@vess-id/ai-identity 0.0.0-dev-20260902121045

package/dist/utils/sdjwt-client.d.ts

@@ -0,0 +1,415 @@
+import { SDJwtVcInstance } from '@sd-jwt/sd-jwt-vc';
+import { KeyManager } from '../did/key-manager';
+import type { DisclosureFrame } from '@sd-jwt/types';
+import type { JWK } from 'jose';
+export declare class SDJwtClient {
+    /**
+     * 🔴 Keyed by DID **and** by the identity of the key that was resolved.
+     *
+     * The instance holds a signer built from a private key the KeyManager
+     * handed over, so two stores holding *different* keys for one DID must not
+     * share an instance. Keying on the DID alone returned whichever one was
+     * built first — and since `setKeyManager` replaces a static field,
+     * constructing a second VPManager silently repointed every later lookup at
+     * a store that did not have the key. Measured: an agent that generated its
+     * DID through one manager could not present with another, failing as
+     * `Private key not found for holder` with the key sitting in the first
+     * manager's store the whole time.
+     *
+     * 🔴 The discriminator is the KEY, not the KeyManager object. Keying on
+     * object identity (a WeakMap-assigned `km0`/`km1`/…) fixed the mix-up and
+     * broke two other things, because the api builds a throwaway KeyManager
+     * per request — `new APIVCManager(new KeyManager(ephemeral))` at
+     * grant/services/remote-vc-issuer.service.ts:2234, which runs on every
+     * tool-invoke auto-issue, plus five more sites:
+     *
+     *   1. Same key material, new object, new id — so a long-lived issuer
+     *      (user/services/sdjwt-credential.service.ts:69) could not read back
+     *      its own warm entry once a per-request manager had replaced the
+     *      static. It failed outright rather than falling back. Measured:
+     *      `{"resolved":false,"msg":"Private key not found for issuer: … km1"}`
+     *      where the DID-only key gave `{"resolved":true}` — by accident, by
+     *      returning the wrong signer on a cache hit.
+     *
+     *   2. Entries accumulated without bound. `keyManagerIds` is a WeakMap, so
+     *      a collected manager releases its id — but the Map entry keyed by
+     *      that id string stays, and a signer closes over a DECRYPTED PRIVATE
+     *      KEY. Nothing in the api calls `clearIssuerCache`. Measured over 25
+     *      issuances of one DID: `{"instanceCount":25,"signerCount":25}` where
+     *      the DID-only key gave 1.
+     *
+     * A thumbprint (RFC 7638) is the right granularity for both: same key ⇒
+     * same entry whoever holds it, different key ⇒ different entry. It is
+     * computed over the public members only (`crv`/`kty`/`x`/`y` — `d`, `kid`
+     * and `alg` are excluded by the spec), which is what makes two stores
+     * holding the same keypair agree. Two *different* private keys sharing a
+     * public half is not a case that exists for a valid EC pair, so nothing is
+     * conflated that should not be. Measured at ~1.7µs per call, against an
+     * ECDSA signature that follows it.
+     */
+    private static instances;
+    /**
+     * 🔴 Only ever read as a fallback — when a call arrives without a KeyManager.
+     *
+     * `VCManager`, `VPManager` and `APIVCManager` used to assign it in their
+     * constructors. They no longer do — every one of them passes its own
+     * KeyManager to each call — so within the SDK this field holds whatever an
+     * external consumer set via the deprecated {@link setKeyManager}, and
+     * otherwise a default `new KeyManager()` that {@link resolveKey} creates the
+     * first time it actually has to fall back. Nothing else writes it, and a
+     * call that carries its own store never causes that default to exist.
+     *
+     * It stays because `SDJwtClient` is a public export and a consumer pairing
+     * `setKeyManager` with {@link getSDJwtInstance} would otherwise break on a
+     * minor release. Removal belongs to the next major.
+     */
+    private static keyManager;
+    private static signerCache;
+    private static verifierCache;
+    /**
+     * A stable identifier for the key itself, shared by every store holding it.
+     *
+     * 🔴 Falls back to a per-call unique value rather than to a constant when
+     * the thumbprint cannot be computed. A constant would make two unrelated
+     * malformed keys collide on one cache entry, which is the mix-up this whole
+     * scheme exists to prevent — the safe direction of failure is "cache
+     * nothing", never "share an entry". In practice this is unreachable for a
+     * key that got through `getKey`; it is here so a future JWK shape degrades
+     * into a slow path instead of a wrong one.
+     */
+    private static keyId;
+    private static nextFallbackKeyId;
+    /**
+     * 🔴 Cache keys are built here and nowhere else.
+     *
+     * Three maps, three key shapes. When they were assembled inline at each
+     * call site, `clearIssuerCache` wrote its own third version from memory and
+     * matched only one of them: it deleted `issuerDid` where the instance was
+     * stored as `${did}:issuer:${kmId}`, and `signer:${did}` where the signer
+     * was stored as `signer:${did}:${kmId}`. Measured before the fix — one
+     * issuer cached, then cleared:
+     *
+     *   BEFORE {"instanceCount":1,"signerCount":1,"verifierCount":1}
+     *   AFTER  {"instanceCount":1,"signerCount":1,"verifierCount":0}
+     *
+     * The signer closes over a decrypted private key, so the two that survived
+     * were the two that mattered. Keeping writers and the eraser on one
+     * definition is what stops that from drifting apart again.
+     */
+    private static instanceKey;
+    private static signerKey;
+    /**
+     * The part of a key that identifies the DID, up to and including the
+     * delimiter before the key-identity segment.
+     *
+     * 🔴 `clearIssuerCache` matches on these rather than rebuilding prefixes of
+     * its own — writing the shape a second time is the mistake being fixed. The
+     * trailing `:` is load-bearing: matching a bare DID would make
+     * `did:key:abc` also evict `did:key:abcd`.
+     */
+    private static instancePrefix;
+    private static signerPrefix;
+    /**
+     * 🔴 Carries the key identity too, symmetrically with {@link signerKey}.
+     *
+     * It used to be keyed by DID alone, on the reasoning that "a verifier is
+     * built from the public half, which is the same value no matter which store
+     * the private key came out of". That holds for the case the caches were
+     * built for — one keypair, several stores — and fails for the exact case
+     * the key segment exists to separate: two stores holding *different* keys
+     * under one DID. There the second caller reused the first's verifier and so
+     * checked signatures against a public key that was not its own.
+     *
+     * Costs nothing now that the segment is the key's own thumbprint rather
+     * than a per-object id: the same keypair still yields one entry however
+     * many managers hold it, which is what the old comment actually wanted.
+     */
+    private static verifierKey;
+    private static verifierPrefix;
+    private constructor();
+    /**
+     * Initialize with KeyManager for DID-based key management
+     *
+     * @deprecated Pass the KeyManager to the call instead:
+     * {@link getIssuerInstance}`(did, keyManager)`,
+     * {@link getHolderInstance}`(did, keyManager)`, {@link issueSDJWT} and
+     * {@link verifySDJWT} all take one. This setter writes a **static** field,
+     * so every manager an application constructs repoints key resolution for
+     * every other one — construction order decides which store is searched.
+     *
+     * 🔴 Not a style preference; it caused a production failure. A long-lived
+     * issuer and a per-request `new APIVCManager(new KeyManager(ephemeral))`
+     * coexist in the api, and whichever ran last won: the long-lived one then
+     * signed with a store that was not its own or failed outright with
+     * `Private key not found for issuer: …`. See PR #1441.
+     *
+     * Retained for external SDK consumers that pair it with
+     * {@link getSDJwtInstance}; scheduled for removal in the next major.
+     */
+    static setKeyManager(keyManager: KeyManager): void;
+    /**
+     * Get SDJwtVcInstance for issuer role (VC issuance)
+     */
+    static getIssuerInstance(issuerDid: string, keyManager?: KeyManager): Promise<SDJwtVcInstance>;
+    /**
+     * Get SDJwtVcInstance for holder role (VP presentation)
+     */
+    static getHolderInstance(holderDid: string, keyManager?: KeyManager): Promise<SDJwtVcInstance>;
+    /**
+     * Resolve the key, then look in the cache — in that order.
+     *
+     * 🔴 The order is the fix, not an implementation detail. The cache key
+     * names the key that was resolved, so it cannot be built before resolving,
+     * and the store must therefore be consulted on a hit as well as a miss.
+     * That is what makes a warm entry reachable from any manager holding the
+     * same key: with the KeyManager object in the key, the caller whose store
+     * DID hold the key looked under a name nobody had written to and got
+     * `Private key not found` — the store had it the whole time.
+     *
+     * The extra work on a hit is one `getKey` (an in-memory or DB read the
+     * caller would owe anyway on a miss) plus a ~1.7µs thumbprint. What is
+     * saved is the SDJwtVcInstance and, more to the point, re-importing the
+     * key material into a signer.
+     */
+    private static getInstance;
+    /**
+     * Fetch the DID's private key from the given store (or the static one) and
+     * derive the identity the caches key on.
+     */
+    private static resolveKey;
+    /**
+     * Get SDJwtVcInstance with specified role (backward compatibility)
+     *
+     * @deprecated Call {@link getIssuerInstance}`(did, keyManager)` or
+     * {@link getHolderInstance}`(did, keyManager)` directly — this wrapper adds
+     * nothing but the role switch, and the role is known at every call site.
+     *
+     * 🔴 `keyManager` was added here because omitting it was the defect: with no
+     * way to name a store, every caller of this wrapper fell through to the
+     * static field and so was the one path that could not benefit from the
+     * PR #1441 fix. Callers that still omit it keep the old static behaviour, so
+     * existing external code is unaffected.
+     */
+    static getSDJwtInstance(did: string, options?: {
+        role?: 'issuer' | 'holder';
+        keyManager?: KeyManager;
+    }): Promise<SDJwtVcInstance>;
+    /**
+     * Create a new SDJwtVcInstance with DID-based keys and role
+     */
+    private static createInstance;
+    /**
+     * Claims that MUST NOT be selectively disclosable.
+     *
+     * - cnf: Proof of Possession binding (RFC 7800). If disclosable, Holder can
+     *   hide cnf to bypass PoP verification and transfer VC to another party.
+     * - Standard JWT registered claims (iss, sub, exp, iat, nbf, jti) must
+     *   always be visible for signature verification and expiry checks.
+     * - vct: SD-JWT VC credential type discriminator.
+     */
+    private static readonly NEVER_DISCLOSE;
+    /**
+     * Claims that decide whether an action is PERMITTED, and so must not be
+     * withholdable by the party they constrain.
+     *
+     * 🔴 Separate from NEVER_DISCLOSE on purpose. That set is about structural
+     * integrity — hide `cnf` and Proof of Possession cannot be checked at all.
+     * This set is about authorisation: these fields are readable, they simply
+     * must not be OPTIONAL, because SD-JWT makes an undisclosed field
+     * physically absent rather than merely hidden. A holder who omits the
+     * disclosure presents a credential with no constraints on it.
+     *
+     * The harm is not theoretical. Gate-2 permits when the delegate list is
+     * empty (tool-executor.service.ts) — deliberate backward compatibility for
+     * two credential shapes that genuinely carry no `delegates` — and a
+     * withheld disclosure lands in that same branch. Cedar Gate-1 backstops
+     * high-risk actions, but only where the Cedar default policy is
+     * bootstrapped; that early return's own comment records that a non-Cedar
+     * deployment's flat-permission fallback does not risk-gate, making the
+     * withholding an unconditional allow there.
+     *
+     * 🔴 Enforced here rather than by curating each caller's field list. Four
+     * issuance paths pass their own arrays — remote-vc-issuer.service.ts,
+     * user/services/sdjwt-credential.service.ts (a hardcoded switch that
+     * duplicates the SDK config), sdk/src/vc/api-vc-manager.ts, and
+     * oauth.service.ts in two places — so fixing one leaves three standing,
+     * and a fifth added later would inherit the defect. This function is the
+     * single point all of them flow through.
+     *
+     * It is also the only place that can stop the NESTED case: the recursion
+     * below passes every key of a nested object as disclosable regardless of
+     * what was requested, which no call-site list can reach.
+     *
+     * What is NOT here: `approval` and `intent_description`. Those are
+     * selective for privacy — an approver's identity, free text — and no gate
+     * reads them to decide anything. The line being drawn is "authorisation
+     * input", not "sensitive".
+     *
+     * Field-by-field, with where each is read:
+     * - delegates:     carries actions/effect/resource (tool-auth.service.ts)
+     * - actions:       what a delegate may do
+     * - tool:          prefixes bare actions into the permission string that
+     *                  gates the decision; withheld, `message.post` is emitted
+     *                  instead of `slack.message.post` — a different string
+     * - resourceScope: gates the scope match (tool-manager.ts)
+     * - permissions:   the flat-permission path (tool-auth.service.ts)
+     * - effect:        whether a delegate rule allows or denies
+     * - resource:      what a rule applies to
+     */
+    private static readonly NEVER_SELECTIVE;
+    /**
+     * Create disclosure frame for selective disclosure
+     */
+    static createDisclosureFrame<T extends Record<string, any>>(claims: T, selectivelyDisclosable?: string[]): DisclosureFrame<T>;
+    /**
+     * Issue an SD-JWT with selective disclosure
+     */
+    static issueSDJWT(payload: Record<string, any>, _privateKey: any, // Not used since we get key from KeyManager based on issuer DID
+    selectiveDisclosureFields?: string[], keyManager?: KeyManager): Promise<string>;
+    /**
+     * Verify an SD-JWT
+     */
+    static verifySDJWT(credential: string, keyManager?: KeyManager): Promise<{
+        valid: boolean;
+        payload?: any;
+        error?: string;
+    }>;
+    /**
+     * Legacy methods for backward compatibility
+     */
+    static createSignerVerifier(): Promise<{
+        signer: (data: string) => Promise<string>;
+        verifier: (data: string, signatureBase64url: string) => Promise<boolean>;
+    }>;
+    static generateKeyPair(): Promise<import("./crypto").KeyPair>;
+    /**
+     * Clear caches for optimization
+     */
+    static clearCaches(): void;
+    /**
+     * Drop every cache entry holding key material for one DID.
+     *
+     * 🔴 Scans rather than deletes by exact key, because the caller cannot
+     * build the exact keys. Both the instance and signer keys carry a
+     * `keyManagerId`, which is private and WeakMap-derived, and this method
+     * takes only a DID. The same DID legitimately has one entry per KeyManager
+     * that ever resolved it, so anything short of "all of them" leaves a live
+     * signer — and a signer closes over a decrypted private key. The maps hold
+     * a handful of entries; a linear pass is not worth optimizing away.
+     *
+     * 🔴 Clears the holder instance too, despite the `Issuer` in the name.
+     * The unit being freed is the DID's key material, not a role: a holder
+     * instance is constructed with `kbSigner` set to the very same signer
+     * object as the issuer's, so evicting the signer while leaving the holder
+     * instance cached would keep the decrypted key reachable through the map
+     * we claimed to have cleaned. Roles are not separable here; the DID is the
+     * only safe granularity.
+     *
+     * 🔴 Matches on a delimiter, not a bare prefix. `did:key:abc` and
+     * `did:key:abcd` are different DIDs, and `startsWith(did)` would take the
+     * second one down with the first.
+     */
+    static clearIssuerCache(issuerDid: string): void;
+    /**
+     * Get cache statistics
+     */
+    static getCacheStats(): {
+        instanceCount: number;
+        signerCount: number;
+        verifierCount: number;
+    };
+    /**
+     * Create a verifier function from an external public key
+     * This is used for verifying SD-JWTs when you don't have the private key
+     * (e.g., API side verifying credentials issued by MCP)
+     */
+    private static getVerifierFromPublicKey;
+    /**
+     * Get SDJwtVcInstance for verification with an external public key
+     * Used when verifying credentials without having the issuer's private key
+     */
+    private static getVerificationInstance;
+    /**
+     * Get SDJwtVcInstance for decoding without verification
+     */
+    private static getDecodingInstance;
+    /**
+     * Verify an SD-JWT with an external public key
+     * Use this when you have the issuer's public key but not their private key
+     *
+     * @param credential - The SD-JWT credential string
+     * @param publicKey - The issuer's public key (JWK format)
+     * @returns Verification result with valid flag and payload
+     *
+     * @example
+     * ```typescript
+     * const publicKey = extractPublicKeyFromDid(issuerDid)
+     * const result = await SDJwtClient.verifyWithExternalKey(credential, publicKey)
+     * if (result.valid) {
+     *   console.log('Verified claims:', result.payload.claims)
+     * }
+     * ```
+     */
+    static verifyWithExternalKey(credential: string, publicKey: JWK): Promise<{
+        valid: boolean;
+        payload?: any;
+        claims?: any;
+        error?: string;
+    }>;
+    /**
+     * Verify an SD-JWT by extracting the issuer's public key from the DID
+     * Automatically resolves did:jwk DIDs
+     *
+     * @param credential - The SD-JWT credential string
+     * @returns Verification result with valid flag and payload
+     *
+     * @example
+     * ```typescript
+     * const result = await SDJwtClient.verifyWithIssuerDid(credential)
+     * if (result.valid) {
+     *   console.log('Issuer:', result.payload.iss)
+     * }
+     * ```
+     */
+    static verifyWithIssuerDid(credential: string): Promise<{
+        valid: boolean;
+        payload?: any;
+        claims?: any;
+        issuerDid?: string;
+        error?: string;
+    }>;
+    /**
+     * Decode an SD-JWT without verification
+     * Use this when you need to inspect the credential before verification
+     * or when you don't have the issuer's public key
+     *
+     * WARNING: The returned payload has not been verified!
+     * Only use this for inspection purposes, not for authorization decisions.
+     *
+     * @param credential - The SD-JWT credential string
+     * @returns Decoded JWT payload, header, and disclosures
+     *
+     * @example
+     * ```typescript
+     * const decoded = await SDJwtClient.decodeWithoutVerification(credential)
+     * console.log('Issuer (unverified):', decoded.payload?.iss)
+     * console.log('Disclosures:', decoded.disclosures?.length)
+     * ```
+     */
+    static decodeWithoutVerification(credential: string): Promise<{
+        payload?: any;
+        header?: any;
+        disclosures?: any[];
+        claims?: any;
+        error?: string;
+    }>;
+    /**
+     * Extract issuer DID from an SD-JWT without verification
+     * Useful for determining the issuer before verification
+     *
+     * @param credential - The SD-JWT credential string
+     * @returns The issuer DID or null if not found
+     */
+    static extractIssuerDid(credential: string): string | null;
+}
+//# sourceMappingURL=sdjwt-client.d.ts.map

package/dist/utils/sdjwt-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdjwt-client.d.ts","sourceRoot":"","sources":["../../src/utils/sdjwt-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAGnD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAE/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AACpD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAA;AAI/B,qBAAa,WAAW;IACtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;IACH,OAAO,CAAC,MAAM,CAAC,SAAS,CAA0C;IAElE;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,MAAM,CAAC,UAAU,CAAY;IACrC,OAAO,CAAC,MAAM,CAAC,WAAW,CAA8B;IACxD,OAAO,CAAC,MAAM,CAAC,aAAa,CAA8B;IAE1D;;;;;;;;;;OAUG;mBACkB,KAAK;IAQ1B,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAI;IAEpC;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,MAAM,CAAC,WAAW;IAI1B,OAAO,CAAC,MAAM,CAAC,SAAS;IAIxB;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAM,CAAC,cAAc;IAI7B,OAAO,CAAC,MAAM,CAAC,YAAY;IAI3B;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,MAAM,CAAC,WAAW;IAI1B,OAAO,CAAC,MAAM,CAAC,cAAc;IAI7B,OAAO;IAEP;;;;;;;;;;;;;;;;;;OAkBG;WACW,aAAa,CAAC,UAAU,EAAE,UAAU;IAIlD;;OAEG;WACiB,iBAAiB,CACnC,SAAS,EAAE,MAAM,EACjB,UAAU,CAAC,EAAE,UAAU,GACtB,OAAO,CAAC,eAAe,CAAC;IAI3B;;OAEG;WACiB,iBAAiB,CACnC,SAAS,EAAE,MAAM,EACjB,UAAU,CAAC,EAAE,UAAU,GACtB,OAAO,CAAC,eAAe,CAAC;IAI3B;;;;;;;;;;;;;;;OAeG;mBACkB,WAAW;IAchC;;;OAGG;mBACkB,UAAU;IAwC/B;;;;;;;;;;;;OAYG;WACiB,gBAAgB,CAClC,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAAC,UAAU,CAAC,EAAE,UAAU,CAAA;KAAE,GAChE,OAAO,CAAC,eAAe,CAAC;IAO3B;;OAEG;mBACkB,cAAc;IA2DnC;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CASpC;IAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+CG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAoBrC;IAEF;;OAEG;WACW,qBAAqB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/D,MAAM,EAAE,CAAC,EACT,sBAAsB,GAAE,MAAM,EAAO,GACpC,eAAe,CAAC,CAAC,CAAC;IAmErB;;OAEG;WACiB,UAAU,CAC5B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC5B,WAAW,EAAE,GAAG,EAAE,gEAAgE;IAClF,yBAAyB,GAAE,MAAM,EAAO,EACxC,UAAU,CAAC,EAAE,UAAU,GACtB,OAAO,CAAC,MAAM,CAAC;IAgBlB;;OAEG;WACiB,WAAW,CAC7B,UAAU,EAAE,MAAM,EAClB,UAAU,CAAC,EAAE,UAAU,GACtB,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,GAAG,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA0C7D;;OAEG;WACiB,oBAAoB;;;;WAQpB,eAAe;IAInC;;OAEG;WACW,WAAW,IAAI,IAAI;IAMjC;;;;;;;;;;;;;;;;;;;;;;OAsBG;WACW,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAwBvD;;OAEG;WACW,aAAa,IAAI;QAC7B,aAAa,EAAE,MAAM,CAAA;QACrB,WAAW,EAAE,MAAM,CAAA;QACnB,aAAa,EAAE,MAAM,CAAA;KACtB;IAQD;;;;OAIG;mBACkB,wBAAwB;IAmC7C;;;OAGG;mBACkB,uBAAuB;IAsB5C;;OAEG;mBACkB,mBAAmB;IAsBxC;;;;;;;;;;;;;;;;OAgBG;WACiB,qBAAqB,CACvC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,GAAG,GACb,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,GAAG,CAAC;QAAC,MAAM,CAAC,EAAE,GAAG,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA2B3E;;;;;;;;;;;;;;OAcG;WACiB,mBAAmB,CACrC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,GAAG,CAAC;QAAC,MAAM,CAAC,EAAE,GAAG,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAiC/F;;;;;;;;;;;;;;;;;OAiBG;WACiB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;QACzE,OAAO,CAAC,EAAE,GAAG,CAAA;QACb,MAAM,CAAC,EAAE,GAAG,CAAA;QACZ,WAAW,CAAC,EAAE,GAAG,EAAE,CAAA;QACnB,MAAM,CAAC,EAAE,GAAG,CAAA;QACZ,KAAK,CAAC,EAAE,MAAM,CAAA;KACf,CAAC;IAuBF;;;;;;OAMG;WACW,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;CAelE"}

package/dist/utils/sdjwt-disclosure.d.ts

@@ -0,0 +1,13 @@
+import { CredentialType } from '../types';
+export interface DisclosureFields {
+    selectiveFields: string[];
+    mandatoryFields: string[];
+    neverDisclose: string[];
+    decoyCount: number;
+}
+/**
+ * Get selective disclosure fields for a given credential type.
+ * If requestedFields is provided, they are filtered against the neverDisclose list.
+ */
+export declare function getDefaultDisclosureFields(credentialType: CredentialType, requestedFields?: string[]): DisclosureFields;
+//# sourceMappingURL=sdjwt-disclosure.d.ts.map

package/dist/utils/sdjwt-disclosure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdjwt-disclosure.d.ts","sourceRoot":"","sources":["../../src/utils/sdjwt-disclosure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAEzC,MAAM,WAAW,gBAAgB;IAC/B,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,UAAU,EAAE,MAAM,CAAA;CACnB;AAqED;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,cAAc,EAAE,cAAc,EAC9B,eAAe,CAAC,EAAE,MAAM,EAAE,GACzB,gBAAgB,CAYlB"}

package/dist/utils/tier-utils.d.ts

@@ -0,0 +1,15 @@
+import { UserTier, TierLimits } from '../types/tier';
+/**
+ * Check if a tier limit value represents unlimited.
+ * In TIER_LIMITS, -1 is used to represent unlimited values.
+ */
+export declare function isUnlimited(value: number): boolean;
+/**
+ * Safely resolve a tier string to a valid UserTier, defaulting to 'free'.
+ */
+export declare function resolveUserTier(tier: string | undefined | null): UserTier;
+/**
+ * Get tier limits for a user's tier, with safe fallback to free tier.
+ */
+export declare function getTierLimits(tier: string | undefined | null): TierLimits;
+//# sourceMappingURL=tier-utils.d.ts.map

package/dist/utils/tier-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tier-utils.d.ts","sourceRoot":"","sources":["../../src/utils/tier-utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAe,MAAM,eAAe,CAAA;AAEjE;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAElD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,QAAQ,CAKzE;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,UAAU,CAEzE"}

package/dist/vc/api-vc-manager.d.ts

@@ -0,0 +1,43 @@
+import { IssueSDJWTVCRequest, IssueSDJWTVCResult, VerifySDJWTVCResult } from '../types';
+import { KeyManager } from '../did/key-manager';
+/**
+ * API-focused VC Manager for server-side operations
+ * Provides stateless SD-JWT operations without local persistence
+ */
+export declare class APIVCManager {
+    private keyManager;
+    /**
+     * 🔴 Deliberately does NOT call `SDJwtClient.setKeyManager` — that assigned a
+     * static, so constructing one of these repointed every other manager's key
+     * resolution. Every call below passes `this.keyManager` instead (#1449).
+     */
+    constructor(keyManager?: KeyManager);
+    /**
+     * Issue an SD-JWT VC with selective disclosure
+     */
+    issueSDJWTVC(request: IssueSDJWTVCRequest): Promise<IssueSDJWTVCResult>;
+    /**
+     * Verify an SD-JWT VC
+     */
+    verifySDJWTVC(credential: string): Promise<VerifySDJWTVCResult>;
+    /**
+     * Issue a project access credential
+     */
+    issueProjectAccessCredential(agentDid: string, projectId: string, permissions: string[], issuerDid: string, expirationHours?: number): Promise<IssueSDJWTVCResult>;
+    /**
+     * Issue a tool access credential
+     */
+    issueToolAccessCredential(agentDid: string, toolName: string, actions: string[], projectId: string, issuerDid: string, expirationHours?: number): Promise<IssueSDJWTVCResult>;
+    /**
+     * Issue a multi-tool access credential
+     */
+    issueMultiToolCredential(agentDid: string, toolPermissions: Array<{
+        tool: string;
+        actions: string[];
+    }>, projectId: string, issuerDid: string, expirationHours?: number): Promise<IssueSDJWTVCResult>;
+    /**
+     * Issue an admin credential
+     */
+    issueAdminCredential(agentDid: string, scope: 'project' | 'global', projectId: string | undefined, issuerDid: string, expirationHours?: number): Promise<IssueSDJWTVCResult>;
+}
+//# sourceMappingURL=api-vc-manager.d.ts.map

package/dist/vc/api-vc-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-vc-manager.d.ts","sourceRoot":"","sources":["../../src/vc/api-vc-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EAEpB,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAI/C;;;GAGG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,UAAU,CAAY;IAE9B;;;;OAIG;gBACS,UAAU,CAAC,EAAE,UAAU;IAInC;;OAEG;IACG,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAgE7E;;OAEG;IACG,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IA6CrE;;OAEG;IACG,4BAA4B,CAChC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EAAE,EACrB,SAAS,EAAE,MAAM,EACjB,eAAe,SAAK,GACnB,OAAO,CAAC,kBAAkB,CAAC;IAkB9B;;OAEG;IACG,yBAAyB,CAC7B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EAAE,EACjB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,eAAe,SAAK,GACnB,OAAO,CAAC,kBAAkB,CAAC;IAkB9B;;OAEG;IACG,wBAAwB,CAC5B,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,EAC3D,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,eAAe,SAAK,GACnB,OAAO,CAAC,kBAAkB,CAAC;IAiB9B;;OAEG;IACG,oBAAoB,CACxB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,SAAS,GAAG,QAAQ,EAC3B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,SAAS,EAAE,MAAM,EACjB,eAAe,SAAI,GAClB,OAAO,CAAC,kBAAkB,CAAC;CAiB/B"}

package/dist/vc/vc-manager.d.ts

@@ -0,0 +1,55 @@
+import { VCTemplate } from '../types';
+import { KeyManager } from '../did/key-manager';
+import { AgentManager } from '../did/agent';
+import { UserIdentityManager } from '../identity/user-identity-manager';
+export declare class VCManager {
+    private keyManager;
+    private templates;
+    private agentManager;
+    private userIdentityManager;
+    constructor(keyManager?: KeyManager, agentManager?: AgentManager, userIdentityManager?: UserIdentityManager);
+    /**
+     * Get fields that should be selectively disclosable based on VC type
+     */
+    private getSelectivelyDisclosableFields;
+    /**
+     * Issue a Verifiable Credential as SD-JWT VC
+     * Enhanced to support User/Agent DID separation
+     */
+    issue(template: string, claims: any, options: {
+        issuerDid?: string;
+        subjectDid?: string;
+        agentId?: string;
+        expiresIn?: string;
+    }): Promise<string>;
+    /**
+     * Get subject's public key for cnf claim
+     */
+    private getSubjectPublicKey;
+    /**
+     * Issue using existing Issuer API (OID4VCI)
+     */
+    issueViaAPI(credentialType: string, claims: any, options: {
+        issuerDid: string;
+        subjectDid: string;
+    }): Promise<string>;
+    /**
+     * Verify a SD-JWT VC
+     */
+    verify(sdjwtVc: string, options?: {
+        expectedIssuer?: string;
+        expectedSubject?: string;
+        requiredClaims?: string[];
+    }): Promise<any>;
+    /**
+     * Revoke a Verifiable Credential
+     */
+    revoke(_vcId: string, _issuerDid: string): Promise<void>;
+    /**
+     * Register a custom VC template
+     */
+    registerTemplate(template: VCTemplate): void;
+    private registerDefaultTemplates;
+    private calculateExpirationDate;
+}
+//# sourceMappingURL=vc-manager.d.ts.map

package/dist/vc/vc-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vc-manager.d.ts","sourceRoot":"","sources":["../../src/vc/vc-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgD,UAAU,EAAE,MAAM,UAAU,CAAA;AAEnF,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAE/C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAA;AAGvE,qBAAa,SAAS;IACpB,OAAO,CAAC,UAAU,CAAY;IAC9B,OAAO,CAAC,SAAS,CAAqC;IACtD,OAAO,CAAC,YAAY,CAAc;IAClC,OAAO,CAAC,mBAAmB,CAAqB;gBAG9C,UAAU,CAAC,EAAE,UAAU,EACvB,YAAY,CAAC,EAAE,YAAY,EAC3B,mBAAmB,CAAC,EAAE,mBAAmB;IAiB3C;;OAEG;IACH,OAAO,CAAC,+BAA+B;IAavC;;;OAGG;IACG,KAAK,CACT,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,GAAG,EACX,OAAO,EAAE;QACP,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,SAAS,CAAC,EAAE,MAAM,CAAA;KACnB,GACA,OAAO,CAAC,MAAM,CAAC;IAqGlB;;OAEG;YACW,mBAAmB;IAgCjC;;OAEG;IACG,WAAW,CACf,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,GAAG,EACX,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,CAAA;QACjB,UAAU,EAAE,MAAM,CAAA;KACnB,GACA,OAAO,CAAC,MAAM,CAAC;IAoClB;;OAEG;IACG,MAAM,CACV,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QACR,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,eAAe,CAAC,EAAE,MAAM,CAAA;QACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;KAC1B,GACA,OAAO,CAAC,GAAG,CAAC;IAgDf;;OAEG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK9D;;OAEG;IACH,gBAAgB,CAAC,QAAQ,EAAE,UAAU,GAAG,IAAI;IAI5C,OAAO,CAAC,wBAAwB;IA4BhC,OAAO,CAAC,uBAAuB;CA2BhC"}

package/dist/vp/kb-jwt-builder.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Single source of truth for Key Binding JWT (KB-JWT) issuance shared across
+ * the AIdentity stack. Four production code paths build KB-JWTs and they
+ * MUST stay byte-for-byte equivalent so a presentation built on one side is
+ * accepted by the verifier on the other:
+ *
+ *   - SDK clients via `VPManager.create()` (this package)
+ *   - API service via `packages/api/src/vp/vp-creation.service.ts`
+ *   - Remote MCP via `packages/remote-mcp/src/services/vp-creation.service.ts`
+ *   - agentd (`@vess-id/vess`) via `VPBuilder.buildVP()`
+ *     (`packages/agentd/src/wallet/vp-builder.ts`)
+ *
+ * Historically each path had its own copy of this logic. PR #391 (the
+ * commit that made `exp` REQUIRED on the verifier side) updated only two of
+ * the three issuer paths known at the time; the SDK was missed and every
+ * SDK-built VP started failing at verification time. The follow-up
+ * consolidation (commit 02b169aa) brought the SDK in line, but agentd —
+ * which had its own KB-JWT literal in `wallet/vp-builder.ts` — was not
+ * recognized as a fourth issuer. Staging then rejected every VP from
+ * `@vess-id/vess` agentd alpha builds with `KB-JWT missing exp` until the
+ * agentd hotfix (this commit's cohort) wired its VPBuilder through
+ * `buildKbJwtPayload()`. This module exists so that a future verifier
+ * change cannot drift from the issuer side: any update lands in one place
+ * and all four paths inherit it.
+ */
+/**
+ * Default KB-JWT lifetime in seconds. Mirrors the cap enforced by the API's
+ * `KeyBindingVerifierService.MAX_KB_JWT_LIFETIME_SECONDS` (also 300).
+ *
+ * The KB-JWT `exp` is the smaller of:
+ *   - `iat + KB_JWT_DEFAULT_LIFETIME_SECONDS`
+ *   - the parent VC's `exp` (so the bearer's freshness window cannot outlive
+ *     the underlying credential's validity, which is itself bounded by
+ *     `grant.expiresAt` at issuance time).
+ */
+export declare const KB_JWT_DEFAULT_LIFETIME_SECONDS = 300;
+export interface KbJwtPayload {
+    iss: string;
+    aud: string;
+    nonce: string;
+    iat: number;
+    exp: number;
+}
+export interface BuildKbJwtPayloadArgs {
+    /** Holder DID — becomes the KB-JWT `iss` claim. */
+    holderDid: string;
+    /** Verifier audience (URL or hostname). Will be normalized via {@link normalizeDomain}. */
+    audience: string;
+    /** Verifier-supplied nonce / challenge. */
+    nonce: string;
+    /** The parent SD-JWT VC string. Its `exp` (if any) caps the KB-JWT lifetime. */
+    vcCredential: string;
+}
+export interface BuildKbJwtPayloadDeps {
+    /** Returns the current time in milliseconds. Defaults to `Date.now`. */
+    now?: () => number;
+}
+/**
+ * Build a Key Binding JWT payload for an SD-JWT VC presentation.
+ *
+ * Throws when the parent VC is already expired (`vc.exp <= now`). The error
+ * message intentionally contains the substring `"VC has expired"` so that
+ * downstream catchers (notably remote-mcp's `isCredentialInvalidError`) can
+ * detect a stale-credential condition and trigger a re-approval flow rather
+ * than surface an opaque issuance failure to the user.
+ */
+export declare function buildKbJwtPayload(args: BuildKbJwtPayloadArgs, deps?: BuildKbJwtPayloadDeps): KbJwtPayload;
+/**
+ * Best-effort read of the VC's `exp` claim from the SD-JWT outer payload.
+ * Returns undefined when the VC is malformed, missing exp, or the field is
+ * not a number — callers fall back to {@link KB_JWT_DEFAULT_LIFETIME_SECONDS}
+ * in that case so issuance does not break for VCs without an explicit expiry.
+ */
+export declare function readVcExpSeconds(sdJwtVc: string): number | undefined;
+/**
+ * Normalize a domain string for consistent use as a JWT `aud` claim.
+ *
+ * The API verifier compares the KB-JWT `aud` against the expected domain by
+ * exact string match, so issuer and verifier must agree on the canonical
+ * form. We delegate to the URL parser, which strips paths and lowercases
+ * the host, then return the resulting `origin`.
+ *
+ * Inputs without a scheme are assumed to be hostnames; `localhost` (with or
+ * without a port) defaults to `http://`, everything else to `https://`. If
+ * URL parsing fails, the input is returned unchanged so a caller can still
+ * detect the mismatch downstream rather than silently swallowing a typo.
+ */
+export declare function normalizeDomain(domain: string): string;
+//# sourceMappingURL=kb-jwt-builder.d.ts.map

package/dist/vp/kb-jwt-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kb-jwt-builder.d.ts","sourceRoot":"","sources":["../../src/vp/kb-jwt-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,MAAM,CAAA;AAElD,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,qBAAqB;IACpC,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAA;IACjB,2FAA2F;IAC3F,QAAQ,EAAE,MAAM,CAAA;IAChB,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAA;IACb,gFAAgF;IAChF,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,wEAAwE;IACxE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,qBAAqB,EAC3B,IAAI,GAAE,qBAA0B,GAC/B,YAAY,CAqBd;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUpE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAgBtD"}