@vess-id/ai-identity 0.19.0 → 0.21.0

package/dist/types/permission-vc.d.ts

@@ -233,6 +233,24 @@ export interface PermissionRule {
     actions: string[];
     /** Rule-level constraints */
     constraints?: PermissionConstraints;
+    /**
+     * RAR authorization-details type (RFC 9396 §2), carried verbatim (#952).
+     *
+     * A free-form URN naming the kind of authorization this delegate represents,
+     * for consumers that speak RAR. Deliberately unvalidated: the registry of
+     * types belongs to whoever issues them, and rejecting an unrecognised URN
+     * here would make this service the gatekeeper of a vocabulary it does not
+     * own.
+     *
+     * NOT an authorization input. Gate-2 authorises on `provider`, `actions`,
+     * `resource.type` and `resource.id`; a credential must not be able to widen
+     * or narrow what it may do by naming a type. Note how close this sits to
+     * `resource.type`, which Gate-2 *does* read — the two are one level apart
+     * and the format is unchecked, so a line reaching for the wrong one would
+     * not be caught by the compiler or at runtime. Pinned in
+     * `gate2-fast-path.spec.ts` ("delegates[].type is inert at Gate-2").
+     */
+    type?: string;
     /**
      * Cedar policy binding (Phase 1).
      *
@@ -364,6 +382,16 @@ export interface VcApprovalClaim {
      * approved (action, resource) tuple. Optional for backward compatibility.
      */
     action?: string;
+    /**
+     * #1205 P1 (decision-bound authorization) — `sha256:` hex of the
+     * canonicalized approved salient params. Binds the issued VC to the CONCRETE
+     * parameter values the approver consented to, so a caller cannot execute with
+     * different (e.g. tampered `body`/`to`) parameters under the same approval.
+     * Computed at claimVC (Step 4) from the final persisted `actionParams`;
+     * verified fail-closed at the PEP (Step 5). Absent on legacy VCs and on
+     * actions that declare no salient set.
+     */
+    params_hash?: string;
 }
 /**
  * Scheduling Wow Phase 1 §5.3 (Task 7) — the delegation-policy snapshot baked
@@ -493,6 +521,59 @@ export interface PermissionVcClaims_V3 extends Omit<PermissionVcClaims_V2, 'v'>
      * no enforcement gate reads it. {@link VcSchedulingDelegationClaim}.
      */
     schedulingDelegation?: VcSchedulingDelegationClaim;
+    /**
+     * How this credential came to exist (#954).
+     *
+     * - `'user_approved'` — a person consented. Paired with {@link approval},
+     *   which carries the back-reference to the approval request and outcome.
+     * - `'auto_issued'` — consent was given on the user's behalf: a Cedar
+     *   permit, an advance delegation policy, or a signup funnel.
+     * - `'unrecorded'` — provenance is genuinely unknown. Credentials issued
+     *   before the consent type was recorded, and any path where no approval
+     *   assertion reaches the issuer, land here.
+     *
+     * Derived from the approval's `consent_type` — HOW the consent was
+     * obtained — and never from `granted_by`, which records WHO. Those come
+     * apart in practice: booking start writes `granted_by: 'system'` for both
+     * an explicit human click and an automatic funnel, because the visitor's
+     * identity is gone by the time the credential is issued.
+     *
+     * The third value is not a placeholder to be tidied away later. Guessing
+     * between the other two would fabricate audit data, and this claim is
+     * signed — it cannot be corrected once issued.
+     *
+     * Never taken from the request: `approvalAssertion` is an internal-only
+     * extension on `issueVC` precisely so this stays true (see the comment on
+     * `IssueVCRequestDto`).
+     *
+     * Optional, and permanently so. The type describes credentials that are
+     * already signed and in circulation; those cannot be re-issued to carry a
+     * new field, so a required one would invalidate them at the type layer.
+     * Absent means "issued before #954", not "auto-issued".
+     *
+     * Audit and disclosure metadata — no gate reads it to decide anything. If a
+     * gate ever should, the decision belongs in policy, against `approval`,
+     * rather than against a label the issuer wrote about itself.
+     */
+    issuance_mode?: 'user_approved' | 'auto_issued' | 'unrecorded';
+    /**
+     * Why this credential was requested, in the requester's own words (#955).
+     *
+     * Free text, deliberately. Narrowing it to a vocabulary would turn a
+     * description into a decision input, and Phase 1 neither records nor
+     * evaluates it (DEV-INSTRUCTIONS §256) — no gate reads it, and none should
+     * without that being a decision someone makes on purpose.
+     *
+     * SD-protected at issuance. Natural language written by a person tends to
+     * name people, accounts and circumstances, so a verifier gets it only when
+     * the holder chooses to disclose it. Keep it out of audit logs and error
+     * messages for the same reason.
+     *
+     * Optional, and permanently so: the type describes credentials already
+     * signed and in circulation, which cannot be re-issued to carry a new
+     * field.
+     */
+    intent_description?: string;
 }
 /**
  * Permission VC Claims (canonical union of v2 + v3).

package/dist/types/permission-vc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission-vc.d.ts","sourceRoot":"","sources":["../../src/types/permission-vc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH;;;;GAIG;AACH,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,CAAA;AAEjF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,kBAAkB;IACjC,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAA;IACZ,oEAAoE;IACpE,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAMD;;;;;;;;;GASG;AACH,MAAM,WAAW,wBAAwB;IACvC,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,yEAAyE;IACzE,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,uBAAuB;IACvB,IAAI,CAAC,EAAE,wBAAwB,CAAA;IAC/B,iDAAiD;IACjD,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,0CAA0C;IAC1C,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,wCAAwC;IACxC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/B;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,kBAAkB,EAAE,gBAAgB,EAAE,CAAA;CACxD;AAMD;;;;;;;;;GASG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,QAAQ,CAAA;IACd,wDAAwD;IACxD,aAAa,EAAE,MAAM,CAAA;IACrB,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAA;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,WAAW,CAAA;IACjB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAA;IACjB,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAA;IAClB,wEAAwE;IACxE,WAAW,EAAE,MAAM,CAAA;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GAAG,eAAe,GAAG,kBAAkB,CAAA;AAE5D,8CAA8C;AAC9C,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,SAAS,GAAG,GAAG,IAAI,eAAe,CAExE;AAED,iDAAiD;AACjD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,SAAS,GAAG,GAAG,IAAI,kBAAkB,CAE9E;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,cAAc;IAC7B,4DAA4D;IAC5D,EAAE,CAAC,EAAE,MAAM,CAAA;IACX;;;;;OAKG;IACH,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,kBAAkB,CAAA;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,uBAAuB;IACvB,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAA;IAC3B,sBAAsB;IACtB,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,6EAA6E;IAC7E,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,6BAA6B;IAC7B,WAAW,CAAC,EAAE,qBAAqB,CAAA;IACnC;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,SAAS,CAAA;IACtB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,SAAS,EAAE,CAAA;CAC1B;AAMD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,qBAAqB;IACpC,qBAAqB;IACrB,CAAC,EAAE,GAAG,CAAA;IACN,oCAAoC;IACpC,IAAI,EAAE,sBAAsB,CAAA;IAC5B,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAA;IACX,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAA;IACX,iCAAiC;IACjC,GAAG,EAAE,MAAM,CAAA;IACX,kCAAkC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAA;IACX,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAA;IACX,iBAAiB;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,4BAA4B;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,6BAA6B;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,yEAAyE;IACzE,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAA;IAClB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,iDAAiD;IACjD,GAAG,CAAC,EAAE;QACJ,2DAA2D;QAC3D,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAC7B,CAAA;IACD,+DAA+D;IAC/D,SAAS,EAAE,cAAc,EAAE,CAAA;CAC5B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAA;IAClB,2EAA2E;IAC3E,UAAU,EAAE,MAAM,CAAA;IAClB,sEAAsE;IACtE,UAAU,EAAE,MAAM,CAAA;IAClB,iDAAiD;IACjD,UAAU,EAAE,MAAM,CAAA;IAClB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,2BAA2B;IAC1C,2DAA2D;IAC3D,UAAU,EAAE;QACV,2CAA2C;QAC3C,UAAU,EAAE,MAAM,EAAE,CAAA;QACpB,yDAAyD;QACzD,WAAW,EAAE,MAAM,CAAA;QACnB,uDAAuD;QACvD,SAAS,EAAE,MAAM,CAAA;QACjB,iEAAiE;QACjE,QAAQ,EAAE,MAAM,CAAA;KACjB,CAAA;IACD,oEAAoE;IACpE,kBAAkB,EAAE,MAAM,CAAA;IAC1B,mEAAmE;IACnE,YAAY,EAAE;QAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAA;IAC5D,wEAAwE;IACxE,eAAe,EAAE,MAAM,CAAA;IACvB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;;;;;;;;OAYG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,qBAAsB,SAAQ,IAAI,CAAC,qBAAqB,EAAE,GAAG,CAAC;IAC7E,oFAAoF;IACpF,CAAC,EAAE,GAAG,CAAA;IACN;;;OAGG;IACH,gBAAgB,CAAC,EAAE;QACjB,yCAAyC;QACzC,SAAS,EAAE,MAAM,CAAA;QACjB,2CAA2C;QAC3C,WAAW,EAAE,MAAM,CAAA;KACpB,CAAA;IACD;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,YAAY,GAAG,YAAY,GAAG,kBAAkB,GAAG,sBAAsB,CAAA;IACjF;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAA;IAC1B;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,2BAA2B,CAAA;CACnD;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,kBAAkB,GAAG,qBAAqB,GAAG,qBAAqB,CAAA;AAE9E;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG;IAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAKhG;AAMD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,WAAW;IAC1B,kCAAkC;IAClC,OAAO,EAAE;QACP,gBAAgB;QAChB,SAAS,EAAE,MAAM,CAAA;QACjB,iBAAiB;QACjB,UAAU,EAAE,MAAM,CAAA;QAClB,2BAA2B;QAC3B,QAAQ,CAAC,EAAE,MAAM,CAAA;KAClB,CAAA;IACD,qBAAqB;IACrB,MAAM,EAAE;QACN,iBAAiB;QACjB,UAAU,EAAE,MAAM,CAAA;KACnB,CAAA;IACD,gDAAgD;IAChD,OAAO,EAAE;QACP,uBAAuB;QACvB,QAAQ,EAAE,MAAM,CAAA;QAChB,wBAAwB;QACxB,MAAM,EAAE,MAAM,CAAA;QACd,sBAAsB;QACtB,QAAQ,EAAE;YACR,IAAI,EAAE,MAAM,CAAA;YACZ,EAAE,EAAE,MAAM,CAAA;YACV,2EAA2E;YAC3E,UAAU,CAAC,EAAE,MAAM,CAAA;SACpB,CAAA;QACD,0EAA0E;QAC1E,OAAO,CAAC,EAAE,OAAO,kBAAkB,EAAE,YAAY,EAAE,CAAA;QACnD,oDAAoD;QACpD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KACjC,CAAA;IACD,uCAAuC;IACvC,WAAW,EAAE;QACX,aAAa;QACb,GAAG,EAAE,MAAM,CAAA;QACX,uBAAuB;QACvB,SAAS,EAAE,MAAM,EAAE,CAAA;QACnB,uBAAuB;QACvB,QAAQ,EAAE,MAAM,CAAA;QAChB,0BAA0B;QAC1B,SAAS,EAAE,MAAM,CAAA;QACjB,2BAA2B;QAC3B,UAAU,EAAE,MAAM,CAAA;QAClB,yCAAyC;QACzC,SAAS,EAAE,cAAc,EAAE,CAAA;KAC5B,CAAA;IACD,sDAAsD;IACtD,WAAW,EAAE;QACX,+BAA+B;QAC/B,GAAG,EAAE,MAAM,CAAA;QACX,wBAAwB;QACxB,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,yBAAyB;QACzB,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,6CAA6C;QAC7C,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAC1B,CAAA;CACF;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,oCAAoC;IACpC,OAAO,EAAE,OAAO,CAAA;IAChB,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,2CAA2C;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,mCAAmC;IACnC,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,mDAAmD;IACnD,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAMD;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,iCAAiC;IACjC,UAAU,EAAE,MAAM,CAAA;IAClB,uBAAuB;IACvB,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAA;IAC3B,wBAAwB;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,sBAAsB;IACtB,QAAQ,EAAE;QACR,IAAI,EAAE,MAAM,CAAA;QACZ,EAAE,EAAE,MAAM,CAAA;KACX,CAAA;IACD,iBAAiB;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,iBAAiB;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,oCAAoC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACjC;AAMD;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;CACrB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB,CAY5E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAqB1F;AAMD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,EAAG,kBAA2B,CAAA;AAE3D,gDAAgD;AAChD,MAAM,MAAM,aAAa,GAAG,OAAO,gBAAgB,CAAA;AAEnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,IAAI,CAAC,qBAAqB,EAAE,OAAO,CAAC,GACzC,qBAAqB,GAAG;IAAE,KAAK,EAAE,aAAa,CAAA;CAAE,CAElD"}
+{"version":3,"file":"permission-vc.d.ts","sourceRoot":"","sources":["../../src/types/permission-vc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH;;;;GAIG;AACH,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,CAAA;AAEjF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,kBAAkB;IACjC,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAA;IACZ,oEAAoE;IACpE,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAMD;;;;;;;;;GASG;AACH,MAAM,WAAW,wBAAwB;IACvC,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,yEAAyE;IACzE,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,uBAAuB;IACvB,IAAI,CAAC,EAAE,wBAAwB,CAAA;IAC/B,iDAAiD;IACjD,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,0CAA0C;IAC1C,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,wCAAwC;IACxC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/B;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,kBAAkB,EAAE,gBAAgB,EAAE,CAAA;CACxD;AAMD;;;;;;;;;GASG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,QAAQ,CAAA;IACd,wDAAwD;IACxD,aAAa,EAAE,MAAM,CAAA;IACrB,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAA;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,WAAW,CAAA;IACjB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAA;IACjB,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAA;IAClB,wEAAwE;IACxE,WAAW,EAAE,MAAM,CAAA;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GAAG,eAAe,GAAG,kBAAkB,CAAA;AAE5D,8CAA8C;AAC9C,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,SAAS,GAAG,GAAG,IAAI,eAAe,CAExE;AAED,iDAAiD;AACjD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,SAAS,GAAG,GAAG,IAAI,kBAAkB,CAE9E;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,cAAc;IAC7B,4DAA4D;IAC5D,EAAE,CAAC,EAAE,MAAM,CAAA;IACX;;;;;OAKG;IACH,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,kBAAkB,CAAA;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,uBAAuB;IACvB,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAA;IAC3B,sBAAsB;IACtB,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,6EAA6E;IAC7E,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,6BAA6B;IAC7B,WAAW,CAAC,EAAE,qBAAqB,CAAA;IACnC;;;;;;;;;;;;;;;;OAgBG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,SAAS,CAAA;IACtB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,SAAS,EAAE,CAAA;CAC1B;AAMD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,qBAAqB;IACpC,qBAAqB;IACrB,CAAC,EAAE,GAAG,CAAA;IACN,oCAAoC;IACpC,IAAI,EAAE,sBAAsB,CAAA;IAC5B,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAA;IACX,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAA;IACX,iCAAiC;IACjC,GAAG,EAAE,MAAM,CAAA;IACX,kCAAkC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAA;IACX,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAA;IACX,iBAAiB;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,4BAA4B;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,6BAA6B;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,yEAAyE;IACzE,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAA;IAClB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,iDAAiD;IACjD,GAAG,CAAC,EAAE;QACJ,2DAA2D;QAC3D,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAC7B,CAAA;IACD,+DAA+D;IAC/D,SAAS,EAAE,cAAc,EAAE,CAAA;CAC5B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAA;IAClB,2EAA2E;IAC3E,UAAU,EAAE,MAAM,CAAA;IAClB,sEAAsE;IACtE,UAAU,EAAE,MAAM,CAAA;IAClB,iDAAiD;IACjD,UAAU,EAAE,MAAM,CAAA;IAClB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,2BAA2B;IAC1C,2DAA2D;IAC3D,UAAU,EAAE;QACV,2CAA2C;QAC3C,UAAU,EAAE,MAAM,EAAE,CAAA;QACpB,yDAAyD;QACzD,WAAW,EAAE,MAAM,CAAA;QACnB,uDAAuD;QACvD,SAAS,EAAE,MAAM,CAAA;QACjB,iEAAiE;QACjE,QAAQ,EAAE,MAAM,CAAA;KACjB,CAAA;IACD,oEAAoE;IACpE,kBAAkB,EAAE,MAAM,CAAA;IAC1B,mEAAmE;IACnE,YAAY,EAAE;QAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAA;IAC5D,wEAAwE;IACxE,eAAe,EAAE,MAAM,CAAA;IACvB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;;;;;;;;OAYG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,qBAAsB,SAAQ,IAAI,CAAC,qBAAqB,EAAE,GAAG,CAAC;IAC7E,oFAAoF;IACpF,CAAC,EAAE,GAAG,CAAA;IACN;;;OAGG;IACH,gBAAgB,CAAC,EAAE;QACjB,yCAAyC;QACzC,SAAS,EAAE,MAAM,CAAA;QACjB,2CAA2C;QAC3C,WAAW,EAAE,MAAM,CAAA;KACpB,CAAA;IACD;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,YAAY,GAAG,YAAY,GAAG,kBAAkB,GAAG,sBAAsB,CAAA;IACjF;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAA;IAC1B;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,2BAA2B,CAAA;IAClD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,aAAa,CAAC,EAAE,eAAe,GAAG,aAAa,GAAG,YAAY,CAAA;IAC9D;;;;;;;;;;;;;;;;OAgBG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,kBAAkB,GAAG,qBAAqB,GAAG,qBAAqB,CAAA;AAE9E;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG;IAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAKhG;AAMD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,WAAW;IAC1B,kCAAkC;IAClC,OAAO,EAAE;QACP,gBAAgB;QAChB,SAAS,EAAE,MAAM,CAAA;QACjB,iBAAiB;QACjB,UAAU,EAAE,MAAM,CAAA;QAClB,2BAA2B;QAC3B,QAAQ,CAAC,EAAE,MAAM,CAAA;KAClB,CAAA;IACD,qBAAqB;IACrB,MAAM,EAAE;QACN,iBAAiB;QACjB,UAAU,EAAE,MAAM,CAAA;KACnB,CAAA;IACD,gDAAgD;IAChD,OAAO,EAAE;QACP,uBAAuB;QACvB,QAAQ,EAAE,MAAM,CAAA;QAChB,wBAAwB;QACxB,MAAM,EAAE,MAAM,CAAA;QACd,sBAAsB;QACtB,QAAQ,EAAE;YACR,IAAI,EAAE,MAAM,CAAA;YACZ,EAAE,EAAE,MAAM,CAAA;YACV,2EAA2E;YAC3E,UAAU,CAAC,EAAE,MAAM,CAAA;SACpB,CAAA;QACD,0EAA0E;QAC1E,OAAO,CAAC,EAAE,OAAO,kBAAkB,EAAE,YAAY,EAAE,CAAA;QACnD,oDAAoD;QACpD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KACjC,CAAA;IACD,uCAAuC;IACvC,WAAW,EAAE;QACX,aAAa;QACb,GAAG,EAAE,MAAM,CAAA;QACX,uBAAuB;QACvB,SAAS,EAAE,MAAM,EAAE,CAAA;QACnB,uBAAuB;QACvB,QAAQ,EAAE,MAAM,CAAA;QAChB,0BAA0B;QAC1B,SAAS,EAAE,MAAM,CAAA;QACjB,2BAA2B;QAC3B,UAAU,EAAE,MAAM,CAAA;QAClB,yCAAyC;QACzC,SAAS,EAAE,cAAc,EAAE,CAAA;KAC5B,CAAA;IACD,sDAAsD;IACtD,WAAW,EAAE;QACX,+BAA+B;QAC/B,GAAG,EAAE,MAAM,CAAA;QACX,wBAAwB;QACxB,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,yBAAyB;QACzB,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,6CAA6C;QAC7C,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAC1B,CAAA;CACF;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,oCAAoC;IACpC,OAAO,EAAE,OAAO,CAAA;IAChB,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,2CAA2C;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,mCAAmC;IACnC,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,mDAAmD;IACnD,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAMD;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,iCAAiC;IACjC,UAAU,EAAE,MAAM,CAAA;IAClB,uBAAuB;IACvB,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAA;IAC3B,wBAAwB;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,sBAAsB;IACtB,QAAQ,EAAE;QACR,IAAI,EAAE,MAAM,CAAA;QACZ,EAAE,EAAE,MAAM,CAAA;KACX,CAAA;IACD,iBAAiB;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,iBAAiB;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,oCAAoC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACjC;AAMD;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;CACrB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB,CAY5E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAqB1F;AAMD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,EAAG,kBAA2B,CAAA;AAE3D,gDAAgD;AAChD,MAAM,MAAM,aAAa,GAAG,OAAO,gBAAgB,CAAA;AAEnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,IAAI,CAAC,qBAAqB,EAAE,OAAO,CAAC,GACzC,qBAAqB,GAAG;IAAE,KAAK,EAAE,aAAa,CAAA;CAAE,CAElD"}

package/dist/types/vc.d.ts

@@ -8,7 +8,17 @@ export declare enum CredentialType {
     DEVELOPER = "DeveloperCredential",
     TEMPORARY = "TemporaryCredential",
     ADMIN = "AdminCredential",
-    RECEIPT = "ReceiptCredential"
+    RECEIPT = "ReceiptCredential",
+    /**
+     * Account attributes asserted by an organisation about the account holder
+     * (OEM ⑯). Issued server-to-server, never from a user's own grants.
+     */
+    ACCOUNT = "AccountCredential",
+    /**
+     * Agent instance card (OEM ⑯, Model C). Carries a pointer to the service
+     * card and the hash that pins it — not the capability description itself.
+     */
+    AGENT_CARD = "AgentCardCredential"
 }
 /**
  * Credential Status enumeration

package/dist/types/vc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vc.d.ts","sourceRoot":"","sources":["../../src/types/vc.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,oBAAY,cAAc;IACxB,cAAc,4BAA4B;IAC1C,WAAW,yBAAyB;IACpC,SAAS,wBAAwB;IACjC,SAAS,wBAAwB;IACjC,KAAK,oBAAoB;IACzB,OAAO,sBAAsB;CAC9B;AAED;;;GAGG;AACH,oBAAY,gBAAgB;IAC1B,MAAM,WAAW;IACjB,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,SAAS,cAAc;CACxB;AAED;;;;;;;GAOG;AACH,oBAAY,MAAM;IAChB,iBAAiB,qBAAqB;IACtC,OAAO,YAAY;CACpB;AAED;;;;;;;;;;GAUG;AACH,oBAAY,QAAQ;IAClB,KAAK,UAAU;IACf,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,SAAS,cAAc;CACxB;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,gBAAgB,GAAG,QAAQ,CAe7E;AAED,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,QAAQ,GAAG,gBAAgB,CAgB7E;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,iBAAiB,EAAE;QACjB,EAAE,EAAE,MAAM,CAAA;QACV,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KACnB,CAAA;IACD,gBAAgB,CAAC,EAAE;QACjB,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,eAAe,EAAE,MAAM,CAAA;QACvB,oBAAoB,EAAE,MAAM,CAAA;KAC7B,CAAA;CACF;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,wBAAwB;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,iBAAiB;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,kBAAkB;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,sBAAsB;IACtB,IAAI,EAAE,cAAc,CAAA;IACpB,wBAAwB;IACxB,MAAM,EAAE;QACN,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;QACtB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;QAChB,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB,aAAa,CAAC,EAAE,MAAM,CAAA;QACtB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KACnB,CAAA;IACD,wBAAwB;IACxB,MAAM,EAAE,gBAAgB,CAAA;IACxB,4BAA4B;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,4BAA4B;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,0BAA0B;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,yBAAyB;IACzB,QAAQ,EAAE,IAAI,CAAA;IACd,2BAA2B;IAC3B,SAAS,CAAC,EAAE,IAAI,CAAA;IAChB,2BAA2B;IAC3B,SAAS,CAAC,EAAE,IAAI,CAAA;IAChB,wBAAwB;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,yBAAyB;IACzB,SAAS,EAAE,IAAI,CAAA;IACf,uBAAuB;IACvB,SAAS,EAAE,IAAI,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,iBAAiB;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,kBAAkB;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,sBAAsB;IACtB,IAAI,CAAC,EAAE,cAAc,CAAA;IACrB,wBAAwB;IACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC3B,sBAAsB;IACtB,cAAc,CAAC,EAAE,IAAI,CAAA;IACrB,iBAAiB;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,eAAe;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,6CAA6C;IAC7C,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAA;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,sCAAsC;IACtC,KAAK,EAAE,OAAO,CAAA;IACd,+BAA+B;IAC/B,OAAO,CAAC,EAAE;QACR,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,GAAG,CAAC,EAAE,MAAM,CAAA;QAEZ,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KACnB,CAAA;IACD,+BAA+B;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,6BAA6B;IAC7B,UAAU,EAAE,MAAM,CAAA;IAClB,iBAAiB;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,kBAAkB;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,sBAAsB;IACtB,IAAI,EAAE,cAAc,CAAA;IACpB,2BAA2B;IAC3B,SAAS,CAAC,EAAE,IAAI,CAAA;CACjB;AAED,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACpD,iBAAiB,EAAE;QACjB,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACnC,GAAG,EAAE,MAAM,CAAA;KACZ,CAAA;CACF;AAED,MAAM,WAAW,YAAa,SAAQ,YAAY;IAChD,iBAAiB,EAAE;QACjB,EAAE,EAAE,MAAM,CAAA;QACV,QAAQ,EAAE,MAAM,CAAA;QAChB,OAAO,EAAE,CAAC,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC,EAAE,CAAA;KACzC,CAAA;CACF;AAED,MAAM,WAAW,UAAU,CAAC,CAAC,SAAS,YAAY,GAAG,YAAY;IAC/D,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;IACrB,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,OAAO,CAAA;CAC9B"}
+{"version":3,"file":"vc.d.ts","sourceRoot":"","sources":["../../src/types/vc.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,oBAAY,cAAc;IACxB,cAAc,4BAA4B;IAC1C,WAAW,yBAAyB;IACpC,SAAS,wBAAwB;IACjC,SAAS,wBAAwB;IACjC,KAAK,oBAAoB;IACzB,OAAO,sBAAsB;IAC7B;;;OAGG;IACH,OAAO,sBAAsB;IAC7B;;;OAGG;IACH,UAAU,wBAAwB;CACnC;AAED;;;GAGG;AACH,oBAAY,gBAAgB;IAC1B,MAAM,WAAW;IACjB,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,SAAS,cAAc;CACxB;AAED;;;;;;;GAOG;AACH,oBAAY,MAAM;IAChB,iBAAiB,qBAAqB;IACtC,OAAO,YAAY;CACpB;AAED;;;;;;;;;;GAUG;AACH,oBAAY,QAAQ;IAClB,KAAK,UAAU;IACf,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,SAAS,cAAc;CACxB;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,gBAAgB,GAAG,QAAQ,CAe7E;AAED,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,QAAQ,GAAG,gBAAgB,CAgB7E;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,iBAAiB,EAAE;QACjB,EAAE,EAAE,MAAM,CAAA;QACV,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KACnB,CAAA;IACD,gBAAgB,CAAC,EAAE;QACjB,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,eAAe,EAAE,MAAM,CAAA;QACvB,oBAAoB,EAAE,MAAM,CAAA;KAC7B,CAAA;CACF;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,wBAAwB;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,iBAAiB;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,kBAAkB;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,sBAAsB;IACtB,IAAI,EAAE,cAAc,CAAA;IACpB,wBAAwB;IACxB,MAAM,EAAE;QACN,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;QACtB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;QAChB,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB,aAAa,CAAC,EAAE,MAAM,CAAA;QACtB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KACnB,CAAA;IACD,wBAAwB;IACxB,MAAM,EAAE,gBAAgB,CAAA;IACxB,4BAA4B;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,4BAA4B;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,0BAA0B;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,yBAAyB;IACzB,QAAQ,EAAE,IAAI,CAAA;IACd,2BAA2B;IAC3B,SAAS,CAAC,EAAE,IAAI,CAAA;IAChB,2BAA2B;IAC3B,SAAS,CAAC,EAAE,IAAI,CAAA;IAChB,wBAAwB;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,yBAAyB;IACzB,SAAS,EAAE,IAAI,CAAA;IACf,uBAAuB;IACvB,SAAS,EAAE,IAAI,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,iBAAiB;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,kBAAkB;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,sBAAsB;IACtB,IAAI,CAAC,EAAE,cAAc,CAAA;IACrB,wBAAwB;IACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC3B,sBAAsB;IACtB,cAAc,CAAC,EAAE,IAAI,CAAA;IACrB,iBAAiB;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,eAAe;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,6CAA6C;IAC7C,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAA;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,sCAAsC;IACtC,KAAK,EAAE,OAAO,CAAA;IACd,+BAA+B;IAC/B,OAAO,CAAC,EAAE;QACR,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,GAAG,CAAC,EAAE,MAAM,CAAA;QAEZ,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KACnB,CAAA;IACD,+BAA+B;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,6BAA6B;IAC7B,UAAU,EAAE,MAAM,CAAA;IAClB,iBAAiB;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,kBAAkB;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,sBAAsB;IACtB,IAAI,EAAE,cAAc,CAAA;IACpB,2BAA2B;IAC3B,SAAS,CAAC,EAAE,IAAI,CAAA;CACjB;AAED,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACpD,iBAAiB,EAAE;QACjB,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACnC,GAAG,EAAE,MAAM,CAAA;KACZ,CAAA;CACF;AAED,MAAM,WAAW,YAAa,SAAQ,YAAY;IAChD,iBAAiB,EAAE;QACjB,EAAE,EAAE,MAAM,CAAA;QACV,QAAQ,EAAE,MAAM,CAAA;QAChB,OAAO,EAAE,CAAC,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC,EAAE,CAAA;KACzC,CAAA;CACF;AAED,MAAM,WAAW,UAAU,CAAC,CAAC,SAAS,YAAY,GAAG,YAAY;IAC/D,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;IACrB,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,OAAO,CAAA;CAC9B"}

package/dist/utils/sdjwt-client.d.ts

@@ -3,28 +3,196 @@ import { KeyManager } from '../did/key-manager';
 import type { DisclosureFrame } from '@sd-jwt/types';
 import type { JWK } from 'jose';
 export declare class SDJwtClient {
+    /**
+     * 🔴 Keyed by DID **and** by the identity of the key that was resolved.
+     *
+     * The instance holds a signer built from a private key the KeyManager
+     * handed over, so two stores holding *different* keys for one DID must not
+     * share an instance. Keying on the DID alone returned whichever one was
+     * built first — and since `setKeyManager` replaces a static field,
+     * constructing a second VPManager silently repointed every later lookup at
+     * a store that did not have the key. Measured: an agent that generated its
+     * DID through one manager could not present with another, failing as
+     * `Private key not found for holder` with the key sitting in the first
+     * manager's store the whole time.
+     *
+     * 🔴 The discriminator is the KEY, not the KeyManager object. Keying on
+     * object identity (a WeakMap-assigned `km0`/`km1`/…) fixed the mix-up and
+     * broke two other things, because the api builds a throwaway KeyManager
+     * per request — `new APIVCManager(new KeyManager(ephemeral))` at
+     * grant/services/remote-vc-issuer.service.ts:2234, which runs on every
+     * tool-invoke auto-issue, plus five more sites:
+     *
+     *   1. Same key material, new object, new id — so a long-lived issuer
+     *      (user/services/sdjwt-credential.service.ts:69) could not read back
+     *      its own warm entry once a per-request manager had replaced the
+     *      static. It failed outright rather than falling back. Measured:
+     *      `{"resolved":false,"msg":"Private key not found for issuer: … km1"}`
+     *      where the DID-only key gave `{"resolved":true}` — by accident, by
+     *      returning the wrong signer on a cache hit.
+     *
+     *   2. Entries accumulated without bound. `keyManagerIds` is a WeakMap, so
+     *      a collected manager releases its id — but the Map entry keyed by
+     *      that id string stays, and a signer closes over a DECRYPTED PRIVATE
+     *      KEY. Nothing in the api calls `clearIssuerCache`. Measured over 25
+     *      issuances of one DID: `{"instanceCount":25,"signerCount":25}` where
+     *      the DID-only key gave 1.
+     *
+     * A thumbprint (RFC 7638) is the right granularity for both: same key ⇒
+     * same entry whoever holds it, different key ⇒ different entry. It is
+     * computed over the public members only (`crv`/`kty`/`x`/`y` — `d`, `kid`
+     * and `alg` are excluded by the spec), which is what makes two stores
+     * holding the same keypair agree. Two *different* private keys sharing a
+     * public half is not a case that exists for a valid EC pair, so nothing is
+     * conflated that should not be. Measured at ~1.7µs per call, against an
+     * ECDSA signature that follows it.
+     */
     private static instances;
+    /**
+     * 🔴 Only ever read as a fallback — when a call arrives without a KeyManager.
+     *
+     * `VCManager`, `VPManager` and `APIVCManager` used to assign it in their
+     * constructors. They no longer do — every one of them passes its own
+     * KeyManager to each call — so within the SDK this field holds whatever an
+     * external consumer set via the deprecated {@link setKeyManager}, and
+     * otherwise a default `new KeyManager()` that {@link resolveKey} creates the
+     * first time it actually has to fall back. Nothing else writes it, and a
+     * call that carries its own store never causes that default to exist.
+     *
+     * It stays because `SDJwtClient` is a public export and a consumer pairing
+     * `setKeyManager` with {@link getSDJwtInstance} would otherwise break on a
+     * minor release. Removal belongs to the next major.
+     */
     private static keyManager;
     private static signerCache;
     private static verifierCache;
+    /**
+     * A stable identifier for the key itself, shared by every store holding it.
+     *
+     * 🔴 Falls back to a per-call unique value rather than to a constant when
+     * the thumbprint cannot be computed. A constant would make two unrelated
+     * malformed keys collide on one cache entry, which is the mix-up this whole
+     * scheme exists to prevent — the safe direction of failure is "cache
+     * nothing", never "share an entry". In practice this is unreachable for a
+     * key that got through `getKey`; it is here so a future JWK shape degrades
+     * into a slow path instead of a wrong one.
+     */
+    private static keyId;
+    private static nextFallbackKeyId;
+    /**
+     * 🔴 Cache keys are built here and nowhere else.
+     *
+     * Three maps, three key shapes. When they were assembled inline at each
+     * call site, `clearIssuerCache` wrote its own third version from memory and
+     * matched only one of them: it deleted `issuerDid` where the instance was
+     * stored as `${did}:issuer:${kmId}`, and `signer:${did}` where the signer
+     * was stored as `signer:${did}:${kmId}`. Measured before the fix — one
+     * issuer cached, then cleared:
+     *
+     *   BEFORE {"instanceCount":1,"signerCount":1,"verifierCount":1}
+     *   AFTER  {"instanceCount":1,"signerCount":1,"verifierCount":0}
+     *
+     * The signer closes over a decrypted private key, so the two that survived
+     * were the two that mattered. Keeping writers and the eraser on one
+     * definition is what stops that from drifting apart again.
+     */
+    private static instanceKey;
+    private static signerKey;
+    /**
+     * The part of a key that identifies the DID, up to and including the
+     * delimiter before the key-identity segment.
+     *
+     * 🔴 `clearIssuerCache` matches on these rather than rebuilding prefixes of
+     * its own — writing the shape a second time is the mistake being fixed. The
+     * trailing `:` is load-bearing: matching a bare DID would make
+     * `did:key:abc` also evict `did:key:abcd`.
+     */
+    private static instancePrefix;
+    private static signerPrefix;
+    /**
+     * 🔴 Carries the key identity too, symmetrically with {@link signerKey}.
+     *
+     * It used to be keyed by DID alone, on the reasoning that "a verifier is
+     * built from the public half, which is the same value no matter which store
+     * the private key came out of". That holds for the case the caches were
+     * built for — one keypair, several stores — and fails for the exact case
+     * the key segment exists to separate: two stores holding *different* keys
+     * under one DID. There the second caller reused the first's verifier and so
+     * checked signatures against a public key that was not its own.
+     *
+     * Costs nothing now that the segment is the key's own thumbprint rather
+     * than a per-object id: the same keypair still yields one entry however
+     * many managers hold it, which is what the old comment actually wanted.
+     */
+    private static verifierKey;
+    private static verifierPrefix;
     private constructor();
     /**
      * Initialize with KeyManager for DID-based key management
+     *
+     * @deprecated Pass the KeyManager to the call instead:
+     * {@link getIssuerInstance}`(did, keyManager)`,
+     * {@link getHolderInstance}`(did, keyManager)`, {@link issueSDJWT} and
+     * {@link verifySDJWT} all take one. This setter writes a **static** field,
+     * so every manager an application constructs repoints key resolution for
+     * every other one — construction order decides which store is searched.
+     *
+     * 🔴 Not a style preference; it caused a production failure. A long-lived
+     * issuer and a per-request `new APIVCManager(new KeyManager(ephemeral))`
+     * coexist in the api, and whichever ran last won: the long-lived one then
+     * signed with a store that was not its own or failed outright with
+     * `Private key not found for issuer: …`. See PR #1441.
+     *
+     * Retained for external SDK consumers that pair it with
+     * {@link getSDJwtInstance}; scheduled for removal in the next major.
      */
     static setKeyManager(keyManager: KeyManager): void;
     /**
      * Get SDJwtVcInstance for issuer role (VC issuance)
      */
-    static getIssuerInstance(issuerDid: string): Promise<SDJwtVcInstance>;
+    static getIssuerInstance(issuerDid: string, keyManager?: KeyManager): Promise<SDJwtVcInstance>;
     /**
      * Get SDJwtVcInstance for holder role (VP presentation)
      */
-    static getHolderInstance(holderDid: string): Promise<SDJwtVcInstance>;
+    static getHolderInstance(holderDid: string, keyManager?: KeyManager): Promise<SDJwtVcInstance>;
+    /**
+     * Resolve the key, then look in the cache — in that order.
+     *
+     * 🔴 The order is the fix, not an implementation detail. The cache key
+     * names the key that was resolved, so it cannot be built before resolving,
+     * and the store must therefore be consulted on a hit as well as a miss.
+     * That is what makes a warm entry reachable from any manager holding the
+     * same key: with the KeyManager object in the key, the caller whose store
+     * DID hold the key looked under a name nobody had written to and got
+     * `Private key not found` — the store had it the whole time.
+     *
+     * The extra work on a hit is one `getKey` (an in-memory or DB read the
+     * caller would owe anyway on a miss) plus a ~1.7µs thumbprint. What is
+     * saved is the SDJwtVcInstance and, more to the point, re-importing the
+     * key material into a signer.
+     */
+    private static getInstance;
+    /**
+     * Fetch the DID's private key from the given store (or the static one) and
+     * derive the identity the caches key on.
+     */
+    private static resolveKey;
     /**
      * Get SDJwtVcInstance with specified role (backward compatibility)
+     *
+     * @deprecated Call {@link getIssuerInstance}`(did, keyManager)` or
+     * {@link getHolderInstance}`(did, keyManager)` directly — this wrapper adds
+     * nothing but the role switch, and the role is known at every call site.
+     *
+     * 🔴 `keyManager` was added here because omitting it was the defect: with no
+     * way to name a store, every caller of this wrapper fell through to the
+     * static field and so was the one path that could not benefit from the
+     * PR #1441 fix. Callers that still omit it keep the old static behaviour, so
+     * existing external code is unaffected.
      */
     static getSDJwtInstance(did: string, options?: {
         role?: 'issuer' | 'holder';
+        keyManager?: KeyManager;
     }): Promise<SDJwtVcInstance>;
     /**
      * Create a new SDJwtVcInstance with DID-based keys and role
@@ -40,6 +208,55 @@ export declare class SDJwtClient {
      * - vct: SD-JWT VC credential type discriminator.
      */
     private static readonly NEVER_DISCLOSE;
+    /**
+     * Claims that decide whether an action is PERMITTED, and so must not be
+     * withholdable by the party they constrain.
+     *
+     * 🔴 Separate from NEVER_DISCLOSE on purpose. That set is about structural
+     * integrity — hide `cnf` and Proof of Possession cannot be checked at all.
+     * This set is about authorisation: these fields are readable, they simply
+     * must not be OPTIONAL, because SD-JWT makes an undisclosed field
+     * physically absent rather than merely hidden. A holder who omits the
+     * disclosure presents a credential with no constraints on it.
+     *
+     * The harm is not theoretical. Gate-2 permits when the delegate list is
+     * empty (tool-executor.service.ts) — deliberate backward compatibility for
+     * two credential shapes that genuinely carry no `delegates` — and a
+     * withheld disclosure lands in that same branch. Cedar Gate-1 backstops
+     * high-risk actions, but only where the Cedar default policy is
+     * bootstrapped; that early return's own comment records that a non-Cedar
+     * deployment's flat-permission fallback does not risk-gate, making the
+     * withholding an unconditional allow there.
+     *
+     * 🔴 Enforced here rather than by curating each caller's field list. Four
+     * issuance paths pass their own arrays — remote-vc-issuer.service.ts,
+     * user/services/sdjwt-credential.service.ts (a hardcoded switch that
+     * duplicates the SDK config), sdk/src/vc/api-vc-manager.ts, and
+     * oauth.service.ts in two places — so fixing one leaves three standing,
+     * and a fifth added later would inherit the defect. This function is the
+     * single point all of them flow through.
+     *
+     * It is also the only place that can stop the NESTED case: the recursion
+     * below passes every key of a nested object as disclosable regardless of
+     * what was requested, which no call-site list can reach.
+     *
+     * What is NOT here: `approval` and `intent_description`. Those are
+     * selective for privacy — an approver's identity, free text — and no gate
+     * reads them to decide anything. The line being drawn is "authorisation
+     * input", not "sensitive".
+     *
+     * Field-by-field, with where each is read:
+     * - delegates:     carries actions/effect/resource (tool-auth.service.ts)
+     * - actions:       what a delegate may do
+     * - tool:          prefixes bare actions into the permission string that
+     *                  gates the decision; withheld, `message.post` is emitted
+     *                  instead of `slack.message.post` — a different string
+     * - resourceScope: gates the scope match (tool-manager.ts)
+     * - permissions:   the flat-permission path (tool-auth.service.ts)
+     * - effect:        whether a delegate rule allows or denies
+     * - resource:      what a rule applies to
+     */
+    private static readonly NEVER_SELECTIVE;
     /**
      * Create disclosure frame for selective disclosure
      */
@@ -48,11 +265,11 @@ export declare class SDJwtClient {
      * Issue an SD-JWT with selective disclosure
      */
     static issueSDJWT(payload: Record<string, any>, _privateKey: any, // Not used since we get key from KeyManager based on issuer DID
-    selectiveDisclosureFields?: string[]): Promise<string>;
+    selectiveDisclosureFields?: string[], keyManager?: KeyManager): Promise<string>;
     /**
      * Verify an SD-JWT
      */
-    static verifySDJWT(credential: string): Promise<{
+    static verifySDJWT(credential: string, keyManager?: KeyManager): Promise<{
         valid: boolean;
         payload?: any;
         error?: string;
@@ -70,7 +287,27 @@ export declare class SDJwtClient {
      */
     static clearCaches(): void;
     /**
-     * Clear cache for specific issuer
+     * Drop every cache entry holding key material for one DID.
+     *
+     * 🔴 Scans rather than deletes by exact key, because the caller cannot
+     * build the exact keys. Both the instance and signer keys carry a
+     * `keyManagerId`, which is private and WeakMap-derived, and this method
+     * takes only a DID. The same DID legitimately has one entry per KeyManager
+     * that ever resolved it, so anything short of "all of them" leaves a live
+     * signer — and a signer closes over a decrypted private key. The maps hold
+     * a handful of entries; a linear pass is not worth optimizing away.
+     *
+     * 🔴 Clears the holder instance too, despite the `Issuer` in the name.
+     * The unit being freed is the DID's key material, not a role: a holder
+     * instance is constructed with `kbSigner` set to the very same signer
+     * object as the issuer's, so evicting the signer while leaving the holder
+     * instance cached would keep the decrypted key reachable through the map
+     * we claimed to have cleaned. Roles are not separable here; the DID is the
+     * only safe granularity.
+     *
+     * 🔴 Matches on a delimiter, not a bare prefix. `did:key:abc` and
+     * `did:key:abcd` are different DIDs, and `startsWith(did)` would take the
+     * second one down with the first.
      */
     static clearIssuerCache(issuerDid: string): void;
     /**

package/dist/utils/sdjwt-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sdjwt-client.d.ts","sourceRoot":"","sources":["../../src/utils/sdjwt-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAGnD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAE/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AACpD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAA;AAG/B,qBAAa,WAAW;IACtB,OAAO,CAAC,MAAM,CAAC,SAAS,CAA0C;IAClE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAY;IACrC,OAAO,CAAC,MAAM,CAAC,WAAW,CAA8B;IACxD,OAAO,CAAC,MAAM,CAAC,aAAa,CAA8B;IAE1D,OAAO;IAEP;;OAEG;WACW,aAAa,CAAC,UAAU,EAAE,UAAU;IAIlD;;OAEG;WACiB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IASlF;;OAEG;WACiB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IASlF;;OAEG;WACiB,gBAAgB,CAClC,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAA;KAAE,GACvC,OAAO,CAAC,eAAe,CAAC;IAK3B;;OAEG;mBACkB,cAAc;IA8DnC;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAEpC;IAEF;;OAEG;WACW,qBAAqB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/D,MAAM,EAAE,CAAC,EACT,sBAAsB,GAAE,MAAM,EAAO,GACpC,eAAe,CAAC,CAAC,CAAC;IAgCrB;;OAEG;WACiB,UAAU,CAC5B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC5B,WAAW,EAAE,GAAG,EAAE,gEAAgE;IAClF,yBAAyB,GAAE,MAAM,EAAO,GACvC,OAAO,CAAC,MAAM,CAAC;IAgBlB;;OAEG;WACiB,WAAW,CAC7B,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,GAAG,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA0C7D;;OAEG;WACiB,oBAAoB;;;;WAQpB,eAAe;IAInC;;OAEG;WACW,WAAW,IAAI,IAAI;IAMjC;;OAEG;WACW,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAMvD;;OAEG;WACW,aAAa,IAAI;QAC7B,aAAa,EAAE,MAAM,CAAA;QACrB,WAAW,EAAE,MAAM,CAAA;QACnB,aAAa,EAAE,MAAM,CAAA;KACtB;IAQD;;;;OAIG;mBACkB,wBAAwB;IAiC7C;;;OAGG;mBACkB,uBAAuB;IAsB5C;;OAEG;mBACkB,mBAAmB;IAsBxC;;;;;;;;;;;;;;;;OAgBG;WACiB,qBAAqB,CACvC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,GAAG,GACb,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,GAAG,CAAC;QAAC,MAAM,CAAC,EAAE,GAAG,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA2B3E;;;;;;;;;;;;;;OAcG;WACiB,mBAAmB,CACrC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,GAAG,CAAC;QAAC,MAAM,CAAC,EAAE,GAAG,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAiC/F;;;;;;;;;;;;;;;;;OAiBG;WACiB,yBAAyB,CAC3C,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC;QACT,OAAO,CAAC,EAAE,GAAG,CAAA;QACb,MAAM,CAAC,EAAE,GAAG,CAAA;QACZ,WAAW,CAAC,EAAE,GAAG,EAAE,CAAA;QACnB,MAAM,CAAC,EAAE,GAAG,CAAA;QACZ,KAAK,CAAC,EAAE,MAAM,CAAA;KACf,CAAC;IAuBF;;;;;;OAMG;WACW,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;CAelE"}
+{"version":3,"file":"sdjwt-client.d.ts","sourceRoot":"","sources":["../../src/utils/sdjwt-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAGnD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAE/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AACpD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAA;AAI/B,qBAAa,WAAW;IACtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;IACH,OAAO,CAAC,MAAM,CAAC,SAAS,CAA0C;IAElE;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,MAAM,CAAC,UAAU,CAAY;IACrC,OAAO,CAAC,MAAM,CAAC,WAAW,CAA8B;IACxD,OAAO,CAAC,MAAM,CAAC,aAAa,CAA8B;IAE1D;;;;;;;;;;OAUG;mBACkB,KAAK;IAQ1B,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAI;IAEpC;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,MAAM,CAAC,WAAW;IAI1B,OAAO,CAAC,MAAM,CAAC,SAAS;IAIxB;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAM,CAAC,cAAc;IAI7B,OAAO,CAAC,MAAM,CAAC,YAAY;IAI3B;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,MAAM,CAAC,WAAW;IAI1B,OAAO,CAAC,MAAM,CAAC,cAAc;IAI7B,OAAO;IAEP;;;;;;;;;;;;;;;;;;OAkBG;WACW,aAAa,CAAC,UAAU,EAAE,UAAU;IAIlD;;OAEG;WACiB,iBAAiB,CACnC,SAAS,EAAE,MAAM,EACjB,UAAU,CAAC,EAAE,UAAU,GACtB,OAAO,CAAC,eAAe,CAAC;IAI3B;;OAEG;WACiB,iBAAiB,CACnC,SAAS,EAAE,MAAM,EACjB,UAAU,CAAC,EAAE,UAAU,GACtB,OAAO,CAAC,eAAe,CAAC;IAI3B;;;;;;;;;;;;;;;OAeG;mBACkB,WAAW;IAchC;;;OAGG;mBACkB,UAAU;IAwC/B;;;;;;;;;;;;OAYG;WACiB,gBAAgB,CAClC,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAAC,UAAU,CAAC,EAAE,UAAU,CAAA;KAAE,GAChE,OAAO,CAAC,eAAe,CAAC;IAO3B;;OAEG;mBACkB,cAAc;IA2DnC;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CASpC;IAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+CG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAoBrC;IAEF;;OAEG;WACW,qBAAqB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC/D,MAAM,EAAE,CAAC,EACT,sBAAsB,GAAE,MAAM,EAAO,GACpC,eAAe,CAAC,CAAC,CAAC;IAmErB;;OAEG;WACiB,UAAU,CAC5B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC5B,WAAW,EAAE,GAAG,EAAE,gEAAgE;IAClF,yBAAyB,GAAE,MAAM,EAAO,EACxC,UAAU,CAAC,EAAE,UAAU,GACtB,OAAO,CAAC,MAAM,CAAC;IAgBlB;;OAEG;WACiB,WAAW,CAC7B,UAAU,EAAE,MAAM,EAClB,UAAU,CAAC,EAAE,UAAU,GACtB,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,GAAG,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA0C7D;;OAEG;WACiB,oBAAoB;;;;WAQpB,eAAe;IAInC;;OAEG;WACW,WAAW,IAAI,IAAI;IAMjC;;;;;;;;;;;;;;;;;;;;;;OAsBG;WACW,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAwBvD;;OAEG;WACW,aAAa,IAAI;QAC7B,aAAa,EAAE,MAAM,CAAA;QACrB,WAAW,EAAE,MAAM,CAAA;QACnB,aAAa,EAAE,MAAM,CAAA;KACtB;IAQD;;;;OAIG;mBACkB,wBAAwB;IAmC7C;;;OAGG;mBACkB,uBAAuB;IAsB5C;;OAEG;mBACkB,mBAAmB;IAsBxC;;;;;;;;;;;;;;;;OAgBG;WACiB,qBAAqB,CACvC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,GAAG,GACb,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,GAAG,CAAC;QAAC,MAAM,CAAC,EAAE,GAAG,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA2B3E;;;;;;;;;;;;;;OAcG;WACiB,mBAAmB,CACrC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,GAAG,CAAC;QAAC,MAAM,CAAC,EAAE,GAAG,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAiC/F;;;;;;;;;;;;;;;;;OAiBG;WACiB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;QACzE,OAAO,CAAC,EAAE,GAAG,CAAA;QACb,MAAM,CAAC,EAAE,GAAG,CAAA;QACZ,WAAW,CAAC,EAAE,GAAG,EAAE,CAAA;QACnB,MAAM,CAAC,EAAE,GAAG,CAAA;QACZ,KAAK,CAAC,EAAE,MAAM,CAAA;KACf,CAAC;IAuBF;;;;;;OAMG;WACW,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;CAelE"}

package/dist/utils/sdjwt-disclosure.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sdjwt-disclosure.d.ts","sourceRoot":"","sources":["../../src/utils/sdjwt-disclosure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAEzC,MAAM,WAAW,gBAAgB;IAC/B,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,UAAU,EAAE,MAAM,CAAA;CACnB;AAqCD;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,cAAc,EAAE,cAAc,EAC9B,eAAe,CAAC,EAAE,MAAM,EAAE,GACzB,gBAAgB,CAYlB"}
+{"version":3,"file":"sdjwt-disclosure.d.ts","sourceRoot":"","sources":["../../src/utils/sdjwt-disclosure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAEzC,MAAM,WAAW,gBAAgB;IAC/B,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,UAAU,EAAE,MAAM,CAAA;CACnB;AAqED;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,cAAc,EAAE,cAAc,EAC9B,eAAe,CAAC,EAAE,MAAM,EAAE,GACzB,gBAAgB,CAYlB"}

package/dist/vc/api-vc-manager.d.ts

@@ -6,6 +6,11 @@ import { KeyManager } from '../did/key-manager';
  */
 export declare class APIVCManager {
     private keyManager;
+    /**
+     * 🔴 Deliberately does NOT call `SDJwtClient.setKeyManager` — that assigned a
+     * static, so constructing one of these repointed every other manager's key
+     * resolution. Every call below passes `this.keyManager` instead (#1449).
+     */
     constructor(keyManager?: KeyManager);
     /**
      * Issue an SD-JWT VC with selective disclosure

package/dist/vc/api-vc-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-vc-manager.d.ts","sourceRoot":"","sources":["../../src/vc/api-vc-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EAEpB,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAI/C;;;GAGG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,UAAU,CAAY;gBAElB,UAAU,CAAC,EAAE,UAAU;IAMnC;;OAEG;IACG,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAqD7E;;OAEG;IACG,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IA4CrE;;OAEG;IACG,4BAA4B,CAChC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EAAE,EACrB,SAAS,EAAE,MAAM,EACjB,eAAe,SAAK,GACnB,OAAO,CAAC,kBAAkB,CAAC;IAkB9B;;OAEG;IACG,yBAAyB,CAC7B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EAAE,EACjB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,eAAe,SAAK,GACnB,OAAO,CAAC,kBAAkB,CAAC;IAkB9B;;OAEG;IACG,wBAAwB,CAC5B,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,EAC3D,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,eAAe,SAAK,GACnB,OAAO,CAAC,kBAAkB,CAAC;IAiB9B;;OAEG;IACG,oBAAoB,CACxB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,SAAS,GAAG,QAAQ,EAC3B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,SAAS,EAAE,MAAM,EACjB,eAAe,SAAI,GAClB,OAAO,CAAC,kBAAkB,CAAC;CAiB/B"}
+{"version":3,"file":"api-vc-manager.d.ts","sourceRoot":"","sources":["../../src/vc/api-vc-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EAEpB,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAI/C;;;GAGG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,UAAU,CAAY;IAE9B;;;;OAIG;gBACS,UAAU,CAAC,EAAE,UAAU;IAInC;;OAEG;IACG,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAgE7E;;OAEG;IACG,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IA6CrE;;OAEG;IACG,4BAA4B,CAChC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EAAE,EACrB,SAAS,EAAE,MAAM,EACjB,eAAe,SAAK,GACnB,OAAO,CAAC,kBAAkB,CAAC;IAkB9B;;OAEG;IACG,yBAAyB,CAC7B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EAAE,EACjB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,eAAe,SAAK,GACnB,OAAO,CAAC,kBAAkB,CAAC;IAkB9B;;OAEG;IACG,wBAAwB,CAC5B,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,EAC3D,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,eAAe,SAAK,GACnB,OAAO,CAAC,kBAAkB,CAAC;IAiB9B;;OAEG;IACG,oBAAoB,CACxB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,SAAS,GAAG,QAAQ,EAC3B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,SAAS,EAAE,MAAM,EACjB,eAAe,SAAI,GAClB,OAAO,CAAC,kBAAkB,CAAC;CAiB/B"}

package/dist/vc/vc-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vc-manager.d.ts","sourceRoot":"","sources":["../../src/vc/vc-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,UAAU,EACX,MAAM,UAAU,CAAA;AAEjB,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAE/C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAA;AAGvE,qBAAa,SAAS;IACpB,OAAO,CAAC,UAAU,CAAY;IAC9B,OAAO,CAAC,SAAS,CAAqC;IACtD,OAAO,CAAC,YAAY,CAAc;IAClC,OAAO,CAAC,mBAAmB,CAAqB;gBAG9C,UAAU,CAAC,EAAE,UAAU,EACvB,YAAY,CAAC,EAAE,YAAY,EAC3B,mBAAmB,CAAC,EAAE,mBAAmB;IAQ3C;;OAEG;IACH,OAAO,CAAC,+BAA+B;IAavC;;;OAGG;IACG,KAAK,CACT,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,GAAG,EACX,OAAO,EAAE;QACP,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,SAAS,CAAC,EAAE,MAAM,CAAA;KACnB,GACA,OAAO,CAAC,MAAM,CAAC;IAmGlB;;OAEG;YACW,mBAAmB;IA6BjC;;OAEG;IACG,WAAW,CACf,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,GAAG,EACX,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,CAAA;QACjB,UAAU,EAAE,MAAM,CAAA;KACnB,GACA,OAAO,CAAC,MAAM,CAAC;IAoClB;;OAEG;IACG,MAAM,CACV,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QACR,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,eAAe,CAAC,EAAE,MAAM,CAAA;QACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;KAC1B,GACA,OAAO,CAAC,GAAG,CAAC;IAkDf;;OAEG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK9D;;OAEG;IACH,gBAAgB,CAAC,QAAQ,EAAE,UAAU,GAAG,IAAI;IAI5C,OAAO,CAAC,wBAAwB;IA4BhC,OAAO,CAAC,uBAAuB;CA2BhC"}
+{"version":3,"file":"vc-manager.d.ts","sourceRoot":"","sources":["../../src/vc/vc-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgD,UAAU,EAAE,MAAM,UAAU,CAAA;AAEnF,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAE/C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAA;AAGvE,qBAAa,SAAS;IACpB,OAAO,CAAC,UAAU,CAAY;IAC9B,OAAO,CAAC,SAAS,CAAqC;IACtD,OAAO,CAAC,YAAY,CAAc;IAClC,OAAO,CAAC,mBAAmB,CAAqB;gBAG9C,UAAU,CAAC,EAAE,UAAU,EACvB,YAAY,CAAC,EAAE,YAAY,EAC3B,mBAAmB,CAAC,EAAE,mBAAmB;IAiB3C;;OAEG;IACH,OAAO,CAAC,+BAA+B;IAavC;;;OAGG;IACG,KAAK,CACT,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,GAAG,EACX,OAAO,EAAE;QACP,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,SAAS,CAAC,EAAE,MAAM,CAAA;KACnB,GACA,OAAO,CAAC,MAAM,CAAC;IAqGlB;;OAEG;YACW,mBAAmB;IAgCjC;;OAEG;IACG,WAAW,CACf,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,GAAG,EACX,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,CAAA;QACjB,UAAU,EAAE,MAAM,CAAA;KACnB,GACA,OAAO,CAAC,MAAM,CAAC;IAoClB;;OAEG;IACG,MAAM,CACV,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QACR,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,eAAe,CAAC,EAAE,MAAM,CAAA;QACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;KAC1B,GACA,OAAO,CAAC,GAAG,CAAC;IAgDf;;OAEG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK9D;;OAEG;IACH,gBAAgB,CAAC,QAAQ,EAAE,UAAU,GAAG,IAAI;IAI5C,OAAO,CAAC,wBAAwB;IA4BhC,OAAO,CAAC,uBAAuB;CA2BhC"}

package/dist/vp/vp-manager.d.ts

@@ -2,11 +2,44 @@ import { VerifiablePresentation, VPRequest } from '../types';
 import { KeyManager } from '../did/key-manager';
 export declare class VPManager {
     private keyManager;
+    /**
+     * 🔴 Deliberately does NOT call `SDJwtClient.setKeyManager` — that assigned a
+     * static, so constructing a VPManager repointed key resolution for every
+     * manager already alive. `presentOne` passes `this.keyManager` (#1449).
+     */
     constructor(keyManager?: KeyManager);
     /**
      * Create a SD-JWT presentation using the present() method
      * This properly binds the holder's key to the SD-JWT VC
      */
+    /**
+     * Separator between presentations in a multi-credential response.
+     *
+     * 🔴 A comma, because SD-JWT already owns `~`.
+     *
+     * Each presentation is `<issuer-jwt>~<disclosure>*~<kb-jwt>`, so splitting a
+     * bundle on `~` would take it apart at the wrong level. OID4VP carries
+     * several presentations as a JSON array; this transport has one string, so
+     * the array becomes a comma-joined list — a character that appears in
+     * neither base64url nor the SD-JWT grammar.
+     */
+    static readonly PRESENTATION_SEPARATOR = ",";
+    /**
+     * Build a presentation over one or more credentials.
+     *
+     * 🔴 Every credential gets its own presentation, and its own KB-JWT.
+     *
+     * An SD-JWT presentation binds one key-binding token to one credential —
+     * there is no place in that format for a second. So "present three
+     * credentials" is three presentations, joined, exactly as OID4VP carries an
+     * array of them. Each one proves holder possession of the credential it
+     * belongs to, which a single KB-JWT over a bundle could not do.
+     *
+     * This used to take `vcs[0]` and drop the rest in silence. The caller got
+     * back a presentation missing the authority it thought it was carrying, and
+     * found out at the verifier — if at all, since a delegation alone is often
+     * enough to reach a permit.
+     */
     create(vcs: string[], // Array of SD-JWT VC strings
     options: {
         holderDid: string;
@@ -14,6 +47,8 @@ export declare class VPManager {
         domain: string;
         purpose?: string;
     }): Promise<string>;
+    /** One credential, one KB-JWT. */
+    private presentOne;
     /**
      * Verify a Verifiable Presentation
      */

package/dist/vp/vp-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vp-manager.d.ts","sourceRoot":"","sources":["../../src/vp/vp-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAE5D,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAM/C,qBAAa,SAAS;IACpB,OAAO,CAAC,UAAU,CAAY;gBAElB,UAAU,CAAC,EAAE,UAAU;IAMnC;;;OAGG;IACG,MAAM,CACV,GAAG,EAAE,MAAM,EAAE,EAAE,6BAA6B;IAC5C,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,CAAA;QACjB,SAAS,EAAE,MAAM,CAAA;QACjB,MAAM,EAAE,MAAM,CAAA;QACd,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB,GACA,OAAO,CAAC,MAAM,CAAC;IA6ClB;;OAEG;IACG,MAAM,CACV,KAAK,EAAE,MAAM,EACb,OAAO,EAAE;QACP,iBAAiB,EAAE,MAAM,CAAA;QACzB,cAAc,EAAE,MAAM,CAAA;QACtB,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,GACA,OAAO,CAAC,sBAAsB,CAAC;IAwClC;;OAEG;IACH,aAAa,CACX,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE;QACN,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,eAAe,CAAC,EAAE,GAAG,CAAA;KACtB,GACA,SAAS;IAQZ;;OAEG;IACG,MAAM,CACV,KAAK,EAAE,MAAM,EACb,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,GAAG,CAAA;KAAE,CAAC;CAehD"}
+{"version":3,"file":"vp-manager.d.ts","sourceRoot":"","sources":["../../src/vp/vp-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAE5D,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAM/C,qBAAa,SAAS;IACpB,OAAO,CAAC,UAAU,CAAY;IAE9B;;;;OAIG;gBACS,UAAU,CAAC,EAAE,UAAU;IAInC;;;OAGG;IACH;;;;;;;;;;OAUG;IACH,MAAM,CAAC,QAAQ,CAAC,sBAAsB,OAAM;IAE5C;;;;;;;;;;;;;;;OAeG;IACG,MAAM,CACV,GAAG,EAAE,MAAM,EAAE,EAAE,6BAA6B;IAC5C,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,CAAA;QACjB,SAAS,EAAE,MAAM,CAAA;QACjB,MAAM,EAAE,MAAM,CAAA;QACd,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB,GACA,OAAO,CAAC,MAAM,CAAC;IAalB,kCAAkC;YACpB,UAAU;IA+CxB;;OAEG;IACG,MAAM,CACV,KAAK,EAAE,MAAM,EACb,OAAO,EAAE;QACP,iBAAiB,EAAE,MAAM,CAAA;QACzB,cAAc,EAAE,MAAM,CAAA;QACtB,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,GACA,OAAO,CAAC,sBAAsB,CAAC;IAwClC;;OAEG;IACH,aAAa,CACX,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE;QACN,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,eAAe,CAAC,EAAE,GAAG,CAAA;KACtB,GACA,SAAS;IAQZ;;OAEG;IACG,MAAM,CACV,KAAK,EAAE,MAAM,EACb,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,GAAG,CAAA;KAAE,CAAC;CAehD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vess-id/ai-identity",
-  "version": "0.19.0",
+  "version": "0.21.0",
   "description": "TypeScript SDK for AI Identity Layer",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -22,7 +22,7 @@
     "directory": "packages/sdk"
   },
   "dependencies": {
-    "@cedar-policy/cedar-wasm": "4.11.0",
+    "@cedar-policy/cedar-wasm": "4.11.2",
     "@sd-jwt/crypto-nodejs": "^0.15.0",
     "@sd-jwt/sd-jwt-vc": "^0.15.1",
     "@sd-jwt/types": "^0.15.0",
@@ -33,7 +33,7 @@
   },
   "devDependencies": {
     "@types/jest": "^29.5.14",
-    "@types/node": "^20.19.39",
+    "@types/node": "^22.19.17",
     "@types/uuid": "^9.0.8",
     "jest": "^29.7.0",
     "ts-jest": "^29.4.9",