sdjwt_oid4vc library

SD-JWT VC + OpenID4VCI/OpenID4VP protocol library for Dart wallets (holder role).

The two things a host app must provide are an Es256Signer (the holder key) and — optionally — an Oid4vcHttp (defaults to DefaultOid4vcHttp). Everything else is pure, deterministic logic.

Classes

CredentialMatch
A held credential that satisfies a request, plus the claims to reveal.
CredentialOffer
A parsed credential offer (from a openid-credential-offer:// deep link or the offer JSON).
CredentialStatus
The resolved status of one credential.
DcqlClaim
A single claim path within a DcqlCredentialQuery.
DcqlCredentialQuery
One requested credential within a DcqlQuery.
DcqlCredentialSet
One credential_sets entry: a set of acceptable options, each option a combination of DcqlCredentialQuery.ids that together satisfy the set (e.g. "a PID, OR (a driving licence AND an age credential)").
DcqlQuery
A Digital Credentials Query Language (DCQL) query — the modern OpenID4VP way a verifier states which credentials and which claims it wants.
DefaultOid4vcHttp
Default Oid4vcHttp over package:http.
Disclosure
One selectively-disclosable value of an SD-JWT VC.
Es256Signer
The holder's signing key — the only cryptographic dependency this library has, and it is injected, never imported.
HttpResp
A minimal HTTP response, decoupled from any client library.
IssuerMetadata
The issuer endpoints and credential types this wallet needs, gathered from /.well-known/openid-credential-issuer (+ the authorization server's /.well-known/oauth-authorization-server).
IssuerTrust
The trust policy used when verifying an SD-JWT VC's issuer signature.
Jwk
JWK helpers. The only one we need is the RFC 7638 thumbprint, used to derive a stable kid for the holder key.
Jws
Compact-JWS helpers shared by the SD-JWT codec and the OID4VP request parser.
JwsParts
The three decoded parts of a compact JWS (header.payload.signature).
KbJwt
Key Binding JWT helpers (SD-JWT VC, typ: kb+jwt).
KeyAttestation
Optional proof that the holder key lives in hardware, bound to a server-supplied nonce.
Oid4vcHttp
Injectable HTTP transport. Implementations must not retry or follow auth challenges silently — the protocol clients drive the flow.
Oid4vciClient
OpenID4VCI holder client: turns a credential offer into an issued SD-JWT VC over the pre-authorized-code flow.
Oid4vpClient
OpenID4VP holder client: fetch a request, match it against held credentials, build the vp_token, and submit it.
PresentationRequest
A parsed OpenID4VP authorization request (Request Object).
RequestObjectSignature
The signing material of a signed OpenID4VP request object (a JAR — a JWT-Secured Authorization Request).
ResponseEncryption
The verifier's response-encryption parameters for direct_post.jwt, read from the request's client_metadata.
SdJwt
Codec for the SD-JWT VC compact serialization <issuer-JWT>~<disclosure>~…~[<KB-JWT>].
SdJwtVc
A parsed SD-JWT VC.
StatusListRef
A reference to a credential's entry in a Token Status List (IETF draft-ietf-oauth-status-list): the uri of the status list token and the index of this credential within it.
StatusListResolver
Resolves a credential's revocation status from its Token Status List.
TokenResponse
The result of POST /token.

Enums

CredentialStatusKind
The four status values the Token Status List spec defines; anything else is issuer-defined ("application specific").
IssuerTrustMode
How SdJwtVc.verifyIssuer should resolve and trust the issuer's public key.

Constants

preAuthorizedCodeGrant → const String
The OpenID4VCI grant type for the pre-authorized code flow — the only grant this wallet uses.

Functions

b64uDecode(String input) → Uint8List
Decodes unpadded (or padded) base64url into bytes.
b64uDecodeToString(String input) → String
Decodes unpadded base64url into a UTF-8 string.
b64uEncode(List<int> bytes) → String
base64url without padding — the encoding JOSE/SD-JWT uses everywhere (RFC 7515 §2). These four helpers are the only place the codec lives, so the -/_ alphabet and the missing = padding are handled in exactly one spot. Encodes bytes as unpadded base64url.
b64uEncodeString(String text) → String
Encodes text (UTF-8) as unpadded base64url.
systemClock() → int
The real wall clock, truncated to whole seconds (JWT iat/exp are NumericDate, i.e. seconds).

Typedefs

Clock = int Function()
A source of the current time, in seconds since the Unix epoch.

Exceptions / Errors

CredentialError
The POST /credential exchange failed.
HttpError
A transport-level failure carrying the HTTP status when there was one.
OfferParseError
A credential offer (deep link or JSON) could not be parsed.
Oid4vcError
Every error this library throws on its own behalf is an Oid4vcError.
PresentationError
An OpenID4VP request could not be fetched/parsed, or a response could not be built/submitted.
SdJwtError
An SD-JWT VC could not be parsed, resolved, or verified.
StatusError
A credential's revocation status could not be resolved — the status list was unreachable or malformed, its signature did not verify, or the index was out of range.
TokenError
The POST /token exchange failed (bad tx_code, error response, …).