Security & Build: Remove unsigned payload bypass and fix build determinism

docs/demos/example-identity.mdx

@@ -9,16 +9,14 @@ This example demonstrates an [ACK-ID](https://agentcommercekit.com/ack-id) and [
 
 The API supports issuing, verifying, and revoking two primary credential types:
 
-- **`ControllerCredential`**: proves ownership of DIDs (part of ACK-ID).
-- **`PaymentReceiptCredential`**: provides proof of payment meeting a Payment Request (part of ACK-Pay).
+- **`ControllerCredential`**: Proves ownership of DIDs as part of ACK-ID.
+- **`PaymentReceiptCredential`**: Provides proof of payment that satisfies a Payment Request as part of ACK-Pay.
 
-The issuer implements credential revocation using [Bitstring Status List](https://www.w3.org/TR/vc-bitstring-status-list/), a privacy-preserving and efficient revocation list method.
+The issuer implements credential revocation using [Bitstring Status List](https://www.w3.org/TR/vc-bitstring-status-list/), a privacy-preserving and efficient revocation-list method.
 
 ## Installation and Setup
 
-Install dependencies and prepare your environment.
-
-From within the issuer example directory (e.g., from project root: `./examples/issuer`) execute the setup:
+Install dependencies and prepare your environment. From within the issuer example directory (for example, `./examples/issuer` from the project root), execute:
 
 ```sh
 pnpm run setup
@@ -32,26 +30,26 @@ Start the API server locally:
 pnpm run dev
 ```
 
-The server runs at: [http://localhost:3456](http://localhost:3456)
+The server runs at <http://localhost:3456>.
 
 ## API Endpoints
 
 ### Authentication
 
-All endpoints require a **signed payload** (JWT) proving DID ownership. During local development, include the `X-Payload-Issuer` header with a resolvable DID-URI to bypass signature verification.
+Mutation endpoints require a signed payload (JWT) proving DID ownership. Read-only GET endpoints do not require a signed payload.
 
 ### Response Format
 
-All API responses use this JSON structure:
+Credential endpoints use this JSON structure:
 
 ```json
 {
   "ok": true,
-  "data": <data>
+  "data": "<data>"
 }
 ```
 
-or
+or:
 
 ```json
 {
@@ -60,120 +58,118 @@ or
 }
 ```
 
-### Controller Credential Endpoints
+`GET /status/:listId` returns a bare `BitstringStatusListCredential`, and `GET /.well-known/did.json` returns a bare DID document without the `{ ok, data }` envelope.
+
+## Controller Credential Endpoints
 
-#### `POST /credentials/controller`
+### POST /credentials/controller
 
-Issue a ControllerCredential proving DID control.
+Issue a `ControllerCredential` proving DID control.
 
-**Sample cURL:**
+#### Sample cURL
 
 ```sh
+# NOTE: Replace this non-runnable placeholder with a valid signed JWT.
 curl --request POST \
   --url http://localhost:3456/credentials/controller \
   --header 'Content-Type: application/json' \
-  --header 'X-Payload-Issuer: did:web:0.0.0.0%3A3458:controller' \
   --data '{
-  "controller": "did:web:0.0.0.0%3A3458:controller",
-  "subject": "did:web:0.0.0.0%3A3458:agent"
+  "payload": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJkaWQ6d2ViOmV4YW1wbGUuY29tIn0.signature"
 }'
 ```
 
-#### `GET /credentials/controller/:id`
+### GET /credentials/controller/:id
 
-Retrieve a ControllerCredential by ID.
+Retrieve a `ControllerCredential` by ID.
 
-**Sample cURL:**
+#### Sample cURL
 
 ```sh
 curl --request GET \
   --url http://localhost:3456/credentials/controller/abc123
 ```
 
-#### `DELETE /credentials/controller`
+### DELETE /credentials/controller
 
-Revoke a ControllerCredential by ID.
+Revoke a `ControllerCredential` by ID.
 
-**Sample cURL:**
+#### Sample cURL
 
 ```sh
+# NOTE: Replace this non-runnable placeholder with a valid signed JWT.
 curl --request DELETE \
   --url http://localhost:3456/credentials/controller \
   --header 'Content-Type: application/json' \
-  --header 'X-Payload-Issuer: did:web:0.0.0.0%3A3458:controller' \
   --data '{
-  "id": "abc123"
+  "payload": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJkaWQ6d2ViOmV4YW1wbGUuY29tIn0.signature"
 }'
 ```
 
-### Payment Receipt Endpoints
+## Payment Receipt Endpoints
 
-#### `POST /credentials/receipts`
+### POST /credentials/receipts
 
-Issue a PaymentReceiptCredential.
+Issue a `PaymentReceiptCredential`.
 
-**Sample cURL:**
+#### Sample cURL
 
 ```sh
+# NOTE: Replace this non-runnable placeholder with a valid signed JWT.
 curl --request POST \
   --url http://localhost:3456/credentials/receipts \
   --header 'Content-Type: application/json' \
-  --header 'X-Payload-Issuer: did:web:0.0.0.0%3A3458:wallet' \
   --data '{
-  "metadata": { "txHash": "0x123abc456def" },
-  "payerDid": "did:web:0.0.0.0%3A3458:wallet",
-  "paymentRequestToken": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9...",
-  "paymentOptionId": "option1"
+  "payload": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJkaWQ6d2ViOmV4YW1wbGUuY29tIn0.signature"
 }'
 ```
 
-#### `GET /credentials/receipts/:id`
+### GET /credentials/receipts/:id
 
-Retrieve a PaymentReceiptCredential by ID.
+Retrieve a `PaymentReceiptCredential` by ID.
 
-**Sample cURL:**
+#### Sample cURL
 
 ```sh
 curl --request GET \
   --url http://localhost:3456/credentials/receipts/abc123
 ```
 
-#### `DELETE /credentials/receipts`
+### DELETE /credentials/receipts
 
-Revoke a PaymentReceiptCredential by ID.
+Revoke a `PaymentReceiptCredential` by ID.
 
-**Sample cURL:**
+#### Sample cURL
 
 ```sh
+# NOTE: Replace this non-runnable placeholder with a valid signed JWT.
 curl --request DELETE \
   --url http://localhost:3456/credentials/receipts \
   --header 'Content-Type: application/json' \
-  --header 'X-Payload-Issuer: did:web:0.0.0.0%3A3458:payee' \
   --data '{
-  "id": "abc123"
+  "payload": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJkaWQ6d2ViOmV4YW1wbGUuY29tIn0.signature"
 }'
 ```
 
-### Status List Endpoint
+## Status List Endpoint
 
-#### `GET /status/:listId`
+### GET /status/:listId
 
-Retrieve Bitstring Status List credential for revocation checks.
+Retrieve the Bitstring Status List credential for revocation checks.
 
-**Sample cURL:**
+#### Sample cURL
 
 ```sh
 curl --request GET \
-  --url http://localhost:3456/status/1
+  --url http://localhost:3456/status/0
 ```
 
-### DID Document Endpoint
+## DID Document Endpoint
 
-#### `GET /.well-known/did.json`
+### GET /.well-known/did.json
 
 Retrieve the issuer's DID Document.
 
-**Sample cURL:**
+#### Sample cURL
 
 ```sh
 curl --request GET \
@@ -183,4 +179,4 @@ curl --request GET \
 ## References
 
 - [Verifiable Credentials Data Model Specification](https://www.w3.org/TR/vc-data-model/)
-- [This Example's Source Code](https://github.com/agentcommercekit/ack/tree/main/examples/issuer)
+- [This example's source code](https://github.com/agentcommercekit/ack/tree/main/examples/issuer)

examples/issuer/.env.example

@@ -1,8 +1,2 @@
 BASE_URL="http://localhost:3456"
 NODE_ENV="development"
-
-# Local-development ONLY: when "true", accept unsigned request payloads with an
-# `X-Payload-Issuer` header instead of a signed JWT. This bypasses signature
-# verification (authentication), so it is off by default. Never enable it in a
-# deployed environment.
-# ALLOW_UNSIGNED_PAYLOADS="true"