@credo-ts/core
Version:
<p align="center"> <br /> <img alt="Credo Logo" src="https://github.com/openwallet-foundation/credo-ts/blob/c7886cb8377ceb8ee4efe8d264211e561a75072d/images/credo-logo.png" height="250px" /> </p> <h1 align="center"><b>Credo - Core</b></h1
181 lines • 6.17 kB
text/typescript
import { HashName } from "../../crypto/hashes/Hasher.mjs";
import { X509Certificate } from "../x509/X509Certificate.mjs";
import { EncodedX509Certificate } from "../x509/X509ServiceOptions.mjs";
import "../x509/index.mjs";
import { SdJwtVc } from "./SdJwtVcService.mjs";
import { SdJwtVcRecord } from "./repository/SdJwtVcRecord.mjs";
import "./repository/index.mjs";
import { TrustedIssuer } from "../../agent/TrustedIssuersForVerification.mjs";
import { X509VerificationTrustedCertificates } from "../x509/X509ModuleConfig.mjs";
import "../../crypto/index.mjs";
import { PublicJwk } from "../kms/jwk/PublicJwk.mjs";
import "../kms/index.mjs";
import { SdJwtVcPayload } from "@sd-jwt/sd-jwt-vc";
//#region src/modules/sd-jwt-vc/SdJwtVcOptions.d.ts
export interface SdJwtVcStoreOptions {
record: SdJwtVcRecord;
}
export type SdJwtVcHeader = Record<string, unknown>;
export interface IDisclosureFrame {
/**
* The claims that are selectively disclosable: property names in an object, element positions in an array.
*/
_sd?: Array<string | number>;
_sd_decoy?: number;
[x: string]: Array<string | number> | number | IDisclosureFrame | undefined;
}
export interface IPresentationFrame {
[x: string]: boolean | IPresentationFrame;
}
export interface SdJwtVcHolderDidBinding {
method: 'did';
didUrl: string;
}
export interface SdJwtVcHolderJwkBinding {
method: 'jwk';
jwk: PublicJwk;
}
export interface SdJwtVcIssuerDid {
method: 'did';
didUrl: string;
}
export interface SdJwtVcIssuerX5c {
method: 'x5c';
/**
*
* Array of X509 certificates.
*
* The certificate containing the public key corresponding to the key used to digitally sign the JWS MUST be the first certificate.
*/
x5c: X509Certificate[];
/**
* The issuer of the SD-JWT VC.
*
* NOTE: in the latest draft of SD-JWT VC the issuer field is optional when using an X509 certificates
* to sign the SD-JWT VC.
*
* Since it's not clear what the iss value should be Credo will likely require
* the value to be undefined in a future version, but for now if the issuer value
* is defined it MUST match an SAN URI or DNS entry in the leaf certificate, mimicking
* previous behavior.
*/
issuer?: string;
}
export type SdJwtVcHolderBinding = SdJwtVcHolderDidBinding | SdJwtVcHolderJwkBinding;
export type SdJwtVcIssuer = SdJwtVcIssuerDid | SdJwtVcIssuerX5c;
export interface SdJwtVcSignOptions<Payload extends SdJwtVcPayload = SdJwtVcPayload> {
/**
* If `iat` is omitted from the payload, the current time will be used.
* If `iat` is explicitly set to `null`, no `iat` claim will be included in the issued credential.
*/
payload: Omit<Payload, 'iat'> & {
iat?: number | null;
};
/**
* If holder is not provided, we don't bind the SD-JWT VC to a key (so bearer VC)
*/
holder?: SdJwtVcHolderBinding;
issuer: SdJwtVcIssuer;
disclosureFrame?: IDisclosureFrame;
/**
* The hashing algorithm used for the disclosure digests, and placed in the
* `_sd_alg` claim of the SD-JWT VC.
*
* `sha-1` is not supported, as SD-JWT VC requires a hash algorithm that is
* considered secure at the time of issuance.
*
* @default 'sha-256'
*/
hashingAlgorithm?: Exclude<HashName, 'sha-1'>;
/**
* The header 'typ' to use for the SD-JWT VC. vc+sd-jwt is supported
* for backwards compatibility but implementations should update to
* dc+sd-jwt
*
* @default 'dc+sd-jwt'
*/
headerType?: 'dc+sd-jwt' | 'vc+sd-jwt';
}
export type SdJwtVcPresentOptions<_Payload extends SdJwtVcPayload = SdJwtVcPayload> = {
sdJwtVc: string | SdJwtVc;
/**
* Use true to disclose everything
*/
presentationFrame?: IPresentationFrame;
/**
* This information is received out-of-band from the verifier.
* The claims will be used to create a normal JWT, used for key binding.
*
* If not defined, a KB-JWT will not be created
*/
verifierMetadata?: {
audience: string;
nonce: string;
issuedAt: number;
};
/**
* Additional payload to include in the KB JWT
*/
additionalPayload?: Record<string, unknown>;
};
export type SdJwtVcVerifyOptions = {
compactSdJwtVc: string;
/**
* If the key binding object is present, the sd-jwt is required to have a key binding jwt attached
* and will be validated against the provided key binding options.
*/
keyBinding?: {
/**
* The expected `aud` value in the payload of the KB-JWT. The value of this is dependant on the
* exchange protocol used.
*/
audience: string;
/**
* The expected `nonce` value in the payload of the KB-JWT. The value of this is dependant on the
* exchange protocol used.
*/
nonce: string;
};
requiredClaimKeys?: Array<string>;
/**
* Whether to fetch the `vct` type metadata
*
* It will will not influence the verification result if fetching of type metadata fails
*
* @default false
*/
fetchTypeMetadata?: boolean;
/**
* Whether to verify the status of the credential. If set to false and the credential
* has a status, it will not be checked and the status list will not be fetched.
*
* @default true
* @deprecated use `disableStatusValidation`
*/
verifyCredentialStatus?: boolean;
/**
* Whether to verify the status of the credential. If set to true and the credential
* has a status, it will not be checked and the status list will not be fetched.
*
* @default false
*/
disableStatusValidation?: boolean;
/**
* Trusted certificates for the verification.
*
* @deprecated use `trustedIssuers` instead.
*/
trustedCertificates?: EncodedX509Certificate[] | X509VerificationTrustedCertificates[];
/**
* Trusted issuers for the verification. Only entries whose `method` matches the credential signer
* method are considered (x509 entries gate x5c-signed credentials, did entries gate did-signed ones).
*/
trustedIssuers?: TrustedIssuer[];
/**
* Date that should be used as the current time. If not provided, current time will be used.
*/
now?: Date;
};
//#endregion
export type { SdJwtVcPayload };
//# sourceMappingURL=SdJwtVcOptions.d.mts.map