Source: oas/oas/oas-attestation/src/vc_jose.rs. SHA-256: bc53b9e6bf836e08e39faab3f7f89f73044baba653623da2e60db6d53fa8e70a.

This source reference follows declared modules and preserves feature attributes. It includes public declarations and implementation methods in those modules. Private-module exports and trait resolution still require the compiler; not every declaration is a crate-root import. Function bodies and constant values are omitted. Source comments describe their implementation context and are not a production deployment claim.

vc_jose::JWT_VC_TYP

JWT-VC media type per W3C VC-JOSE-COSE.

pub const JWT_VC_TYP: &str;

Source line: 92.

vc_jose::VC_CLAIM

JWT-VC payload claim name carrying the OAS credential body.

pub const VC_CLAIM: &str;

Source line: 95.

vc_jose::JwtVcHeader

JOSE header for a JWT-VC compact serialization.

#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct JwtVcHeader {
/// Algorithm identifier (matches the [`Signer::algorithm`] used).

pub alg: String,
/// Media type — fixed to `"vc+jwt"`.

pub typ: String,
/// Verification method ID (the `did:oas:...#key-id` of the issuer key).

pub kid: String
}

Source line: 103.

vc_jose::JwtVcHeader::new

Constructs the canonical header for a given algorithm and verification method ID.

pub fn new(alg: impl Into<String>, kid: impl Into<String>) -> Self;

Source line: 115.

vc_jose::JwtVcPayload

JWT-VC payload — JWT registered claims plus the vc claim carrying the OAS credential body.

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct JwtVcPayload {
/// Issuer DID (RFC 7519 §4.1.1).

pub iss: String,
/// Subject DID (RFC 7519 §4.1.2).

pub sub: String,
/// "Not before" — Unix seconds, derived from credential issuance date.

/// (RFC 7519 §4.1.5).

#[serde(skip_serializing_if = "Option::is_none")]
pub nbf: Option<i64>,
/// JWT ID (RFC 7519 §4.1.7).

#[serde(skip_serializing_if = "Option::is_none")]
pub jti: Option<String>,
/// Holder confirmation key per RFC 7800 (`cnf.jwk`).

#[serde(skip_serializing_if = "Option::is_none")]
pub cnf: Option<serde_json::Value>,
/// The OAS credential body (without its native Ed25519Signature2020

/// proof — the JWT signature replaces it).

pub vc: serde_json::Value
}

Source line: 131.

vc_jose::JwtVcSignOptions

Caller-supplied options for [sign_credential_jwt_vc].

#[derive(Debug, Clone)]
pub struct JwtVcSignOptions {
/// Full verification method ID

/// (e.g., `"did:oas:test:hmr:auditor#key-1"`).

pub verification_method_id: String,
/// Optional explicit `nbf` claim (Unix seconds). If `None`, the function

/// attempts to parse the credential's `issuanceDate` (ISO 8601) and

/// converts it to Unix seconds. If parsing fails, `nbf` is omitted.

pub issuance_unix_seconds: Option<i64>,
/// Optional JWT ID. If `None`, no `jti` claim is emitted.

pub jwt_id: Option<String>,
/// Optional holder confirmation key per RFC 7800. If supplied, embedded

/// under `payload.cnf.jwk`. Used by verifiers to enforce the §14.5.1

/// holder binding rule for authority-bearing credentials presented over

/// JWT-VC.

pub holder_public_key_jwk: Option<serde_json::Value>
}

Source line: 157.

vc_jose::JwtVc

A parsed JWT-VC ready for inspection.

Returned by [verify_jwt_vc] (after the signature has been validated) and by [parse_jwt_vc] (without verification — for inspection only).

#[derive(Debug, Clone)]
pub struct JwtVc {

}

Source line: 186.

vc_jose::JwtVc::header

Returns the JOSE header.

pub fn header(&self) -> &JwtVcHeader;

Source line: 195.

vc_jose::JwtVc::payload

Returns the JWT payload.

pub fn payload(&self) -> &JwtVcPayload;

Source line: 200.

vc_jose::JwtVc::as_compact_string

Returns the compact serialization (header.payload.signature).

pub fn as_compact_string(&self) -> &str;

Source line: 205.

vc_jose::JwtVc::issuer

Returns the issuer DID from the payload.

pub fn issuer(&self) -> &str;

Source line: 210.

vc_jose::JwtVc::subject

Returns the subject DID from the payload.

pub fn subject(&self) -> &str;

Source line: 215.

vc_jose::JwtVc::algorithm

Returns the algorithm identifier from the JOSE header.

pub fn algorithm(&self) -> &str;

Source line: 220.

vc_jose::JwtVc::verification_method_id

Returns the verification method ID (kid) from the JOSE header.

pub fn verification_method_id(&self) -> &str;

Source line: 225.

vc_jose::JwtVc::holder_confirmation_key

Returns the holder confirmation key (cnf.jwk) per RFC 7800, if the credential was signed with one.

pub fn holder_confirmation_key(&self) -> Option<&serde_json::Value>;

Source line: 231.

vc_jose::JwtVc::to_credential

Reconstructs the original [OasCredential] body from the vc claim.

The reconstructed credential will not carry an Ed25519Signature2020 proof — the JWT signature replaces it. Verifying this credential structurally (via [OasCredential::validate]) will succeed; verifying it cryptographically via [crate::verify::verify_credential] will fail because there is no proof field. Use [verify_jwt_vc] for cryptographic verification of JWT-VC credentials.

pub fn to_credential(&self) -> Result<OasCredential, AttestationError>;

Source line: 244.

vc_jose::JwtVc::format_id

Returns the registered OAS proof format identifier this JWT-VC represents.

pub const fn format_id() -> ProofFormatId;

Source line: 251.

vc_jose::JwtVc::format_url

Returns the canonical OAS format identifier URL for this format.

pub const fn format_url() -> &'static str;

Source line: 256.

vc_jose::sign_credential_jwt_vc

Signs an [OasCredential] as a JWT-VC compact string per OAS Spec §14.4.

The credential's existing proof (if any) is stripped before encoding — the JWT signature replaces it. The result is a [JwtVc] wrapping the compact serialization, the parsed header, and the parsed payload.

Arguments

• credential - The credential to sign.
• signer - Any [Signer] implementation. The signer's algorithm() is used as the alg JOSE header value.
• options - Sign options (verification method ID, optional nbf jti / cnf claims).

Errors

Returns [AttestationError] on JSON serialization or signing failure.

pub fn sign_credential_jwt_vc(
    credential: &OasCredential,
    signer: &dyn Signer,
    options: &JwtVcSignOptions,
) -> Result<JwtVc, AttestationError>;

Source line: 307.

vc_jose::parse_jwt_vc

Parses a JWT-VC compact string without verifying its signature.

Returns a [JwtVc] for inspection. Do not trust any field returned by this function until [verify_jwt_vc] has succeeded against a known issuer public key.

pub fn parse_jwt_vc(compact: &str) -> Result<JwtVc, AttestationError>;

Source line: 370.

vc_jose::verify_jwt_vc

Verifies a JWT-VC compact string against a known issuer [Verifier].

Per OAS Spec §14.4:

1. Parses the three-segment compact form.
2. Validates the JOSE header type and decodes the payload.
3. Decodes the base64url signature.
4. Routes the signature to the supplied verifier — the verifier's algorithm() MUST match the JOSE header alg, otherwise this function rejects with InvalidProofSignature.
5. Re-derives the signing input (base64url(header).base64url(payload)) and verifies the signature against the verifier's public key.

On success, returns the parsed [JwtVc] with all claims accessible.

Errors

• [AttestationError::InvalidProofSignature] on any structural, parsing, algorithm-mismatch, or cryptographic failure.

pub fn verify_jwt_vc(compact: &str, verifier: &dyn Verifier) -> Result<JwtVc, AttestationError>;

Source line: 422.