it is derived
+         * from the signing key — the common case.
+         *
+         * Available in chain mode; stub-mode implementation is minimal but
+         * shape-compatible (callers can write tests once and run in either).
+         */
+        buildCreate(opts: {
+            signerPrivateKey: string;
+            publicKey?: string;
+            serviceEndpoints?: unknown[];
+            nonce?: number;
+        }): Promise<ChainTransaction>;
+        /**
+         * Submit a previously-built `DidCreate` transaction, poll its
+         * receipt, and return the DID descriptor. Accepts either the
+         * `ChainTransaction` object or a stringified JSON tx (the common
+         * shape for relay paths where the tx arrived as an HTTP body).
+         */
+        submitCreate(signedTx: ChainTransaction | string): Promise<DID>;
+        /**
+         * Convenience wrapper for the case where the SDK's configured
+         * signer owns the public key being registered. Throws otherwise —
+         * use `buildCreate` + `submitCreate` for the relay pattern.
+         */
         create(publicKey: string): Promise<DID>;
         resolve(did: string): Promise<DIDDocument | null>;
         deactivate(did: string, signerKey: string): Promise<void>;
@@ -57,6 +94,43 @@ export interface SolidusSDK {
             disclosedMessages: BbsDisclosedMessage[];
         }): Promise<BbsCredentialProofResult>;
     };
+    /**
+     * Low-level chain primitives. Used by relayer / onboarding paths that
+     * need to seed new accounts with native token before they can pay
+     * their first tx fee, or perform plain transfers outside of DID and
+     * credential semantics. Available only in chain mode — `undefined` in
+     * stub mode.
+     */
+    chain?: {
+        /**
+         * Submit a `Transfer` transaction and wait for its receipt. Throws
+         * on a failed receipt. `toAddress` is a base58 address (the format
+         * `addressFromPublicKey` returns), not a public key.
+         */
+        transfer(opts: {
+            signerPrivateKey: string;
+            toAddress: string;
+            amount: number;
+            nonce?: number;
+        }): Promise<{
+            tx_hash: string;
+            status: string;
+            block_height: number;
+            fee_paid: number;
+            events: Array<{
+                type: string;
+                [key: string]: unknown;
+            }>;
+        }>;
+        /** Balance (in base units) for the given base58 address. */
+        getBalance(address: string): Promise<number>;
+    };
+    /**
+     * Fetch chain metadata (id, native token, genesis hash, latest height,
+     * node version) via the `solidus_chainInfo` RPC method. Available only in
+     * chain mode (testnet/mainnet) — `undefined` in stub mode.
+     */
+    getChainInfo?(): Promise<ChainInfo>;
 }
 export interface SolidusConfig {
     mode: 'stub' | 'testnet' | 'mainnet';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,GAAG,EAAE,WAAW,EAAE,oBAAoB,EACtC,qBAAqB,EAAE,kBAAkB,EAAE,UAAU,EACtD,MAAM,gBAAgB,CAAA;AAKvB,OAAO,KAAK,EACV,mBAAmB,EACnB,wBAAwB,EAEzB,MAAM,gBAAgB,CAAA;AAEvB,YAAY,EACV,GAAG,EAAE,WAAW,EAAE,oBAAoB,EACtC,qBAAqB,EAAE,kBAAkB,EAAE,UAAU,GACtD,CAAA;AACD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC7D,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AACnE,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACnD,YAAY,EACV,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAA;AAIjD,OAAO,EACL,YAAY,EACZ,aAAa,GACd,MAAM,kBAAkB,CAAA;AACzB,YAAY,EACV,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,kBAAkB,IAAI,uBAAuB,GAC9C,MAAM,kBAAkB,CAAA;AAEzB,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE;QACH,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QACvC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;QACjD,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;KAC1D,CAAA;IACD,WAAW,EAAE;QACX,KAAK,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;QACnE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;QACjD,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9D,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAA;KAC3D,CAAA;IACD,IAAI,EAAE;QACJ,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;QAChD,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;KACvF,CAAA;IACD;;;OAGG;IACH,GAAG,CAAC,EAAE;QACJ,eAAe,CAAC,MAAM,EAAE;YACtB,gBAAgB,EAAE,MAAM,CAAA;YACxB,UAAU,EAAE,MAAM,CAAA;YAClB,cAAc,EAAE,MAAM,CAAA;YACtB,WAAW,EAAE,UAAU,CAAA;YACvB,SAAS,EAAE,UAAU,CAAA;YACrB,eAAe,EAAE,MAAM,CAAA;SACxB,GAAG,OAAO,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,OAAO,CAAA;SAAE,CAAC,CAAA;QACvE,WAAW,CAAC,MAAM,EAAE;YAClB,QAAQ,EAAE,MAAM,CAAA;YAChB,SAAS,EAAE,MAAM,CAAA;YACjB,SAAS,CAAC,EAAE,MAAM,CAAA;YAClB,KAAK,CAAC,EAAE,MAAM,CAAA;YACd,iBAAiB,EAAE,mBAAmB,EAAE,CAAA;YACxC,iBAAiB,EAAE,MAAM,CAAA;SAC1B,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;QACpB,qBAAqB,CAAC,MAAM,EAAE;YAC5B,YAAY,EAAE,MAAM,CAAA;YACpB,QAAQ,EAAE,MAAM,CAAA;YAChB,SAAS,CAAC,EAAE,MAAM,CAAA;YAClB,KAAK,CAAC,EAAE,MAAM,CAAA;YACd,iBAAiB,EAAE,mBAAmB,EAAE,CAAA;SACzC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAA;KACtC,CAAA;CACF;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAA;IACpC,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,gEAAgE;IAChE,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAkCD,wBAAgB,SAAS,CAAC,MAAM,EAAE,aAAa,GAAG,UAAU,CAiB3D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,GAAG,EAAE,WAAW,EAAE,oBAAoB,EACtC,qBAAqB,EAAE,kBAAkB,EAAE,UAAU,EACtD,MAAM,gBAAgB,CAAA;AAKvB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAC9D,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAC9D,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAChF,OAAO,KAAK,EACV,mBAAmB,EACnB,wBAAwB,EAEzB,MAAM,gBAAgB,CAAA;AACvB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAErD,YAAY,EACV,GAAG,EAAE,WAAW,EAAE,oBAAoB,EACtC,qBAAqB,EAAE,kBAAkB,EAAE,UAAU,GACtD,CAAA;AACD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC7D,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AACnE,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACpD,YAAY,EACV,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAA;AACjD,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAMlE,OAAO,EACL,YAAY,EACZ,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EACV,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,yBAAyB,EACzB,UAAU,EACV,kBAAkB,IAAI,uBAAuB,GAC9C,MAAM,kBAAkB,CAAA;AAEzB,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE;QACH;;;;;;;;;;;;WAYG;QACH,WAAW,CAAC,IAAI,EAAE;YAChB,gBAAgB,EAAE,MAAM,CAAA;YACxB,SAAS,CAAC,EAAE,MAAM,CAAA;YAClB,gBAAgB,CAAC,EAAE,OAAO,EAAE,CAAA;YAC5B,KAAK,CAAC,EAAE,MAAM,CAAA;SACf,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;QAC7B;;;;;WAKG;QACH,YAAY,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QAC/D;;;;WAIG;QACH,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QACvC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;QACjD,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;KAC1D,CAAA;IACD,WAAW,EAAE;QACX,KAAK,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;QACnE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;QACjD,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9D,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAA;KAC3D,CAAA;IACD,IAAI,EAAE;QACJ,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;QAChD,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;KACvF,CAAA;IACD;;;OAGG;IACH,GAAG,CAAC,EAAE;QACJ,eAAe,CAAC,MAAM,EAAE;YACtB,gBAAgB,EAAE,MAAM,CAAA;YACxB,UAAU,EAAE,MAAM,CAAA;YAClB,cAAc,EAAE,MAAM,CAAA;YACtB,WAAW,EAAE,UAAU,CAAA;YACvB,SAAS,EAAE,UAAU,CAAA;YACrB,eAAe,EAAE,MAAM,CAAA;SACxB,GAAG,OAAO,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,OAAO,CAAA;SAAE,CAAC,CAAA;QACvE,WAAW,CAAC,MAAM,EAAE;YAClB,QAAQ,EAAE,MAAM,CAAA;YAChB,SAAS,EAAE,MAAM,CAAA;YACjB,SAAS,CAAC,EAAE,MAAM,CAAA;YAClB,KAAK,CAAC,EAAE,MAAM,CAAA;YACd,iBAAiB,EAAE,mBAAmB,EAAE,CAAA;YACxC,iBAAiB,EAAE,MAAM,CAAA;SAC1B,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;QACpB,qBAAqB,CAAC,MAAM,EAAE;YAC5B,YAAY,EAAE,MAAM,CAAA;YACpB,QAAQ,EAAE,MAAM,CAAA;YAChB,SAAS,CAAC,EAAE,MAAM,CAAA;YAClB,KAAK,CAAC,EAAE,MAAM,CAAA;YACd,iBAAiB,EAAE,mBAAmB,EAAE,CAAA;SACzC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAA;KACtC,CAAA;IACD;;;;;;OAMG;IACH,KAAK,CAAC,EAAE;QACN;;;;WAIG;QACH,QAAQ,CAAC,IAAI,EAAE;YACb,gBAAgB,EAAE,MAAM,CAAA;YACxB,SAAS,EAAE,MAAM,CAAA;YACjB,MAAM,EAAE,MAAM,CAAA;YACd,KAAK,CAAC,EAAE,MAAM,CAAA;SACf,GAAG,OAAO,CAAC;YACV,OAAO,EAAE,MAAM,CAAA;YACf,MAAM,EAAE,MAAM,CAAA;YACd,YAAY,EAAE,MAAM,CAAA;YACpB,QAAQ,EAAE,MAAM,CAAA;YAChB,MAAM,EAAE,KAAK,CAAC;gBAAE,IAAI,EAAE,MAAM,CAAC;gBAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;aAAE,CAAC,CAAA;SACxD,CAAC,CAAA;QACF,4DAA4D;QAC5D,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;KAC7C,CAAA;IACD;;;;OAIG;IACH,YAAY,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,CAAA;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAA;IACpC,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,gEAAgE;IAChE,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAoCD,wBAAgB,SAAS,CAAC,MAAM,EAAE,aAAa,GAAG,UAAU,CAiB3D"}

package/dist/index.js

@@ -1,17 +1,23 @@
 import { randomUUID } from 'node:crypto';
-import { didCreate, didResolve, didDeactivate } from './stub/did.js';
+import { didCreate, didResolve, didDeactivate, didBuildCreate, didSubmitCreate } from './stub/did.js';
 import { credentialsIssue, credentialsVerify, credentialsRevoke, credentialsQuery } from './stub/credentials.js';
 import { getSql } from './stub/db.js';
 import { createChainClient } from './chain/index.js';
+export { addressFromPublicKey, getAddressFromKey } from './chain/transaction.js';
 export { runMigrations, closeConnection } from './stub/db.js';
 export { generateKeypair, decodePublicKey } from './stub/crypto.js';
+export { createChainClient } from './chain/index.js';
 export { utf8ToHex, toHex } from './chain/bbs.js';
 // SD-JWT VC (selective-disclosure JWT, VC profile) — required for
-// EUDI Wallet interop. Phase 1: issue + verify on flat subjects.
-export { issueSdJwtVc, verifySdJwtVc, } from './sdjwt/index.js';
+// EUDI Wallet interop.
+//   Phase 1: issue + verify on flat subjects.
+//   Phase 2: holder presentation API + Key-Binding JWT.
+export { issueSdJwtVc, verifySdJwtVc, presentSdJwtVc, createStatusListJwt, ed25519PublicKeyToJwk, ed25519PublicKeyFromJwk, } from './sdjwt/index.js';
 function createStubSdk() {
     return {
         did: {
+            buildCreate: didBuildCreate,
+            submitCreate: didSubmitCreate,
             create: didCreate,
             resolve: didResolve,
             deactivate: didDeactivate,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAKxC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AACpE,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAChH,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,OAAO,EAAE,iBAAiB,EAAoB,MAAM,kBAAkB,CAAA;AAWtE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC7D,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAOnE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAA;AAEjD,kEAAkE;AAClE,iEAAiE;AACjE,OAAO,EACL,YAAY,EACZ,aAAa,GACd,MAAM,kBAAkB,CAAA;AA+DzB,SAAS,aAAa;IACpB,OAAO;QACL,GAAG,EAAE;YACH,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,aAAa;SAC1B;QACD,WAAW,EAAE;YACX,KAAK,EAAE,gBAAgB;YACvB,MAAM,EAAE,iBAAiB;YACzB,MAAM,EAAE,iBAAiB;YACzB,KAAK,EAAE,gBAAgB;SACxB;QACD,IAAI,EAAE;YACJ,KAAK,CAAC,eAAe,CAAC,MAAc;gBAClC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAA;gBACpB,MAAM,SAAS,GAAG,UAAU,EAAE,CAAA;gBAC9B,MAAM,GAAG,CAAA,2DAA2D,SAAS,KAAK,MAAM,GAAG,CAAA;gBAC3F,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,KAAK,CAAC,kBAAkB,CACtB,GAAW,EACX,UAAkB,EAClB,OAAe;gBAEf,qDAAqD;gBACrD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;YACpC,CAAC;SACF;KACF,CAAA;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,MAAqB;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,CAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAgD,IAAI,MAAM,CAAC,CAAA;IAEvH,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,SAAS,CAAC;QACf,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,uBAAuB,CAAA;YACzF,MAAM,SAAS,GAAG,MAAM,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAA;YACpF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAA;YAC3F,CAAC;YACD,OAAO,iBAAiB,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QAClF,CAAC;QACD,KAAK,MAAM,CAAC;QACZ;YACE,OAAO,aAAa,EAAE,CAAA;IAC1B,CAAC;AACH,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAKxC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AACrG,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAChH,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,OAAO,EAAE,iBAAiB,EAAoB,MAAM,kBAAkB,CAAA;AAGtE,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAYhF,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC7D,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAEnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAMpD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAA;AAGjD,kEAAkE;AAClE,uBAAuB;AACvB,8CAA8C;AAC9C,wDAAwD;AACxD,OAAO,EACL,YAAY,EACZ,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,kBAAkB,CAAA;AAoIzB,SAAS,aAAa;IACpB,OAAO;QACL,GAAG,EAAE;YACH,WAAW,EAAE,cAAc;YAC3B,YAAY,EAAE,eAAe;YAC7B,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,aAAa;SAC1B;QACD,WAAW,EAAE;YACX,KAAK,EAAE,gBAAgB;YACvB,MAAM,EAAE,iBAAiB;YACzB,MAAM,EAAE,iBAAiB;YACzB,KAAK,EAAE,gBAAgB;SACxB;QACD,IAAI,EAAE;YACJ,KAAK,CAAC,eAAe,CAAC,MAAc;gBAClC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAA;gBACpB,MAAM,SAAS,GAAG,UAAU,EAAE,CAAA;gBAC9B,MAAM,GAAG,CAAA,2DAA2D,SAAS,KAAK,MAAM,GAAG,CAAA;gBAC3F,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,KAAK,CAAC,kBAAkB,CACtB,GAAW,EACX,UAAkB,EAClB,OAAe;gBAEf,qDAAqD;gBACrD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;YACpC,CAAC;SACF;KACF,CAAA;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,MAAqB;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,CAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAgD,IAAI,MAAM,CAAC,CAAA;IAEvH,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,SAAS,CAAC;QACf,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,uBAAuB,CAAA;YACzF,MAAM,SAAS,GAAG,MAAM,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAA;YACpF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAA;YAC3F,CAAC;YACD,OAAO,iBAAiB,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QAClF,CAAC;QACD,KAAK,MAAM,CAAC;QACZ;YACE,OAAO,aAAa,EAAE,CAAA;IAC1B,CAAC;AACH,CAAC"}

package/dist/sdjwt/index.d.ts

@@ -1,4 +1,8 @@
-export type { IssueSdJwtVcParams, IssuedSdJwtVc, VerifySdJwtVcParams, VerificationResult, } from './types.js';
+export type { IssueSdJwtVcParams, IssuedSdJwtVc, VerifySdJwtVcParams, VerificationResult, PresentSdJwtVcParams, PresentationResult, } from './types.js';
 export { issueSdJwtVc } from './issue.js';
 export { verifySdJwtVc } from './verify.js';
+export { presentSdJwtVc } from './present.js';
+export { createStatusListJwt } from './status-list.js';
+export type { CreateStatusListJwtParams } from './status-list.js';
+export { ed25519PublicKeyToJwk, ed25519PublicKeyFromJwk, type Ed25519Jwk, } from './signer.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/sdjwt/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sdjwt/index.ts"],"names":[],"mappings":"AAGA,YAAY,EACV,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sdjwt/index.ts"],"names":[],"mappings":"AAGA,YAAY,EACV,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AACtD,YAAY,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAA;AACjE,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,UAAU,GAChB,MAAM,aAAa,CAAA"}

package/dist/sdjwt/index.js

@@ -2,4 +2,7 @@
 // See `.claude/plans/2026-05-09-sdjwt-vc-implementation.md`.
 export { issueSdJwtVc } from './issue.js';
 export { verifySdJwtVc } from './verify.js';
+export { presentSdJwtVc } from './present.js';
+export { createStatusListJwt } from './status-list.js';
+export { ed25519PublicKeyToJwk, ed25519PublicKeyFromJwk, } from './signer.js';
 //# sourceMappingURL=index.js.map

package/dist/sdjwt/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sdjwt/index.ts"],"names":[],"mappings":"AAAA,qCAAqC;AACrC,6DAA6D;AAS7D,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sdjwt/index.ts"],"names":[],"mappings":"AAAA,qCAAqC;AACrC,6DAA6D;AAW7D,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAEtD,OAAO,EACL,qBAAqB,EACrB,uBAAuB,GAExB,MAAM,aAAa,CAAA"}

package/dist/sdjwt/issue.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"issue.d.ts","sourceRoot":"","sources":["../../src/sdjwt/issue.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAWH,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAgBnE,wBAAsB,YAAY,CAChC,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,aAAa,CAAC,CAmExB"}
+{"version":3,"file":"issue.d.ts","sourceRoot":"","sources":["../../src/sdjwt/issue.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAYH,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAuDnE,wBAAsB,YAAY,CAChC,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,aAAa,CAAC,CA+ExB"}

package/dist/sdjwt/issue.js

@@ -9,15 +9,44 @@
  */
 import { SDJwtVcInstance } from '@sd-jwt/sd-jwt-vc';
 import * as ed from '@noble/ed25519';
-import { makeEd25519Signer, sdJwtHasher, sdJwtSaltGenerator, } from './signer.js';
+import { ed25519PublicKeyToJwk, makeEd25519Signer, sdJwtHasher, sdJwtSaltGenerator, } from './signer.js';
+/**
+ * Build a sd-jwt-js DisclosureFrame from a list of disclosable claim
+ * paths (Phase 2c). Each path is a dot-separated string like
+ * `address.street`. The resulting frame is recursive — nested `_sd`
+ * arrays per object level — matching sd-jwt-js's DisclosureFrame type.
+ *
+ * Default behaviour (when `disclosable` is undefined): every top-level
+ * key except `id` is disclosable. Nested objects are NOT auto-expanded
+ * — callers who want nested disclosure must pass explicit paths.
+ */
 function buildDisclosureFrame(subject, disclosable) {
-    // Only flat top-level subject keys are disclosable in Phase 1.
-    // Nested-path disclosure (sd-jwt-js supports it via recursive _sd
-    // arrays) is deferred. Default: every key except `id` is disclosable.
-    const keys = disclosable ?? Object.keys(subject).filter((k) => k !== 'id');
-    // sd-jwt-js types the _sd array as (keyof Payload)[]; we keep the
-    // payload generic so the runtime list of strings has to be cast.
-    return { _sd: keys };
+    const paths = disclosable ?? Object.keys(subject).filter((k) => k !== 'id');
+    // Flat fast path: no dotted paths → original Phase 1 behaviour.
+    if (paths.every((p) => !p.includes('.'))) {
+        return { _sd: paths };
+    }
+    const root = { _sd: [] };
+    for (const path of paths) {
+        const segments = path.split('.');
+        let cursor = root;
+        for (let i = 0; i < segments.length; i++) {
+            const seg = segments[i];
+            if (i === segments.length - 1) {
+                cursor._sd.push(seg);
+            }
+            else {
+                const existing = cursor[seg];
+                if (existing === undefined ||
+                    Array.isArray(existing) ||
+                    seg === '_sd') {
+                    cursor[seg] = { _sd: [] };
+                }
+                cursor = cursor[seg];
+            }
+        }
+    }
+    return root;
 }
 export async function issueSdJwtVc(params) {
     if (params.issuerPrivateKey.length !== 32) {
@@ -58,6 +87,18 @@ export async function issueSdJwtVc(params) {
     if (params.validUntil !== undefined) {
         payload['exp'] = Math.floor(new Date(params.validUntil).getTime() / 1000);
     }
+    // When a holder public key is supplied, bind the credential to that
+    // key via the W3C `cnf` claim (RFC 7800). The verifier checks the
+    // KB-JWT's signature against this key at presentation time.
+    if (params.holderPublicKey !== undefined) {
+        payload['cnf'] = { jwk: ed25519PublicKeyToJwk(params.holderPublicKey) };
+    }
+    // Optional status-list reference per draft-ietf-oauth-status-list.
+    if (params.status !== undefined) {
+        payload['status'] = {
+            status_list: { uri: params.status.uri, idx: params.status.idx },
+        };
+    }
     const disclosureFrame = buildDisclosureFrame(subject, params.disclosable);
     const compact = await sdjwt.issue(payload, disclosureFrame);
     // Quick sanity check that we can derive a count of disclosures from

package/dist/sdjwt/issue.js.map

@@ -1 +1 @@
-{"version":3,"file":"issue.js","sourceRoot":"","sources":["../../src/sdjwt/issue.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAA;AAEpC,OAAO,EACL,iBAAiB,EACjB,WAAW,EACX,kBAAkB,GACnB,MAAM,aAAa,CAAA;AAGpB,SAAS,oBAAoB,CAC3B,OAAgC,EAChC,WAAsB;IAEtB,+DAA+D;IAC/D,kEAAkE;IAClE,sEAAsE;IACtE,MAAM,IAAI,GACR,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAA;IAC/D,kEAAkE;IAClE,iEAAiE;IACjE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAyD,CAAA;AAC7E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAA0B;IAE1B,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,0CAA0C,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAC3E,CAAA;IACH,CAAC;IAED,6DAA6D;IAC7D,qEAAqE;IACrE,sDAAsD;IACtD,MAAM,eAAe,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA;IAE3E,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC;QAChC,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAClD,OAAO,EAAE,OAAO;QAChB,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,SAAS;QAClB,aAAa,EAAE,kBAAkB;QACjC,+DAA+D;QAC/D,8DAA8D;QAC9D,qDAAqD;QACrD,sBAAsB,EAAE,KAAK;KAC9B,CAAC,CAAA;IAEF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAA;IACrC,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC/E,qEAAqE;IACrE,2CAA2C;IAC3C,OAAO,OAAO,CAAC,IAAI,CAAC,CAAA;IAEpB,MAAM,OAAO,GAA4B;QACvC,GAAG,EAAE,MAAM,CAAC,MAAM;QAClB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,GAAG;QACR,GAAG,OAAO;KACX,CAAA;IACD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,CAAC,KAAK,CAAC,GAAG,SAAS,CAAA;IACvD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAA;IAC1E,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAA;IAC3E,CAAC;IAED,MAAM,eAAe,GAAG,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;IACzE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,KAAK,CAC/B,OAA4C,EAC5C,eAAoD,CACrD,CAAA;IAED,oEAAoE;IACpE,gEAAgE;IAChE,+DAA+D;IAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAChC,MAAM,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,CAAA;IAEzE,gEAAgE;IAChE,kEAAkE;IAClE,sDAAsD;IACtD,KAAK,eAAe,CAAA;IAEpB,OAAO;QACL,OAAO;QACP,OAAO;QACP,eAAe;KAChB,CAAA;AACH,CAAC"}
+{"version":3,"file":"issue.js","sourceRoot":"","sources":["../../src/sdjwt/issue.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAA;AAEpC,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,WAAW,EACX,kBAAkB,GACnB,MAAM,aAAa,CAAA;AAGpB;;;;;;;;;GASG;AACH,SAAS,oBAAoB,CAC3B,OAAgC,EAChC,WAAsB;IAEtB,MAAM,KAAK,GACT,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAA;IAE/D,gEAAgE;IAChE,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACzC,OAAO,EAAE,GAAG,EAAE,KAAK,EAElB,CAAA;IACH,CAAC;IAOD,MAAM,IAAI,GAAc,EAAE,GAAG,EAAE,EAAE,EAAE,CAAA;IACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,MAAM,GAAc,IAAI,CAAA;QAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAA;YACxB,IAAI,CAAC,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACtB,CAAC;iBAAM,CAAC;gBACN,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;gBAC5B,IACE,QAAQ,KAAK,SAAS;oBACtB,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;oBACvB,GAAG,KAAK,KAAK,EACb,CAAC;oBACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAe,CAAA;gBACxC,CAAC;gBACD,MAAM,GAAG,MAAM,CAAC,GAAG,CAAc,CAAA;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAA2D,CAAA;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAA0B;IAE1B,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,0CAA0C,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAC3E,CAAA;IACH,CAAC;IAED,6DAA6D;IAC7D,qEAAqE;IACrE,sDAAsD;IACtD,MAAM,eAAe,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA;IAE3E,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC;QAChC,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAClD,OAAO,EAAE,OAAO;QAChB,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,SAAS;QAClB,aAAa,EAAE,kBAAkB;QACjC,+DAA+D;QAC/D,8DAA8D;QAC9D,qDAAqD;QACrD,sBAAsB,EAAE,KAAK;KAC9B,CAAC,CAAA;IAEF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAA;IACrC,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC/E,qEAAqE;IACrE,2CAA2C;IAC3C,OAAO,OAAO,CAAC,IAAI,CAAC,CAAA;IAEpB,MAAM,OAAO,GAA4B;QACvC,GAAG,EAAE,MAAM,CAAC,MAAM;QAClB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,GAAG;QACR,GAAG,OAAO;KACX,CAAA;IACD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,CAAC,KAAK,CAAC,GAAG,SAAS,CAAA;IACvD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAA;IAC1E,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAA;IAC3E,CAAC;IACD,oEAAoE;IACpE,kEAAkE;IAClE,4DAA4D;IAC5D,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,qBAAqB,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAA;IACzE,CAAC;IACD,mEAAmE;IACnE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,CAAC,QAAQ,CAAC,GAAG;YAClB,WAAW,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE;SAChE,CAAA;IACH,CAAC;IAED,MAAM,eAAe,GAAG,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;IACzE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,KAAK,CAC/B,OAA4C,EAC5C,eAAoD,CACrD,CAAA;IAED,oEAAoE;IACpE,gEAAgE;IAChE,+DAA+D;IAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAChC,MAAM,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,CAAA;IAEzE,gEAAgE;IAChE,kEAAkE;IAClE,sDAAsD;IACtD,KAAK,eAAe,CAAA;IAEpB,OAAO;QACL,OAAO;QACP,OAAO;QACP,eAAe;KAChB,CAAA;AACH,CAAC"}

package/dist/sdjwt/present.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Holder-side presentation API for SD-JWT VC.
+ *
+ * Phase 2. Takes an issued SD-JWT VC (with all disclosures attached)
+ * and returns a presentation that:
+ *   - reveals only the disclosures the holder consents to,
+ *   - is bound to a Key-Binding JWT signed by the holder's private key.
+ *
+ * The KB-JWT proves the holder controls the key referenced by the
+ * issuer-set `cnf.jwk` claim — without it, anyone with a copy of the
+ * compact form could replay the credential to a different verifier.
+ */
+import type { PresentSdJwtVcParams, PresentationResult } from './types.js';
+export declare function presentSdJwtVc(params: PresentSdJwtVcParams): Promise<PresentationResult>;
+//# sourceMappingURL=present.d.ts.map

package/dist/sdjwt/present.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"present.d.ts","sourceRoot":"","sources":["../../src/sdjwt/present.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAUH,OAAO,KAAK,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AA6C1E,wBAAsB,cAAc,CAClC,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CAmC7B"}

package/dist/sdjwt/present.js

@@ -0,0 +1,80 @@
+/**
+ * Holder-side presentation API for SD-JWT VC.
+ *
+ * Phase 2. Takes an issued SD-JWT VC (with all disclosures attached)
+ * and returns a presentation that:
+ *   - reveals only the disclosures the holder consents to,
+ *   - is bound to a Key-Binding JWT signed by the holder's private key.
+ *
+ * The KB-JWT proves the holder controls the key referenced by the
+ * issuer-set `cnf.jwk` claim — without it, anyone with a copy of the
+ * compact form could replay the credential to a different verifier.
+ */
+import { SDJwtVcInstance } from '@sd-jwt/sd-jwt-vc';
+import { makeEd25519Signer, sdJwtHasher, sdJwtSaltGenerator, } from './signer.js';
+/**
+ * Build a sd-jwt-js PresentationFrame from a list of claim paths
+ * (Phase 2c — supports nested paths via dot notation). Each path is
+ * either a top-level key (`'firstName'`) or a dotted path into a
+ * nested object (`'address.street'`). Result is a recursive map
+ * `{ key: true | { nestedKey: true } }` matching sd-jwt-js's
+ * PresentationFrame type.
+ */
+function buildPresentationFrame(reveal) {
+    // Flat fast path — preserves the original Phase 2 behaviour.
+    if (reveal.every((p) => !p.includes('.'))) {
+        const flat = {};
+        for (const k of reveal)
+            flat[k] = true;
+        return flat;
+    }
+    const root = {};
+    for (const path of reveal) {
+        const segments = path.split('.');
+        let cursor = root;
+        for (let i = 0; i < segments.length; i++) {
+            const seg = segments[i];
+            if (i === segments.length - 1) {
+                cursor[seg] = true;
+            }
+            else {
+                // If a previous path already pinned this segment as `true`,
+                // upgrade to an object so we can attach the nested key.
+                const existing = cursor[seg];
+                if (existing === true || existing === undefined) {
+                    cursor[seg] = {};
+                }
+                cursor = cursor[seg];
+            }
+        }
+    }
+    return root;
+}
+export async function presentSdJwtVc(params) {
+    if (params.holderPrivateKey.length !== 32) {
+        throw new Error(`holderPrivateKey must be 32 bytes, got ${params.holderPrivateKey.length}`);
+    }
+    // Holder uses its own key as the KB-JWT signer. The issuer-side
+    // signer is irrelevant here — present() does not re-sign the SD-JWT,
+    // only the new KB-JWT.
+    const sdjwt = new SDJwtVcInstance({
+        hasher: sdJwtHasher,
+        saltGenerator: sdJwtSaltGenerator,
+        hashAlg: 'sha-256',
+        kbSigner: makeEd25519Signer(params.holderPrivateKey),
+        kbSignAlg: 'EdDSA',
+        loadTypeMetadataFormat: false,
+    });
+    const presentationFrame = buildPresentationFrame(params.claimsToReveal);
+    const compact = await sdjwt.present(params.compact, presentationFrame, {
+        kb: {
+            payload: {
+                iat: Math.floor(Date.now() / 1000),
+                aud: params.audience,
+                nonce: params.nonce,
+            },
+        },
+    });
+    return { compact };
+}
+//# sourceMappingURL=present.js.map

package/dist/sdjwt/present.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"present.js","sourceRoot":"","sources":["../../src/sdjwt/present.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAGnD,OAAO,EACL,iBAAiB,EACjB,WAAW,EACX,kBAAkB,GACnB,MAAM,aAAa,CAAA;AAGpB;;;;;;;GAOG;AACH,SAAS,sBAAsB,CAC7B,MAAgB;IAEhB,6DAA6D;IAC7D,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAyB,EAAE,CAAA;QACrC,KAAK,MAAM,CAAC,IAAI,MAAM;YAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAA;QACtC,OAAO,IAA6D,CAAA;IACtE,CAAC;IAKD,MAAM,IAAI,GAAc,EAAE,CAAA;IAC1B,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,MAAM,GAAc,IAAI,CAAA;QAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAA;YACxB,IAAI,CAAC,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAA;YACpB,CAAC;iBAAM,CAAC;gBACN,4DAA4D;gBAC5D,wDAAwD;gBACxD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;gBAC5B,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAChD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAA;gBAClB,CAAC;gBACD,MAAM,GAAG,MAAM,CAAC,GAAG,CAAc,CAAA;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAA6D,CAAA;AACtE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAA4B;IAE5B,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,0CAA0C,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAC3E,CAAA;IACH,CAAC;IAED,gEAAgE;IAChE,qEAAqE;IACrE,uBAAuB;IACvB,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC;QAChC,MAAM,EAAE,WAAW;QACnB,aAAa,EAAE,kBAAkB;QACjC,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,iBAAiB,CAAC,MAAM,CAAC,gBAAgB,CAAC;QACpD,SAAS,EAAE,OAAO;QAClB,sBAAsB,EAAE,KAAK;KAC9B,CAAC,CAAA;IAEF,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;IACvE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,CACjC,MAAM,CAAC,OAAO,EACd,iBAAiB,EACjB;QACE,EAAE,EAAE;YACF,OAAO,EAAE;gBACP,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;gBAClC,GAAG,EAAE,MAAM,CAAC,QAAQ;gBACpB,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB;SACF;KACF,CACF,CAAA;IAED,OAAO,EAAE,OAAO,EAAE,CAAA;AACpB,CAAC"}

package/dist/sdjwt/signer.d.ts

@@ -40,4 +40,20 @@ export declare function sdJwtHasher(data: string | ArrayBuffer, alg: string): Ui
  * sd-jwt-js calls this with `length = 16` by default.
  */
 export declare function sdJwtSaltGenerator(length: number): string;
+/**
+ * JWK shape used in the SD-JWT VC `cnf` claim for an Ed25519 holder
+ * key. Matches RFC 8037 — Ed25519 → OKP curve, no `d` (private)
+ * component. The verifier reconstructs the raw 32-byte public key from
+ * `x`.
+ */
+export interface Ed25519Jwk {
+    kty: 'OKP';
+    crv: 'Ed25519';
+    x: string;
+    alg: 'EdDSA';
+}
+/** Convert a 32-byte Ed25519 public key into the canonical JWK form. */
+export declare function ed25519PublicKeyToJwk(publicKey: Uint8Array): Ed25519Jwk;
+/** Recover a 32-byte Ed25519 public key from its canonical JWK form. */
+export declare function ed25519PublicKeyFromJwk(jwk: unknown): Uint8Array;
 //# sourceMappingURL=signer.d.ts.map

package/dist/sdjwt/signer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signer.d.ts","sourceRoot":"","sources":["../../src/sdjwt/signer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAqBH;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,UAAU,IAIxC,MAAM,MAAM,KAAG,OAAO,CAAC,MAAM,CAAC,CAI7C;AAED,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,UAAU,IAIzC,MAAM,MAAM,EAAE,WAAW,MAAM,KAAG,OAAO,CAAC,OAAO,CAAC,CAWjE;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,GAAG,WAAW,EAC1B,GAAG,EAAE,MAAM,GACV,UAAU,CASZ;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAQzD"}
+{"version":3,"file":"signer.d.ts","sourceRoot":"","sources":["../../src/sdjwt/signer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAqBH;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,UAAU,IAIxC,MAAM,MAAM,KAAG,OAAO,CAAC,MAAM,CAAC,CAI7C;AAED,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,UAAU,IAIzC,MAAM,MAAM,EAAE,WAAW,MAAM,KAAG,OAAO,CAAC,OAAO,CAAC,CAWjE;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,GAAG,WAAW,EAC1B,GAAG,EAAE,MAAM,GACV,UAAU,CASZ;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAQzD;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,KAAK,CAAA;IACV,GAAG,EAAE,SAAS,CAAA;IACd,CAAC,EAAE,MAAM,CAAA;IACT,GAAG,EAAE,OAAO,CAAA;CACb;AAED,wEAAwE;AACxE,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,UAAU,GAAG,UAAU,CAUvE;AAED,wEAAwE;AACxE,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,OAAO,GAAG,UAAU,CAehE"}

package/dist/sdjwt/signer.js

@@ -89,4 +89,31 @@ export function sdJwtSaltGenerator(length) {
         .replace(/\//g, '_')
         .replace(/=/g, '');
 }
+/** Convert a 32-byte Ed25519 public key into the canonical JWK form. */
+export function ed25519PublicKeyToJwk(publicKey) {
+    if (publicKey.length !== 32) {
+        throw new Error(`publicKey must be 32 bytes, got ${publicKey.length}`);
+    }
+    return {
+        kty: 'OKP',
+        crv: 'Ed25519',
+        x: toBase64Url(publicKey),
+        alg: 'EdDSA',
+    };
+}
+/** Recover a 32-byte Ed25519 public key from its canonical JWK form. */
+export function ed25519PublicKeyFromJwk(jwk) {
+    if (!jwk ||
+        typeof jwk !== 'object' ||
+        jwk.kty !== 'OKP' ||
+        jwk.crv !== 'Ed25519' ||
+        typeof jwk.x !== 'string') {
+        throw new Error('not an Ed25519 OKP JWK');
+    }
+    const bytes = fromBase64Url(jwk.x);
+    if (bytes.length !== 32) {
+        throw new Error(`JWK x must decode to 32 bytes, got ${bytes.length}`);
+    }
+    return bytes;
+}
 //# sourceMappingURL=signer.js.map

package/dist/sdjwt/signer.js.map

@@ -1 +1 @@
-{"version":3,"file":"signer.js","sourceRoot":"","sources":["../../src/sdjwt/signer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAA;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAE3C,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,CAC/D,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAC7C,GAAG,CACJ,CAAA;IACD,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;AACtD,CAAC;AAED,SAAS,WAAW,CAAC,KAAiB;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SACtB,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;AACtB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAsB;IACtD,IAAI,UAAU,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,oCAAoC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;IAC1E,CAAC;IACD,OAAO,KAAK,EAAE,IAAY,EAAmB,EAAE;QAC7C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,CAAA;QAC1E,OAAO,WAAW,CAAC,GAAG,CAAC,CAAA;IACzB,CAAC,CAAA;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB,CAAC,SAAqB;IACvD,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,mCAAmC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAA;IACxE,CAAC;IACD,OAAO,KAAK,EAAE,IAAY,EAAE,SAAiB,EAAoB,EAAE;QACjE,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,WAAW,CACzB,aAAa,CAAC,SAAS,CAAC,EACxB,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAC9B,SAAS,CACV,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CACzB,IAA0B,EAC1B,GAAW;IAEX,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,EAAE,CAAC,CAAA;IAC9D,CAAC;IACD,MAAM,KAAK,GACT,OAAO,IAAI,KAAK,QAAQ;QACtB,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;QAChC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAA;IAC1B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;AACtB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;IACpC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;IAC7B,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SACtB,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;AACtB,CAAC"}
+{"version":3,"file":"signer.js","sourceRoot":"","sources":["../../src/sdjwt/signer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAA;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAE3C,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,CAC/D,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAC7C,GAAG,CACJ,CAAA;IACD,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;AACtD,CAAC;AAED,SAAS,WAAW,CAAC,KAAiB;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SACtB,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;AACtB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAsB;IACtD,IAAI,UAAU,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,oCAAoC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;IAC1E,CAAC;IACD,OAAO,KAAK,EAAE,IAAY,EAAmB,EAAE;QAC7C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,CAAA;QAC1E,OAAO,WAAW,CAAC,GAAG,CAAC,CAAA;IACzB,CAAC,CAAA;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB,CAAC,SAAqB;IACvD,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,mCAAmC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAA;IACxE,CAAC;IACD,OAAO,KAAK,EAAE,IAAY,EAAE,SAAiB,EAAoB,EAAE;QACjE,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,WAAW,CACzB,aAAa,CAAC,SAAS,CAAC,EACxB,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAC9B,SAAS,CACV,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CACzB,IAA0B,EAC1B,GAAW;IAEX,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,EAAE,CAAC,CAAA;IAC9D,CAAC;IACD,MAAM,KAAK,GACT,OAAO,IAAI,KAAK,QAAQ;QACtB,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;QAChC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAA;IAC1B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;AACtB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;IACpC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;IAC7B,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SACtB,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;AACtB,CAAC;AAeD,wEAAwE;AACxE,MAAM,UAAU,qBAAqB,CAAC,SAAqB;IACzD,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,mCAAmC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAA;IACxE,CAAC;IACD,OAAO;QACL,GAAG,EAAE,KAAK;QACV,GAAG,EAAE,SAAS;QACd,CAAC,EAAE,WAAW,CAAC,SAAS,CAAC;QACzB,GAAG,EAAE,OAAO;KACb,CAAA;AACH,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,uBAAuB,CAAC,GAAY;IAClD,IACE,CAAC,GAAG;QACJ,OAAO,GAAG,KAAK,QAAQ;QACtB,GAAyB,CAAC,GAAG,KAAK,KAAK;QACvC,GAAyB,CAAC,GAAG,KAAK,SAAS;QAC5C,OAAQ,GAAuB,CAAC,CAAC,KAAK,QAAQ,EAC9C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;IAC3C,CAAC;IACD,MAAM,KAAK,GAAG,aAAa,CAAE,GAAqB,CAAC,CAAC,CAAC,CAAA;IACrD,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,sCAAsC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;IACvE,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/sdjwt/status-list.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Status list (draft-ietf-oauth-status-list) helper for issuers.
+ *
+ * The lifecycle:
+ *   1. Issuer creates a `StatusList` (a bitstring of N statuses,
+ *      typically 1 bit per credential — 0 = active, 1 = revoked).
+ *   2. Issuer wraps it in a JWT signed by the issuer's key, served at
+ *      a stable URL (e.g., `/status-lists/<id>`).
+ *   3. Each issued SD-JWT VC carries a `status.status_list.{uri, idx}`
+ *      pointing at one bit in the list.
+ *   4. To revoke a credential, the issuer flips its bit and republishes
+ *      the (now-updated) JWT at the same URL.
+ *   5. Verifiers refetch the list (cache-respecting) and check the bit.
+ *
+ * `createStatusListJwt` is a thin wrapper around `@sd-jwt/jwt-status-list`
+ * that uses Ed25519 / EdDSA to match the rest of Solidus's signing
+ * conventions.
+ */
+import { type BitsPerStatus } from '@sd-jwt/jwt-status-list';
+export interface CreateStatusListJwtParams {
+    /** Issuer's raw 32-byte Ed25519 private key. */
+    issuerPrivateKey: Uint8Array;
+    /** Issuer DID — becomes the `iss` claim on the status-list JWT. */
+    issuer: string;
+    /**
+     * The URL where this status-list JWT will be served. Becomes the
+     * `sub` claim per draft-ietf-oauth-status-list §6.2 and is what
+     * issued credentials reference via `status.status_list.uri`.
+     */
+    uri: string;
+    /**
+     * Total number of statuses in the list. Determines the bitstring
+     * size. Choose with growth in mind — once published, callers cannot
+     * shrink the list without breaking existing references.
+     */
+    totalStatuses: number;
+    /**
+     * Bits per status. 1 = boolean (active/revoked); 2/4/8 add finer
+     * granularity (suspended, expired, etc.) per spec §6. Default 1.
+     */
+    bitsPerStatus?: BitsPerStatus;
+    /**
+     * Indexes whose status should be set to non-zero. With `bitsPerStatus
+     * = 1`, listing an index here means "revoked". For higher bit
+     * widths, pass `[index, value]` tuples.
+     */
+    revoked?: Array<number | [number, number]>;
+    /**
+     * Optional time-to-live in seconds — verifiers MAY use this to
+     * decide how long to cache the list. Per draft-ietf-oauth-status-list.
+     */
+    ttlSeconds?: number;
+}
+/**
+ * Build a signed status-list JWT.
+ *
+ * Returns the JWT in compact form. Issuers serve this at the URL
+ * embedded in their issued SD-JWT VCs' `status.status_list.uri` claim.
+ */
+export declare function createStatusListJwt(params: CreateStatusListJwtParams): Promise<string>;
+//# sourceMappingURL=status-list.d.ts.map

package/dist/sdjwt/status-list.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-list.d.ts","sourceRoot":"","sources":["../../src/sdjwt/status-list.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,yBAAyB,CAAA;AAUhC,MAAM,WAAW,yBAAyB;IACxC,gDAAgD;IAChD,gBAAgB,EAAE,UAAU,CAAA;IAE5B,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAA;IAEd;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAA;IAEX;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAA;IAErB;;;OAGG;IACH,aAAa,CAAC,EAAE,aAAa,CAAA;IAE7B;;;;OAIG;IACH,OAAO,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAE1C;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,yBAAyB,GAChC,OAAO,CAAC,MAAM,CAAC,CA8CjB"}

package/dist/sdjwt/status-list.js

@@ -0,0 +1,63 @@
+/**
+ * Status list (draft-ietf-oauth-status-list) helper for issuers.
+ *
+ * The lifecycle:
+ *   1. Issuer creates a `StatusList` (a bitstring of N statuses,
+ *      typically 1 bit per credential — 0 = active, 1 = revoked).
+ *   2. Issuer wraps it in a JWT signed by the issuer's key, served at
+ *      a stable URL (e.g., `/status-lists/<id>`).
+ *   3. Each issued SD-JWT VC carries a `status.status_list.{uri, idx}`
+ *      pointing at one bit in the list.
+ *   4. To revoke a credential, the issuer flips its bit and republishes
+ *      the (now-updated) JWT at the same URL.
+ *   5. Verifiers refetch the list (cache-respecting) and check the bit.
+ *
+ * `createStatusListJwt` is a thin wrapper around `@sd-jwt/jwt-status-list`
+ * that uses Ed25519 / EdDSA to match the rest of Solidus's signing
+ * conventions.
+ */
+import * as ed from '@noble/ed25519';
+import { StatusList, createHeaderAndPayload, } from '@sd-jwt/jwt-status-list';
+function toBase64Url(bytes) {
+    return Buffer.from(bytes)
+        .toString('base64')
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=/g, '');
+}
+/**
+ * Build a signed status-list JWT.
+ *
+ * Returns the JWT in compact form. Issuers serve this at the URL
+ * embedded in their issued SD-JWT VCs' `status.status_list.uri` claim.
+ */
+export async function createStatusListJwt(params) {
+    if (params.issuerPrivateKey.length !== 32) {
+        throw new Error(`issuerPrivateKey must be 32 bytes, got ${params.issuerPrivateKey.length}`);
+    }
+    const bitsPerStatus = params.bitsPerStatus ?? 1;
+    const list = new StatusList(new Array(params.totalStatuses).fill(0), bitsPerStatus);
+    for (const entry of params.revoked ?? []) {
+        if (typeof entry === 'number') {
+            list.setStatus(entry, 1);
+        }
+        else {
+            list.setStatus(entry[0], entry[1]);
+        }
+    }
+    const now = Math.floor(Date.now() / 1000);
+    const basePayload = {
+        iss: params.issuer,
+        sub: params.uri,
+        iat: now,
+    };
+    if (params.ttlSeconds !== undefined)
+        basePayload['ttl'] = params.ttlSeconds;
+    const { header, payload } = createHeaderAndPayload(list, basePayload, { alg: 'EdDSA', typ: 'statuslist+jwt' });
+    const headerSegment = toBase64Url(new TextEncoder().encode(JSON.stringify(header)));
+    const payloadSegment = toBase64Url(new TextEncoder().encode(JSON.stringify(payload)));
+    const signingInput = `${headerSegment}.${payloadSegment}`;
+    const signature = await ed.signAsync(new TextEncoder().encode(signingInput), params.issuerPrivateKey);
+    return `${signingInput}.${toBase64Url(signature)}`;
+}
+//# sourceMappingURL=status-list.js.map

package/dist/sdjwt/status-list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-list.js","sourceRoot":"","sources":["../../src/sdjwt/status-list.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAA;AACpC,OAAO,EACL,UAAU,EACV,sBAAsB,GAEvB,MAAM,yBAAyB,CAAA;AAEhC,SAAS,WAAW,CAAC,KAAiB;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SACtB,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;AACtB,CAAC;AA2CD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAiC;IAEjC,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,0CAA0C,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAC3E,CAAA;IACH,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,CAAC,CAAA;IAC/C,MAAM,IAAI,GAAG,IAAI,UAAU,CACzB,IAAI,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EACvC,aAAa,CACd,CAAA;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;QAC1B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QACpC,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,MAAM,WAAW,GAA4B;QAC3C,GAAG,EAAE,MAAM,CAAC,MAAM;QAClB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,GAAG;KACT,CAAA;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;QAAE,WAAW,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,UAAU,CAAA;IAE3E,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,sBAAsB,CAChD,IAAI,EACJ,WAAoB,EACpB,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,gBAAgB,EAAE,CACxC,CAAA;IAED,MAAM,aAAa,GAAG,WAAW,CAC/B,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CACjD,CAAA;IACD,MAAM,cAAc,GAAG,WAAW,CAChC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAClD,CAAA;IACD,MAAM,YAAY,GAAG,GAAG,aAAa,IAAI,cAAc,EAAE,CAAA;IACzD,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,SAAS,CAClC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EACtC,MAAM,CAAC,gBAAgB,CACxB,CAAA;IACD,OAAO,GAAG,YAAY,IAAI,WAAW,CAAC,SAAS,CAAC,EAAE,CAAA;AACpD,CAAC"}