@solidus-network/sdk 0.2.0 → 0.5.0

package/dist/sdjwt/types.d.ts

@@ -33,18 +33,38 @@ export interface IssueSdJwtVcParams {
      */
     issuerPrivateKey: Uint8Array;
     /**
-     * Subject-claim paths that should be disclosable. Each entry is a
-     * top-level subject key (Phase 1 supports flat structures only;
-     * nested disclosure comes in Phase 2). If omitted, every subject
-     * claim is disclosable.
+     * Subject-claim paths that should be disclosable. Each entry is
+     * either a top-level key (`'birthdate'`) or a dotted path into a
+     * nested object (`'address.street'`). If omitted, every top-level
+     * subject claim except `id` is disclosable; nested objects are not
+     * auto-expanded — pass explicit paths to selectively disclose them.
      *
-     * @example ['birthdate', 'address']
+     * @example ['birthdate', 'address.street', 'address.city']
      */
     disclosable?: string[];
     /** RFC 3339 timestamp; sd-jwt-vc maps this to `nbf`. Defaults to now. */
     validFrom?: string;
     /** RFC 3339 timestamp; sd-jwt-vc maps this to `exp`. Optional. */
     validUntil?: string;
+    /**
+     * Optional 32-byte Ed25519 public key of the *holder*. When provided,
+     * the issued SD-JWT embeds a `cnf.jwk` claim binding the credential
+     * to this key — required if the verifier is going to enforce a
+     * Key-Binding JWT at presentation time. Omit to issue a bearer
+     * credential (Phase 1 default).
+     */
+    holderPublicKey?: Uint8Array;
+    /**
+     * Optional reference into a status list (draft-ietf-oauth-status-list).
+     * When set, the issued SD-JWT carries `status: { status_list: { uri,
+     * idx } }`; verifiers that supply a `statusListFetcher` will fetch
+     * the list, look up bit `idx`, and reject the credential if the
+     * status indicates revocation.
+     */
+    status?: {
+        uri: string;
+        idx: number;
+    };
 }
 /**
  * The compact-serialised SD-JWT VC, plus metadata. The `compact` field
@@ -70,6 +90,77 @@ export interface VerifySdJwtVcParams {
      * from the chain client.
      */
     issuerPublicKey: Uint8Array;
+    /**
+     * If provided, the verifier requires a valid Key-Binding JWT and
+     * checks the KB-JWT's `aud` claim against this value. Use this to
+     * stop a stolen presentation from being replayed against a different
+     * verifier.
+     */
+    expectedAudience?: string;
+    /**
+     * If provided, the verifier requires a valid Key-Binding JWT and
+     * checks the KB-JWT's `nonce` claim against this value. The verifier
+     * is responsible for generating a fresh nonce per presentation
+     * request and remembering it for the duration of the round-trip.
+     */
+    expectedNonce?: string;
+    /**
+     * Callback that fetches the status-list JWT at a given URI. Required
+     * to enable revocation checking; if absent the verifier skips the
+     * status check (treats every credential as live). In production the
+     * caller usually wires this to `fetch()`; tests can use an in-memory
+     * map.
+     */
+    statusListFetcher?: (uri: string) => Promise<string>;
+    /**
+     * Verifier callback for the *status list JWT*'s signature. The
+     * status list JWT is signed by the issuer (or a status-list-specific
+     * key); pass the public key here. If omitted, the same issuerPublicKey
+     * used for the SD-JWT is reused — appropriate when the issuer signs
+     * its own status lists.
+     */
+    statusListIssuerPublicKey?: Uint8Array;
+}
+/** Parameters accepted by [`presentSdJwtVc`]. */
+export interface PresentSdJwtVcParams {
+    /** Compact-serialised SD-JWT VC as issued (with all disclosures attached). */
+    compact: string;
+    /**
+     * Paths of the subject claims to reveal in this presentation. Each
+     * entry is either a top-level key (`'firstName'`) or a dotted path
+     * into a nested object (`'address.street'`). Any disclosure not
+     * listed here is omitted from the presented compact form; the
+     * verifier still sees the hash but cannot recover the value.
+     *
+     * @example ['firstName', 'address.street']
+     */
+    claimsToReveal: string[];
+    /**
+     * Holder's raw 32-byte Ed25519 *private* key. Must be the partner of
+     * the `holderPublicKey` that was bound at issuance time via `cnf.jwk`.
+     * Required because Phase 2 always emits a Key-Binding JWT — bearer
+     * presentations stay on the Phase-1 verify path with no `aud`/`nonce`.
+     */
+    holderPrivateKey: Uint8Array;
+    /**
+     * Audience identifier for the verifier (typically the verifier's
+     * client_id or origin). Becomes the `aud` claim of the KB-JWT.
+     */
+    audience: string;
+    /**
+     * Fresh, single-use nonce supplied by the verifier. Becomes the
+     * `nonce` claim of the KB-JWT.
+     */
+    nonce: string;
+}
+/** Result of [`presentSdJwtVc`]. */
+export interface PresentationResult {
+    /**
+     * Compact-serialised presentation:
+     * `<jws>~<revealed_d1>~<revealed_d2>~<kb-jwt>`. Note that the trailing
+     * `~` before the KB-JWT is part of the spec.
+     */
+    compact: string;
 }
 export interface VerificationResult {
     /** True if signature, hashes, and freshness all check out. */

package/dist/sdjwt/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sdjwt/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAA;IAEd;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAA;IAEX;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAEhC;;;OAGG;IACH,gBAAgB,EAAE,UAAU,CAAA;IAE5B;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IAEtB,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAA;IAEf,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAEhC,4CAA4C;IAC5C,eAAe,EAAE,MAAM,CAAA;CACxB;AAED,gDAAgD;AAChD,MAAM,WAAW,mBAAmB;IAClC,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAA;IAEf;;;;;OAKG;IACH,eAAe,EAAE,UAAU,CAAA;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,8DAA8D;IAC9D,KAAK,EAAE,OAAO,CAAA;IAEd;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAE/B,oCAAoC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,CAAA;IAEZ,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAA;CACf"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sdjwt/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAA;IAEd;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAA;IAEX;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAEhC;;;OAGG;IACH,gBAAgB,EAAE,UAAU,CAAA;IAE5B;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IAEtB,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,UAAU,CAAA;IAE5B;;;;;;OAMG;IACH,MAAM,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;CACtC;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAA;IAEf,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAEhC,4CAA4C;IAC5C,eAAe,EAAE,MAAM,CAAA;CACxB;AAED,gDAAgD;AAChD,MAAM,WAAW,mBAAmB;IAClC,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAA;IAEf;;;;;OAKG;IACH,eAAe,EAAE,UAAU,CAAA;IAE3B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAEzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IAEtB;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IAEpD;;;;;;OAMG;IACH,yBAAyB,CAAC,EAAE,UAAU,CAAA;CACvC;AAED,iDAAiD;AACjD,MAAM,WAAW,oBAAoB;IACnC,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAA;IAEf;;;;;;;;OAQG;IACH,cAAc,EAAE,MAAM,EAAE,CAAA;IAExB;;;;;OAKG;IACH,gBAAgB,EAAE,UAAU,CAAA;IAE5B;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAA;IAEhB;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAA;CACd;AAED,oCAAoC;AACpC,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,8DAA8D;IAC9D,KAAK,EAAE,OAAO,CAAA;IAEd;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAE/B,oCAAoC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,CAAA;IAEZ,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAA;CACf"}

package/dist/sdjwt/verify.d.ts

@@ -1,9 +1,22 @@
 /**
- * Verify an SD-JWT VC.
+ * Verify an SD-JWT VC, optionally including a Key-Binding JWT.
  *
- * Phase 1 verifies signature, freshness (`iat`/`nbf`/`exp`), and
- * reconstructs the disclosed claims. Status-list and KB-JWT
- * verification land in Phase 2.
+ * Phase 1 verified just the issuer's signature + freshness; Phase 2
+ * adds an optional KB-JWT path. When the caller supplies
+ * `expectedAudience` and/or `expectedNonce`, the verifier:
+ *   - requires a KB-JWT to be present in the compact form,
+ *   - extracts the holder's public key from the SD-JWT's `cnf.jwk`,
+ *   - verifies the KB-JWT signature against that key,
+ *   - checks `aud` and `nonce` match the caller's expectations,
+ *   - confirms `sd_hash` matches the hash of the SD-JWT being presented.
+ *
+ * If neither expected* is set, the verifier behaves as Phase 1 — bearer
+ * presentations remain accepted.
+ *
+ * KB-JWT parsing is done in this module rather than via sd-jwt-js's
+ * `verify()` because sd-jwt-js conflates "extract KB-JWT" and "check
+ * nonce" in a single option, leaving us no clean way to surface
+ * `aud mismatch` separately from `nonce mismatch`.
  */
 import type { VerifySdJwtVcParams, VerificationResult } from './types.js';
 export declare function verifySdJwtVc(params: VerifySdJwtVcParams): Promise<VerificationResult>;

package/dist/sdjwt/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/sdjwt/verify.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAEzE,wBAAsB,aAAa,CACjC,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CAyC7B"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/sdjwt/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAWH,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AA4EzE,wBAAsB,aAAa,CACjC,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CAuI7B"}

package/dist/sdjwt/verify.js

@@ -1,12 +1,81 @@
 /**
- * Verify an SD-JWT VC.
+ * Verify an SD-JWT VC, optionally including a Key-Binding JWT.
  *
- * Phase 1 verifies signature, freshness (`iat`/`nbf`/`exp`), and
- * reconstructs the disclosed claims. Status-list and KB-JWT
- * verification land in Phase 2.
+ * Phase 1 verified just the issuer's signature + freshness; Phase 2
+ * adds an optional KB-JWT path. When the caller supplies
+ * `expectedAudience` and/or `expectedNonce`, the verifier:
+ *   - requires a KB-JWT to be present in the compact form,
+ *   - extracts the holder's public key from the SD-JWT's `cnf.jwk`,
+ *   - verifies the KB-JWT signature against that key,
+ *   - checks `aud` and `nonce` match the caller's expectations,
+ *   - confirms `sd_hash` matches the hash of the SD-JWT being presented.
+ *
+ * If neither expected* is set, the verifier behaves as Phase 1 — bearer
+ * presentations remain accepted.
+ *
+ * KB-JWT parsing is done in this module rather than via sd-jwt-js's
+ * `verify()` because sd-jwt-js conflates "extract KB-JWT" and "check
+ * nonce" in a single option, leaving us no clean way to surface
+ * `aud mismatch` separately from `nonce mismatch`.
  */
 import { SDJwtVcInstance } from '@sd-jwt/sd-jwt-vc';
-import { makeEd25519Verifier, sdJwtHasher } from './signer.js';
+import * as ed from '@noble/ed25519';
+import { sha256 } from '@noble/hashes/sha2';
+import { ed25519PublicKeyFromJwk, makeEd25519Verifier, sdJwtHasher, } from './signer.js';
+function fromBase64Url(input) {
+    const padded = input
+        .replace(/-/g, '+')
+        .replace(/_/g, '/')
+        .padEnd(input.length + ((4 - (input.length % 4)) % 4), '=');
+    return new Uint8Array(Buffer.from(padded, 'base64'));
+}
+function toBase64Url(input) {
+    return Buffer.from(input)
+        .toString('base64')
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=/g, '');
+}
+/**
+ * Decode (without verifying) the KB-JWT off the end of a compact SD-JWT.
+ *
+ * The compact form is `<jws>~<d1>~<d2>~<kb-jwt>`. The KB-JWT is the
+ * final non-empty segment; the `<jws>~<d1>~...~` prefix (with the
+ * trailing `~` retained) is what `sd_hash` covers per spec §3.3.
+ */
+function extractKbJwt(compact) {
+    const lastTilde = compact.lastIndexOf('~');
+    if (lastTilde < 0)
+        return null;
+    const kbCompact = compact.slice(lastTilde + 1);
+    if (kbCompact.length === 0)
+        return null;
+    const sdJwtBody = compact.slice(0, lastTilde + 1); // includes trailing `~`
+    const segments = kbCompact.split('.');
+    if (segments.length !== 3)
+        return null;
+    let payload;
+    try {
+        payload = JSON.parse(new TextDecoder().decode(fromBase64Url(segments[1])));
+    }
+    catch {
+        return null;
+    }
+    return { kbCompact, sdJwtBody, payload };
+}
+async function verifyKbSignature(kbCompact, holderPublicKey) {
+    const segments = kbCompact.split('.');
+    if (segments.length !== 3)
+        return false;
+    const signingInput = `${segments[0]}.${segments[1]}`;
+    const signature = fromBase64Url(segments[2]);
+    try {
+        return await ed.verifyAsync(signature, new TextEncoder().encode(signingInput), holderPublicKey);
+    }
+    catch {
+        return false;
+    }
+}
 export async function verifySdJwtVc(params) {
     if (params.issuerPublicKey.length !== 32) {
         return {
@@ -15,31 +84,31 @@ export async function verifySdJwtVc(params) {
             error: `issuerPublicKey must be 32 bytes, got ${params.issuerPublicKey.length}`,
         };
     }
+    const requireKb = params.expectedAudience !== undefined ||
+        params.expectedNonce !== undefined;
+    const statusListVerifier = params.statusListIssuerPublicKey
+        ? makeEd25519Verifier(params.statusListIssuerPublicKey)
+        : makeEd25519Verifier(params.issuerPublicKey);
     const sdjwt = new SDJwtVcInstance({
         verifier: makeEd25519Verifier(params.issuerPublicKey),
         hasher: sdJwtHasher,
         hashAlg: 'sha-256',
         loadTypeMetadataFormat: false,
+        // Wire status-list lookup if the caller supplied a fetcher.
+        // sd-jwt-vc fetches the status-list JWT, verifies its signature,
+        // looks up `idx`, and (by default) treats any non-zero status as
+        // revoked.
+        ...(params.statusListFetcher !== undefined
+            ? {
+                statusListFetcher: params.statusListFetcher,
+                statusVerifier: statusListVerifier,
+            }
+            : {}),
     });
+    let payload;
     try {
         const result = await sdjwt.verify(params.compact);
-        const payload = result.payload;
-        // sd-jwt-js's verify() reconstructs the disclosed claims and merges
-        // them into the payload, dropping the `_sd` arrays. So
-        // `result.payload` is already the full revealed claim set.
-        const claims = {};
-        for (const [k, v] of Object.entries(payload)) {
-            // Drop SD-JWT housekeeping fields from the user-facing claim set.
-            if (k === '_sd' || k === '_sd_alg' || k === 'cnf')
-                continue;
-            claims[k] = v;
-        }
-        const out = { valid: true, claims };
-        if (typeof payload['iss'] === 'string')
-            out.issuer = payload['iss'];
-        if (typeof payload['vct'] === 'string')
-            out.vct = payload['vct'];
-        return out;
+        payload = result.payload;
     }
     catch (e) {
         return {
@@ -48,5 +117,85 @@ export async function verifySdJwtVc(params) {
             error: e instanceof Error ? e.message : String(e),
         };
     }
+    if (requireKb) {
+        const parsed = extractKbJwt(params.compact);
+        if (!parsed) {
+            return {
+                valid: false,
+                claims: {},
+                error: 'KB-JWT required but not present in compact form',
+            };
+        }
+        const cnf = payload.cnf;
+        if (!cnf?.jwk) {
+            return {
+                valid: false,
+                claims: {},
+                error: 'SD-JWT does not bind a holder key (`cnf.jwk` missing)',
+            };
+        }
+        let holderPk;
+        try {
+            holderPk = ed25519PublicKeyFromJwk(cnf.jwk);
+        }
+        catch (e) {
+            return {
+                valid: false,
+                claims: {},
+                error: `cnf.jwk invalid: ${e instanceof Error ? e.message : String(e)}`,
+            };
+        }
+        const sigOk = await verifyKbSignature(parsed.kbCompact, holderPk);
+        if (!sigOk) {
+            return {
+                valid: false,
+                claims: {},
+                error: 'KB-JWT signature does not match the holder key from cnf.jwk',
+            };
+        }
+        if (params.expectedAudience !== undefined &&
+            parsed.payload.aud !== params.expectedAudience) {
+            return {
+                valid: false,
+                claims: {},
+                error: `KB-JWT aud mismatch: expected ${params.expectedAudience}, got ${parsed.payload.aud ?? '<missing>'}`,
+            };
+        }
+        if (params.expectedNonce !== undefined &&
+            parsed.payload.nonce !== params.expectedNonce) {
+            return {
+                valid: false,
+                claims: {},
+                error: `KB-JWT nonce mismatch: expected ${params.expectedNonce}, got ${parsed.payload.nonce ?? '<missing>'}`,
+            };
+        }
+        // Confirm sd_hash matches the SHA-256 of the SD-JWT body (everything
+        // before the KB-JWT, with the trailing `~` retained per spec).
+        if (parsed.payload.sd_hash !== undefined) {
+            const expectedHash = toBase64Url(sha256(new TextEncoder().encode(parsed.sdJwtBody)));
+            if (parsed.payload.sd_hash !== expectedHash) {
+                return {
+                    valid: false,
+                    claims: {},
+                    error: 'KB-JWT sd_hash does not cover the presented SD-JWT body',
+                };
+            }
+        }
+    }
+    // sd-jwt-js's verify() reconstructs disclosed claims and merges
+    // them into the payload, dropping the `_sd` arrays. The caller
+    // should never see SD-JWT housekeeping fields.
+    const claims = {};
+    for (const [k, v] of Object.entries(payload)) {
+        if (k === '_sd' || k === '_sd_alg' || k === 'cnf')
+            continue;
+        claims[k] = v;
+    }
+    const out = { valid: true, claims };
+    if (typeof payload['iss'] === 'string')
+        out.issuer = payload['iss'];
+    if (typeof payload['vct'] === 'string')
+        out.vct = payload['vct'];
+    return out;
 }
 //# sourceMappingURL=verify.js.map

package/dist/sdjwt/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/sdjwt/verify.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAG9D,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAA2B;IAE3B,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACzC,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,EAAE;YACV,KAAK,EAAE,yCAAyC,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE;SAChF,CAAA;IACH,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC;QAChC,QAAQ,EAAE,mBAAmB,CAAC,MAAM,CAAC,eAAe,CAAC;QACrD,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,SAAS;QAClB,sBAAsB,EAAE,KAAK;KAC9B,CAAC,CAAA;IAEF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QACjD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAkC,CAAA;QAEzD,oEAAoE;QACpE,uDAAuD;QACvD,2DAA2D;QAC3D,MAAM,MAAM,GAA4B,EAAE,CAAA;QAC1C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,kEAAkE;YAClE,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,KAAK;gBAAE,SAAQ;YAC3D,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QACf,CAAC;QAED,MAAM,GAAG,GAAuB,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;QACvD,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ;YAAE,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;QACnE,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ;YAAE,GAAG,CAAC,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;QAChE,OAAO,GAAG,CAAA;IACZ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,EAAE;YACV,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;SAClD,CAAA;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/sdjwt/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAA;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAC3C,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,WAAW,GACZ,MAAM,aAAa,CAAA;AAGpB,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,MAAM,GAAG,KAAK;SACjB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC7D,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;AACtD,CAAC;AAED,SAAS,WAAW,CAAC,KAAiB;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SACtB,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;AACtB,CAAC;AAeD;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IAC1C,IAAI,SAAS,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAC9B,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAA;IAC9C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACvC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,CAAA,CAAC,wBAAwB;IAC1E,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACtC,IAAI,OAAqB,CAAA;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAClB,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,CACtC,CAAA;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,CAAA;AAC1C,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,SAAiB,EACjB,eAA2B;IAE3B,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACvC,MAAM,YAAY,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAE,IAAI,QAAQ,CAAC,CAAC,CAAE,EAAE,CAAA;IACtD,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAA;IAC7C,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,WAAW,CACzB,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EACtC,eAAe,CAChB,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAA2B;IAE3B,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACzC,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,EAAE;YACV,KAAK,EAAE,yCAAyC,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE;SAChF,CAAA;IACH,CAAC;IAED,MAAM,SAAS,GACb,MAAM,CAAC,gBAAgB,KAAK,SAAS;QACrC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAA;IAEpC,MAAM,kBAAkB,GAAG,MAAM,CAAC,yBAAyB;QACzD,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,yBAAyB,CAAC;QACvD,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;IAE/C,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC;QAChC,QAAQ,EAAE,mBAAmB,CAAC,MAAM,CAAC,eAAe,CAAC;QACrD,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,SAAS;QAClB,sBAAsB,EAAE,KAAK;QAC7B,4DAA4D;QAC5D,iEAAiE;QACjE,iEAAiE;QACjE,WAAW;QACX,GAAG,CAAC,MAAM,CAAC,iBAAiB,KAAK,SAAS;YACxC,CAAC,CAAC;gBACE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBAC3C,cAAc,EAAE,kBAAkB;aACnC;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAA;IAEF,IAAI,OAAgC,CAAA;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QACjD,OAAO,GAAG,MAAM,CAAC,OAAkC,CAAA;IACrD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,EAAE;YACV,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;SAClD,CAAA;IACH,CAAC;IAED,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,iDAAiD;aACzD,CAAA;QACH,CAAC;QAED,MAAM,GAAG,GAAI,OAAuC,CAAC,GAAG,CAAA;QACxD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;YACd,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,uDAAuD;aAC/D,CAAA;QACH,CAAC;QACD,IAAI,QAAoB,CAAA;QACxB,IAAI,CAAC;YACH,QAAQ,GAAG,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC7C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,oBAAoB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;aACxE,CAAA;QACH,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;QACjE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,6DAA6D;aACrE,CAAA;QACH,CAAC;QAED,IACE,MAAM,CAAC,gBAAgB,KAAK,SAAS;YACrC,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,gBAAgB,EAC9C,CAAC;YACD,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,iCAAiC,MAAM,CAAC,gBAAgB,SAAS,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,WAAW,EAAE;aAC5G,CAAA;QACH,CAAC;QAED,IACE,MAAM,CAAC,aAAa,KAAK,SAAS;YAClC,MAAM,CAAC,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,aAAa,EAC7C,CAAC;YACD,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,mCAAmC,MAAM,CAAC,aAAa,SAAS,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,WAAW,EAAE;aAC7G,CAAA;QACH,CAAC;QAED,qEAAqE;QACrE,+DAA+D;QAC/D,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACzC,MAAM,YAAY,GAAG,WAAW,CAC9B,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CACnD,CAAA;YACD,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;gBAC5C,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,EAAE;oBACV,KAAK,EAAE,yDAAyD;iBACjE,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,+DAA+D;IAC/D,+CAA+C;IAC/C,MAAM,MAAM,GAA4B,EAAE,CAAA;IAC1C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,KAAK;YAAE,SAAQ;QAC3D,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IACf,CAAC;IAED,MAAM,GAAG,GAAuB,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IACvD,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ;QAAE,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;IACnE,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ;QAAE,GAAG,CAAC,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;IAChE,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/stub/credentials.js

@@ -13,7 +13,7 @@ function rowToVC(row) {
         proof: {
             type: 'Ed25519Signature2020',
             created: row.issued_at.toISOString(),
-            verificationMethod: `${row.issuer_did}#key-1`,
+            verificationMethod: `${row.issuer_did}#key-0`,
             proofPurpose: 'assertionMethod',
             proofValue: row.proof_value,
         },

package/dist/stub/did.d.ts

@@ -1,5 +1,24 @@
 import type { DID, DIDDocument } from '@solidus-network/types';
+import type { ChainTransaction } from '../chain/transaction.js';
 export declare function didCreate(publicKeyHex: string): Promise<DID>;
 export declare function didResolve(did: string): Promise<DIDDocument | null>;
 export declare function didDeactivate(did: string, _signerKey: string): Promise<void>;
+/**
+ * Stub-mode `buildCreate`. Produces a shape-compatible `ChainTransaction`
+ * envelope so callers can write a single relay-style code path that runs
+ * unchanged in stub and chain modes. The "signature" is meaningless in
+ * stub mode — there is no chain to verify against — but the payload is
+ * faithful so that `submitCreate` can extract `public_key`.
+ */
+export declare function didBuildCreate(opts: {
+    signerPrivateKey: string;
+    publicKey?: string;
+    serviceEndpoints?: unknown[];
+    nonce?: number;
+}): Promise<ChainTransaction>;
+/**
+ * Stub-mode `submitCreate`. Parses the publicKey out of the supplied tx
+ * and delegates to the existing `didCreate` to insert the row.
+ */
+export declare function didSubmitCreate(signedTx: ChainTransaction | string): Promise<DID>;
 //# sourceMappingURL=did.d.ts.map

package/dist/stub/did.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"did.d.ts","sourceRoot":"","sources":["../../src/stub/did.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAYtD,wBAAsB,SAAS,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAWlE;AAED,wBAAsB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAgCzE;AAED,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKlF"}
+{"version":3,"file":"did.d.ts","sourceRoot":"","sources":["../../src/stub/did.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAY/D,wBAAsB,SAAS,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAWlE;AAED,wBAAsB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAgCzE;AAED,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKlF;AAID;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,gBAAgB,EAAE,MAAM,CAAA;IACxB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,gBAAgB,CAAC,EAAE,OAAO,EAAE,CAAA;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA0B5B;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CASvF"}

package/dist/stub/did.js

@@ -21,7 +21,7 @@ export async function didResolve(did) {
     if (rows.length === 0)
         return null;
     const row = rows[0];
-    const vmId = `${row.did}#key-1`;
+    const vmId = `${row.did}#key-0`;
     return {
         '@context': [
             'https://www.w3.org/ns/did/v1',
@@ -49,4 +49,58 @@ export async function didDeactivate(did, _signerKey) {
     UPDATE stub_dids SET deactivated = true, updated_at = now() WHERE did = ${did}
   `;
 }
+// ---------- buildCreate / submitCreate (stub) ----------
+/**
+ * Stub-mode `buildCreate`. Produces a shape-compatible `ChainTransaction`
+ * envelope so callers can write a single relay-style code path that runs
+ * unchanged in stub and chain modes. The "signature" is meaningless in
+ * stub mode — there is no chain to verify against — but the payload is
+ * faithful so that `submitCreate` can extract `public_key`.
+ */
+export async function didBuildCreate(opts) {
+    if (!opts.signerPrivateKey || opts.signerPrivateKey.length !== 64) {
+        throw new Error('didBuildCreate (stub): signerPrivateKey must be a 64-char hex string');
+    }
+    // Derive the signer pubkey from the privkey hex deterministically. We
+    // do NOT run real ed25519 in the stub — for the stub the "pubkey" is
+    // simply a marker derived by reversing the privkey bytes. This is
+    // sufficient for shape compatibility; chain mode does real signing.
+    const signerPubBytes = hexToBytes(opts.signerPrivateKey).reverse();
+    const publicKey = opts.publicKey ?? Buffer.from(signerPubBytes).toString('hex');
+    if (publicKey.toLowerCase() !== Buffer.from(signerPubBytes).toString('hex').toLowerCase()) {
+        throw new Error(`didBuildCreate (stub): signerPrivateKey does not own publicKey (the SDK enforces this invariant in both modes)`);
+    }
+    return {
+        sender_pubkey: Array.from(signerPubBytes),
+        nonce: opts.nonce ?? 0,
+        payload: {
+            DidCreate: {
+                public_key: Array.from(hexToBytes(publicKey)),
+                service_endpoints: opts.serviceEndpoints ?? [],
+            },
+        },
+        signature: Array(64).fill(0),
+    };
+}
+/**
+ * Stub-mode `submitCreate`. Parses the publicKey out of the supplied tx
+ * and delegates to the existing `didCreate` to insert the row.
+ */
+export async function didSubmitCreate(signedTx) {
+    const tx = typeof signedTx === 'string' ? JSON.parse(signedTx) : signedTx;
+    const payload = tx.payload;
+    const payloadPub = payload?.DidCreate?.public_key;
+    if (!Array.isArray(payloadPub) || payloadPub.length !== 32) {
+        throw new Error('didSubmitCreate (stub): tx is not a DidCreate with a 32-byte public_key');
+    }
+    const publicKeyHex = Buffer.from(Uint8Array.from(payloadPub)).toString('hex');
+    return didCreate(publicKeyHex);
+}
+function hexToBytes(hex) {
+    const out = new Uint8Array(hex.length / 2);
+    for (let i = 0; i < hex.length; i += 2) {
+        out[i / 2] = parseInt(hex.substring(i, i + 2), 16);
+    }
+    return out;
+}
 //# sourceMappingURL=did.js.map

package/dist/stub/did.js.map

@@ -1 +1 @@
-{"version":3,"file":"did.js","sourceRoot":"","sources":["../../src/stub/did.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAU7C,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,YAAoB;IAClD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAA;IACpB,MAAM,EAAE,GAAG,oBAAoB,UAAU,EAAE,EAAE,CAAA;IAC7C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAEpC,MAAM,GAAG,CAAA;;cAEG,EAAE,KAAK,YAAY,KAAK,EAAE;GACrC,CAAA;IAED,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;AAC5E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAW;IAC1C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAA;IACpB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAU;;;kBAGhB,GAAG;GAClB,CAAA;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAElC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAA;IACpB,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,GAAG,QAAQ,CAAA;IAE/B,OAAO;QACL,UAAU,EAAE;YACV,8BAA8B;YAC9B,kDAAkD;SACnD;QACD,EAAE,EAAE,GAAG,CAAC,GAAG;QACX,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,kBAAkB,EAAE;YAClB;gBACE,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,4BAA4B;gBAClC,UAAU,EAAE,GAAG,CAAC,GAAG;gBACnB,kBAAkB,EAAE,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC;aACpD;SACF;QACD,cAAc,EAAE,CAAC,IAAI,CAAC;QACtB,eAAe,EAAE,CAAC,IAAI,CAAC;QACvB,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE;QACrC,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE;KACtC,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,UAAkB;IACjE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAA;IACpB,MAAM,GAAG,CAAA;8EACmE,GAAG;GAC9E,CAAA;AACH,CAAC"}
+{"version":3,"file":"did.js","sourceRoot":"","sources":["../../src/stub/did.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAGxC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAU7C,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,YAAoB;IAClD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAA;IACpB,MAAM,EAAE,GAAG,oBAAoB,UAAU,EAAE,EAAE,CAAA;IAC7C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAEpC,MAAM,GAAG,CAAA;;cAEG,EAAE,KAAK,YAAY,KAAK,EAAE;GACrC,CAAA;IAED,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;AAC5E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAW;IAC1C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAA;IACpB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAU;;;kBAGhB,GAAG;GAClB,CAAA;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAElC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAA;IACpB,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,GAAG,QAAQ,CAAA;IAE/B,OAAO;QACL,UAAU,EAAE;YACV,8BAA8B;YAC9B,kDAAkD;SACnD;QACD,EAAE,EAAE,GAAG,CAAC,GAAG;QACX,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,kBAAkB,EAAE;YAClB;gBACE,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,4BAA4B;gBAClC,UAAU,EAAE,GAAG,CAAC,GAAG;gBACnB,kBAAkB,EAAE,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC;aACpD;SACF;QACD,cAAc,EAAE,CAAC,IAAI,CAAC;QACtB,eAAe,EAAE,CAAC,IAAI,CAAC;QACvB,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE;QACrC,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE;KACtC,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,UAAkB;IACjE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAA;IACpB,MAAM,GAAG,CAAA;8EACmE,GAAG;GAC9E,CAAA;AACH,CAAC;AAED,0DAA0D;AAE1D;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAKpC;IACC,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAA;IACzF,CAAC;IACD,sEAAsE;IACtE,qEAAqE;IACrE,kEAAkE;IAClE,oEAAoE;IACpE,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAA;IAClE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC/E,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAC1F,MAAM,IAAI,KAAK,CACb,gHAAgH,CACjH,CAAA;IACH,CAAC;IACD,OAAO;QACL,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC;QACzC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC;QACtB,OAAO,EAAE;YACP,SAAS,EAAE;gBACT,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;gBAC7C,iBAAiB,EAAE,IAAI,CAAC,gBAAgB,IAAI,EAAE;aAC/C;SACF;QACD,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;KAC7B,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAmC;IACvE,MAAM,EAAE,GAAqB,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;IAC3F,MAAM,OAAO,GAAG,EAAE,CAAC,OAAgE,CAAA;IACnF,MAAM,UAAU,GAAG,OAAO,EAAE,SAAS,EAAE,UAAU,CAAA;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAA;IAC5F,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC7E,OAAO,SAAS,CAAC,YAAY,CAAC,CAAA;AAChC,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACpD,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solidus-network/sdk",
-  "version": "0.2.0",
+  "version": "0.5.0",
   "description": "Solidus Network SDK — DID resolution, verifiable credential issuance and verification, SD-JWT VC (EUDI-compatible), and on-chain queries via JSON-RPC.",
   "type": "module",
   "main": "./dist/index.js",
@@ -17,8 +17,8 @@
     "@noble/hashes": "^1.5.0",
     "@sd-jwt/sd-jwt-vc": "^0.19.0",
     "@sd-jwt/types": "^0.19.0",
-    "@solidus-network/auth": "0.2.0",
-    "@solidus-network/types": "0.2.0",
+    "@solidus-network/auth": "0.5.0",
+    "@solidus-network/types": "0.5.0",
     "bs58": "^6.0.0",
     "postgres": "^3.4.4"
   },