[java-idp-plugin-vci] branch main updated: Improve readability

Thu Oct 29 15:27:51 UTC 2026

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-idp-plugin-vci.

View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-vci/commit/5ba08f3daa08f1eded45ff626f5475cf204496a1

The following commit(s) were added to refs/heads/main by this push:
     new 5ba08f3  Improve readability
5ba08f3 is described below

commit 5ba08f3daa08f1eded45ff626f5475cf204496a1
Author: Janne Lauros <janne.lauros at csc.fi>
AuthorDate: Thu Oct 29 17:27:40 2026 +0200

    Improve readability
---
 README.md | 24 +++++++++++++-----------
 1 file changed, 13 insertions(+), 11 deletions(-)

diff --git a/README.md b/README.md
index a1b938a..92ced4f 100644
--- a/README.md
+++ b/README.md
@@ -4272,17 +4272,19 @@ The values of IdP attributes are strings. Convert them before they go to the lis
 `ageInYears` and `over18` stand for attributes of your own. `String()` makes a JavaScript string of
 the Java one, so that `JSON.stringify` serializes it as a string.
 
-How deep a path goes decides what a wallet can disclose:
+How deep a path goes decides what a wallet can show without the rest:
 
-| Claim | Given as | Disclosed |
+| Claim | Given as | A wallet discloses |
 |---|---|---|
-| `address` | four paths, one per member | each member on its own, `_sd` in `address` |
-| `place_of_birth` | one path, an object as the value | the object as a whole |
-| `nationalities`, `evidence` | one path, an array as the value | the array as a whole |
+| `address` | four paths, one per member | each member on its own |
+| `place_of_birth` | one path, an object as the value | all members together |
+| `nationalities`, `evidence` | one path, an array as the value | all elements together, or each element on its own with `sd`, see below |
 | `age_equal_or_over` | one path per age | each age on its own |
 
-An object that holds values you give gets an `_sd` of its own. The objects on the way to it,
-`verified_claims` here, are not selectively disclosable, a wallet always shows that they are there.
+[Disclosures for Object Properties](https://datatracker.ietf.org/doc/draft-ietf-oauth-selective-disclosure-jwt/) of SD-JWT shows
+how the claims of an object are hidden behind digests in its `_sd`. The plugin does that for every
+object that holds values you give, for `address` in this example. The objects on the path to them,
+`verified_claims` and `claims`, are always visible, only their names show, not their contents.
 
 [Disclosures for Array Elements](https://datatracker.ietf.org/doc/draft-ietf-oauth-selective-disclosure-jwt/) of SD-JWT shows
 `nationalities` with each element disclosed on its own. To issue an array like that, name it in
@@ -4420,7 +4422,7 @@ The offer is refused when a `mandatory` claim of the metadata is not in it, here
 | Date | a string, there is no date type | a string with `full-date` in `claim_types` |
 | Date and time | a string | a string or epoch seconds with `tdate` in `claim_types` |
 | Bytes | a string, a `data:` url for example | base64 or base64url with `bstr` in `claim_types` |
-| Object | a JSON object, disclosed as a whole, or a path per member, each disclosed | a JSON object or a path per member, both one element |
+| Object | a JSON object, disclosed as a whole, or a path per member, each member disclosed on its own | a JSON object or a path per member, both one element |
 | Array | a JSON array, disclosed as a whole, or element by element as in [Disclosures for Array Elements](https://datatracker.ietf.org/doc/draft-ietf-oauth-selective-disclosure-jwt/) with `sd` | a JSON array, a `claim_types` entry on it types every item |
 | Typed value inside an array | | a `claim_types` path with `null` for the array |
 | Null | not supported, refused | not supported, refused |
@@ -4431,8 +4433,8 @@ The places to configure, in order:
    the credential for everything JSON has.
 2. `claim_types` in `_issuance_configuration`, mdoc only. Dates, byte strings, and numbers and
    booleans that come as text.
-3. The depth of the paths, and `sd` for arrays. For an SD-JWT VC it decides what is disclosed on
-   its own, for an mdoc where an element ends.
+3. The depth of the paths, and `sd` for arrays. In an SD-JWT VC they decide what a wallet can
+   disclose on its own. In an mdoc the depth decides where an element ends.
 4. For a document type of a standard, the definitions of that standard. The types, the values and
    for an mDL the country of the Document Signer certificate.
 
@@ -4626,7 +4628,7 @@ Members of a `vc+sd-jwt` credential, [W3C VCDM 2.0](https://www.w3.org/TR/vc-dat
 | [`id`](https://www.w3.org/TR/vc-data-model-2.0/#identifiers) | The plugin | Not read | `urn:uuid:` and a random UUID, per credential. |
 | [`issuer`](https://www.w3.org/TR/vc-data-model-2.0/#issuer) | The plugin | Not read | The issuer identifier, see [Credential Issuer identifiers](#credential-issuer-identifiers). |
 | [`validFrom`, `validUntil`](https://www.w3.org/TR/vc-data-model-2.0/#validity-period) | The plugin | Not read | The validity window, see `lifetime` and `not_before` above. |
-| [`credentialSubject`](https://www.w3.org/TR/vc-data-model-2.0/#credential-subject) | The plugin | Not read | The claims, from the IdP attribute. Selectively disclosable. |
+| [`credentialSubject`](https://www.w3.org/TR/vc-data-model-2.0/#credential-subject) | The plugin | Not read | The claims, from the IdP attribute. A wallet discloses each value you give on its own, see [Complex claims](#complex-claims). |
 
 ### Credential Issuer identifiers
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.
