@sphereon/ssi-types 0.30.2-unstable.9 → 0.31.0

package/src/mapper/credential-constraints.ts

@@ -0,0 +1,19 @@
+import { CredentialFormat, PresentationFormat } from '../types'
+
+export type CredentialEncoding = 'json' /*includes json-ld*/ | 'jwt' | 'cbor'
+
+export type IssuerAttributeName = 'iss' | 'issuer' | 'issuerAuth'
+export type SubjectAttributeName = 'subject' | 'id' | 'deviceMac' | 'TODO'
+export type TypeAttributeName = 'type' | 'vct'
+
+export type DataModel = 'W3C_VCDM' | 'IETF_SD_JWT' | 'ISO_MSO_MDOC'
+
+export interface CredentialConstraint {
+  credentialFormat: CredentialFormat
+  presentationFormat: PresentationFormat
+  maxSignatures: number
+  encoding: CredentialEncoding
+  dataModel: DataModel
+  typeAttribute?: TypeAttributeName // optional since mdocs use namespace maps without an explicit type attribute
+  issuerAttributes: [IssuerAttributeName]
+}

package/src/mapper/credential-mapper.ts

@@ -41,9 +41,9 @@ import {
   WrappedVerifiablePresentation,
   WrappedW3CVerifiableCredential,
 } from '../types'
-import { MdocDocument } from '../types/mso_mdoc'
+import { getMdocDecodedPayload, MdocDocument } from '../types/mso_mdoc'
 import { ObjectUtils } from '../utils'
-import { com } from '@sphereon/kmp-mdl-mdoc'
+import { com } from '@sphereon/kmp-mdoc-core'
 import DeviceResponseCbor = com.sphereon.mdoc.data.device.DeviceResponseCbor
 
 export class CredentialMapper {
@@ -66,7 +66,7 @@ export class CredentialMapper {
    */
   static decodeVerifiablePresentation(
     presentation: OriginalVerifiablePresentation,
-    hasher?: Hasher
+    hasher?: Hasher,
   ): JwtDecodedVerifiablePresentation | IVerifiablePresentation | SdJwtDecodedVerifiableCredential | MdocOid4vpMdocVpToken | MdocDeviceResponse {
     if (CredentialMapper.isJwtEncoded(presentation)) {
       const payload = jwt_decode(presentation as string) as JwtDecodedVerifiablePresentation
@@ -111,7 +111,7 @@ export class CredentialMapper {
    */
   static decodeVerifiableCredential(
     credential: OriginalVerifiableCredential,
-    hasher?: Hasher
+    hasher?: Hasher,
   ): JwtDecodedVerifiableCredential | IVerifiableCredential | SdJwtDecodedVerifiableCredential {
     if (CredentialMapper.isJwtEncoded(credential)) {
       const payload = jwt_decode(credential as string) as JwtDecodedVerifiableCredential
@@ -151,7 +151,7 @@ export class CredentialMapper {
    */
   static toWrappedVerifiablePresentation(
     originalPresentation: OriginalVerifiablePresentation,
-    opts?: { maxTimeSkewInMS?: number; hasher?: Hasher }
+    opts?: { maxTimeSkewInMS?: number; hasher?: Hasher },
   ): WrappedVerifiablePresentation {
     // MSO_MDOC
     if (CredentialMapper.isMsoMdocDecodedPresentation(originalPresentation) || CredentialMapper.isMsoMdocOid4VPEncoded(originalPresentation)) {
@@ -162,19 +162,20 @@ export class CredentialMapper {
         deviceResponse = originalPresentation
       }
 
-      const mdocCredential: WrappedMdocCredential | undefined = deviceResponse.documents
-        ?.map((doc) => CredentialMapper.toWrappedVerifiableCredential(doc, opts) as WrappedMdocCredential)
-        .find((value) => value !== undefined)
-      if (mdocCredential === undefined) {
-        throw Error('mdoc credential data corruption')
+      const mdocCredentials = deviceResponse.documents?.map(
+        (doc) => CredentialMapper.toWrappedVerifiableCredential(doc, opts) as WrappedMdocCredential,
+      )
+      if (!mdocCredentials || mdocCredentials.length === 0) {
+        throw new Error('could not extract any mdoc credentials from mdoc device response')
       }
+
       return {
         type: CredentialMapper.isMsoMdocDecodedPresentation(originalPresentation) ? OriginalType.MSO_MDOC_DECODED : OriginalType.MSO_MDOC_ENCODED,
         format: 'mso_mdoc',
         original: originalPresentation,
         presentation: deviceResponse,
         decoded: deviceResponse,
-        vcs: [mdocCredential],
+        vcs: mdocCredentials,
       }
     }
     // SD-JWT
@@ -205,7 +206,7 @@ export class CredentialMapper {
       typeof originalPresentation !== 'string' && CredentialMapper.hasJWTProofType(originalPresentation) ? proof?.jwt : originalPresentation
     if (!original) {
       throw Error(
-        'Could not determine original presentation, probably it was a converted JWT presentation, that is now missing the JWT value in the proof'
+        'Could not determine original presentation, probably it was a converted JWT presentation, that is now missing the JWT value in the proof',
       )
     }
     const decoded = CredentialMapper.decodeVerifiablePresentation(original) as IVerifiablePresentation | JwtDecodedVerifiablePresentation
@@ -233,7 +234,7 @@ export class CredentialMapper {
       ? []
       : (CredentialMapper.toWrappedVerifiableCredentials(
           vp.verifiableCredential ?? [] /*.map(value => value.original)*/,
-          opts
+          opts,
         ) as WrappedW3CVerifiableCredential[])
 
     const presentation = {
@@ -261,7 +262,7 @@ export class CredentialMapper {
    */
   static toWrappedVerifiableCredentials(
     verifiableCredentials: OriginalVerifiableCredential[],
-    opts?: { maxTimeSkewInMS?: number; hasher?: Hasher }
+    opts?: { maxTimeSkewInMS?: number; hasher?: Hasher },
   ): WrappedVerifiableCredential[] {
     return verifiableCredentials.map((vc) => CredentialMapper.toWrappedVerifiableCredential(vc, opts))
   }
@@ -277,10 +278,10 @@ export class CredentialMapper {
    */
   static toWrappedVerifiableCredential(
     verifiableCredential: OriginalVerifiableCredential,
-    opts?: { maxTimeSkewInMS?: number; hasher?: Hasher }
+    opts?: { maxTimeSkewInMS?: number; hasher?: Hasher },
   ): WrappedVerifiableCredential {
     // MSO_MDOC
-    if (CredentialMapper.isMsoMdocDecodedCredential(verifiableCredential) || CredentialMapper.isMsoMdocDecodedCredential(verifiableCredential)) {
+    if (CredentialMapper.isMsoMdocDecodedCredential(verifiableCredential) || CredentialMapper.isMsoMdocOid4VPEncoded(verifiableCredential)) {
       let mdoc: MdocDocument
       if (CredentialMapper.isMsoMdocOid4VPEncoded(verifiableCredential)) {
         mdoc = decodeMdocIssuerSigned(verifiableCredential)
@@ -291,8 +292,8 @@ export class CredentialMapper {
         type: CredentialMapper.isMsoMdocDecodedCredential(verifiableCredential) ? OriginalType.MSO_MDOC_DECODED : OriginalType.MSO_MDOC_ENCODED,
         format: 'mso_mdoc',
         original: verifiableCredential,
-        credential: mdocDecodedCredentialToUniformCredential(mdoc),
-        decoded: mdoc,
+        credential: mdoc,
+        decoded: getMdocDecodedPayload(mdoc),
       }
     }
 
@@ -319,10 +320,10 @@ export class CredentialMapper {
 
     // If the VC is not an encoded/decoded SD-JWT, we assume it will be a W3C VC
     const proof = CredentialMapper.getFirstProof(verifiableCredential)
-    const original = CredentialMapper.hasJWTProofType(verifiableCredential) && proof ? proof.jwt ?? verifiableCredential : verifiableCredential
+    const original = CredentialMapper.hasJWTProofType(verifiableCredential) && proof ? (proof.jwt ?? verifiableCredential) : verifiableCredential
     if (!original) {
       throw Error(
-        'Could not determine original credential, probably it was a converted JWT credential, that is now missing the JWT value in the proof'
+        'Could not determine original credential, probably it was a converted JWT credential, that is now missing the JWT value in the proof',
       )
     }
     const decoded = CredentialMapper.decodeVerifiableCredential(original) as JwtDecodedVerifiableCredential | IVerifiableCredential
@@ -358,7 +359,7 @@ export class CredentialMapper {
     return ObjectUtils.isString(original) && !original.startsWith('ey') && ObjectUtils.isBase64(original)
   }
 
-  public static isW3cCredential(credential: ICredential | SdJwtDecodedVerifiableCredential): credential is ICredential {
+  public static isW3cCredential(credential: ICredential | SdJwtDecodedVerifiableCredential | MdocDocument): credential is ICredential {
     return typeof credential === 'object' && '@context' in credential && ((credential as ICredential).type?.includes('VerifiableCredential') || false)
   }
 
@@ -438,7 +439,7 @@ export class CredentialMapper {
   }
 
   public static isW3cPresentation(
-    presentation: UniformVerifiablePresentation | IPresentation | SdJwtDecodedVerifiableCredential | DeviceResponseCbor
+    presentation: UniformVerifiablePresentation | IPresentation | SdJwtDecodedVerifiableCredential | DeviceResponseCbor,
   ): presentation is IPresentation {
     return (
       typeof presentation === 'object' &&
@@ -448,7 +449,7 @@ export class CredentialMapper {
   }
 
   public static isSdJwtDecodedCredentialPayload(
-    credential: ICredential | SdJwtDecodedVerifiableCredentialPayload
+    credential: ICredential | SdJwtDecodedVerifiableCredentialPayload,
   ): credential is SdJwtDecodedVerifiableCredentialPayload {
     return typeof credential === 'object' && 'vct' in credential
   }
@@ -462,7 +463,11 @@ export class CredentialMapper {
         // We are doing this over here, as the rest of the logic around it would otherwise need to be adjusted substantially
         return false
       }
-      return firstOriginal.toJson().toJsonString() === secondOriginal.toJson().toJsonString()
+
+      // FIXME: mdoc library fails on parsing the device signed, so for now we just check whether the issuerSigned
+      // is equal, then we have a good chance it is the same credential. Once device signed parsing is fixed in mdl
+      // library we can move the .equals() to the top-level object.
+      return firstOriginal.issuerSigned.equals(secondOriginal.issuerSigned)
     } else if (CredentialMapper.isSdJwtDecodedCredential(firstOriginal) || CredentialMapper.isSdJwtDecodedCredential(secondOriginal)) {
       return firstOriginal.compactSdJwtVc === secondOriginal.compactSdJwtVc
     } else {
@@ -476,7 +481,7 @@ export class CredentialMapper {
   }
 
   public static isSdJwtDecodedCredential(
-    original: OriginalVerifiableCredential | OriginalVerifiablePresentation | ICredential | IPresentation
+    original: OriginalVerifiableCredential | OriginalVerifiablePresentation | ICredential | IPresentation,
   ): original is SdJwtDecodedVerifiableCredential {
     return (
       typeof original === 'object' &&
@@ -485,7 +490,7 @@ export class CredentialMapper {
   }
 
   public static isMsoMdocDecodedCredential(
-    original: OriginalVerifiableCredential | OriginalVerifiablePresentation | ICredential | IPresentation
+    original: OriginalVerifiableCredential | OriginalVerifiablePresentation | ICredential | IPresentation,
   ): original is MdocDocument {
     return typeof original === 'object' && 'issuerSigned' in original && (<MdocDocument>original).issuerSigned !== undefined
   }
@@ -520,7 +525,7 @@ export class CredentialMapper {
   static jwtEncodedPresentationToUniformPresentation(
     jwt: string,
     makeCredentialsUniform: boolean = true,
-    opts?: { maxTimeSkewInMS?: number }
+    opts?: { maxTimeSkewInMS?: number },
   ): IPresentation {
     return CredentialMapper.jwtDecodedPresentationToUniformPresentation(jwt_decode(jwt), makeCredentialsUniform, opts)
   }
@@ -528,7 +533,7 @@ export class CredentialMapper {
   static jwtDecodedPresentationToUniformPresentation(
     decoded: JwtDecodedVerifiablePresentation,
     makeCredentialsUniform: boolean = true,
-    opts?: { maxTimeSkewInMS?: number }
+    opts?: { maxTimeSkewInMS?: number },
   ): IVerifiablePresentation {
     const { iss, aud, jti, vp, ...rest } = decoded
 
@@ -575,7 +580,7 @@ export class CredentialMapper {
     opts?: {
       maxTimeSkewInMS?: number
       hasher?: Hasher
-    }
+    },
   ): IVerifiableCredential {
     if (CredentialMapper.isMsoMdocDecodedCredential(verifiableCredential)) {
       return mdocDecodedCredentialToUniformCredential(verifiableCredential)
@@ -589,7 +594,7 @@ export class CredentialMapper {
         : verifiableCredential
     if (!original) {
       throw Error(
-        'Could not determine original credential from passed in credential. Probably because a JWT proof type was present, but now is not available anymore'
+        'Could not determine original credential from passed in credential. Probably because a JWT proof type was present, but now is not available anymore',
       )
     }
     const decoded = CredentialMapper.decodeVerifiableCredential(original, opts?.hasher)
@@ -612,7 +617,7 @@ export class CredentialMapper {
 
   static toUniformPresentation(
     presentation: OriginalVerifiablePresentation,
-    opts?: { maxTimeSkewInMS?: number; addContextIfMissing?: boolean }
+    opts?: { maxTimeSkewInMS?: number; addContextIfMissing?: boolean; hasher?: Hasher },
   ): IVerifiablePresentation {
     if (CredentialMapper.isSdJwtDecodedCredential(presentation)) {
       throw new Error('Converting SD-JWT VC to uniform VP is not supported.')
@@ -624,10 +629,10 @@ export class CredentialMapper {
     const original = typeof presentation !== 'string' && CredentialMapper.hasJWTProofType(presentation) ? proof?.jwt : presentation
     if (!original) {
       throw Error(
-        'Could not determine original presentation, probably it was a converted JWT presentation, that is now missing the JWT value in the proof'
+        'Could not determine original presentation, probably it was a converted JWT presentation, that is now missing the JWT value in the proof',
       )
     }
-    const decoded = CredentialMapper.decodeVerifiablePresentation(original)
+    const decoded = CredentialMapper.decodeVerifiablePresentation(original, opts?.hasher)
     const isJwtEncoded: boolean = CredentialMapper.isJwtEncoded(original)
     const isJwtDecoded: boolean = CredentialMapper.isJwtDecodedPresentation(original)
     const uniformPresentation =
@@ -641,7 +646,7 @@ export class CredentialMapper {
     }
 
     uniformPresentation.verifiableCredential = uniformPresentation.verifiableCredential?.map((vc) =>
-      CredentialMapper.toUniformCredential(vc, opts)
+      CredentialMapper.toUniformCredential(vc, opts),
     ) as IVerifiableCredential[] // We cast it because we IPresentation needs a VC. The internal Credential doesn't have the required Proof anymore (that is intended)
     return uniformPresentation
   }
@@ -650,14 +655,14 @@ export class CredentialMapper {
     jwt: string,
     opts?: {
       maxTimeSkewInMS?: number
-    }
+    },
   ): IVerifiableCredential {
     return CredentialMapper.jwtDecodedCredentialToUniformCredential(jwt_decode(jwt), opts)
   }
 
   static jwtDecodedCredentialToUniformCredential(
     decoded: JwtDecodedVerifiableCredential,
-    opts?: { maxTimeSkewInMS?: number }
+    opts?: { maxTimeSkewInMS?: number },
   ): IVerifiableCredential {
     const { exp, nbf, iss, vc, sub, jti, ...rest } = decoded
     const credential: IVerifiableCredential = {
@@ -825,7 +830,7 @@ export class CredentialMapper {
   }
 
   static toCompactJWT(
-    jwtDocument: W3CVerifiableCredential | JwtDecodedVerifiableCredential | W3CVerifiablePresentation | JwtDecodedVerifiablePresentation | string
+    jwtDocument: W3CVerifiableCredential | JwtDecodedVerifiableCredential | W3CVerifiablePresentation | JwtDecodedVerifiablePresentation | string,
   ): string {
     if (!jwtDocument || CredentialMapper.detectDocumentType(jwtDocument) !== DocumentFormat.JWT) {
       throw Error('Cannot convert non JWT credential to JWT')
@@ -855,7 +860,7 @@ export class CredentialMapper {
       | JwtDecodedVerifiablePresentation
       | SdJwtDecodedVerifiableCredential
       | MdocDeviceResponse
-      | MdocDocument
+      | MdocDocument,
   ): DocumentFormat {
     if (this.isMsoMdocOid4VPEncoded(document as any) || this.isMsoMdocDecodedCredential(document as any)) {
       return DocumentFormat.MSO_MDOC
@@ -883,7 +888,7 @@ export class CredentialMapper {
   }
 
   private static hasJWTProofType(
-    document: W3CVerifiableCredential | W3CVerifiablePresentation | JwtDecodedVerifiableCredential | JwtDecodedVerifiablePresentation
+    document: W3CVerifiableCredential | W3CVerifiablePresentation | JwtDecodedVerifiableCredential | JwtDecodedVerifiablePresentation,
   ): boolean {
     if (typeof document === 'string') {
       return false
@@ -892,7 +897,7 @@ export class CredentialMapper {
   }
 
   private static getFirstProof(
-    document: W3CVerifiableCredential | W3CVerifiablePresentation | JwtDecodedVerifiableCredential | JwtDecodedVerifiablePresentation
+    document: W3CVerifiableCredential | W3CVerifiablePresentation | JwtDecodedVerifiableCredential | JwtDecodedVerifiablePresentation,
   ): IProof | undefined {
     if (!document || typeof document === 'string') {
       return undefined

package/src/types/cose.ts

@@ -1,3 +1,8 @@
+import { com } from '@sphereon/kmp-mdoc-core'
+import SignatureAlgorithm = com.sphereon.crypto.generic.SignatureAlgorithm
+import KeyType = com.sphereon.crypto.generic.KeyType
+import KeyOperations = com.sphereon.crypto.generic.KeyOperations
+
 /**
  * See our mdl-mdoc and crypto library for more information
  * https://github.com/Sphereon-Opensource/mdoc-cbor-crypto-multiplatform
@@ -17,6 +22,14 @@ export interface ICoseKeyJson {
   y?: string
   d?: string
   x5chain?: Array<string>
+  getSignatureAlgorithm(): SignatureAlgorithm
+  getKty(): KeyType
+  getKeyOperations(): Array<KeyOperations>
+  getX509CertificateChain(): Array<string> | undefined
+  toPublicKey(): ICoseKeyJson
+  getKidAsString(): string | undefined
+  getXAsString(): string
+  getYAsString(): string
 
   [k: string]: unknown
 }

package/src/types/index.ts

@@ -3,7 +3,9 @@ export * from './pex'
 export * from './vc'
 export * from './generic'
 export * from './sd-jwt-vc'
+export * from './sd-jwt-type-metadata'
 export * from './w3c-vc'
 export * from './jose'
 export * from './cose'
 export * from './mso_mdoc'
+export * from './metadata-types'

package/src/types/metadata-types.ts

@@ -0,0 +1,5 @@
+export type MetadataType = 'issuer' | 'authorizationServer' | 'openidFederation'
+
+export interface IMetadataImportArgs {
+  metadataType: MetadataType
+}

package/src/types/mso_mdoc.ts

@@ -5,7 +5,7 @@
  * for sd-jwts
  */
 
-import { com } from '@sphereon/kmp-mdl-mdoc'
+import { com } from '@sphereon/kmp-mdoc-core'
 import { IProofPurpose, IProofType } from './did'
 import { OriginalType, WrappedVerifiableCredential, WrappedVerifiablePresentation } from './vc'
 import { IVerifiableCredential } from './w3c-vc'
@@ -25,6 +25,8 @@ export type MdocOid4vpMdocVpToken = string
 export type MdocIssuerSigned = com.sphereon.mdoc.data.device.IssuerSignedCbor
 export type MdocDocument = com.sphereon.mdoc.data.device.DocumentCbor
 export type MdocDocumentJson = com.sphereon.mdoc.data.device.DocumentJson
+export type IssuerSignedJson = com.sphereon.mdoc.data.device.IssuerSignedJson
+export type DeviceSignedJson = com.sphereon.mdoc.data.device.DeviceSignedJson
 export type MdocDeviceResponse = com.sphereon.mdoc.data.device.DeviceResponseCbor
 
 export interface WrappedMdocCredential {
@@ -33,9 +35,10 @@ export interface WrappedMdocCredential {
    */
   original: MdocDocument | MdocOid4vpIssuerSigned
   /**
-   * Decoded version of the Mdoc payload. We add the record to make sure existing implementations remain happy
+   * Record where keys are the namespaces and the values are objects again with the namespace values
+   * @todo which types can be there? (it doesn't matter for matching as mdoc only matches on path)
    */
-  decoded: MdocDocument & { [key: string]: any }
+  decoded: MdocDecodedPayload
   /**
    * Type of this credential.
    */
@@ -47,7 +50,7 @@ export interface WrappedMdocCredential {
   /**
    * Internal stable representation of a Credential
    */
-  credential: IVerifiableCredential
+  credential: MdocDocument
 }
 
 export interface WrappedMdocPresentation {
@@ -72,9 +75,10 @@ export interface WrappedMdocPresentation {
    */
   presentation: MdocDeviceResponse
   /**
-   * Wrapped Mdocs belonging to the Presentation. .
+   * Wrapped Mdocs belonging to the Presentation. There can be multiple
+   * documents in a single device response
    */
-  vcs: [WrappedMdocCredential]
+  vcs: WrappedMdocCredential[]
 }
 
 export function isWrappedMdocCredential(vc: WrappedVerifiableCredential): vc is WrappedMdocCredential {
@@ -84,6 +88,32 @@ export function isWrappedMdocCredential(vc: WrappedVerifiableCredential): vc is
 export function isWrappedMdocPresentation(vp: WrappedVerifiablePresentation): vp is WrappedMdocPresentation {
   return vp.format === 'mso_mdoc'
 }
+/**
+ * Record where keys are the namespaces and the values are objects again with the namespace values
+ */
+export type MdocDecodedPayload = Record<string, Record<string, string | number | boolean>>
+export function getMdocDecodedPayload(mdoc: MdocDocument): MdocDecodedPayload {
+  const mdocJson = mdoc.toJson()
+  if (!mdocJson.issuerSigned.nameSpaces) {
+    throw Error(`Cannot access Issuer Signed items from the Mdoc`)
+  }
+
+  const issuerSignedJson = mdocJson.issuerSigned.toJsonDTO<IssuerSignedJson>()
+  const namespaces = issuerSignedJson.nameSpaces as unknown as Record<string, IssuerSignedItemJson[]>
+
+  const decodedPayload: MdocDecodedPayload = {}
+  for (const [namespace, items] of Object.entries(namespaces)) {
+    decodedPayload[namespace] = items.reduce(
+      (acc, item) => ({
+        ...acc,
+        [item.key]: item.value.value,
+      }),
+      {},
+    )
+  }
+
+  return decodedPayload
+}
 
 /**
  * Decode an Mdoc from its issuerSigned OID4VP Base64URL (string) to an object containing the disclosures,
@@ -98,6 +128,10 @@ export function decodeMdocIssuerSigned(oid4vpIssuerSigned: MdocOid4vpIssuerSigne
   return holderMdoc
 }
 
+export function encodeMdocIssuerSigned(issuerSigned: MdocIssuerSigned, encoding: 'base64url' = 'base64url') {
+  return encodeTo(issuerSigned.cborEncode(), Encoding.BASE64URL)
+}
+
 /**
  * Decode an Mdoc from its vp_token OID4VP Base64URL (string) to an object containing the disclosures,
  * signed payload, decoded payload
@@ -112,7 +146,7 @@ export function decodeMdocDeviceResponse(vpToken: MdocOid4vpMdocVpToken): MdocDe
 export const mdocDecodedCredentialToUniformCredential = (
   decoded: MdocDocument,
   // @ts-ignore
-  opts?: { maxTimeSkewInMS?: number }
+  opts?: { maxTimeSkewInMS?: number },
 ): IVerifiableCredential => {
   const mdoc = decoded.toJson()
   const json = mdoc.toJsonDTO<DocumentJson>()

package/src/types/sd-jwt-type-metadata.ts

@@ -0,0 +1,220 @@
+import * as u8a from 'uint8arrays'
+import { AsyncHasher } from './sd-jwt-vc'
+
+/**
+ * Represents the metadata associated with a specific SD-JWT VC type.
+ */
+interface SdJwtTypeMetadata {
+  /**
+   * REQUIRED. The VC type URI.
+   */
+  vct: string;
+
+  /**
+   * OPTIONAL. A human-readable name for the type.
+   */
+  name?: string;
+
+  /**
+   * OPTIONAL. A human-readable description for the type.
+   */
+  description?: string;
+
+  /**
+   * OPTIONAL. A URI of another type that this type extends.
+   */
+  extends?: string;
+
+  /**
+   * OPTIONAL. Integrity metadata string for the 'extends' field.
+   */
+  ['extends#integrity']?: string;
+
+  /**
+   * OPTIONAL. URL pointing towards a JSON Schema document describing the VC's structure.
+   */
+  schema_uri?: string;
+
+  /**
+   * OPTIONAL. Integrity metadata string for the 'schema_uri' field.
+   */
+  ['schema_uri#integrity']?: string;
+
+  /**
+   * OPTIONAL. Display metadata for various languages.
+   */
+  display?: Array<SdJwtTypeDisplayMetadata>;
+
+  /**
+   * OPTIONAL. Metadata for the claims within the VC.
+   */
+  // TODO:
+  claims?: Array<any>;
+}
+
+/**
+ * Represents display metadata for a specific language.
+ */
+interface SdJwtTypeDisplayMetadata {
+  /**
+   * REQUIRED. Language tag for the display information.
+   */
+  lang: string;
+
+  /**
+   * REQUIRED. Human-readable name for the type.
+   */
+  name: string;
+
+  /**
+   * OPTIONAL. Human-readable description for the type.
+   */
+  description?: string;
+
+  /**
+   * OPTIONAL. Rendering metadata for the type.
+   */
+  rendering?: SdJwtTypeRenderingMetadata;
+}
+
+/**
+ * Contains rendering metadata for different methods.
+ */
+interface SdJwtTypeRenderingMetadata {
+  /**
+   * OPTIONAL. Simple rendering method metadata.
+   */
+  simple?: SdJwtSimpleRenderingMetadata;
+
+  /**
+   * OPTIONAL. Metadata for SVG templates.
+   */
+  svg_template?: Array<SdJwtSVGTemplateMetadata>;
+}
+
+/**
+ * Represents metadata for simple rendering.
+ */
+interface SdJwtSimpleRenderingMetadata {
+  /**
+   * OPTIONAL. Metadata for the logo image.
+   */
+  logo?: SdJwtLogoMetadata;
+
+  /**
+   * OPTIONAL. Background color for the credential.
+   */
+  background_color?: string;
+
+  /**
+   * OPTIONAL. Text color for the credential.
+   */
+  text_color?: string;
+}
+
+/**
+ * Represents metadata for a logo.
+ */
+interface SdJwtLogoMetadata {
+  /**
+   * REQUIRED. URI pointing to the logo image.
+   */
+  uri: string;
+
+  /**
+   * OPTIONAL. Integrity metadata string for the 'uri' field.
+   */
+  ['uri#integrity']?: string;
+
+  /**
+   * OPTIONAL. Alternative text for the logo image.
+   */
+  alt_text?: string;
+}
+
+/**
+ * Represents metadata for SVG templates.
+ */
+interface SdJwtSVGTemplateMetadata {
+  /**
+   * REQUIRED. URI pointing to the SVG template.
+   */
+  uri: string;
+
+  /**
+   * OPTIONAL. Integrity metadata string for the 'uri' field.
+   */
+  ['uri#integrity']?: string;
+
+  /**
+   * OPTIONAL. Properties for the SVG template.
+   */
+  properties?: SdJwtSVGTemplateProperties;
+}
+
+/**
+ * Contains properties for SVG templates.
+ */
+interface SdJwtSVGTemplateProperties {
+  /**
+   * OPTIONAL. The orientation for which the SVG template is optimized.
+   */
+  orientation?: string;
+
+  /**
+   * OPTIONAL. The color scheme for which the SVG template is optimized.
+   */
+  color_scheme?: string;
+}
+
+
+// Helper function to fetch API with error handling
+async function fetchUrlWithErrorHandling(url: string): Promise<Response> {
+  const response = await fetch(url)
+  if (!response.ok) {
+    throw new Error(`${response.status}: ${response.statusText}`)
+  }
+  return response
+}
+
+export type SdJwtTypeHasher = (input: any, alg?: string) => string
+
+async function validateIntegrity(input: any, integrityValue: string, hasher: AsyncHasher, alg?: string): Promise<boolean> {
+  const hash = await hasher(input, alg ?? 'sha256')
+  return u8a.toString(hash, 'utf-8') === integrityValue
+}
+
+// Fetch and validate Type Metadata
+export async function fetchSdJwtTypeMetadataFromVctUrl(vct: string, opts?: { hasher?: AsyncHasher, integrity?: string }): Promise<SdJwtTypeMetadata> {
+  const url = new URL(vct)
+  const wellKnownUrl = `${url.origin}/.well-known/vct${url.pathname}`
+
+  const response = await fetchUrlWithErrorHandling(wellKnownUrl)
+  const metadata: SdJwtTypeMetadata = await response.json()
+  assertValidTypeMetadata(metadata, vct)
+  if (opts?.integrity && opts.hasher) {
+    if (!await validateIntegrity(metadata, opts.integrity, opts.hasher)) {
+      throw new Error('Integrity check failed')
+    }
+  }
+  return metadata
+}
+
+function assertValidTypeMetadata(metadata: SdJwtTypeMetadata, vct: string): void {
+  if (metadata.vct !== vct) {
+    throw new Error('VCT mismatch in metadata and credential')
+  }
+}
+
+
+/*
+// Example usage
+  try {
+    const vct = 'https://betelgeuse.example.com/education_credential'
+    const typeMetadata = await fetchSdJwtTypeMetadataFromVctUrl(vct)
+    console.log('Type Metadata retrieved successfully:', typeMetadata)
+  } catch (error) {
+    console.error('Error fetching type metadata:', error.message)
+  }
+*/
+