ubid-common 0.1.0

package/dist/credential-verifiers/MsoMdocVerifier.js

@@ -0,0 +1,213 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MsoMdocVerifier = MsoMdocVerifier;
+const jose_1 = require("jose");
+const error_1 = require("../error");
+const util_1 = require("../utils/util");
+const mdl_1 = require("@auth0/mdl");
+const cbor_1 = require("@auth0/mdl/lib/cbor/");
+const cose_kit_1 = require("cose-kit");
+const X509ChainVerifier_1 = require("../x509/X509ChainVerifier");
+function MsoMdocVerifier(args) {
+    let errors = [];
+    const logError = (error, message) => {
+        errors.push({ error, message });
+    };
+    const x509ChainVerifier = args.x509ChainVerifier ?? new X509ChainVerifier_1.X509ChainVerifier();
+    // Device authentication and digest checks remain delegated to @auth0/mdl.
+    // Certificate path validation is performed once by X509ChainVerifier.
+    const verifier = new mdl_1.Verifier([]);
+    async function verifyIssuerCertificate(issuerAuth) {
+        const x5chain = issuerAuth.x5chain;
+        if (!x5chain || x5chain.length === 0) {
+            logError(error_1.CredentialVerificationError.InvalidCertificateChain, "MSO issuerAuth does not contain x5chain");
+            return false;
+        }
+        if (args.context.trustedCertificates.length === 0) {
+            logError(error_1.CredentialVerificationError.NotTrustedIssuer, "No IACA trust anchors are configured");
+            return false;
+        }
+        const result = await x509ChainVerifier.verify({
+            x5c: x5chain.map((certificate) => Buffer.from(certificate).toString("base64")),
+            trustedCertificates: args.context.trustedCertificates,
+            algorithm: issuerAuth.algName,
+            validationTime: issuerAuth.decodedPayload.validityInfo.signed,
+        });
+        if (!result.success) {
+            logError(error_1.CredentialVerificationError.NotTrustedIssuer, `Invalid MSO issuer certificate chain: ${result.error}`);
+            return false;
+        }
+        try {
+            if (!issuerAuth.algName) {
+                logError(error_1.CredentialVerificationError.InvalidCertificateChain, "MSO issuerAuth algorithm is missing or unsupported");
+                return false;
+            }
+            const publicKey = await (0, jose_1.importX509)(result.value.leafCertificatePem, issuerAuth.algName);
+            if (await issuerAuth.verify(publicKey) !== true) {
+                logError(error_1.CredentialVerificationError.InvalidSignature, "Invalid MSO issuerAuth signature");
+                return false;
+            }
+            return true;
+        }
+        catch {
+            logError(error_1.CredentialVerificationError.InvalidSignature, "Unable to verify MSO issuerAuth signature");
+            return false;
+        }
+    }
+    const getSessionTranscriptBytesForOID4VPHandover = async (clId, respUri, nonce, mdocNonce) => (0, cbor_1.cborEncode)(mdl_1.DataItem.fromData([
+        null,
+        null,
+        [
+            await args.context.subtle.digest('SHA-256', new Uint8Array((0, cbor_1.cborEncode)([clId, mdocNonce]))),
+            await args.context.subtle.digest('SHA-256', new Uint8Array((0, cbor_1.cborEncode)([respUri, mdocNonce]))),
+            nonce
+        ]
+    ]));
+    async function expirationCheck(issuerSigned) {
+        const { validFrom, validUntil, signed } = issuerSigned.issuerAuth.decodedPayload.validityInfo;
+        if (Math.floor(validUntil.getTime() / 1000) + args.context.clockTolerance < Math.floor(new Date().getTime() / 1000)) {
+            logError(error_1.CredentialVerificationError.ExpiredCredential, "Credential is expired");
+            return error_1.CredentialVerificationError.ExpiredCredential;
+        }
+        return null;
+    }
+    function extractHolderPublicKeyJwk(parsedDocument) {
+        if (parsedDocument.issuerSigned.issuerAuth.decodedPayload.deviceKeyInfo == undefined) {
+            logError(error_1.CredentialVerificationError.MsoMdocMissingDeviceKeyInfo, "MsoMdocMissingDeviceKeyInfo");
+            return null;
+        }
+        const cosePublicKey = parsedDocument.issuerSigned.issuerAuth.decodedPayload.deviceKeyInfo.deviceKey;
+        const holderPublicKeyJwk = (0, cose_kit_1.COSEKeyToJWK)(cosePublicKey);
+        return holderPublicKeyJwk;
+    }
+    async function issuerSignedCheck(rawCredential) {
+        try {
+            const credentialBytes = (0, util_1.fromBase64Url)(rawCredential);
+            const issuerSigned = (0, cbor_1.cborDecode)(credentialBytes);
+            const [header, _, payload, sig] = issuerSigned.get('issuerAuth');
+            const decodedIssuerAuthPayload = (0, cbor_1.cborDecode)(payload);
+            const docType = decodedIssuerAuthPayload.data.get('docType');
+            const m = {
+                version: '1.0',
+                documents: [new Map([
+                        ['docType', docType],
+                        ['issuerSigned', issuerSigned]
+                    ])],
+                status: 0
+            };
+            const encoded = (0, cbor_1.cborEncode)(m);
+            const mdoc = (0, mdl_1.parse)(encoded);
+            const [parsedDocument] = mdoc.documents;
+            const expirationCheckRes = await expirationCheck(parsedDocument.issuerSigned);
+            if (expirationCheckRes !== null) {
+                return { holderPublicKeyJwk: null };
+            }
+            if (!await verifyIssuerCertificate(parsedDocument.issuerSigned.issuerAuth)) {
+                return { holderPublicKeyJwk: null };
+            }
+            const holderPublicKeyJwk = extractHolderPublicKeyJwk(parsedDocument);
+            return {
+                holderPublicKeyJwk
+            };
+        }
+        catch (err) {
+            // @ts-ignore
+            if (err?.name && err.name === "X509InvalidCertificateChain") {
+                logError(error_1.CredentialVerificationError.InvalidCertificateChain, "Invalid Certificate chain: " + JSON.stringify(err));
+            }
+        }
+        return { holderPublicKeyJwk: null };
+    }
+    async function deviceResponseCheck(mdoc, opts) {
+        try {
+            const [parsedDocument] = mdoc.documents;
+            if (!parsedDocument.deviceSigned) { // not a DeviceResponse
+                return { holderPublicKeyJwk: null };
+            }
+            if (!await verifyIssuerCertificate(parsedDocument.issuerSigned.issuerAuth)) {
+                return { holderPublicKeyJwk: null };
+            }
+            const expiredResult = await expirationCheck(parsedDocument.issuerSigned);
+            if (expiredResult) {
+                return { holderPublicKeyJwk: null };
+            }
+            const holderPublicKeyJwk = extractHolderPublicKeyJwk(parsedDocument);
+            if (opts.expectedAudience && opts.responseUri && opts.expectedNonce && opts.holderNonce) {
+                await verifier.verify(mdoc.encode(), {
+                    disableCertificateChainValidation: true,
+                    encodedSessionTranscript: await getSessionTranscriptBytesForOID4VPHandover(opts.expectedAudience, opts.responseUri, opts.expectedNonce, opts.holderNonce)
+                });
+                return { holderPublicKeyJwk };
+            }
+            return { holderPublicKeyJwk: holderPublicKeyJwk };
+        }
+        catch (err) {
+            if (err instanceof Error) {
+                if (err.name === "X509InvalidCertificateChain") {
+                    logError(error_1.CredentialVerificationError.NotTrustedIssuer, "Issuer is not trusted");
+                    return { holderPublicKeyJwk: null };
+                }
+                else if (err.name === "MDLError") {
+                    logError(error_1.CredentialVerificationError.InvalidSignature, `MDLError: ${err.message}`);
+                }
+                else {
+                    console.error(err);
+                }
+            }
+            return { holderPublicKeyJwk: null };
+        }
+    }
+    return {
+        async verify({ rawCredential, opts }) {
+            errors = [];
+            if (typeof rawCredential !== 'string') {
+                return {
+                    success: false,
+                    error: error_1.CredentialVerificationError.InvalidDatatype,
+                };
+            }
+            try {
+                const decodedCred = (0, util_1.fromBase64Url)(rawCredential);
+                const parsedMDOC = (0, mdl_1.parse)(decodedCred);
+                const { holderPublicKeyJwk } = await deviceResponseCheck(parsedMDOC, opts);
+                if (errors.length === 0 && holderPublicKeyJwk !== null) {
+                    return {
+                        success: true,
+                        value: {
+                            holderPublicKey: holderPublicKeyJwk,
+                        }
+                    };
+                }
+                if (errors.length > 0) {
+                    return {
+                        success: false,
+                        error: errors.length > 0 ? errors[0].error : error_1.CredentialVerificationError.UnknownProblem,
+                    };
+                }
+            }
+            catch (err) {
+                const { holderPublicKeyJwk } = await issuerSignedCheck(rawCredential);
+                if (errors.length === 0 && holderPublicKeyJwk !== null) {
+                    return {
+                        success: true,
+                        value: {
+                            holderPublicKey: holderPublicKeyJwk,
+                        }
+                    };
+                }
+                if (errors.length > 0) {
+                    return {
+                        success: false,
+                        error: errors.length > 0 ? errors[0].error : error_1.CredentialVerificationError.UnknownProblem,
+                    };
+                }
+            }
+            console.error(errors);
+            return {
+                success: false,
+                error: error_1.CredentialVerificationError.UnknownProblem
+            };
+        },
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiTXNvTWRvY1ZlcmlmaWVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2NyZWRlbnRpYWwtdmVyaWZpZXJzL01zb01kb2NWZXJpZmllci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQWFBLDBDQW1SQztBQWhTRCwrQkFBdUM7QUFDdkMsb0NBQXVEO0FBRXZELHdDQUE4QztBQUM5QyxvQ0FBeUc7QUFFekcsK0NBQThEO0FBQzlELHVDQUF3QztBQUN4QyxpRUFHbUM7QUFFbkMsU0FBZ0IsZUFBZSxDQUFDLElBSS9CO0lBQ0EsSUFBSSxNQUFNLEdBQThELEVBQUUsQ0FBQztJQUMzRSxNQUFNLFFBQVEsR0FBRyxDQUFDLEtBQWtDLEVBQUUsT0FBZSxFQUFRLEVBQUU7UUFDOUUsTUFBTSxDQUFDLElBQUksQ0FBQyxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDO0lBQ2pDLENBQUMsQ0FBQTtJQUNELE1BQU0saUJBQWlCLEdBQUcsSUFBSSxDQUFDLGlCQUFpQixJQUFJLElBQUkscUNBQWlCLEVBQUUsQ0FBQztJQUU1RSwwRUFBMEU7SUFDMUUsc0VBQXNFO0lBQ3RFLE1BQU0sUUFBUSxHQUFHLElBQUksY0FBUSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBRWxDLEtBQUssVUFBVSx1QkFBdUIsQ0FDckMsVUFBc0M7UUFFdEMsTUFBTSxPQUFPLEdBQUcsVUFBVSxDQUFDLE9BQU8sQ0FBQztRQUNuQyxJQUFJLENBQUMsT0FBTyxJQUFJLE9BQU8sQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDdEMsUUFBUSxDQUNQLG1DQUEyQixDQUFDLHVCQUF1QixFQUNuRCx5Q0FBeUMsQ0FDekMsQ0FBQztZQUNGLE9BQU8sS0FBSyxDQUFDO1FBQ2QsQ0FBQztRQUNELElBQUksSUFBSSxDQUFDLE9BQU8sQ0FBQyxtQkFBbUIsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDbkQsUUFBUSxDQUNQLG1DQUEyQixDQUFDLGdCQUFnQixFQUM1QyxzQ0FBc0MsQ0FDdEMsQ0FBQztZQUNGLE9BQU8sS0FBSyxDQUFDO1FBQ2QsQ0FBQztRQUNELE1BQU0sTUFBTSxHQUFHLE1BQU0saUJBQWlCLENBQUMsTUFBTSxDQUFDO1lBQzdDLEdBQUcsRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FDaEMsTUFBTSxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUM7WUFDN0MsbUJBQW1CLEVBQUUsSUFBSSxDQUFDLE9BQU8sQ0FBQyxtQkFBbUI7WUFDckQsU0FBUyxFQUFFLFVBQVUsQ0FBQyxPQUFPO1lBQzdCLGNBQWMsRUFBRSxVQUFVLENBQUMsY0FBYyxDQUFDLFlBQVksQ0FBQyxNQUFNO1NBQzdELENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDckIsUUFBUSxDQUNQLG1DQUEyQixDQUFDLGdCQUFnQixFQUM1Qyx5Q0FBeUMsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUN2RCxDQUFDO1lBQ0YsT0FBTyxLQUFLLENBQUM7UUFDZCxDQUFDO1FBQ0QsSUFBSSxDQUFDO1lBQ0osSUFBSSxDQUFDLFVBQVUsQ0FBQyxPQUFPLEVBQUUsQ0FBQztnQkFDekIsUUFBUSxDQUNQLG1DQUEyQixDQUFDLHVCQUF1QixFQUNuRCxvREFBb0QsQ0FDcEQsQ0FBQztnQkFDRixPQUFPLEtBQUssQ0FBQztZQUNkLENBQUM7WUFDRCxNQUFNLFNBQVMsR0FBRyxNQUFNLElBQUEsaUJBQVUsRUFDakMsTUFBTSxDQUFDLEtBQUssQ0FBQyxrQkFBa0IsRUFDL0IsVUFBVSxDQUFDLE9BQU8sQ0FDbEIsQ0FBQztZQUNGLElBQUksTUFBTSxVQUFVLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxLQUFLLElBQUksRUFBRSxDQUFDO2dCQUNqRCxRQUFRLENBQ1AsbUNBQTJCLENBQUMsZ0JBQWdCLEVBQzVDLGtDQUFrQyxDQUNsQyxDQUFDO2dCQUNGLE9BQU8sS0FBSyxDQUFDO1lBQ2QsQ0FBQztZQUNELE9BQU8sSUFBSSxDQUFDO1FBQ2IsQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUNSLFFBQVEsQ0FDUCxtQ0FBMkIsQ0FBQyxnQkFBZ0IsRUFDNUMsMkNBQTJDLENBQzNDLENBQUM7WUFDRixPQUFPLEtBQUssQ0FBQztRQUNkLENBQUM7SUFDRixDQUFDO0lBR0QsTUFBTSwwQ0FBMEMsR0FBRyxLQUFLLEVBQUUsSUFBWSxFQUFFLE9BQWUsRUFBRSxLQUFhLEVBQUUsU0FBaUIsRUFBRSxFQUFFLENBQUMsSUFBQSxpQkFBVSxFQUN2SSxjQUFRLENBQUMsUUFBUSxDQUNoQjtRQUNDLElBQUk7UUFDSixJQUFJO1FBQ0o7WUFDQyxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FDL0IsU0FBUyxFQUNULElBQUksVUFBVSxDQUFDLElBQUEsaUJBQVUsRUFBQyxDQUFDLElBQUksRUFBRSxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQzdDO1lBQ0QsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQy9CLFNBQVMsRUFDVCxJQUFJLFVBQVUsQ0FBQyxJQUFBLGlCQUFVLEVBQUMsQ0FBQyxPQUFPLEVBQUUsU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUNoRDtZQUNELEtBQUs7U0FDTDtLQUNELENBQ0QsQ0FDRCxDQUFDO0lBRUYsS0FBSyxVQUFVLGVBQWUsQ0FBQyxZQUEwQjtRQUN4RCxNQUFNLEVBQUUsU0FBUyxFQUFFLFVBQVUsRUFBRSxNQUFNLEVBQUUsR0FBRyxZQUFZLENBQUMsVUFBVSxDQUFDLGNBQWMsQ0FBQyxZQUFZLENBQUM7UUFDOUYsSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxPQUFPLEVBQUUsR0FBRyxJQUFJLENBQUMsR0FBRyxJQUFJLENBQUMsT0FBTyxDQUFDLGNBQWMsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksSUFBSSxFQUFFLENBQUMsT0FBTyxFQUFFLEdBQUcsSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUNySCxRQUFRLENBQUMsbUNBQTJCLENBQUMsaUJBQWlCLEVBQUUsdUJBQXVCLENBQUMsQ0FBQztZQUNqRixPQUFPLG1DQUEyQixDQUFDLGlCQUFpQixDQUFDO1FBQ3RELENBQUM7UUFDRCxPQUFPLElBQUksQ0FBQztJQUNiLENBQUM7SUFFRCxTQUFTLHlCQUF5QixDQUFDLGNBQW9DO1FBQ3RFLElBQUksY0FBYyxDQUFDLFlBQVksQ0FBQyxVQUFVLENBQUMsY0FBYyxDQUFDLGFBQWEsSUFBSSxTQUFTLEVBQUUsQ0FBQztZQUN0RixRQUFRLENBQUMsbUNBQTJCLENBQUMsMkJBQTJCLEVBQUUsNkJBQTZCLENBQUMsQ0FBQztZQUNqRyxPQUFPLElBQUksQ0FBQztRQUNiLENBQUM7UUFFRCxNQUFNLGFBQWEsR0FBRyxjQUFjLENBQUMsWUFBWSxDQUFDLFVBQVUsQ0FBQyxjQUFjLENBQUMsYUFBYSxDQUFDLFNBQVMsQ0FBQztRQUNwRyxNQUFNLGtCQUFrQixHQUFHLElBQUEsdUJBQVksRUFBQyxhQUFhLENBQUMsQ0FBQztRQUN2RCxPQUFPLGtCQUF5QixDQUFDO0lBQ2xDLENBQUM7SUFFRCxLQUFLLFVBQVUsaUJBQWlCLENBQUMsYUFBcUI7UUFDckQsSUFBSSxDQUFDO1lBQ0osTUFBTSxlQUFlLEdBQUcsSUFBQSxvQkFBYSxFQUFDLGFBQWEsQ0FBQyxDQUFDO1lBQ3JELE1BQU0sWUFBWSxHQUF5QixJQUFBLGlCQUFVLEVBQUMsZUFBZSxDQUFDLENBQUM7WUFDdkUsTUFBTSxDQUFDLE1BQU0sRUFBRSxDQUFDLEVBQUUsT0FBTyxFQUFFLEdBQUcsQ0FBQyxHQUFHLFlBQVksQ0FBQyxHQUFHLENBQUMsWUFBWSxDQUFzQixDQUFDO1lBQ3RGLE1BQU0sd0JBQXdCLEdBQWEsSUFBQSxpQkFBVSxFQUFDLE9BQU8sQ0FBQyxDQUFDO1lBQy9ELE1BQU0sT0FBTyxHQUFHLHdCQUF3QixDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsU0FBUyxDQUFDLENBQUM7WUFDN0QsTUFBTSxDQUFDLEdBQUc7Z0JBQ1QsT0FBTyxFQUFFLEtBQUs7Z0JBQ2QsU0FBUyxFQUFFLENBQUMsSUFBSSxHQUFHLENBQUM7d0JBQ25CLENBQUMsU0FBUyxFQUFFLE9BQU8sQ0FBQzt3QkFDcEIsQ0FBQyxjQUFjLEVBQUUsWUFBWSxDQUFDO3FCQUM5QixDQUFDLENBQUM7Z0JBQ0gsTUFBTSxFQUFFLENBQUM7YUFDVCxDQUFDO1lBQ0YsTUFBTSxPQUFPLEdBQUcsSUFBQSxpQkFBVSxFQUFDLENBQUMsQ0FBQyxDQUFDO1lBQzlCLE1BQU0sSUFBSSxHQUFHLElBQUEsV0FBSyxFQUFDLE9BQU8sQ0FBQyxDQUFDO1lBQzVCLE1BQU0sQ0FBQyxjQUFjLENBQUMsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDO1lBQ3hDLE1BQU0sa0JBQWtCLEdBQUcsTUFBTSxlQUFlLENBQUMsY0FBYyxDQUFDLFlBQVksQ0FBQyxDQUFDO1lBQzlFLElBQUksa0JBQWtCLEtBQUssSUFBSSxFQUFFLENBQUM7Z0JBQ2pDLE9BQU8sRUFBRSxrQkFBa0IsRUFBRSxJQUFJLEVBQUUsQ0FBQztZQUNyQyxDQUFDO1lBRUQsSUFBSSxDQUFDLE1BQU0sdUJBQXVCLENBQUMsY0FBYyxDQUFDLFlBQVksQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO2dCQUM1RSxPQUFPLEVBQUUsa0JBQWtCLEVBQUUsSUFBSSxFQUFFLENBQUM7WUFDckMsQ0FBQztZQUNELE1BQU0sa0JBQWtCLEdBQUcseUJBQXlCLENBQUMsY0FBYyxDQUFDLENBQUM7WUFFckUsT0FBTztnQkFDTixrQkFBa0I7YUFDbEIsQ0FBQztRQUVILENBQUM7UUFDRCxPQUFPLEdBQUcsRUFBRSxDQUFDO1lBQ1osYUFBYTtZQUNiLElBQUksR0FBRyxFQUFFLElBQUksSUFBSSxHQUFHLENBQUMsSUFBSSxLQUFLLDZCQUE2QixFQUFFLENBQUM7Z0JBQzdELFFBQVEsQ0FBQyxtQ0FBMkIsQ0FBQyx1QkFBdUIsRUFBRSw2QkFBNkIsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUE7WUFDbkgsQ0FBQztRQUNGLENBQUM7UUFDRCxPQUFPLEVBQUUsa0JBQWtCLEVBQUUsSUFBSSxFQUFFLENBQUM7SUFFckMsQ0FBQztJQUVELEtBQUssVUFBVSxtQkFBbUIsQ0FBQyxJQUFVLEVBQUUsSUFLOUM7UUFDQSxJQUFJLENBQUM7WUFDSixNQUFNLENBQUMsY0FBYyxDQUFDLEdBQUcsSUFBSSxDQUFDLFNBQW1DLENBQUM7WUFDbEUsSUFBSSxDQUFDLGNBQWMsQ0FBQyxZQUFZLEVBQUUsQ0FBQyxDQUFDLHVCQUF1QjtnQkFDMUQsT0FBTyxFQUFFLGtCQUFrQixFQUFFLElBQUksRUFBRSxDQUFDO1lBQ3JDLENBQUM7WUFFRCxJQUFJLENBQUMsTUFBTSx1QkFBdUIsQ0FBQyxjQUFjLENBQUMsWUFBWSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7Z0JBQzVFLE9BQU8sRUFBRSxrQkFBa0IsRUFBRSxJQUFJLEVBQUUsQ0FBQztZQUNyQyxDQUFDO1lBRUQsTUFBTSxhQUFhLEdBQUcsTUFBTSxlQUFlLENBQUMsY0FBYyxDQUFDLFlBQVksQ0FBQyxDQUFDO1lBQ3pFLElBQUksYUFBYSxFQUFFLENBQUM7Z0JBQ25CLE9BQU8sRUFBRSxrQkFBa0IsRUFBRSxJQUFJLEVBQUUsQ0FBQztZQUNyQyxDQUFDO1lBRUQsTUFBTSxrQkFBa0IsR0FBRyx5QkFBeUIsQ0FBQyxjQUFjLENBQUMsQ0FBQztZQUVyRSxJQUFJLElBQUksQ0FBQyxnQkFBZ0IsSUFBSSxJQUFJLENBQUMsV0FBVyxJQUFJLElBQUksQ0FBQyxhQUFhLElBQUksSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDO2dCQUN6RixNQUFNLFFBQVEsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxFQUFFO29CQUNwQyxpQ0FBaUMsRUFBRSxJQUFJO29CQUN2Qyx3QkFBd0IsRUFBRSxNQUFNLDBDQUEwQyxDQUN6RSxJQUFJLENBQUMsZ0JBQWdCLEVBQ3JCLElBQUksQ0FBQyxXQUFXLEVBQ2hCLElBQUksQ0FBQyxhQUFhLEVBQ2xCLElBQUksQ0FBQyxXQUFXLENBQUM7aUJBQ2xCLENBQUMsQ0FBQztnQkFDSCxPQUFPLEVBQUUsa0JBQWtCLEVBQUUsQ0FBQztZQUMvQixDQUFDO1lBRUQsT0FBTyxFQUFFLGtCQUFrQixFQUFFLGtCQUFrQixFQUFFLENBQUE7UUFFbEQsQ0FBQztRQUNELE9BQU8sR0FBRyxFQUFFLENBQUM7WUFDWixJQUFJLEdBQUcsWUFBWSxLQUFLLEVBQUUsQ0FBQztnQkFDMUIsSUFBSSxHQUFHLENBQUMsSUFBSSxLQUFLLDZCQUE2QixFQUFFLENBQUM7b0JBQ2hELFFBQVEsQ0FBQyxtQ0FBMkIsQ0FBQyxnQkFBZ0IsRUFBRSx1QkFBdUIsQ0FBQyxDQUFDO29CQUNoRixPQUFPLEVBQUUsa0JBQWtCLEVBQUUsSUFBSSxFQUFFLENBQUM7Z0JBQ3JDLENBQUM7cUJBQ0ksSUFBSSxHQUFHLENBQUMsSUFBSSxLQUFLLFVBQVUsRUFBRSxDQUFDO29CQUNsQyxRQUFRLENBQUMsbUNBQTJCLENBQUMsZ0JBQWdCLEVBQUUsYUFBYSxHQUFHLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQztnQkFDcEYsQ0FBQztxQkFDSSxDQUFDO29CQUNMLE9BQU8sQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUM7Z0JBQ3BCLENBQUM7WUFDRixDQUFDO1lBQ0QsT0FBTyxFQUFFLGtCQUFrQixFQUFFLElBQUksRUFBRSxDQUFDO1FBQ3JDLENBQUM7SUFDRixDQUFDO0lBRUQsT0FBTztRQUNOLEtBQUssQ0FBQyxNQUFNLENBQUMsRUFBRSxhQUFhLEVBQUUsSUFBSSxFQUFFO1lBQ25DLE1BQU0sR0FBRyxFQUFFLENBQUM7WUFDWixJQUFJLE9BQU8sYUFBYSxLQUFLLFFBQVEsRUFBRSxDQUFDO2dCQUN2QyxPQUFPO29CQUNOLE9BQU8sRUFBRSxLQUFLO29CQUNkLEtBQUssRUFBRSxtQ0FBMkIsQ0FBQyxlQUFlO2lCQUNsRCxDQUFBO1lBQ0YsQ0FBQztZQUdELElBQUksQ0FBQztnQkFDSixNQUFNLFdBQVcsR0FBRyxJQUFBLG9CQUFhLEVBQUMsYUFBYSxDQUFDLENBQUE7Z0JBQ2hELE1BQU0sVUFBVSxHQUFHLElBQUEsV0FBSyxFQUFDLFdBQVcsQ0FBQyxDQUFDO2dCQUN0QyxNQUFNLEVBQUUsa0JBQWtCLEVBQUUsR0FBRyxNQUFNLG1CQUFtQixDQUFDLFVBQVUsRUFBRSxJQUFJLENBQUMsQ0FBQztnQkFFM0UsSUFBSSxNQUFNLENBQUMsTUFBTSxLQUFLLENBQUMsSUFBSSxrQkFBa0IsS0FBSyxJQUFJLEVBQUUsQ0FBQztvQkFDeEQsT0FBTzt3QkFDTixPQUFPLEVBQUUsSUFBSTt3QkFDYixLQUFLLEVBQUU7NEJBQ04sZUFBZSxFQUFFLGtCQUFrQjt5QkFDbkM7cUJBQ0QsQ0FBQTtnQkFDRixDQUFDO2dCQUVELElBQUksTUFBTSxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztvQkFDdkIsT0FBTzt3QkFDTixPQUFPLEVBQUUsS0FBSzt3QkFDZCxLQUFLLEVBQUUsTUFBTSxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLG1DQUEyQixDQUFDLGNBQWM7cUJBQ3hGLENBQUE7Z0JBQ0YsQ0FBQztZQUNGLENBQUM7WUFDRCxPQUFPLEdBQUcsRUFBRSxDQUFDO2dCQUNaLE1BQU0sRUFBRSxrQkFBa0IsRUFBRSxHQUFHLE1BQU0saUJBQWlCLENBQUMsYUFBYSxDQUFDLENBQUM7Z0JBQ3RFLElBQUksTUFBTSxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksa0JBQWtCLEtBQUssSUFBSSxFQUFFLENBQUM7b0JBQ3hELE9BQU87d0JBQ04sT0FBTyxFQUFFLElBQUk7d0JBQ2IsS0FBSyxFQUFFOzRCQUNOLGVBQWUsRUFBRSxrQkFBa0I7eUJBQ25DO3FCQUNELENBQUE7Z0JBQ0YsQ0FBQztnQkFFRCxJQUFJLE1BQU0sQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7b0JBQ3ZCLE9BQU87d0JBQ04sT0FBTyxFQUFFLEtBQUs7d0JBQ2QsS0FBSyxFQUFFLE1BQU0sQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBRSxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxtQ0FBMkIsQ0FBQyxjQUFjO3FCQUN4RixDQUFBO2dCQUNGLENBQUM7WUFDRixDQUFDO1lBRUQsT0FBTyxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsQ0FBQztZQUd0QixPQUFPO2dCQUNOLE9BQU8sRUFBRSxLQUFLO2dCQUNkLEtBQUssRUFBRSxtQ0FBMkIsQ0FBQyxjQUFjO2FBQ2pELENBQUE7UUFDRixDQUFDO0tBQ0QsQ0FBQTtBQUNGLENBQUMifQ==

package/dist/credential-verifiers/SDJWTVCValidation.d.ts

@@ -0,0 +1,52 @@
+import type { JWK } from "jose";
+import type { SDJwt } from "@sd-jwt/core";
+import { CredentialVerificationError } from "../error";
+import { Result, VerifiableCredentialFormat } from "../types";
+export interface SDJWTVCVerificationPolicy {
+    acceptedCredentialTypes?: readonly (VerifiableCredentialFormat.DC_SDJWT | VerifiableCredentialFormat.VC_SDJWT)[];
+    allowedHolderAlgorithms?: readonly string[];
+    allowedDisclosureAlgorithms?: readonly string[];
+    requireCredentialIat?: boolean;
+    requireCredentialExpiration?: boolean;
+    kbJwtMaxAgeSeconds?: number;
+    requireStatusCheck?: boolean;
+    now?: () => Date;
+    replayGuard?: KbJwtReplayGuard;
+}
+export interface KbJwtReplayInput {
+    kbJwt: string;
+    nonce: string;
+    audience: string | readonly string[];
+    iat: number;
+    holderJwk: JWK;
+}
+export interface KbJwtReplayGuard {
+    /**
+     * Atomically records the presentation and returns false when it was
+     * already consumed. Production implementations should use a shared,
+     * expiring store when the Verifier has more than one instance.
+     */
+    consume(input: KbJwtReplayInput): Promise<boolean>;
+}
+export interface NormalizedSDJWTVCVerificationPolicy {
+    acceptedCredentialTypes: readonly string[];
+    allowedHolderAlgorithms: readonly string[];
+    allowedDisclosureAlgorithms: readonly string[];
+    requireCredentialIat: boolean;
+    requireCredentialExpiration: boolean;
+    kbJwtMaxAgeSeconds: number;
+    requireStatusCheck: boolean;
+    now: () => Date;
+    replayGuard?: KbJwtReplayGuard;
+}
+export declare function normalizeSDJWTVCVerificationPolicy(policy?: SDJWTVCVerificationPolicy): NormalizedSDJWTVCVerificationPolicy;
+export declare function deriveHolderAlgorithm(jwk: JWK): Result<string, CredentialVerificationError>;
+export declare function validateCredentialHeader(header: Record<string, unknown>, policy: NormalizedSDJWTVCVerificationPolicy): Result<true, CredentialVerificationError>;
+export declare function validateCredentialPayload(payload: Record<string, unknown>, policy: NormalizedSDJWTVCVerificationPolicy, clockToleranceSeconds: number): Result<true, CredentialVerificationError>;
+export declare function validateDisclosures(args: {
+    sdJwt: SDJwt;
+    rawDisclosures: readonly string[];
+    payload: Record<string, unknown>;
+    policy: NormalizedSDJWTVCVerificationPolicy;
+}): Result<true, CredentialVerificationError>;
+//# sourceMappingURL=SDJWTVCValidation.d.ts.map

package/dist/credential-verifiers/SDJWTVCValidation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SDJWTVCValidation.d.ts","sourceRoot":"","sources":["../../src/credential-verifiers/SDJWTVCValidation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAChC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,2BAA2B,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,0BAA0B,EAAE,MAAM,UAAU,CAAC;AAe9D,MAAM,WAAW,yBAAyB;IACzC,uBAAuB,CAAC,EAAE,SAAS,CAClC,0BAA0B,CAAC,QAAQ,GAAG,0BAA0B,CAAC,QAAQ,CACzE,EAAE,CAAC;IACJ,uBAAuB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,2BAA2B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,WAAW,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,GAAG,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAChC;;;;OAIG;IACH,OAAO,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,mCAAmC;IACnD,uBAAuB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,uBAAuB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,2BAA2B,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,oBAAoB,EAAE,OAAO,CAAC;IAC9B,2BAA2B,EAAE,OAAO,CAAC;IACrC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,GAAG,EAAE,MAAM,IAAI,CAAC;IAChB,WAAW,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAED,wBAAgB,kCAAkC,CACjD,MAAM,GAAE,yBAA8B,GACpC,mCAAmC,CAoCrC;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,2BAA2B,CAAC,CA6C3F;AAUD,wBAAgB,wBAAwB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,MAAM,EAAE,mCAAmC,GACzC,MAAM,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAoB3C;AAED,wBAAgB,yBAAyB,CACxC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,MAAM,EAAE,mCAAmC,EAC3C,qBAAqB,EAAE,MAAM,GAC3B,MAAM,CAAC,IAAI,EAAE,2BAA2B,CAAC,CA4C3C;AAoED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACzC,KAAK,EAAE,KAAK,CAAC;IACb,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,EAAE,mCAAmC,CAAC;CAC5C,GAAG,MAAM,CAAC,IAAI,EAAE,2BAA2B,CAAC,CA+B5C"}

package/dist/credential-verifiers/SDJWTVCValidation.js

@@ -0,0 +1,248 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeSDJWTVCVerificationPolicy = normalizeSDJWTVCVerificationPolicy;
+exports.deriveHolderAlgorithm = deriveHolderAlgorithm;
+exports.validateCredentialHeader = validateCredentialHeader;
+exports.validateCredentialPayload = validateCredentialPayload;
+exports.validateDisclosures = validateDisclosures;
+const error_1 = require("../error");
+const types_1 = require("../types");
+const PRIVATE_JWK_PARAMETERS = ["d", "p", "q", "dp", "dq", "qi", "oth", "k"];
+const NON_DISCLOSABLE_ROOT_CLAIMS = new Set([
+    "iss",
+    "nbf",
+    "exp",
+    "cnf",
+    "vct",
+    "vct#integrity",
+    "status",
+]);
+const RESERVED_DISCLOSURE_KEYS = new Set(["_sd", "_sd_alg", "..."]);
+function normalizeSDJWTVCVerificationPolicy(policy = {}) {
+    const acceptedCredentialTypes = policy.acceptedCredentialTypes ?? [
+        types_1.VerifiableCredentialFormat.DC_SDJWT,
+        types_1.VerifiableCredentialFormat.VC_SDJWT,
+    ];
+    const allowedHolderAlgorithms = policy.allowedHolderAlgorithms ?? ["ES256"];
+    const allowedDisclosureAlgorithms = policy.allowedDisclosureAlgorithms ?? ["sha-256"];
+    const kbJwtMaxAgeSeconds = policy.kbJwtMaxAgeSeconds ?? 300;
+    for (const [name, values] of [
+        ["acceptedCredentialTypes", acceptedCredentialTypes],
+        ["allowedHolderAlgorithms", allowedHolderAlgorithms],
+        ["allowedDisclosureAlgorithms", allowedDisclosureAlgorithms],
+    ]) {
+        if (values.length === 0 || values.some((value) => typeof value !== "string" || !value)) {
+            throw new TypeError(`${name} must contain non-empty strings`);
+        }
+        if (new Set(values).size !== values.length) {
+            throw new TypeError(`${name} must not contain duplicates`);
+        }
+    }
+    if (!Number.isSafeInteger(kbJwtMaxAgeSeconds) || kbJwtMaxAgeSeconds <= 0) {
+        throw new TypeError("kbJwtMaxAgeSeconds must be a positive integer");
+    }
+    return Object.freeze({
+        acceptedCredentialTypes: Object.freeze([...acceptedCredentialTypes]),
+        allowedHolderAlgorithms: Object.freeze([...allowedHolderAlgorithms]),
+        allowedDisclosureAlgorithms: Object.freeze([...allowedDisclosureAlgorithms]),
+        requireCredentialIat: policy.requireCredentialIat ?? true,
+        requireCredentialExpiration: policy.requireCredentialExpiration ?? false,
+        kbJwtMaxAgeSeconds,
+        requireStatusCheck: policy.requireStatusCheck ?? false,
+        now: policy.now ?? (() => new Date()),
+        replayGuard: policy.replayGuard,
+    });
+}
+function deriveHolderAlgorithm(jwk) {
+    if (!jwk || typeof jwk !== "object" || Array.isArray(jwk)) {
+        return { success: false, error: error_1.CredentialVerificationError.CannotExtractHolderPublicKey };
+    }
+    if (PRIVATE_JWK_PARAMETERS.some((parameter) => parameter in jwk) ||
+        (jwk.use !== undefined && jwk.use !== "sig") ||
+        (jwk.key_ops !== undefined &&
+            (!Array.isArray(jwk.key_ops) || !jwk.key_ops.includes("verify")))) {
+        return { success: false, error: error_1.CredentialVerificationError.HolderKeyAlgorithmMismatch };
+    }
+    let algorithm;
+    if (jwk.kty === "EC" &&
+        jwk.crv === "P-256" &&
+        typeof jwk.x === "string" &&
+        jwk.x &&
+        typeof jwk.y === "string" &&
+        jwk.y) {
+        algorithm = "ES256";
+    }
+    else if (jwk.kty === "EC" &&
+        jwk.crv === "secp256k1" &&
+        typeof jwk.x === "string" &&
+        jwk.x &&
+        typeof jwk.y === "string" &&
+        jwk.y) {
+        algorithm = "ES256K";
+    }
+    else if (jwk.kty === "OKP" &&
+        jwk.crv === "Ed25519" &&
+        typeof jwk.x === "string" &&
+        jwk.x) {
+        algorithm = "EdDSA";
+    }
+    if (!algorithm || (jwk.alg !== undefined && jwk.alg !== algorithm)) {
+        return { success: false, error: error_1.CredentialVerificationError.HolderKeyAlgorithmMismatch };
+    }
+    return { success: true, value: algorithm };
+}
+function isObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isNumericDate(value) {
+    return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+function validateCredentialHeader(header, policy) {
+    if (typeof header.typ !== "string" ||
+        !policy.acceptedCredentialTypes.includes(header.typ) ||
+        typeof header.alg !== "string" ||
+        !header.alg ||
+        header.alg === "none" ||
+        header.b64 !== undefined ||
+        header.jku !== undefined ||
+        header.x5u !== undefined ||
+        header.jwk !== undefined) {
+        return { success: false, error: error_1.CredentialVerificationError.InvalidCredentialHeader };
+    }
+    if (header.crit !== undefined) {
+        if (!Array.isArray(header.crit) || header.crit.length > 0) {
+            return { success: false, error: error_1.CredentialVerificationError.InvalidCredentialHeader };
+        }
+    }
+    return { success: true, value: true };
+}
+function validateCredentialPayload(payload, policy, clockToleranceSeconds) {
+    let issuerUrl;
+    try {
+        issuerUrl = new URL(String(payload.iss));
+    }
+    catch {
+        return { success: false, error: error_1.CredentialVerificationError.InvalidCredentialPayload };
+    }
+    if (issuerUrl.protocol !== "https:" ||
+        issuerUrl.username ||
+        issuerUrl.password ||
+        issuerUrl.search ||
+        issuerUrl.hash ||
+        typeof payload.vct !== "string" ||
+        payload.vct.length === 0) {
+        return { success: false, error: error_1.CredentialVerificationError.InvalidCredentialPayload };
+    }
+    for (const claim of ["iat", "nbf", "exp"]) {
+        if (payload[claim] !== undefined && !isNumericDate(payload[claim])) {
+            return { success: false, error: error_1.CredentialVerificationError.InvalidCredentialPayload };
+        }
+    }
+    if (policy.requireCredentialIat && !isNumericDate(payload.iat)) {
+        return { success: false, error: error_1.CredentialVerificationError.InvalidCredentialPayload };
+    }
+    if (policy.requireCredentialExpiration && !isNumericDate(payload.exp)) {
+        return { success: false, error: error_1.CredentialVerificationError.InvalidCredentialPayload };
+    }
+    const now = Math.floor(policy.now().getTime() / 1000);
+    const iat = payload.iat;
+    const nbf = payload.nbf;
+    const exp = payload.exp;
+    if ((iat !== undefined && iat > now + clockToleranceSeconds) ||
+        (nbf !== undefined && nbf > now + clockToleranceSeconds) ||
+        (exp !== undefined && exp <= now - clockToleranceSeconds) ||
+        (iat !== undefined && exp !== undefined && iat >= exp) ||
+        (nbf !== undefined && exp !== undefined && nbf >= exp)) {
+        return { success: false, error: error_1.CredentialVerificationError.ExpiredCredential };
+    }
+    return { success: true, value: true };
+}
+function validateDisclosureGraph(value, disclosuresByDigest, usedDigests, isRoot) {
+    if (Array.isArray(value)) {
+        for (const item of value) {
+            if (isObject(item) && typeof item["..."] === "string") {
+                if (Object.keys(item).length !== 1)
+                    return false;
+                const digest = item["..."];
+                const disclosure = disclosuresByDigest.get(digest);
+                if (!disclosure)
+                    continue;
+                if (usedDigests.has(digest) || disclosure.key !== undefined)
+                    return false;
+                usedDigests.add(digest);
+                if (!validateDisclosureGraph(disclosure.value, disclosuresByDigest, usedDigests, false)) {
+                    return false;
+                }
+            }
+            else if (!validateDisclosureGraph(item, disclosuresByDigest, usedDigests, false)) {
+                return false;
+            }
+        }
+        return true;
+    }
+    if (!isObject(value))
+        return true;
+    if (!isRoot && "_sd_alg" in value)
+        return false;
+    for (const [key, nested] of Object.entries(value)) {
+        if (key !== "_sd") {
+            if (!validateDisclosureGraph(nested, disclosuresByDigest, usedDigests, false))
+                return false;
+        }
+    }
+    if (value._sd === undefined)
+        return true;
+    if (!Array.isArray(value._sd) ||
+        value._sd.some((digest) => typeof digest !== "string" || !digest) ||
+        new Set(value._sd).size !== value._sd.length) {
+        return false;
+    }
+    const disclosedKeys = new Set();
+    for (const digest of value._sd) {
+        const disclosure = disclosuresByDigest.get(digest);
+        if (!disclosure)
+            continue;
+        if (usedDigests.has(digest) ||
+            typeof disclosure.key !== "string" ||
+            !disclosure.key ||
+            RESERVED_DISCLOSURE_KEYS.has(disclosure.key) ||
+            disclosure.key in value ||
+            disclosedKeys.has(disclosure.key) ||
+            (isRoot && NON_DISCLOSABLE_ROOT_CLAIMS.has(disclosure.key))) {
+            return false;
+        }
+        disclosedKeys.add(disclosure.key);
+        usedDigests.add(digest);
+        if (!validateDisclosureGraph(disclosure.value, disclosuresByDigest, usedDigests, false)) {
+            return false;
+        }
+    }
+    return true;
+}
+function validateDisclosures(args) {
+    const disclosureAlgorithm = typeof args.payload._sd_alg === "string" ? args.payload._sd_alg : "sha-256";
+    if (!args.policy.allowedDisclosureAlgorithms.includes(disclosureAlgorithm)) {
+        return { success: false, error: error_1.CredentialVerificationError.InvalidDisclosures };
+    }
+    if (new Set(args.rawDisclosures).size !== args.rawDisclosures.length) {
+        return { success: false, error: error_1.CredentialVerificationError.InvalidDisclosures };
+    }
+    const disclosuresByDigest = new Map();
+    for (const disclosure of args.sdJwt.disclosures ?? []) {
+        if (!disclosure._digest || disclosuresByDigest.has(disclosure._digest)) {
+            return { success: false, error: error_1.CredentialVerificationError.InvalidDisclosures };
+        }
+        disclosuresByDigest.set(disclosure._digest, disclosure);
+    }
+    const usedDigests = new Set();
+    if (!validateDisclosureGraph(args.payload, disclosuresByDigest, usedDigests, true) ||
+        usedDigests.size !== disclosuresByDigest.size) {
+        return { success: false, error: error_1.CredentialVerificationError.InvalidDisclosures };
+    }
+    if (!args.payload._sd &&
+        args.rawDisclosures.length > 0) {
+        return { success: false, error: error_1.CredentialVerificationError.InvalidDisclosures };
+    }
+    return { success: true, value: true };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiU0RKV1RWQ1ZhbGlkYXRpb24uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY3JlZGVudGlhbC12ZXJpZmllcnMvU0RKV1RWQ1ZhbGlkYXRpb24udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUE2REEsZ0ZBc0NDO0FBRUQsc0RBNkNDO0FBVUQsNERBdUJDO0FBRUQsOERBZ0RDO0FBb0VELGtEQW9DQztBQTNVRCxvQ0FBdUQ7QUFDdkQsb0NBQThEO0FBRTlELE1BQU0sc0JBQXNCLEdBQUcsQ0FBQyxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsR0FBRyxDQUFVLENBQUM7QUFDdEYsTUFBTSwyQkFBMkIsR0FBRyxJQUFJLEdBQUcsQ0FBQztJQUMzQyxLQUFLO0lBQ0wsS0FBSztJQUNMLEtBQUs7SUFDTCxLQUFLO0lBQ0wsS0FBSztJQUNMLGVBQWU7SUFDZixRQUFRO0NBQ1IsQ0FBQyxDQUFDO0FBQ0gsTUFBTSx3QkFBd0IsR0FBRyxJQUFJLEdBQUcsQ0FBQyxDQUFDLEtBQUssRUFBRSxTQUFTLEVBQUUsS0FBSyxDQUFDLENBQUMsQ0FBQztBQThDcEUsU0FBZ0Isa0NBQWtDLENBQ2pELFNBQW9DLEVBQUU7SUFFdEMsTUFBTSx1QkFBdUIsR0FBRyxNQUFNLENBQUMsdUJBQXVCLElBQUk7UUFDakUsa0NBQTBCLENBQUMsUUFBUTtRQUNuQyxrQ0FBMEIsQ0FBQyxRQUFRO0tBQ25DLENBQUM7SUFDRixNQUFNLHVCQUF1QixHQUFHLE1BQU0sQ0FBQyx1QkFBdUIsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQzVFLE1BQU0sMkJBQTJCLEdBQUcsTUFBTSxDQUFDLDJCQUEyQixJQUFJLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDdEYsTUFBTSxrQkFBa0IsR0FBRyxNQUFNLENBQUMsa0JBQWtCLElBQUksR0FBRyxDQUFDO0lBRTVELEtBQUssTUFBTSxDQUFDLElBQUksRUFBRSxNQUFNLENBQUMsSUFBSTtRQUM1QixDQUFDLHlCQUF5QixFQUFFLHVCQUF1QixDQUFDO1FBQ3BELENBQUMseUJBQXlCLEVBQUUsdUJBQXVCLENBQUM7UUFDcEQsQ0FBQyw2QkFBNkIsRUFBRSwyQkFBMkIsQ0FBQztLQUNuRCxFQUFFLENBQUM7UUFDWixJQUFJLE1BQU0sQ0FBQyxNQUFNLEtBQUssQ0FBQyxJQUFJLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDeEYsTUFBTSxJQUFJLFNBQVMsQ0FBQyxHQUFHLElBQUksaUNBQWlDLENBQUMsQ0FBQztRQUMvRCxDQUFDO1FBQ0QsSUFBSSxJQUFJLEdBQUcsQ0FBQyxNQUFNLENBQUMsQ0FBQyxJQUFJLEtBQUssTUFBTSxDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQzVDLE1BQU0sSUFBSSxTQUFTLENBQUMsR0FBRyxJQUFJLDhCQUE4QixDQUFDLENBQUM7UUFDNUQsQ0FBQztJQUNGLENBQUM7SUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxrQkFBa0IsQ0FBQyxJQUFJLGtCQUFrQixJQUFJLENBQUMsRUFBRSxDQUFDO1FBQzFFLE1BQU0sSUFBSSxTQUFTLENBQUMsK0NBQStDLENBQUMsQ0FBQztJQUN0RSxDQUFDO0lBRUQsT0FBTyxNQUFNLENBQUMsTUFBTSxDQUFDO1FBQ3BCLHVCQUF1QixFQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxHQUFHLHVCQUF1QixDQUFDLENBQUM7UUFDcEUsdUJBQXVCLEVBQUUsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLEdBQUcsdUJBQXVCLENBQUMsQ0FBQztRQUNwRSwyQkFBMkIsRUFBRSxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsR0FBRywyQkFBMkIsQ0FBQyxDQUFDO1FBQzVFLG9CQUFvQixFQUFFLE1BQU0sQ0FBQyxvQkFBb0IsSUFBSSxJQUFJO1FBQ3pELDJCQUEyQixFQUFFLE1BQU0sQ0FBQywyQkFBMkIsSUFBSSxLQUFLO1FBQ3hFLGtCQUFrQjtRQUNsQixrQkFBa0IsRUFBRSxNQUFNLENBQUMsa0JBQWtCLElBQUksS0FBSztRQUN0RCxHQUFHLEVBQUUsTUFBTSxDQUFDLEdBQUcsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDLElBQUksSUFBSSxFQUFFLENBQUM7UUFDckMsV0FBVyxFQUFFLE1BQU0sQ0FBQyxXQUFXO0tBQy9CLENBQUMsQ0FBQztBQUNKLENBQUM7QUFFRCxTQUFnQixxQkFBcUIsQ0FBQyxHQUFRO0lBQzdDLElBQUksQ0FBQyxHQUFHLElBQUksT0FBTyxHQUFHLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUMzRCxPQUFPLEVBQUUsT0FBTyxFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUUsbUNBQTJCLENBQUMsNEJBQTRCLEVBQUUsQ0FBQztJQUM1RixDQUFDO0lBQ0QsSUFDQyxzQkFBc0IsQ0FBQyxJQUFJLENBQUMsQ0FBQyxTQUFTLEVBQUUsRUFBRSxDQUFDLFNBQVMsSUFBSSxHQUFHLENBQUM7UUFDNUQsQ0FBQyxHQUFHLENBQUMsR0FBRyxLQUFLLFNBQVMsSUFBSSxHQUFHLENBQUMsR0FBRyxLQUFLLEtBQUssQ0FBQztRQUM1QyxDQUFDLEdBQUcsQ0FBQyxPQUFPLEtBQUssU0FBUztZQUN6QixDQUFDLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLEVBQ2pFLENBQUM7UUFDRixPQUFPLEVBQUUsT0FBTyxFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUUsbUNBQTJCLENBQUMsMEJBQTBCLEVBQUUsQ0FBQztJQUMxRixDQUFDO0lBRUQsSUFBSSxTQUE2QixDQUFDO0lBQ2xDLElBQ0MsR0FBRyxDQUFDLEdBQUcsS0FBSyxJQUFJO1FBQ2hCLEdBQUcsQ0FBQyxHQUFHLEtBQUssT0FBTztRQUNuQixPQUFPLEdBQUcsQ0FBQyxDQUFDLEtBQUssUUFBUTtRQUN6QixHQUFHLENBQUMsQ0FBQztRQUNMLE9BQU8sR0FBRyxDQUFDLENBQUMsS0FBSyxRQUFRO1FBQ3pCLEdBQUcsQ0FBQyxDQUFDLEVBQ0osQ0FBQztRQUNGLFNBQVMsR0FBRyxPQUFPLENBQUM7SUFDckIsQ0FBQztTQUFNLElBQ04sR0FBRyxDQUFDLEdBQUcsS0FBSyxJQUFJO1FBQ2hCLEdBQUcsQ0FBQyxHQUFHLEtBQUssV0FBVztRQUN2QixPQUFPLEdBQUcsQ0FBQyxDQUFDLEtBQUssUUFBUTtRQUN6QixHQUFHLENBQUMsQ0FBQztRQUNMLE9BQU8sR0FBRyxDQUFDLENBQUMsS0FBSyxRQUFRO1FBQ3pCLEdBQUcsQ0FBQyxDQUFDLEVBQ0osQ0FBQztRQUNGLFNBQVMsR0FBRyxRQUFRLENBQUM7SUFDdEIsQ0FBQztTQUFNLElBQ04sR0FBRyxDQUFDLEdBQUcsS0FBSyxLQUFLO1FBQ2pCLEdBQUcsQ0FBQyxHQUFHLEtBQUssU0FBUztRQUNyQixPQUFPLEdBQUcsQ0FBQyxDQUFDLEtBQUssUUFBUTtRQUN6QixHQUFHLENBQUMsQ0FBQyxFQUNKLENBQUM7UUFDRixTQUFTLEdBQUcsT0FBTyxDQUFDO0lBQ3JCLENBQUM7SUFFRCxJQUFJLENBQUMsU0FBUyxJQUFJLENBQUMsR0FBRyxDQUFDLEdBQUcsS0FBSyxTQUFTLElBQUksR0FBRyxDQUFDLEdBQUcsS0FBSyxTQUFTLENBQUMsRUFBRSxDQUFDO1FBQ3BFLE9BQU8sRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRSxtQ0FBMkIsQ0FBQywwQkFBMEIsRUFBRSxDQUFDO0lBQzFGLENBQUM7SUFDRCxPQUFPLEVBQUUsT0FBTyxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsU0FBUyxFQUFFLENBQUM7QUFDNUMsQ0FBQztBQUVELFNBQVMsUUFBUSxDQUFDLEtBQWM7SUFDL0IsT0FBTyxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksS0FBSyxLQUFLLElBQUksSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUM7QUFDN0UsQ0FBQztBQUVELFNBQVMsYUFBYSxDQUFDLEtBQWM7SUFDcEMsT0FBTyxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLElBQUksQ0FBQyxDQUFDO0FBQy9FLENBQUM7QUFFRCxTQUFnQix3QkFBd0IsQ0FDdkMsTUFBK0IsRUFDL0IsTUFBMkM7SUFFM0MsSUFDQyxPQUFPLE1BQU0sQ0FBQyxHQUFHLEtBQUssUUFBUTtRQUM5QixDQUFDLE1BQU0sQ0FBQyx1QkFBdUIsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQztRQUNwRCxPQUFPLE1BQU0sQ0FBQyxHQUFHLEtBQUssUUFBUTtRQUM5QixDQUFDLE1BQU0sQ0FBQyxHQUFHO1FBQ1gsTUFBTSxDQUFDLEdBQUcsS0FBSyxNQUFNO1FBQ3JCLE1BQU0sQ0FBQyxHQUFHLEtBQUssU0FBUztRQUN4QixNQUFNLENBQUMsR0FBRyxLQUFLLFNBQVM7UUFDeEIsTUFBTSxDQUFDLEdBQUcsS0FBSyxTQUFTO1FBQ3hCLE1BQU0sQ0FBQyxHQUFHLEtBQUssU0FBUyxFQUN2QixDQUFDO1FBQ0YsT0FBTyxFQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLG1DQUEyQixDQUFDLHVCQUF1QixFQUFFLENBQUM7SUFDdkYsQ0FBQztJQUNELElBQUksTUFBTSxDQUFDLElBQUksS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUMvQixJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDM0QsT0FBTyxFQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLG1DQUEyQixDQUFDLHVCQUF1QixFQUFFLENBQUM7UUFDdkYsQ0FBQztJQUNGLENBQUM7SUFDRCxPQUFPLEVBQUUsT0FBTyxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLENBQUM7QUFDdkMsQ0FBQztBQUVELFNBQWdCLHlCQUF5QixDQUN4QyxPQUFnQyxFQUNoQyxNQUEyQyxFQUMzQyxxQkFBNkI7SUFFN0IsSUFBSSxTQUFjLENBQUM7SUFDbkIsSUFBSSxDQUFDO1FBQ0osU0FBUyxHQUFHLElBQUksR0FBRyxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztJQUMxQyxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1IsT0FBTyxFQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLG1DQUEyQixDQUFDLHdCQUF3QixFQUFFLENBQUM7SUFDeEYsQ0FBQztJQUNELElBQ0MsU0FBUyxDQUFDLFFBQVEsS0FBSyxRQUFRO1FBQy9CLFNBQVMsQ0FBQyxRQUFRO1FBQ2xCLFNBQVMsQ0FBQyxRQUFRO1FBQ2xCLFNBQVMsQ0FBQyxNQUFNO1FBQ2hCLFNBQVMsQ0FBQyxJQUFJO1FBQ2QsT0FBTyxPQUFPLENBQUMsR0FBRyxLQUFLLFFBQVE7UUFDL0IsT0FBTyxDQUFDLEdBQUcsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUN2QixDQUFDO1FBQ0YsT0FBTyxFQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLG1DQUEyQixDQUFDLHdCQUF3QixFQUFFLENBQUM7SUFDeEYsQ0FBQztJQUNELEtBQUssTUFBTSxLQUFLLElBQUksQ0FBQyxLQUFLLEVBQUUsS0FBSyxFQUFFLEtBQUssQ0FBVSxFQUFFLENBQUM7UUFDcEQsSUFBSSxPQUFPLENBQUMsS0FBSyxDQUFDLEtBQUssU0FBUyxJQUFJLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDcEUsT0FBTyxFQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLG1DQUEyQixDQUFDLHdCQUF3QixFQUFFLENBQUM7UUFDeEYsQ0FBQztJQUNGLENBQUM7SUFDRCxJQUFJLE1BQU0sQ0FBQyxvQkFBb0IsSUFBSSxDQUFDLGFBQWEsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUNoRSxPQUFPLEVBQUUsT0FBTyxFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUUsbUNBQTJCLENBQUMsd0JBQXdCLEVBQUUsQ0FBQztJQUN4RixDQUFDO0lBQ0QsSUFBSSxNQUFNLENBQUMsMkJBQTJCLElBQUksQ0FBQyxhQUFhLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDdkUsT0FBTyxFQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLG1DQUEyQixDQUFDLHdCQUF3QixFQUFFLENBQUM7SUFDeEYsQ0FBQztJQUVELE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLEdBQUcsRUFBRSxDQUFDLE9BQU8sRUFBRSxHQUFHLElBQUksQ0FBQyxDQUFDO0lBQ3RELE1BQU0sR0FBRyxHQUFHLE9BQU8sQ0FBQyxHQUF5QixDQUFDO0lBQzlDLE1BQU0sR0FBRyxHQUFHLE9BQU8sQ0FBQyxHQUF5QixDQUFDO0lBQzlDLE1BQU0sR0FBRyxHQUFHLE9BQU8sQ0FBQyxHQUF5QixDQUFDO0lBQzlDLElBQ0MsQ0FBQyxHQUFHLEtBQUssU0FBUyxJQUFJLEdBQUcsR0FBRyxHQUFHLEdBQUcscUJBQXFCLENBQUM7UUFDeEQsQ0FBQyxHQUFHLEtBQUssU0FBUyxJQUFJLEdBQUcsR0FBRyxHQUFHLEdBQUcscUJBQXFCLENBQUM7UUFDeEQsQ0FBQyxHQUFHLEtBQUssU0FBUyxJQUFJLEdBQUcsSUFBSSxHQUFHLEdBQUcscUJBQXFCLENBQUM7UUFDekQsQ0FBQyxHQUFHLEtBQUssU0FBUyxJQUFJLEdBQUcsS0FBSyxTQUFTLElBQUksR0FBRyxJQUFJLEdBQUcsQ0FBQztRQUN0RCxDQUFDLEdBQUcsS0FBSyxTQUFTLElBQUksR0FBRyxLQUFLLFNBQVMsSUFBSSxHQUFHLElBQUksR0FBRyxDQUFDLEVBQ3JELENBQUM7UUFDRixPQUFPLEVBQUUsT0FBTyxFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUUsbUNBQTJCLENBQUMsaUJBQWlCLEVBQUUsQ0FBQztJQUNqRixDQUFDO0lBQ0QsT0FBTyxFQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxDQUFDO0FBQ3ZDLENBQUM7QUFFRCxTQUFTLHVCQUF1QixDQUMvQixLQUFjLEVBQ2QsbUJBQWlELEVBQ2pELFdBQXdCLEVBQ3hCLE1BQWU7SUFFZixJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUMxQixLQUFLLE1BQU0sSUFBSSxJQUFJLEtBQUssRUFBRSxDQUFDO1lBQzFCLElBQUksUUFBUSxDQUFDLElBQUksQ0FBQyxJQUFJLE9BQU8sSUFBSSxDQUFDLEtBQUssQ0FBQyxLQUFLLFFBQVEsRUFBRSxDQUFDO2dCQUN2RCxJQUFJLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsTUFBTSxLQUFLLENBQUM7b0JBQUUsT0FBTyxLQUFLLENBQUM7Z0JBQ2pELE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQztnQkFDM0IsTUFBTSxVQUFVLEdBQUcsbUJBQW1CLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDO2dCQUNuRCxJQUFJLENBQUMsVUFBVTtvQkFBRSxTQUFTO2dCQUMxQixJQUFJLFdBQVcsQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLElBQUksVUFBVSxDQUFDLEdBQUcsS0FBSyxTQUFTO29CQUFFLE9BQU8sS0FBSyxDQUFDO2dCQUMxRSxXQUFXLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDO2dCQUN4QixJQUFJLENBQUMsdUJBQXVCLENBQUMsVUFBVSxDQUFDLEtBQUssRUFBRSxtQkFBbUIsRUFBRSxXQUFXLEVBQUUsS0FBSyxDQUFDLEVBQUUsQ0FBQztvQkFDekYsT0FBTyxLQUFLLENBQUM7Z0JBQ2QsQ0FBQztZQUNGLENBQUM7aUJBQU0sSUFBSSxDQUFDLHVCQUF1QixDQUFDLElBQUksRUFBRSxtQkFBbUIsRUFBRSxXQUFXLEVBQUUsS0FBSyxDQUFDLEVBQUUsQ0FBQztnQkFDcEYsT0FBTyxLQUFLLENBQUM7WUFDZCxDQUFDO1FBQ0YsQ0FBQztRQUNELE9BQU8sSUFBSSxDQUFDO0lBQ2IsQ0FBQztJQUNELElBQUksQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDO1FBQUUsT0FBTyxJQUFJLENBQUM7SUFFbEMsSUFBSSxDQUFDLE1BQU0sSUFBSSxTQUFTLElBQUksS0FBSztRQUFFLE9BQU8sS0FBSyxDQUFDO0lBQ2hELEtBQUssTUFBTSxDQUFDLEdBQUcsRUFBRSxNQUFNLENBQUMsSUFBSSxNQUFNLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDbkQsSUFBSSxHQUFHLEtBQUssS0FBSyxFQUFFLENBQUM7WUFDbkIsSUFBSSxDQUFDLHVCQUF1QixDQUFDLE1BQU0sRUFBRSxtQkFBbUIsRUFBRSxXQUFXLEVBQUUsS0FBSyxDQUFDO2dCQUFFLE9BQU8sS0FBSyxDQUFDO1FBQzdGLENBQUM7SUFDRixDQUFDO0lBRUQsSUFBSSxLQUFLLENBQUMsR0FBRyxLQUFLLFNBQVM7UUFBRSxPQUFPLElBQUksQ0FBQztJQUN6QyxJQUNDLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDO1FBQ3pCLEtBQUssQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxPQUFPLE1BQU0sS0FBSyxRQUFRLElBQUksQ0FBQyxNQUFNLENBQUM7UUFDakUsSUFBSSxHQUFHLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksS0FBSyxLQUFLLENBQUMsR0FBRyxDQUFDLE1BQU0sRUFDM0MsQ0FBQztRQUNGLE9BQU8sS0FBSyxDQUFDO0lBQ2QsQ0FBQztJQUVELE1BQU0sYUFBYSxHQUFHLElBQUksR0FBRyxFQUFVLENBQUM7SUFDeEMsS0FBSyxNQUFNLE1BQU0sSUFBSSxLQUFLLENBQUMsR0FBRyxFQUFFLENBQUM7UUFDaEMsTUFBTSxVQUFVLEdBQUcsbUJBQW1CLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ25ELElBQUksQ0FBQyxVQUFVO1lBQUUsU0FBUztRQUMxQixJQUNDLFdBQVcsQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDO1lBQ3ZCLE9BQU8sVUFBVSxDQUFDLEdBQUcsS0FBSyxRQUFRO1lBQ2xDLENBQUMsVUFBVSxDQUFDLEdBQUc7WUFDZix3QkFBd0IsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQztZQUM1QyxVQUFVLENBQUMsR0FBRyxJQUFJLEtBQUs7WUFDdkIsYUFBYSxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDO1lBQ2pDLENBQUMsTUFBTSxJQUFJLDJCQUEyQixDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLENBQUMsRUFDMUQsQ0FBQztZQUNGLE9BQU8sS0FBSyxDQUFDO1FBQ2QsQ0FBQztRQUNELGFBQWEsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ2xDLFdBQVcsQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDeEIsSUFBSSxDQUFDLHVCQUF1QixDQUFDLFVBQVUsQ0FBQyxLQUFLLEVBQUUsbUJBQW1CLEVBQUUsV0FBVyxFQUFFLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDekYsT0FBTyxLQUFLLENBQUM7UUFDZCxDQUFDO0lBQ0YsQ0FBQztJQUNELE9BQU8sSUFBSSxDQUFDO0FBQ2IsQ0FBQztBQUVELFNBQWdCLG1CQUFtQixDQUFDLElBS25DO0lBQ0EsTUFBTSxtQkFBbUIsR0FDeEIsT0FBTyxJQUFJLENBQUMsT0FBTyxDQUFDLE9BQU8sS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7SUFDN0UsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsMkJBQTJCLENBQUMsUUFBUSxDQUFDLG1CQUFtQixDQUFDLEVBQUUsQ0FBQztRQUM1RSxPQUFPLEVBQUUsT0FBTyxFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUUsbUNBQTJCLENBQUMsa0JBQWtCLEVBQUUsQ0FBQztJQUNsRixDQUFDO0lBQ0QsSUFBSSxJQUFJLEdBQUcsQ0FBQyxJQUFJLENBQUMsY0FBYyxDQUFDLENBQUMsSUFBSSxLQUFLLElBQUksQ0FBQyxjQUFjLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDdEUsT0FBTyxFQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLG1DQUEyQixDQUFDLGtCQUFrQixFQUFFLENBQUM7SUFDbEYsQ0FBQztJQUVELE1BQU0sbUJBQW1CLEdBQUcsSUFBSSxHQUFHLEVBQTJCLENBQUM7SUFDL0QsS0FBSyxNQUFNLFVBQVUsSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDLFdBQVcsSUFBSSxFQUFFLEVBQUUsQ0FBQztRQUN2RCxJQUFJLENBQUMsVUFBVSxDQUFDLE9BQU8sSUFBSSxtQkFBbUIsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7WUFDeEUsT0FBTyxFQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLG1DQUEyQixDQUFDLGtCQUFrQixFQUFFLENBQUM7UUFDbEYsQ0FBQztRQUNELG1CQUFtQixDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsT0FBTyxFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBQ3pELENBQUM7SUFDRCxNQUFNLFdBQVcsR0FBRyxJQUFJLEdBQUcsRUFBVSxDQUFDO0lBQ3RDLElBQ0MsQ0FBQyx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLG1CQUFtQixFQUFFLFdBQVcsRUFBRSxJQUFJLENBQUM7UUFDOUUsV0FBVyxDQUFDLElBQUksS0FBSyxtQkFBbUIsQ0FBQyxJQUFJLEVBQzVDLENBQUM7UUFDRixPQUFPLEVBQUUsT0FBTyxFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUUsbUNBQTJCLENBQUMsa0JBQWtCLEVBQUUsQ0FBQztJQUNsRixDQUFDO0lBQ0QsSUFDQyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsR0FBRztRQUNqQixJQUFJLENBQUMsY0FBYyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQzdCLENBQUM7UUFDRixPQUFPLEVBQUUsT0FBTyxFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUUsbUNBQTJCLENBQUMsa0JBQWtCLEVBQUUsQ0FBQztJQUNsRixDQUFDO0lBQ0QsT0FBTyxFQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxDQUFDO0FBQ3ZDLENBQUMifQ==

package/dist/credential-verifiers/SDJWTVCVerifier.d.ts

@@ -0,0 +1,15 @@
+import { Context, CredentialVerifier, HttpClient, PublicKeyResolverEngineI } from "../interfaces";
+import type { TokenStatusListVerifierI } from "../status/TokenStatusListVerifier";
+import { type X509ChainVerifierI } from "../x509/X509ChainVerifier";
+import { SDJWTVCVerificationPolicy } from "./SDJWTVCValidation";
+export { deriveHolderAlgorithm } from "./SDJWTVCValidation";
+export type { KbJwtReplayGuard, KbJwtReplayInput, SDJWTVCVerificationPolicy, } from "./SDJWTVCValidation";
+export declare function SDJWTVCVerifier(args: {
+    context: Context;
+    pkResolverEngine: PublicKeyResolverEngineI;
+    httpClient: HttpClient;
+    policy?: SDJWTVCVerificationPolicy;
+    statusListVerifier?: TokenStatusListVerifierI;
+    x509ChainVerifier?: X509ChainVerifierI;
+}): CredentialVerifier;
+//# sourceMappingURL=SDJWTVCVerifier.d.ts.map

package/dist/credential-verifiers/SDJWTVCVerifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SDJWTVCVerifier.d.ts","sourceRoot":"","sources":["../../src/credential-verifiers/SDJWTVCVerifier.ts"],"names":[],"mappings":"AAUA,OAAO,EACN,OAAO,EAEP,kBAAkB,EAClB,UAAU,EACV,wBAAwB,EACxB,MAAM,eAAe,CAAC;AAIvB,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EAEN,KAAK,kBAAkB,EACvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAGN,yBAAyB,EAIzB,MAAM,qBAAqB,CAAC;AAiD7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,YAAY,EACX,gBAAgB,EAChB,gBAAgB,EAChB,yBAAyB,GACzB,MAAM,qBAAqB,CAAC;AAE7B,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,gBAAgB,EAAE,wBAAwB,CAAC;IAC3C,UAAU,EAAE,UAAU,CAAC;IACvB,MAAM,CAAC,EAAE,yBAAyB,CAAC;IACnC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IAC9C,iBAAiB,CAAC,EAAE,kBAAkB,CAAC;CACvC,GAAG,kBAAkB,CA4YrB"}