VC Wallet SDK

import { PBWallet } from "@passkeybridge/vc-wallet-sdk";

const wallet = new PBWallet({
  apiKey: "pb_live_...",                           // pb_test_... for a sandbox key
  tenantId: "your-tenant-uuid",
  // baseUrl: "https://api.passkeybridge.io/v1",   // default; override for staging
  // timeoutMs: 15_000,                            // default, per request
  // persist: true,                                // IndexedDB in browsers, memory elsewhere
  // storage: myWalletStorage,                     // or bring your own WalletStorage
});

console.log(PBWallet.version);                     // the package version

// JWT-VC by default: an ES256 (P-256) JWS plus a detached ML-DSA-65 proof.
const issued = await wallet.issue({
  subjectDid: "did:web:example.com:users:alice",
  credentialType: "IdentityAttestation",
  claims: {
    verificationLevel: "enhanced",
    verifiedAt: new Date().toISOString(),
  },
  expirationDays: 90,                            // the server default is 90
});

console.log(issued.credential.jwt);              // eyJ...
console.log(issued.credential.credential_id);    // urn:uuid:...
console.log(issued.credential.expires_at);
console.log(issued.pqc.algorithm);               // "ML-DSA-65"
console.log(issued.latency_ms);

// A disclosureFrame switches the format to SD-JWT-VC. The SDK generates a
// P-256 holder key pair, sends the public JWK as cnf.jwk, and keeps the
// private key in the local wallet for presentWithBinding().
const sdJwt = await wallet.issue({
  subjectDid: "did:web:example.com:users:alice",
  credentialType: "KYCAttestation",
  claims: { age_over_18: true, age_over_21: true, country: "US" },
  disclosureFrame: { age_over_18: true, age_over_21: true, country: true },
});
console.log(sdJwt.credential.format);            // "sd-jwt-vc"
console.log(sdJwt.sd?.disclosure_count);         // 3

// One token: a VP JWT from a holder wallet, or a bare VC JWT.
const result = await wallet.verifyPresentation({
  vpToken: "eyJ...",
  expectedNonce: "nonce-from-your-auth-request",   // replay check on the VP / KB-JWT
  presentationDefinition: definition,              // optional Presentation Exchange 2.0
  bindToSignalHash: "carrier-signal-digest",       // optional cross-reference link
});

if (result.verified) {
  console.log(result.holderHash);                  // keyed digest of the holder DID
  console.log(result.credentials?.[0]?.checks);    // signature_valid, not_expired, ...
  console.log(result.crossReferenceId);            // set when bindToSignalHash was passed
  console.log(result.latencyMs);
} else {
  console.error(result.error);
}

// Up to 20 tokens against one definition in a single round trip.
const batch = await wallet.verifyBatchPresentation(tokens, definition, {
  expectedNonce: "nonce-from-your-auth-request",
});
console.log(batch.tokenCount, batch.verified);

// Build an OpenID4VP authorization request for a holder wallet to answer.
const request = await wallet.createPresentationRequest(definition);
console.log(request.nonce, request.authorizationRequest);

// Browser: IndexedDB, encrypted at rest under a non-extractable AES-256-GCM key.
// Node, Deno, edge runtimes and SSR: in memory, for the life of the process.
const stored = await wallet.store(issued.credential, { source: "onboarding" });
await wallet.storeJwt("eyJ...");                      // a credential received out of band

const valid = await wallet.list({ type: "IdentityAttestation", validOnly: true });
const one = await wallet.get("urn:uuid:...");         // null when absent, never throws
await wallet.remove("urn:uuid:...");                  // drops the holder key too
await wallet.clearAll();

// React Native, a CLI, a server-side wallet: implement WalletStorage and pass
// it as `storage` to the constructor.

// Present an SD-JWT-VC with a Key-Binding JWT that proves possession of the
// holder key the SDK generated at issuance.
if (await wallet.hasHolderBinding(credentialId)) {
  const presentation = await wallet.presentWithBinding(
    credentialId,
    "did:web:verifier.example.com",   // audience
    "nonce-from-the-auth-request",    // nonce
    ["age_over_18", "country"],       // reveal only these claims; omit for all
  );
  // "<issuer-jwt>~<disclosure>~<disclosure>~<kb-jwt>"
}

// Pick the wallet credentials that satisfy a presentation definition, then
// resolve them to tokens for verifyBatchPresentation().
const matches = await wallet.selectCredentials(definition);
const tokens = await wallet.assembleBatchTokens(matches.map((c) => c.credentialId));

// Issuer side: create an offer and render credentialOfferUri as a QR code.
const offer = await wallet.createCredentialOffer({
  credentialType: "IdentityAttestation",
  subjectDid: "did:web:example.com:users:alice",
  claims: { verificationLevel: "enhanced" },
  formats: ["jwt_vc_json", "vc+sd-jwt"],
});
console.log(offer.credentialOfferUri, offer.preAuthorizedCode, offer.expiresAt);

// Wallet side: the pre-authorized code flow end to end. Token exchange, a
// holder proof for SD-JWT formats, then the credential request. autoStore
// (default true) keeps the credential and its holder key in the local wallet.
const redeemed = await wallet.redeemOffer(offer.preAuthorizedCode, "vc+sd-jwt");
console.log(redeemed.format, redeemed.stored?.credentialId);
if (redeemed.holderKeyPersisted === false) {
  // The credential arrived but its binding key did not survive. Re-issue it.
}

// Credential configurations and supported formats. No scope required.
const metadata = await wallet.getIssuerMetadata();

// Public reads: no API key scope is needed.
const status = await wallet.checkStatus("urn:uuid:...");
console.log(status.status);   // "active" | "suspended" | "revoked" | "expired" | "unknown"

// Up to 100 ids in one round trip.
const { credentials, checkedAt } = await wallet.batchCheckStatus(["urn:uuid:1", "urn:uuid:2"]);

// Writes need the vc_revoke scope. Revoke is permanent; suspend is reversible.
await wallet.revoke("urn:uuid:...", "user_requested_deletion");
await wallet.suspend("urn:uuid:...", "under_review");
await wallet.reinstate("urn:uuid:...");

// Force a StatusList2021 bitstring rebuild for your issuer DID.
const list = await wallet.refreshStatusList();
console.log(list.etag, list.totalCredentials, list.revokedCount);

import {
  decodeCredential,
  decodeJwtPayload,
  matchCredentials,
  generateHolderKeyPair,
  createKbJwt,
} from "@passkeybridge/vc-wallet-sdk";

// Header and payload of a JWT or SD-JWT. No signature verification.
const { header, payload } = decodeCredential("eyJ...");

// Payload only; null on failure instead of throwing.
const claims = decodeJwtPayload("eyJ...");

// Presentation Exchange 2.0 matcher over any candidate set. A verifier-written
// pattern is capped at 512 characters, refused when a quantified group nests
// another quantifier, and never run against a value over 4096 characters.
const matched = matchCredentials(definition, candidates);

// The holder-side primitives presentWithBinding() is built from.
const pair = await generateHolderKeyPair();
const kbJwt = await createKbJwt(sdJwtWithoutKb, audience, nonce, pair.privateJwk);

import { PBWalletError } from "@passkeybridge/vc-wallet-sdk";

try {
  await wallet.issue({ subjectDid, credentialType });
} catch (err) {
  if (err instanceof PBWalletError) {
    console.error(err.code);        // "unauthorized" | "forbidden" | "rate_limited" | ...
    console.error(err.httpStatus);  // 401, 403, 429, ... when the edge answered
    console.error(err.requestId);   // x-request-id or cf-ray, for support
    console.error(err.message);
  }
}