From 200cc57436d9a58ed813a108a4289c801f19c347 Mon Sep 17 00:00:00 2001
From: Tymofii Pidlisnyi <tima@aeoess.com>
Date: Sat, 17 Oct 2026 12:35:09 -0700
Subject: [PATCH 1/2] fix(sdjwt): dump cnf.jwk in JSON mode so keys with "use"
 verify

---
 code/sdk/python/ap2/sdk/sdjwt/common.py      |  2 +-
 code/sdk/python/ap2/tests/kb_sd_jwt_tests.py | 21 ++++++++++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/code/sdk/python/ap2/sdk/sdjwt/common.py b/code/sdk/python/ap2/sdk/sdjwt/common.py
index cdea78ae..cc540b75 100644
--- a/code/sdk/python/ap2/sdk/sdjwt/common.py
+++ b/code/sdk/python/ap2/sdk/sdjwt/common.py
@@ -83,7 +83,7 @@ def cnf_jwk(self) -> JWK | None:
         cnf = self._find_cnf()
         if isinstance(cnf, dict) and 'jwk' in cnf:
             jwk_model = JsonWebKey.model_validate(cnf['jwk'])
-            return JWK(**jwk_model.model_dump(exclude_none=True))
+            return JWK(**jwk_model.model_dump(mode='json', exclude_none=True))
         return None
 
     def _find_cnf(self) -> dict[str, Any] | None:
diff --git a/code/sdk/python/ap2/tests/kb_sd_jwt_tests.py b/code/sdk/python/ap2/tests/kb_sd_jwt_tests.py
index 7f0dc80f..1d4fdeb3 100644
--- a/code/sdk/python/ap2/tests/kb_sd_jwt_tests.py
+++ b/code/sdk/python/ap2/tests/kb_sd_jwt_tests.py
@@ -137,6 +137,27 @@ def test_verify_accepts_valid_hop(issuer_key):
     )
 
 
+def test_verify_accepts_cnf_jwk_with_use_and_alg(issuer_key):
+    """A prior hop whose ``cnf.jwk`` carries ``use`` and ``alg`` still verifies."""
+    holder = JWK.generate(kty='EC', crv='P-256', use='sig', alg='ES256')
+    assert json.loads(holder.export_public())['use'] == 'sig'
+    prev = _root_open(issuer_key, holder)
+    result = _create(
+        prev_token=prev,
+        holder_key=holder,
+        payload=sample_payment_mandate(),
+        aud='a',
+        nonce='n',
+    )
+    _verify(
+        result.sd_jwt_issuance,
+        prev,
+        issuer_key,
+        expected_aud='a',
+        expected_nonce='n',
+    )
+
+
 def test_verify_accepts_issuer_jwt_hash_mode(issuer_key):
     holder = JWK.generate(kty='EC', crv='P-256')
     prev = _root_open(issuer_key, holder)

From 8a2329d13c6ca3d049c9303f7f60f6bb2b9275f1 Mon Sep 17 00:00:00 2001
From: Tymofii Pidlisnyi <tima@aeoess.com>
Date: Sun, 18 Oct 2026 16:48:05 -0700
Subject: [PATCH 2/2] chore(cspell): add sdjwt to custom words

---
 .cspell/custom-words.txt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.cspell/custom-words.txt b/.cspell/custom-words.txt
index ce73c361..e11ba577 100644
--- a/.cspell/custom-words.txt
+++ b/.cspell/custom-words.txt
@@ -149,6 +149,7 @@ ropeproject
 RPCURL
 Rulebook
 screenreaders
+sdjwt
 setlocal
 sharedpref
 Shopcider