@vess-id/ai-identity 0.5.0-alpha.16 → 0.5.0-alpha.17

package/dist/index.d.mts

@@ -3493,20 +3493,28 @@ declare class APIVCManager {
 
 /**
  * Single source of truth for Key Binding JWT (KB-JWT) issuance shared across
- * the AIdentity stack. Three production code paths build KB-JWTs and they
+ * the AIdentity stack. Four production code paths build KB-JWTs and they
  * MUST stay byte-for-byte equivalent so a presentation built on one side is
  * accepted by the verifier on the other:
  *
  *   - SDK clients via `VPManager.create()` (this package)
  *   - API service via `packages/api/src/vp/vp-creation.service.ts`
  *   - Remote MCP via `packages/remote-mcp/src/services/vp-creation.service.ts`
+ *   - agentd (`@vess-id/vess`) via `VPBuilder.buildVP()`
+ *     (`packages/agentd/src/wallet/vp-builder.ts`)
  *
- * Historically each path had its own copy of this logic, and PR #391 (the
+ * Historically each path had its own copy of this logic. PR #391 (the
  * commit that made `exp` REQUIRED on the verifier side) updated only two of
- * the three. The SDK was missed and every SDK-built VP started failing at
- * verification time. This module exists so that a future verifier change
- * cannot drift from the issuer side: any update lands in one place and all
- * three paths inherit it.
+ * the three issuer paths known at the time; the SDK was missed and every
+ * SDK-built VP started failing at verification time. The follow-up
+ * consolidation (commit 02b169aa) brought the SDK in line, but agentd —
+ * which had its own KB-JWT literal in `wallet/vp-builder.ts` — was not
+ * recognized as a fourth issuer. Staging then rejected every VP from
+ * `@vess-id/vess` agentd alpha builds with `KB-JWT missing exp` until the
+ * agentd hotfix (this commit's cohort) wired its VPBuilder through
+ * `buildKbJwtPayload()`. This module exists so that a future verifier
+ * change cannot drift from the issuer side: any update lands in one place
+ * and all four paths inherit it.
  */
 /**
  * Default KB-JWT lifetime in seconds. Mirrors the cap enforced by the API's