@sphereon/ssi-types 0.33.1-next.2 → 0.33.1-next.68

package/src/types/vc.ts

@@ -1,4 +1,4 @@
-import {
+import type {
   MdocDeviceResponse,
   MdocDocument,
   MdocOid4vpIssuerSigned,
@@ -6,8 +6,8 @@ import {
   WrappedMdocCredential,
   WrappedMdocPresentation,
 } from './mso_mdoc'
-import { SdJwtDecodedVerifiableCredential, WrappedSdJwtVerifiableCredential, WrappedSdJwtVerifiablePresentation } from './sd-jwt-vc'
-import {
+import type { SdJwtDecodedVerifiableCredential, WrappedSdJwtVerifiableCredential, WrappedSdJwtVerifiablePresentation } from './sd-jwt-vc'
+import type {
   JwtDecodedVerifiableCredential,
   JwtDecodedVerifiablePresentation,
   W3CVerifiableCredential,
@@ -20,25 +20,13 @@ export type WrappedVerifiableCredential = WrappedW3CVerifiableCredential | Wrapp
 
 export type WrappedVerifiablePresentation = WrappedW3CVerifiablePresentation | WrappedSdJwtVerifiablePresentation | WrappedMdocPresentation
 
-export enum OriginalType {
-  // W3C
-  JSONLD = 'json-ld',
-  JWT_ENCODED = 'jwt-encoded',
-  JWT_DECODED = 'jwt-decoded',
-
-  // SD-JWT
-  SD_JWT_VC_ENCODED = 'sd-jwt-vc-encoded',
-  SD_JWT_VC_DECODED = 'sd-jwt-vc-decoded',
-
-  // MSO MDOCS
-  MSO_MDOC_ENCODED = 'mso_mdoc-encoded',
-  MSO_MDOC_DECODED = 'mso_mdoc-decoded',
-}
+export type CredentialProofFormat = 'jwt' | 'lds' | 'vc+jwt' /*| 'EthereumEip712Signature2021'*/ | 'cbor'
 
 export type CredentialFormat =
   // W3C
   | 'jwt_vc'
   | 'ldp_vc'
+  | 'vc+jwt'
   // SD-JWT
   | 'vc+sd-jwt'
   // Remaining
@@ -51,8 +39,9 @@ export type PresentationFormat =
   // W3C
   | 'jwt_vp'
   | 'ldp_vp'
+  | 'vp+jwt'
   // SD-JWT
-  | 'vc+sd-jwt'
+  | 'vp+sd-jwt'
   // Remaining
   | 'jwt'
   | 'ldp'
@@ -74,14 +63,3 @@ export type OriginalVerifiablePresentation =
   | MdocOid4vpMdocVpToken
   | MdocDeviceResponse
 export type Original = OriginalVerifiablePresentation | OriginalVerifiableCredential
-
-export const enum DocumentFormat {
-  // W3C
-  JWT,
-  JSONLD,
-  // SD-JWT
-  SD_JWT_VC,
-  // Remaining
-  EIP712,
-  MSO_MDOC,
-}

package/src/types/w3c-vc.ts

@@ -1,6 +1,6 @@
-import { IProofPurpose, IProofType } from './did'
-import { PresentationSubmission } from './pex'
-import { OriginalType, WrappedVerifiableCredential, WrappedVerifiablePresentation } from './vc'
+import { type PresentationSubmission } from './pex'
+import { OriginalType } from '../mapper'
+import { IProofPurpose, IProofType } from '../utils'
 
 export type AdditionalClaims = Record<string, any>
 
@@ -195,8 +195,6 @@ export interface JwtDecodedVerifiablePresentation {
   [x: string]: any
 }
 
-export const JWT_PROOF_TYPE_2020 = 'JwtProof2020'
-
 export interface IVerifyStatusResult {
   verified: boolean
   /**
@@ -284,25 +282,4 @@ export enum StatusListType {
 
 export type StatusPurpose2021 = 'revocation' | 'suspension' | string
 
-export enum StatusListCredentialIdMode {
-  ISSUANCE = 'ISSUANCE',
-  // PERSISTENCE = 'PERSISTENCE',
-  NEVER = 'NEVER',
-}
-
 export type StatusListIndexingDirection = 'rightToLeft'
-
-export enum StatusListDriverType {
-  AGENT_TYPEORM = 'agent_typeorm',
-  /* AGENT_KV_STORE = 'agent_kv_store',
-  GITHUB = 'github',
-  AGENT_FILESYSTEM = 'agent_filesystem',*/
-}
-
-export function isWrappedW3CVerifiableCredential(vc: WrappedVerifiableCredential): vc is WrappedW3CVerifiableCredential {
-  return vc.format === 'jwt_vc' || vc.format === 'ldp_vc'
-}
-
-export function isWrappedW3CVerifiablePresentation(vp: WrappedVerifiablePresentation): vp is WrappedW3CVerifiablePresentation {
-  return vp.format === 'jwt_vp' || vp.format === 'ldp_vp'
-}

package/src/utils/cose.ts

@@ -0,0 +1,46 @@
+export enum ICoseKeyType {
+  OKP = 1,
+  EC2 = 2,
+  RSA = 3,
+  Symmetric = 4,
+  Reserved = 0,
+}
+
+export enum ICoseSignatureAlgorithm {
+  ES256 = -7,
+  ES256K = -47,
+  ES384 = -35,
+  ES512 = -36,
+  EdDSA = -8,
+  HS256_64 = 4,
+  HS256 = 5,
+  HS384 = 6,
+  HS512 = 7,
+  PS256 = -37,
+  PS384 = -38,
+  PS512 = -39,
+}
+
+export enum ICoseKeyOperation {
+  SIGN = 1,
+  VERIFY = 2,
+  ENCRYPT = 3,
+  DECRYPT = 4,
+  WRAP_KEY = 5,
+  UNWRAP_KEY = 6,
+  DERIVE_KEY = 7,
+  DERIVE_BITS = 8,
+  MAC_CREATE = 9,
+  MAC_VERIFY = 10,
+}
+
+export enum ICoseCurve {
+  P_256 = 1,
+  P_384 = 2,
+  P_521 = 3,
+  X25519 = 4,
+  X448 = 5,
+  Ed25519 = 6,
+  Ed448 = 7,
+  secp256k1 = -1,
+}

package/src/utils/did.ts

@@ -0,0 +1,91 @@
+import { IParsedDID } from '../types'
+
+export enum IProofPurpose {
+  verificationMethod = 'verificationMethod',
+  assertionMethod = 'assertionMethod',
+  authentication = 'authentication',
+  keyAgreement = 'keyAgreement',
+  contractAgreement = 'contactAgreement',
+  capabilityInvocation = 'capabilityInvocation',
+  capabilityDelegation = 'capabilityDelegation',
+}
+
+export enum IProofType {
+  Ed25519Signature2018 = 'Ed25519Signature2018',
+  Ed25519Signature2020 = 'Ed25519Signature2020',
+  EcdsaSecp256k1Signature2019 = 'EcdsaSecp256k1Signature2019',
+  EcdsaSecp256k1RecoverySignature2020 = 'EcdsaSecp256k1RecoverySignature2020',
+  JsonWebSignature2020 = 'JsonWebSignature2020',
+  RsaSignature2018 = 'RsaSignature2018',
+  GpgSignature2020 = 'GpgSignature2020',
+  JcsEd25519Signature2020 = 'JcsEd25519Signature2020',
+  BbsBlsSignatureProof2020 = 'BbsBlsSignatureProof2020',
+  BbsBlsBoundSignatureProof2020 = 'BbsBlsBoundSignatureProof2020',
+  JwtProof2020 = 'JwtProof2020',
+  SdJwtProof2024 = 'SdJwtProof2024',
+  MdocProof2024 = 'MsoMdocProof2024',
+}
+
+export const parseDid = (did: string): IParsedDID => {
+  const parsedDid = parse(did)
+  if (parsedDid === null) {
+    throw new Error('invalid did')
+  }
+
+  return parsedDid
+}
+
+const parse = (didUrl: string): IParsedDID | null => {
+  const PCT_ENCODED = '(?:%[0-9a-fA-F]{2})'
+  const ID_CHAR = `(?:[a-zA-Z0-9._-]|${PCT_ENCODED})`
+  const METHOD = '([a-z0-9]+)'
+  const METHOD_ID = `((?:${ID_CHAR}*:)*(${ID_CHAR}+))`
+  const PARAM_CHAR = '[a-zA-Z0-9_.:%-]'
+  const PARAM = `;${PARAM_CHAR}+=${PARAM_CHAR}*`
+  const PARAMS = `((${PARAM})*)`
+  const PATH = `(/[^#?]*)?`
+  const QUERY = `([?][^#]*)?`
+  const FRAGMENT = `(#.*)?`
+  const DID_MATCHER = new RegExp(`^did:${METHOD}:${METHOD_ID}${PARAMS}${PATH}${QUERY}${FRAGMENT}$`)
+
+  if (didUrl === '' || !didUrl) return null
+  const sections = didUrl.match(DID_MATCHER)
+  if (sections) {
+    const parts: IParsedDID = {
+      did: `did:${sections[1]}:${sections[2]}`,
+      method: sections[1],
+      id: sections[2],
+      didUrl,
+    }
+    if (sections[4]) {
+      const params = sections[4].slice(1).split(';')
+      parts.params = {}
+      for (const p of params) {
+        const kv = p.split('=')
+        parts.params[kv[0]] = kv[1]
+      }
+    }
+    if (sections[6]) parts.path = sections[6]
+    if (sections[7]) parts.query = sections[7].slice(1)
+    if (sections[8]) parts.fragment = sections[8].slice(1)
+    return parts
+  }
+
+  return null
+}
+
+// Copied from did-resolver, so we have types without external dep
+
+// Copyright 2018 Consensys AG
+
+// Licensed under the Apache License, Version 2.0(the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+
+// http://www.apache.org/licenses/LICENSE-2.0
+
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+//   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.

package/src/utils/hasher.ts

@@ -1,6 +1,9 @@
 import { sha256, sha384, sha512 } from '@noble/hashes/sha2'
+
+// @ts-ignore
 import * as u8a from 'uint8arrays'
-import { HasherSync } from '../types'
+const { fromString } = u8a
+import type { HasherSync } from '../types'
 
 const supportedAlgorithms = ['sha256', 'sha384', 'sha512'] as const
 type SupportedAlgorithms = (typeof supportedAlgorithms)[number]
@@ -11,7 +14,7 @@ export const shaHasher: HasherSync = (data, algorithm) => {
     throw new Error(`Unsupported hashing algorithm ${algorithm}`)
   }
   const hasher = sanitizedAlgorithm === 'sha384' ? sha384 : sanitizedAlgorithm === 'sha512' ? sha512 : sha256
-  return hasher(typeof data === 'string' ? u8a.fromString(data) : new Uint8Array(data))
+  return hasher(typeof data === 'string' ? fromString(data) : new Uint8Array(data))
 }
 
 export const defaultHasher: HasherSync = shaHasher

package/src/utils/index.ts

@@ -1,2 +1,8 @@
 export * from './object'
 export * from './hasher'
+export * from './vc'
+export * from './did'
+export * from './mdoc'
+export * from './sd-jwt'
+export * from './jose'
+export * from './cose'

package/src/utils/jose.ts

@@ -0,0 +1,47 @@
+export enum JwkKeyType {
+  EC = 'EC',
+  RSA = 'RSA',
+  oct = 'oct',
+  OKP = 'OKP',
+}
+
+export enum JoseSignatureAlgorithm {
+  RS256 = 'RS256',
+  RS384 = 'RS384',
+  RS512 = 'RS512',
+  ES256 = 'ES256',
+  ES256K = 'ES256K',
+  ES384 = 'ES384',
+  ES512 = 'ES512',
+  EdDSA = 'EdDSA',
+  HS256 = 'HS256',
+  HS384 = 'HS384',
+  HS512 = 'HS512',
+  PS256 = 'PS256',
+  PS384 = 'PS384',
+  PS512 = 'PS512',
+  none = 'none',
+}
+
+export enum JoseKeyOperation {
+  SIGN = 'sign',
+  VERIFY = 'verify',
+  ENCRYPT = 'encrypt',
+  DECRYPT = 'decrypt',
+  WRAP_KEY = 'wrapKey',
+  UNWRAP_KEY = 'unwrapKey',
+  DERIVE_KEY = 'deriveKey',
+  DERIVE_BITS = 'deriveBits',
+}
+
+export enum JoseCurve {
+  P_256 = 'P-256',
+  P_384 = 'P-384',
+  P_521 = 'P-521',
+  X25519 = 'X25519',
+  X448 = 'X448',
+  EdDSA = 'EdDSA',
+  Ed25519 = 'Ed25519',
+  Ed448 = 'Ed448',
+  secp256k1 = 'secp256k1',
+}

package/src/utils/mdoc.ts

@@ -0,0 +1,144 @@
+import type {
+  DocumentJson,
+  IssuerSignedItemJson,
+  IVerifiableCredential,
+  MdocDecodedPayload,
+  MdocDeviceResponse,
+  MdocDocument,
+  MdocIssuerSigned,
+  MdocOid4vpIssuerSigned,
+  MdocOid4vpMdocVpToken,
+  WrappedMdocCredential,
+  WrappedMdocPresentation,
+  WrappedVerifiableCredential,
+  WrappedVerifiablePresentation,
+} from '../types'
+import * as mdoc from '@sphereon/kmp-mdoc-core'
+import { IProofPurpose, IProofType } from './did'
+
+export function isWrappedMdocCredential(vc: WrappedVerifiableCredential): vc is WrappedMdocCredential {
+  return vc.format === 'mso_mdoc'
+}
+
+export function isWrappedMdocPresentation(vp: WrappedVerifiablePresentation): vp is WrappedMdocPresentation {
+  return vp.format === 'mso_mdoc'
+}
+
+export function getMdocDecodedPayload(mdoc: MdocDocument): MdocDecodedPayload {
+  const mdocJson = mdoc.toJson()
+  if (!mdocJson.issuerSigned.nameSpaces) {
+    throw Error(`Cannot access Issuer Signed items from the Mdoc`)
+  }
+
+  const issuerSignedJson = mdoc.issuerSigned.toJsonDTO()
+  const namespaces = issuerSignedJson.nameSpaces as unknown as Record<string, IssuerSignedItemJson[]>
+
+  const decodedPayload: MdocDecodedPayload = {}
+  for (const [namespace, items] of Object.entries(namespaces)) {
+    decodedPayload[namespace] = items.reduce(
+      (acc, item) => ({
+        ...acc,
+        [item.key]: item.value.value,
+      }),
+      {},
+    )
+  }
+
+  return decodedPayload
+}
+
+/**
+ * Decode an Mdoc from its issuerSigned OID4VP Base64URL (string) to an object containing the disclosures,
+ * signed payload, decoded payload
+ *
+ */
+export function decodeMdocIssuerSigned(oid4vpIssuerSigned: MdocOid4vpIssuerSigned): MdocDocument {
+  // Issuer signed according to 18013-7 in base64url
+  const issuerSigned: MdocIssuerSigned = mdoc.com.sphereon.mdoc.data.device.IssuerSignedCbor.Static.cborDecode(
+    mdoc.com.sphereon.kmp.decodeFrom(oid4vpIssuerSigned, mdoc.com.sphereon.kmp.Encoding.BASE64URL),
+  )
+  // Create an mdoc from it. // Validations need to be performed by the caller after this!
+  const holderMdoc: MdocDocument = issuerSigned.toDocument()
+  return holderMdoc
+}
+
+export function encodeMdocIssuerSigned(issuerSigned: MdocIssuerSigned, encoding: 'base64url' = 'base64url') {
+  return mdoc.com.sphereon.kmp.encodeTo(issuerSigned.cborEncode(), mdoc.com.sphereon.kmp.Encoding.BASE64URL)
+}
+
+/**
+ * Decode an Mdoc from its vp_token OID4VP Base64URL (string) to an object containing the disclosures,
+ * signed payload, decoded payload
+ *
+ */
+export function decodeMdocDeviceResponse(vpToken: MdocOid4vpMdocVpToken): MdocDeviceResponse {
+  const deviceResponse = mdoc.com.sphereon.mdoc.data.device.DeviceResponseCbor.Static.cborDecode(
+    mdoc.com.sphereon.kmp.decodeFrom(vpToken, mdoc.com.sphereon.kmp.Encoding.BASE64URL),
+  )
+  return deviceResponse
+}
+
+// TODO naive implementation of mapping a mdoc onto a IVerifiableCredential. Needs some fixes and further implementation and needs to be moved out of ssi-types
+export const mdocDecodedCredentialToUniformCredential = (
+  decoded: MdocDocument,
+  // @ts-ignore
+  opts?: { maxTimeSkewInMS?: number },
+): IVerifiableCredential => {
+  const document = decoded.toJson()
+  const json = document.toJsonDTO<DocumentJson>()
+  const type = 'Personal Identification Data'
+  const MSO = document.MSO
+  if (!MSO || !json.issuerSigned?.nameSpaces) {
+    throw Error(`Cannot access Mobile Security Object or Issuer Signed items from the Mdoc`)
+  }
+  const nameSpaces = json.issuerSigned.nameSpaces as unknown as Record<string, IssuerSignedItemJson[]>
+  if (!('eu.europa.ec.eudi.pid.1' in nameSpaces)) {
+    throw Error(`Only PID supported at present`)
+  }
+  const items = nameSpaces['eu.europa.ec.eudi.pid.1']
+  if (!items || items.length === 0) {
+    throw Error(`No issuer signed items were found`)
+  }
+  type DisclosuresAccumulator = {
+    [key: string]: any
+  }
+
+  const credentialSubject = items.reduce((acc: DisclosuresAccumulator, item: IssuerSignedItemJson) => {
+    if (Array.isArray(item.value)) {
+      acc[item.key] = item.value.map((val) => val.value).join(', ')
+    } else {
+      acc[item.key] = item.value.value
+    }
+    return acc
+  }, {})
+  const validFrom = MSO.validityInfo.validFrom
+  const validUntil = MSO.validityInfo.validUntil
+  const docType = MSO.docType
+  const expirationDate = validUntil
+  let issuanceDateStr = validFrom
+
+  const issuanceDate = issuanceDateStr
+  if (!issuanceDate) {
+    throw Error(`JWT issuance date is required but was not present`)
+  }
+
+  const credential: Omit<IVerifiableCredential, 'issuer' | 'issuanceDate'> = {
+    type: [docType], // Mdoc not a W3C VC, so no VerifiableCredential
+    '@context': [], // Mdoc has no JSON-LD by default. Certainly not the VC DM1 default context for JSON-LD
+    credentialSubject: {
+      type,
+      ...credentialSubject,
+    },
+    issuanceDate,
+    expirationDate,
+    proof: {
+      type: IProofType.MdocProof2024,
+      created: issuanceDate,
+      proofPurpose: IProofPurpose.authentication,
+      verificationMethod: json.issuerSigned.issuerAuth.payload,
+      mso_mdoc: mdoc.com.sphereon.kmp.encodeTo(decoded.cborEncode(), mdoc.com.sphereon.kmp.Encoding.BASE64URL),
+    },
+  }
+
+  return credential as IVerifiableCredential
+}

package/src/utils/sd-jwt.ts

@@ -0,0 +1,179 @@
+import { decodeSdJwt, decodeSdJwtSync, getClaims, getClaimsSync } from '@sd-jwt/decode'
+import type {
+  CompactSdJwtVc,
+  Hasher,
+  HasherSync,
+  IVerifiableCredential,
+  SdJwtDecodedDisclosure,
+  SdJwtDecodedVerifiableCredential,
+  SdJwtDecodedVerifiableCredentialPayload,
+  SdJwtDisclosure,
+  SdJwtSignedVerifiableCredentialPayload,
+  SdJwtVcKbJwtHeader,
+  SdJwtVcKbJwtPayload,
+} from '../types'
+import { IProofPurpose, IProofType } from './did'
+
+/**
+ * Decode an SD-JWT vc from its compact format (string) to an object containing the disclosures,
+ * signed payload, decoded payload and the compact SD-JWT vc.
+ *
+ * Both the input and output interfaces of this method are defined in `@sphereon/ssi-types`, so
+ * this method hides the actual implementation of SD-JWT (which is currently based on @sd-jwt/core)
+ */
+export function decodeSdJwtVc(compactSdJwtVc: CompactSdJwtVc, hasher: HasherSync): SdJwtDecodedVerifiableCredential {
+  const { jwt, disclosures, kbJwt } = decodeSdJwtSync(compactSdJwtVc, hasher)
+
+  const signedPayload = jwt.payload as SdJwtSignedVerifiableCredentialPayload
+  const decodedPayload = getClaimsSync(signedPayload, disclosures, hasher)
+  const compactKeyBindingJwt = kbJwt ? compactSdJwtVc.split('~').pop() : undefined
+
+  return {
+    compactSdJwtVc,
+    decodedPayload: decodedPayload as SdJwtDecodedVerifiableCredentialPayload,
+    disclosures: disclosures.map((d) => {
+      const decoded = d.key ? [d.salt, d.key, d.value] : [d.salt, d.value]
+      if (!d._digest) throw new Error('Implementation error: digest not present in disclosure')
+      return {
+        decoded: decoded as SdJwtDecodedDisclosure,
+        digest: d._digest,
+        encoded: d.encode(),
+      } satisfies SdJwtDisclosure
+    }),
+    signedPayload: signedPayload as SdJwtSignedVerifiableCredentialPayload,
+    ...(compactKeyBindingJwt &&
+      kbJwt && {
+        kbJwt: {
+          header: kbJwt.header as SdJwtVcKbJwtHeader,
+          compact: compactKeyBindingJwt,
+          payload: kbJwt.payload as SdJwtVcKbJwtPayload,
+        },
+      }),
+  }
+}
+
+/**
+ * Decode an SD-JWT vc from its compact format (string) to an object containing the disclosures,
+ * signed payload, decoded payload and the compact SD-JWT vc.
+ *
+ * Both the input and output interfaces of this method are defined in `@sphereon/ssi-types`, so
+ * this method hides the actual implementation of SD-JWT (which is currently based on @sd-jwt/core)
+ */
+export async function decodeSdJwtVcAsync(compactSdJwtVc: CompactSdJwtVc, hasher: Hasher): Promise<SdJwtDecodedVerifiableCredential> {
+  const { jwt, disclosures, kbJwt } = await decodeSdJwt(compactSdJwtVc, hasher)
+
+  const signedPayload = jwt.payload as SdJwtSignedVerifiableCredentialPayload
+  const decodedPayload = await getClaims(signedPayload, disclosures, hasher)
+  const compactKeyBindingJwt = kbJwt ? compactSdJwtVc.split('~').pop() : undefined
+
+  return {
+    compactSdJwtVc,
+    decodedPayload: decodedPayload as SdJwtDecodedVerifiableCredentialPayload,
+    disclosures: disclosures.map((d) => {
+      const decoded = d.key ? [d.salt, d.key, d.value] : [d.salt, d.value]
+      if (!d._digest) throw new Error('Implementation error: digest not present in disclosure')
+      return {
+        decoded: decoded as SdJwtDecodedDisclosure,
+        digest: d._digest,
+        encoded: d.encode(),
+      } satisfies SdJwtDisclosure
+    }),
+    signedPayload: signedPayload as SdJwtSignedVerifiableCredentialPayload,
+    ...(compactKeyBindingJwt &&
+      kbJwt && {
+        kbJwt: {
+          header: kbJwt.header as SdJwtVcKbJwtHeader,
+          payload: kbJwt.payload as SdJwtVcKbJwtPayload,
+          compact: compactKeyBindingJwt,
+        },
+      }),
+  }
+}
+
+export const sdJwtDecodedCredentialToUniformCredential = (
+  decoded: SdJwtDecodedVerifiableCredential,
+  opts?: { maxTimeSkewInMS?: number },
+): IVerifiableCredential => {
+  const { decodedPayload } = decoded
+  const { exp, nbf, iss, iat, vct, cnf, status, sub, jti } = decodedPayload
+
+  const maxSkewInMS = opts?.maxTimeSkewInMS ?? 1500
+
+  const expirationDate = jwtDateToISOString({ jwtClaim: exp, claimName: 'exp' })
+  let issuanceDateStr = jwtDateToISOString({ jwtClaim: iat, claimName: 'iat' })
+
+  let nbfDateAsStr: string | undefined
+  if (nbf) {
+    nbfDateAsStr = jwtDateToISOString({ jwtClaim: nbf, claimName: 'nbf' })
+    if (issuanceDateStr && nbfDateAsStr && issuanceDateStr !== nbfDateAsStr) {
+      const diff = Math.abs(new Date(nbfDateAsStr).getTime() - new Date(iss).getTime())
+      if (!maxSkewInMS || diff > maxSkewInMS) {
+        throw Error(`Inconsistent issuance dates between JWT claim (${nbfDateAsStr}) and VC value (${iss})`)
+      }
+    }
+    issuanceDateStr = nbfDateAsStr
+  }
+  const issuanceDate = issuanceDateStr
+  if (!issuanceDate) {
+    throw Error(`JWT issuance date is required but was not present`)
+  }
+
+  // Filter out the fields we don't want in credentialSubject
+  const excludedFields = new Set(['vct', 'cnf', 'iss', 'iat', 'exp', 'nbf', 'jti', 'sub'])
+  const credentialSubject = Object.entries(decodedPayload).reduce(
+    (acc, [key, value]) => {
+      if (
+        !excludedFields.has(key) &&
+        value !== undefined &&
+        value !== '' &&
+        !(typeof value === 'object' && value !== null && Object.keys(value).length === 0)
+      ) {
+        acc[key] = value
+      }
+      return acc
+    },
+    {} as Record<string, any>,
+  )
+
+  const credential: Omit<IVerifiableCredential, 'issuer' | 'issuanceDate'> = {
+    type: [vct], // SDJwt is not a W3C VC, so no VerifiableCredential
+    '@context': [], // SDJwt has no JSON-LD by default. Certainly not the VC DM1 default context for JSON-LD
+    credentialSubject: {
+      ...credentialSubject,
+      id: credentialSubject.id ?? sub ?? jti,
+    },
+    issuanceDate,
+    expirationDate,
+    issuer: iss,
+    ...(cnf && { cnf }),
+    ...(status && { status }),
+    proof: {
+      type: IProofType.SdJwtProof2024,
+      created: nbfDateAsStr ?? issuanceDate,
+      proofPurpose: IProofPurpose.authentication,
+      verificationMethod: iss,
+      jwt: decoded.compactSdJwtVc,
+    },
+  }
+
+  return credential as IVerifiableCredential
+}
+
+const jwtDateToISOString = ({
+  jwtClaim,
+  claimName,
+  isRequired = false,
+}: {
+  jwtClaim?: number
+  claimName: string
+  isRequired?: boolean
+}): string | undefined => {
+  if (jwtClaim) {
+    const claim = parseInt(jwtClaim.toString())
+    // change JWT seconds to millisecond for the date
+    return new Date(claim * (claim < 9999999999 ? 1000 : 1)).toISOString().replace(/\.000Z/, 'Z')
+  } else if (isRequired) {
+    throw Error(`JWT claim ${claimName} is required but was not present`)
+  }
+  return undefined
+}