docknetwork · cykoder · Jul 24, 2026 · Jul 19, 2026 · Jul 19, 2026 · Jul 19, 2026
diff --git a/examples/CHANGELOG.md b/examples/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @docknetwork/sdk-examples
 
+## 0.22.9
+
+### Patch Changes
+
+- Updated dependencies
+  - @docknetwork/credential-sdk@0.56.2
+
 ## 0.22.8
 
 ### Patch Changes

diff --git a/examples/package.json b/examples/package.json
@@ -2,7 +2,7 @@
   "name": "@docknetwork/sdk-examples",
   "private": true,
   "type": "module",
-  "version": "0.22.8",
+  "version": "0.22.9",
   "scripts": {
     "bbs-dock-example": "babel-node ./src/bbs-dock.js",
     "claim-deduction-example": "babel-node ./src/claim-deduction.js",
@@ -18,7 +18,7 @@
     "lint": "eslint \"src/**/*.js\""
   },
   "dependencies": {
-    "@docknetwork/credential-sdk": "0.56.1",
+    "@docknetwork/credential-sdk": "0.56.2",
     "@docknetwork/cheqd-blockchain-api": "6.0.1",
     "@docknetwork/cheqd-blockchain-modules": "6.0.1"
   },

diff --git a/packages/ap2/CHANGELOG.md b/packages/ap2/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @docknetwork/ap2
 
+## 0.2.2
+
+### Patch Changes
+
+- Updated dependencies
+  - @docknetwork/crypto-utils@0.2.2
+
 ## 0.2.1
 
 ### Patch Changes

diff --git a/packages/ap2/package.json b/packages/ap2/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@docknetwork/ap2",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Basic AP2 support",
   "license": "MIT",
   "type": "module",
@@ -34,7 +34,7 @@
     "node": ">=22.0.0"
   },
   "dependencies": {
-    "@docknetwork/crypto-utils": "0.2.1",
+    "@docknetwork/crypto-utils": "0.2.2",
     "ajv": "^8.20.0"
   },
   "devDependencies": {

diff --git a/packages/credential-sdk/CHANGELOG.md b/packages/credential-sdk/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @docknetwork/credential-sdk
 
+## 0.56.2
+
+### Patch Changes
+
+- SD-JWT verification
+- Updated dependencies
+  - @docknetwork/crypto-utils@0.2.2
+
 ## 0.56.1
 
 ### Patch Changes

diff --git a/packages/credential-sdk/package.json b/packages/credential-sdk/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@docknetwork/credential-sdk",
-  "version": "0.56.1",
+  "version": "0.56.2",
   "license": "MIT",
   "type": "module",
   "files": [
@@ -43,7 +43,7 @@
   "dependencies": {
     "@astronautlabs/jsonpath": "^1.1.2",
     "@digitalcredentials/vc-status-list": "^9.0.0",
-    "@docknetwork/crypto-utils": "0.2.1",
+    "@docknetwork/crypto-utils": "0.2.2",
     "@docknetwork/crypto-wasm-ts": "^0.63.0",
     "@docknetwork/vc-delegation-engine": "1.0.4",
     "@juanelas/base64": "^1.1.5",

diff --git a/packages/credential-sdk/src/vc/status-list2021-credential.js b/packages/credential-sdk/src/vc/status-list2021-credential.js
@@ -43,7 +43,7 @@ export default class StatusList2021Credential extends VerifiableCredential {
    * To allow unrevoking indices in the future, use `statusPurpose` = `suspension`.
    * The proof will be generated immediately using supplied `keyDoc`.
    *
-   * @param {object} keyDoc - key document used to sign the credential (see `getKeyDoc`)
+   * @param {KeyDoc} keyDoc
    * @param {string} id - on-chain hex identifier for the `StatusList2021Credential`.
    * @param {object} [params={}]
    * @param {'revocation'|'suspension'} [params.statusPurpose=revocation] - `statusPurpose` of the `StatusList2021Credential`.
@@ -78,7 +78,7 @@ export default class StatusList2021Credential extends VerifiableCredential {
    * the underlying value won't be modified.
    * Throws an error if the underlying status list can't be decoded or any of the supplied indices is out of range.
    *
-   * @param {object} keyDoc - key document used to re-sign the credential (see `getKeyDoc`)
+   * @param {KeyDoc} keyDoc
    * @param {object} [update={}]
    * @param {Iterable<number>} update.revokeIndices - indices to be revoked or suspended
    * @param {Iterable<number>} update.unsuspendIndices - indices to be unsuspended

diff --git a/packages/crypto-utils/CHANGELOG.md b/packages/crypto-utils/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @docknetwork/crypto-utils
 
+## 0.2.2
+
+### Patch Changes
+
+- SD-JWT verification
+
 ## 0.2.1
 
 ### Patch Changes

diff --git a/packages/crypto-utils/README.md b/packages/crypto-utils/README.md
@@ -31,4 +31,12 @@ the 64-byte `r || s` representation required by JOSE. To verify that JOSE
 representation with a Dock ECDSA keypair, first convert it to DER with
 `joseSignatureToDER`.
 
-Subpath exports are available at `keypairs`, `types`, `utils`, and `vc`.
+Subpath exports are available at `keypairs`, `types`, `utils`, `key-utils`, and
+`vc`.
+
+## Environments
+
+Node is the default target. Browser and React Native bundlers resolve
+`@sd-jwt/crypto-nodejs` to `@sd-jwt/crypto-browser` via this package's
+`browser` / `react-native` fields. Apps still need a `Buffer` polyfill where
+the runtime does not provide one.
diff --git a/packages/crypto-utils/jest.config.js b/packages/crypto-utils/jest.config.js
@@ -6,7 +6,7 @@ export default {
     '^.+\\.(ts|js)$': ['babel-jest', { rootMode: 'upward' }],
   },
   transformIgnorePatterns: [
-    '/node_modules/(?!@stablelib|uuid)',
+    '/node_modules/(?!@stablelib|uuid|@sd-jwt|@ar-agents/ap2|jose|@noble)',
   ],
   verbose: true,
 };
diff --git a/packages/crypto-utils/package.json b/packages/crypto-utils/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@docknetwork/crypto-utils",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Lightweight Dock keypairs, crypto value types, byte utilities, and JWS helpers",
   "license": "MIT",
   "type": "module",
@@ -16,6 +16,11 @@
       "require": "./dist/cjs/index.cjs",
       "default": "./dist/esm/index.js"
     },
+    "./key-utils": {
+      "import": "./dist/esm/key-utils.js",
+      "require": "./dist/cjs/key-utils.cjs",
+      "default": "./dist/esm/key-utils.js"
+    },
     "./keypairs": {
       "import": "./dist/esm/keypairs/index.js",
       "require": "./dist/cjs/keypairs/index.cjs",
@@ -52,13 +57,24 @@
   "engines": {
     "node": ">=22.0.0"
   },
+  "browser": {
+    "@sd-jwt/crypto-nodejs": "@sd-jwt/crypto-browser"
+  },
+  "react-native": {
+    "@sd-jwt/crypto-nodejs": "@sd-jwt/crypto-browser"
+  },
   "dependencies": {
+    "@noble/hashes": "^1.8.0",
+    "@sd-jwt/crypto-browser": "^0.9.2",
+    "@sd-jwt/crypto-nodejs": "^0.9.2",
+    "@sd-jwt/sd-jwt-vc": "^0.9.2",
     "@stablelib/ed25519": "^1.0.0",
     "base64url": "^3.0.1",
     "elliptic": "6.6.1",
     "js-sha256": "^0.11.0"
   },
   "devDependencies": {
+    "@ar-agents/ap2": "^0.3.1",
     "@babel/eslint-parser": "^7.25.9",
     "@rollup/plugin-commonjs": "^28.0.1",
     "@rollup/plugin-json": "^6.1.0",
@@ -67,7 +83,8 @@
     "eslint": "^8.0.0",
     "jest": "^29.7.0",
     "rollup": "^4.28.0",
-    "rollup-plugin-multi-input": "^1.4.1"
+    "rollup-plugin-multi-input": "^1.4.1",
+    "zod": "^4.4.3"
   },
   "scripts": {
     "build": "rollup -c",

diff --git a/packages/crypto-utils/src/index.js b/packages/crypto-utils/src/index.js
@@ -1,3 +1,4 @@
+export * from './key-utils';
 export * from './keypairs';
 export * from './types';
 export * from './utils';

diff --git a/packages/crypto-utils/src/key-utils.js b/packages/crypto-utils/src/key-utils.js
@@ -0,0 +1,86 @@
+import { jwkToPublicKey } from './vc/jwk';
+import { verKeyType } from './vc/jws';
+
+/**
+ * Wraps a value in an array when it is a single non-null entry.
+ *
+ * @param {*} value
+ * @returns {Array}
+ */
+export function potentialToArray(value) {
+  if (value == null) {
+    return [];
+  }
+  return Array.isArray(value) ? value : [value];
+}
+
+/**
+ * Returns true when a document already looks like a verification key document.
+ *
+ * @param {*} document
+ * @returns {boolean}
+ */
+export function isKeyDocument(document) {
+  return Boolean(
+    document
+    && typeof document === 'object'
+    && (
+      document.publicKeyJwk
+      || document.publicKeyBase58
+      || document.publicKeyMultibase
+      || (document.publicKey && !Array.isArray(document.publicKey))
+      || typeof document.verifier === 'function'
+      || verKeyType(document) != null
+    ),
+  );
+}
+
+/**
+ * Selects a key document from a DID document by verification-method id.
+ * If `didDocument` is already a key document, it is returned as-is.
+ *
+ * @param {object} didDocument
+ * @param {string} didUrl
+ * @returns {object|null}
+ */
+export function getKeyFromDIDDocument(didDocument, didUrl) {
+  if (isKeyDocument(didDocument)) {
+    return didDocument;
+  }
+
+  const possibleKeys = [
+    ...potentialToArray(didDocument?.verificationMethod),
+    ...potentialToArray(didDocument?.keyAgreement),
+    ...potentialToArray(didDocument?.publicKey),
+  ];
+
+  return possibleKeys.find((key) => key?.id === didUrl) ?? null;
+}
+
+/**
+ * Extracts a usable verification key from a key document for a JWT algorithm.
+ * Returns LD-style keys with `.verifier()` unchanged; otherwise Dock public-key
+ * material suitable for `verifyJwtSignature`.
+ *
+ * @param {object|null|undefined} keyDocument
+ * @param {string} algorithm
+ * @returns {*|null}
+ */
+export function publicKeyFromKeyDocument(keyDocument, algorithm) {
+  if (keyDocument == null) {
+    return null;
+  }
+  if (typeof keyDocument.verifier === 'function') {
+    return keyDocument;
+  }
+  if (verKeyType(keyDocument) != null) {
+    return keyDocument;
+  }
+  if (keyDocument.publicKeyJwk) {
+    return jwkToPublicKey(keyDocument.publicKeyJwk, algorithm);
+  }
+  if (keyDocument.publicKey && !Array.isArray(keyDocument.publicKey)) {
+    return keyDocument.publicKey;
+  }
+  throw new Error('Resolved key document does not contain a usable public key');
+}
diff --git a/packages/crypto-utils/src/utils/types/bytes.js b/packages/crypto-utils/src/utils/types/bytes.js
@@ -1,4 +1,3 @@
-import crypto from 'crypto';
 import { applyToValue } from '../interfaces';
 import { ensureString } from './string';
 import { ensureIterable, isIterable } from './iterable';
@@ -204,10 +203,23 @@ export const normalizeOrConvertStringToU8a = (bytesOrString) => (typeof bytesOrS
 
 /**
  * Creates random `Uint8Array` array of supplied byte length.
+ * Uses `globalThis.crypto.getRandomValues` (Node 22+, browsers, modern RN).
  * @param {number} length
  * @returns {Uint8Array}
  */
-export const randomAsU8a = (length) => u8aToU8a(crypto.randomBytes(length));
+export const randomAsU8a = (length) => {
+  if (
+    globalThis.crypto == null
+    || typeof globalThis.crypto.getRandomValues !== 'function'
+  ) {
+    throw new Error(
+      'globalThis.crypto.getRandomValues is required for randomAsU8a',
+    );
+  }
+  const bytes = new Uint8Array(length);
+  globalThis.crypto.getRandomValues(bytes);
+  return bytes;
+};
 
 /**
  * Creates random hex string of supplied byte length.