//! SD-JWT VC issuance, selective-disclosure presentation, and verification with
//! ES256 holder-key binding.
//!
//! This crate is the cryptographic envelope for [`aerocred-protocol`] claims:
//! it turns a set of claims into a signed, selectively-disclosable credential, a
//! credential into a key-bound presentation that reveals only what a verifier
//! asked for, and a presentation back into verified claims.
//!
//! It is deliberately authority- and schema-agnostic — it signs and checks
//! arbitrary JSON claims, so the same code carries any regulator's vocabulary.
//! Three properties it enforces map straight onto the constitution:
//!
//! - **Selective disclosure.** Claims listed in `_sd` are committed by salted
//!   digest; only the disclosures a holder forwards are revealed (I8).
//! - **Holder-key binding.** A presentation carries a key-binding JWT proving
//!   control of the `cnf` key over this exact request — bound to the verifier
//!   and a nonce, so it cannot be replayed (I5).
//! - **No issuer callback.** Verification needs only the issuer's public key;
//!   the issuer is never contacted (I4).
//!
//! Only ES256 over P-256 is used, matching Apple's Secure Enclave and common
//! WebAuthn authenticators, so which authenticator minted the holder key is
//! invisible to the credential model.
//!
//! **Experimental, and not affiliated with, endorsed by, or representing any
//! aviation authority, government, or vendor.**
//!
//! [`aerocred-protocol`]: https://docs.rs/aerocred-protocol

mod base64url;
mod disclosure;
mod error;
mod issue;
mod jwk;
mod jws;
mod key;
mod present;
mod verify;

pub use error::Error;
pub use issue::{IssuedSdJwt, IssuerParams, SD_JWT_VC_TYP, issue};
pub use jwk::Jwk;
pub use key::SigningKey;
pub use present::{KEY_BINDING_TYP, Presentation, PresentationParams, present};
pub use verify::{VerifiedCredential, VerifyParams, verify};

/// An ES256 public key, re-exported so verifiers can name the issuer key type
/// without depending on `p256` directly.
pub use p256::ecdsa::VerifyingKey;
