Update did-jwks library to latest

[venables]

This updates the jwks-did-resolver package to 1.1.0 from 0.3.0 to ensure we have the latest supported version

Summary by CodeRabbit

• Chores
  • Updated jwks-did-resolver dependency to a newer version for improved stability and compatibility.
  • Added a release changeset documenting a patch release with notes about improved did:jwks support.

[coderabbitai]

Walkthrough

Updated packages/did/package.json to bump the jwks-did-resolver dependency from 0.3.0 to 1.1.0. Added a new changeset file .changeset/large-lines-wave.md declaring a patch release for @agentcommercekit/did with the description "Improve did:jwks support".

Changes

Cohort / File(s)	Summary
Dependency Version Update packages/did/package.json	Bumped jwks-did-resolver from 0.3.0 to 1.1.0 in dependencies.
Release Changeset .changeset/large-lines-wave.md	Added a changeset entry (patch) for @agentcommercekit/did with description "Improve did:jwks support".

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main change: updating the jwks-did-resolver dependency to the latest version, which is the primary purpose of the pull request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch venables/bump-did-jwks

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

.changeset/large-lines-wave.md (1)

5-5: Changelog description is too vague — prefer specifics.

"Improve did:jwks support" doesn't tell consumers what improved. A more useful entry would name the concrete change, e.g.:

Update jwks-did-resolver to 1.1.0, adding support for [specific key types / capabilities]

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.changeset/large-lines-wave.md at line 5, The changelog line "Improve
did:jwks support" is too vague; replace it with a specific description naming
the updated package/version and the concrete capability changes (for example:
"Update jwks-did-resolver to 1.1.0 — adds support for ES256 and RSA-OAEP key
types and improved JWKS caching"), or otherwise list the exact behaviors
fixed/added (package name, version, new key types, protocol changes, and any
breaking changes) so consumers immediately know what changed; edit the
.changeset/large-lines-wave.md entry to include those specifics.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.changeset/large-lines-wave.md:
- Line 2: Update the changeset for "@agentcommercekit/did" in
.changeset/large-lines-wave.md by changing the release type from "patch" to
"minor" and revise the changeset body to explicitly note the breaking change;
replace the existing description with: "Upgrade jwks-did-resolver to 1.1.0 for
RFC-compliant path-based DID resolution (breaking change: path resolution URLs
have changed)" so consumers know the path-based did:jwks resolution URLs have
changed and require attention.

---

Nitpick comments:
In @.changeset/large-lines-wave.md:
- Line 5: The changelog line "Improve did:jwks support" is too vague; replace it
with a specific description naming the updated package/version and the concrete
capability changes (for example: "Update jwks-did-resolver to 1.1.0 — adds
support for ES256 and RSA-OAEP key types and improved JWKS caching"), or
otherwise list the exact behaviors fixed/added (package name, version, new key
types, protocol changes, and any breaking changes) so consumers immediately know
what changed; edit the .changeset/large-lines-wave.md entry to include those
specifics.

[coderabbitai]

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

# Check the changeset file
cat .changeset/large-lines-wave.md

Repository: agentcommercekit/ack

Length of output: 128

---

🏁 Script executed:

# Check the did package.json to see the actual dependency change
cat packages/did/package.json | grep -A 20 -B 5 "jwks-did-resolver\|dependencies"

Repository: agentcommercekit/ack

Length of output: 757

---

🌐 Web query:

jwks-did-resolver npm package changelog 0.3.0 to 1.1.0 breaking changes

💡 Result:

jwks-did-resolver breaking changes from 0.3.0 → 1.1.0

Breaking change introduced in 1.1.0 (tagged Feb 21, 2026)

Path-based did:jwks identifiers resolve to different URLs than before. Root (no-path) DIDs are unchanged. [1][2]

Before (≤ 1.0.0, including 0.3.0): .well-known was placed under the DID path (RFC 8615-invalid), e.g.:

• https://example.com/tenant/.well-known/jwks.json (and similar patterns)

Now (1.1.0): resolution is RFC 8615 / RFC 8414 compliant: [2]

• Direct JWKS: https://example.com/tenant/jwks.json
• OIDC discovery fallback: https://example.com/.well-known/openid-configuration/tenant

Impact: if you used path DIDs (e.g. did:jwks:example.com:tenant), the resolver will now call different endpoints, so servers configured for the old (non-compliant) paths may fail until updated. [2]

0.3.0 → 1.0.0

I didn’t find any documented API-level breaking change in the repo history between these tags—only a doc/spec tweak and the 1.0.0 version tag itself are visible in the comparison metadata GitHub renders. [3]

---

Sources

[1] GitHub tags list showing jwks-did-resolver@0.3.0, @1.0.0, @1.1.0 (catena-labs/did-jwks) (github.com)
[2] GitHub compare view containing the 1.1.0 change description (“RFC 8615/8414-compliant” path resolution and new URL chain) (github.com)
[3] GitHub compare view for jwks-did-resolver@0.3.0...@1.0.0 showing only high-level commit metadata (no explicit breaking notes) (github.com)

Citations:

• 1: https://github.com/catena-labs/did-jwks/tags
• 2: catena-labs/did-jwks@jwks-did-resolver@0.3.0...jwks-did-resolver@1.1.0
• 3: catena-labs/did-jwks@jwks-did-resolver@0.3.0...jwks-did-resolver@1.0.0

---

Change bump type from patch to minor — jwks-did-resolver 1.1.0 contains a breaking change.

The jwks-did-resolver upgrade from 0.3.0 to 1.1.0 introduces a breaking change in how path-based did:jwks identifiers are resolved. In 1.1.0, the resolver now uses RFC 8615/8414-compliant URLs (e.g., https://example.com/tenant/jwks.json) instead of the old non-compliant paths (e.g., https://example.com/tenant/.well-known/jwks.json). If servers or clients in the ecosystem are configured for the old resolution paths, this upgrade will cause silent failures.

Semver requires that breaking changes trigger at least a minor bump (not patch). Additionally, update the changeset description to explicitly note the breaking change: "Upgrade jwks-did-resolver to 1.1.0 for RFC-compliant path-based DID resolution (breaking change: path resolution URLs have changed)".

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.changeset/large-lines-wave.md at line 2, Update the changeset for
"@agentcommercekit/did" in .changeset/large-lines-wave.md by changing the
release type from "patch" to "minor" and revise the changeset body to explicitly
note the breaking change; replace the existing description with: "Upgrade
jwks-did-resolver to 1.1.0 for RFC-compliant path-based DID resolution (breaking
change: path resolution URLs have changed)" so consumers know the path-based
did:jwks resolution URLs have changed and require attention.