@vess-id/ai-identity 0.16.0-alpha.12 → 0.16.0-alpha.13

package/dist/index.d.mts

@@ -195,7 +195,17 @@ declare enum CredentialType {
     DEVELOPER = "DeveloperCredential",
     TEMPORARY = "TemporaryCredential",
     ADMIN = "AdminCredential",
-    RECEIPT = "ReceiptCredential"
+    RECEIPT = "ReceiptCredential",
+    /**
+     * Account attributes asserted by an organisation about the account holder
+     * (OEM ⑯). Issued server-to-server, never from a user's own grants.
+     */
+    ACCOUNT = "AccountCredential",
+    /**
+     * Agent instance card (OEM ⑯, Model C). Carries a pointer to the service
+     * card and the hash that pins it — not the capability description itself.
+     */
+    AGENT_CARD = "AgentCardCredential"
 }
 /**
  * Credential Status enumeration

package/dist/index.js

@@ -2763,6 +2763,8 @@ var CredentialType = /* @__PURE__ */ ((CredentialType2) => {
   CredentialType2["TEMPORARY"] = "TemporaryCredential";
   CredentialType2["ADMIN"] = "AdminCredential";
   CredentialType2["RECEIPT"] = "ReceiptCredential";
+  CredentialType2["ACCOUNT"] = "AccountCredential";
+  CredentialType2["AGENT_CARD"] = "AgentCardCredential";
   return CredentialType2;
 })(CredentialType || {});
 var CredentialStatus = /* @__PURE__ */ ((CredentialStatus2) => {
@@ -3209,6 +3211,38 @@ var DEFAULT_DISCLOSURE_CONFIGS = {
     mandatoryFields: [],
     neverDisclose: DEFAULT_NEVER_DISCLOSE
   },
+  // OEM ⑯ — account attributes an organisation asserts about the holder.
+  //
+  // Everything identifying is selective. An account credential is presented to
+  // decide whether an action is permitted, and that rarely requires knowing
+  // the account number or whose name is on it. Left always-disclosed, every
+  // verifier the holder ever presents to would learn both — and the fallback
+  // for an unregistered type is TEMPORARY, whose selectiveFields is empty,
+  // which is exactly that outcome. Hence this entry.
+  ["AccountCredential" /* ACCOUNT */]: {
+    selectiveFields: ["accountNumber", "accountHolderName", "branchCode"],
+    mandatoryFields: [],
+    neverDisclose: DEFAULT_NEVER_DISCLOSE
+  },
+  // OEM ⑯ Model C — the instance card.
+  //
+  // service_card_url and service_card_hash are absent from selectiveFields,
+  // which is what makes them always-disclosed: the hash proves the fetched
+  // card is the one the issuer signed over, and a holder able to withhold it
+  // could present a card body nobody attested to (AP2 binds checkout_hash for
+  // the same reason).
+  //
+  // 🔴 They are listed in mandatoryFields as documentation, NOT as
+  // enforcement. APIVCManager.issueSDJWTVC passes only `selectiveFields` to
+  // the SD-JWT builder — `mandatoryFields` and `neverDisclose` are not
+  // consumed on that path. Moving these three into selectiveFields would
+  // silently make the hash withholdable and nothing would fail, so the
+  // omission below is the actual guarantee.
+  ["AgentCardCredential" /* AGENT_CARD */]: {
+    selectiveFields: ["version"],
+    mandatoryFields: ["service_card_url", "service_card_hash", "service_id"],
+    neverDisclose: DEFAULT_NEVER_DISCLOSE
+  },
   ["ReceiptCredential" /* RECEIPT */]: {
     selectiveFields: ["action", "resource", "outcome", "amount", "description", "date", "transactionId"],
     mandatoryFields: ["grantId", "auditEventId", "receiptType"],