Advanced SDK Features

import {
  createSdJwt,
  createPresentation,
  verifySdJwt,
} from '@beltic/sdk';

// Create SD-JWT with selectively disclosable claims
const sdJwt = await createSdJwt(credential, privateKey, {
  alg: 'EdDSA',
  issuerDid: 'did:web:beltic.com',
  subjectDid: 'did:web:developer.example.com',
  disclosablePaths: [
    '/legalName',
    '/incorporationJurisdiction',
    '/kybTier',
  ],
});

// Create presentation with selected disclosures
const presentation = createPresentation(sdJwt, [
  '/kybTier',  // Only disclose KYB tier
]);

// Verify SD-JWT presentation
const result = await verifySdJwt(presentation, {
  keyResolver: async (header) => publicKey,
});

console.log(result.disclosedClaims);  // Only contains kybTier

import {
  InMemoryJtiStore,
  checkReplay,
  ReplayDetectedError,
} from '@beltic/sdk';

// Create JTI store (use Redis/database in production)
const jtiStore = new InMemoryJtiStore(300); // 5 min TTL

// Check for replay before processing
async function processToken(token: string) {
  const decoded = decodeToken(token);
  const jti = decoded.payload.jti;
  const exp = decoded.payload.exp;
  
  try {
    await checkReplay(jtiStore, jti, exp);
    // Process token...
  } catch (error) {
    if (error instanceof ReplayDetectedError) {
      console.error(`Replay attack detected: ${error.jti}`);
      throw error;
    }
    throw error;
  }
}

// With middleware
import { createReplayMiddleware } from '@beltic/sdk';

const replayMiddleware = createReplayMiddleware(jtiStore);

app.use('/api/verify', replayMiddleware);

import {
  computeContentHash,
  verifyContentHash,
  createHashClaim,
  verifyHashClaim,
} from '@beltic/sdk';

// Compute hash of content
const content = Buffer.from(JSON.stringify(credential));
const hash = computeContentHash(content, 'sha-256');

// Verify hash
const isValid = verifyContentHash(content, hash, 'sha-256');

// Create hash claim for embedding in credentials
const hashClaim = createHashClaim(content, 'sha-256');
// { algorithm: "sha-256", hash: "base64url-encoded-hash" }

// Verify hash claim
const claimValid = verifyHashClaim(content, hashClaim);

import {
  CredentialChain,
  verifyChainIntegrity,
} from '@beltic/sdk';

// Create a new chain
const chain = new CredentialChain();

// Add credentials to chain
const entry1 = chain.add(credential1, token1);
const entry2 = chain.add(credential2, token2);
const entry3 = chain.add(credential3, token3);

// Each entry has:
// - credentialHash: hash of the credential
// - previousHash: hash of previous entry (null for first)
// - chainHash: combined hash linking to previous

// Get proof for audit
const proof = chain.getProof();

// Verify chain integrity
const isIntact = chain.verify();

// Verify from serialized entries
const entries = [...]; // Load from database
const valid = verifyChainIntegrity(entries);

import {
  MultiSigCredential,
  addSignature,
  verifyMultiSignatures,
} from '@beltic/sdk';

// Create multi-sig credential
const multiSig = new MultiSigCredential(credential);

// Add signatures from multiple parties
await multiSig.addSignature(issuerPrivateKey, 'issuer', {
  alg: 'EdDSA',
  issuerDid: 'did:web:beltic.com',
  subjectDid: 'did:web:developer.example.com',
});

await multiSig.addSignature(auditorPrivateKey, 'auditor', {
  alg: 'EdDSA',
  issuerDid: 'did:web:auditor.example.com',
  subjectDid: 'did:web:developer.example.com',
});

// Get all signatures
const signatures = multiSig.getSignatures();
// [{ signerId: 'issuer', ... }, { signerId: 'auditor', ... }]

// Verify all signatures
const result = await multiSig.verifyAll(async (signerId) => {
  // Return public key for each signer
  if (signerId === 'issuer') return issuerPublicKey;
  if (signerId === 'auditor') return auditorPublicKey;
  throw new Error(`Unknown signer: ${signerId}`);
});

console.log(result.allValid);  // true if all signatures valid
console.log(result.results);   // Per-signature results

import {
  AuditLogger,
  AuditEventType,
  ConsoleAuditHandler,
  InMemoryAuditHandler,
  getAuditLogger,
  setAuditLogger,
} from '@beltic/sdk';

// Create logger with handlers
const logger = new AuditLogger();
logger.addHandler(new ConsoleAuditHandler());

const memoryHandler = new InMemoryAuditHandler();
logger.addHandler(memoryHandler);

// Set as global logger
setAuditLogger(logger);

// Log events manually
logger.log({
  type: AuditEventType.CREDENTIAL_VERIFIED,
  timestamp: new Date(),
  credentialId: 'abc-123',
  action: 'verify',
  actor: 'did:web:verifier.example.com',
  details: { algorithm: 'EdDSA' },
});

// Access in-memory events
console.log(memoryHandler.events);

// SDK operations auto-log when logger is set
const verified = await verifyCredential(token, options);
// Automatically logs CREDENTIAL_VERIFIED event

import {
  LocalSigner,
  AwsKmsSigner,
  signWithSigner,
} from '@beltic/sdk';

// Local signer (for development)
const localSigner = new LocalSigner(privateKey, 'EdDSA');

// AWS KMS signer (for production)
const kmsSigner = new AwsKmsSigner({
  keyId: 'arn:aws:kms:us-east-1:123456789:key/abc-123',
  region: 'us-east-1',
  algorithm: 'ECDSA_SHA_256',  // ES256
});

// Sign with any signer
const signature = await signWithSigner(kmsSigner, data);

// Get signer info
const info = kmsSigner.getInfo();
console.log(info.algorithm);  // 'ES256'
console.log(info.keyId);      // KMS key ARN

import {
  canonicalize,
  canonicalizeToString,
  computeCanonicalHash,
} from '@beltic/sdk';

// Canonicalize JSON object
const obj = { b: 2, a: 1 };
const canonical = canonicalizeToString(obj);
// '{"a":1,"b":2}'  // Keys sorted, no extra whitespace

// Compute hash of canonical form
const hash = computeCanonicalHash(credential, 'sha-256');