@docknetwork/wallet-sdk-core 1.7.7-alpha.0 → 1.9.0

package/src/cloud-wallet.test.js

@@ -0,0 +1,369 @@
+const EventEmitter = require('events');
+const {
+  generateCloudWalletMasterKey,
+  recoverCloudWalletMasterKey,
+  initializeCloudWallet,
+  derivePasskeyVaultKeys,
+  derivePasskeyEncryptionKey,
+  initializePasskeyKeyMappingVault,
+  enrollUserWithPasskey,
+  authenticateWithPasskey,
+  initializeCloudWalletWithPasskey,
+  PASSKEY_KEY_MAPPING_TYPE,
+} = require('./cloud-wallet');
+
+const mockInitializeFromMasterKey = jest.fn().mockResolvedValue(undefined);
+const mockInitializeFromMnemonic = jest.fn().mockResolvedValue(undefined);
+const mockFind = jest.fn().mockResolvedValue({documents: []});
+const mockDeriveBiometricKey = jest.fn().mockReturnValue(Buffer.alloc(32));
+const mockDeriveKeys = jest.fn().mockResolvedValue({
+  hmacKey: 'mock-hmac',
+  agreementKey: 'mock-agreement',
+  verificationKey: 'mock-verification',
+});
+const mockInitialize = jest.fn().mockResolvedValue(undefined);
+const mockDeriveBiometricEncryptionKey = jest.fn().mockResolvedValue({
+  key: Buffer.alloc(32),
+  iv: Buffer.alloc(16),
+});
+const mockEncryptMasterKey = jest
+  .fn()
+  .mockResolvedValue(new Uint8Array([99, 99]));
+const mockDecryptMasterKey = jest
+  .fn()
+  .mockResolvedValue(new Uint8Array([1, 2, 3]));
+const mockGetController = jest.fn().mockResolvedValue('mock-controller');
+const mockInsert = jest.fn().mockResolvedValue(undefined);
+
+jest.mock('@docknetwork/wallet-sdk-wasm/src/services/edv', () => ({
+  edvService: {
+    initializeFromMasterKey: (...args) => mockInitializeFromMasterKey(...args),
+    initializeFromMnemonic: (...args) => mockInitializeFromMnemonic(...args),
+    find: (...args) => mockFind(...args),
+    deriveBiometricKey: (...args) => mockDeriveBiometricKey(...args),
+    deriveKeys: (...args) => mockDeriveKeys(...args),
+    initialize: (...args) => mockInitialize(...args),
+    deriveBiometricEncryptionKey: (...args) =>
+      mockDeriveBiometricEncryptionKey(...args),
+    encryptMasterKey: (...args) => mockEncryptMasterKey(...args),
+    decryptMasterKey: (...args) => mockDecryptMasterKey(...args),
+    getController: (...args) => mockGetController(...args),
+    insert: (...args) => mockInsert(...args),
+  },
+}));
+
+const mockMnemonicGenerate = jest.fn();
+const mockMnemonicToMiniSecret = jest.fn();
+
+jest.mock('@docknetwork/wallet-sdk-wasm/src/services/util-crypto', () => ({
+  utilCryptoService: {
+    mnemonicGenerate: (...args) => mockMnemonicGenerate(...args),
+    mnemonicToMiniSecret: (...args) => mockMnemonicToMiniSecret(...args),
+  },
+}));
+
+function createMockDataStore() {
+  return {
+    events: new EventEmitter(),
+    documents: {
+      getDocumentById: jest.fn(),
+      addDocument: jest.fn(),
+      removeDocument: jest.fn(),
+      updateDocument: jest.fn(),
+      getAllDocuments: jest.fn().mockResolvedValue([]),
+    },
+  };
+}
+
+describe('cloud-wallet', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe('generateCloudWalletMasterKey', () => {
+    it('should generate a mnemonic and master key', async () => {
+      const mockMnemonic =
+        'test mnemonic phrase with twelve words one two three four five six';
+      const mockMasterKey = new Uint8Array([1, 2, 3, 4]);
+
+      mockMnemonicGenerate.mockResolvedValue(mockMnemonic);
+      mockMnemonicToMiniSecret.mockResolvedValue(mockMasterKey);
+
+      const result = await generateCloudWalletMasterKey();
+
+      expect(result.mnemonic).toBe(mockMnemonic);
+      expect(result.masterKey).toBeInstanceOf(Uint8Array);
+      expect(result.masterKey).toEqual(mockMasterKey);
+    });
+
+    it('should convert plain object to Uint8Array when JSON-RPC serialization occurs', async () => {
+      const mockMnemonic = 'test mnemonic';
+      const serializedKey = {0: 10, 1: 20, 2: 30};
+
+      mockMnemonicGenerate.mockResolvedValue(mockMnemonic);
+      mockMnemonicToMiniSecret.mockResolvedValue(serializedKey);
+
+      const result = await generateCloudWalletMasterKey();
+
+      expect(result.masterKey).toBeInstanceOf(Uint8Array);
+      expect(result.masterKey).toEqual(new Uint8Array([10, 20, 30]));
+    });
+  });
+
+  describe('recoverCloudWalletMasterKey', () => {
+    it('should recover master key from mnemonic', async () => {
+      const mockMasterKey = new Uint8Array([5, 6, 7, 8]);
+      mockMnemonicToMiniSecret.mockResolvedValue(mockMasterKey);
+
+      const result = await recoverCloudWalletMasterKey('test mnemonic');
+
+      expect(result).toBeInstanceOf(Uint8Array);
+      expect(result).toEqual(mockMasterKey);
+      expect(mockMnemonicToMiniSecret).toHaveBeenCalledWith('test mnemonic');
+    });
+
+    it('should convert plain object to Uint8Array when JSON-RPC serialization occurs', async () => {
+      const serializedKey = {0: 100, 1: 200};
+      mockMnemonicToMiniSecret.mockResolvedValue(serializedKey);
+
+      const result = await recoverCloudWalletMasterKey('test mnemonic');
+
+      expect(result).toBeInstanceOf(Uint8Array);
+      expect(result).toEqual(new Uint8Array([100, 200]));
+    });
+  });
+
+  describe('initializeCloudWallet', () => {
+    const edvUrl = 'https://edv.example.com';
+    const authKey = 'test-auth-key';
+
+    it('should use masterKey when both masterKey and mnemonic are provided', async () => {
+      const masterKey = new Uint8Array([1, 2, 3]);
+      const dataStore = createMockDataStore();
+
+      await initializeCloudWallet({
+        dataStore,
+        edvUrl,
+        authKey,
+        masterKey,
+        mnemonic: 'should be ignored',
+      });
+
+      expect(mockInitializeFromMasterKey).toHaveBeenCalledWith({
+        masterKey,
+        edvUrl,
+        authKey,
+      });
+      expect(mockInitializeFromMnemonic).not.toHaveBeenCalled();
+    });
+
+    it('should use mnemonic when masterKey is not provided', async () => {
+      const mnemonic = 'test mnemonic phrase';
+      const dataStore = createMockDataStore();
+
+      await initializeCloudWallet({
+        dataStore,
+        edvUrl,
+        authKey,
+        mnemonic,
+      });
+
+      expect(mockInitializeFromMnemonic).toHaveBeenCalledWith({
+        mnemonic,
+        edvUrl,
+        authKey,
+      });
+      expect(mockInitializeFromMasterKey).not.toHaveBeenCalled();
+    });
+
+    it('should throw when neither masterKey nor mnemonic is provided', async () => {
+      const dataStore = createMockDataStore();
+
+      await expect(
+        initializeCloudWallet({dataStore, edvUrl, authKey}),
+      ).rejects.toThrow('Either masterKey or mnemonic is required');
+    });
+  });
+
+  describe('passkey functions', () => {
+    const edvUrl = 'https://edv.example.com';
+    const authKey = 'test-auth-key';
+    const prfOutput = new Uint8Array(32).fill(42);
+    const identifier = 'user@example.com';
+
+    describe('derivePasskeyVaultKeys', () => {
+      it('should derive vault keys from PRF output and identifier', async () => {
+        const result = await derivePasskeyVaultKeys(prfOutput, identifier);
+
+        expect(mockDeriveBiometricKey).toHaveBeenCalledWith(
+          expect.any(Buffer),
+          identifier,
+        );
+        expect(mockDeriveKeys).toHaveBeenCalled();
+        expect(result).toEqual({
+          hmacKey: 'mock-hmac',
+          agreementKey: 'mock-agreement',
+          verificationKey: 'mock-verification',
+        });
+      });
+
+      it('should convert prfOutput to Buffer before calling deriveBiometricKey', async () => {
+        await derivePasskeyVaultKeys(prfOutput, identifier);
+
+        const bufferArg = mockDeriveBiometricKey.mock.calls[0][0];
+        expect(Buffer.isBuffer(bufferArg)).toBe(true);
+        expect(bufferArg).toEqual(Buffer.from(prfOutput));
+      });
+    });
+
+    describe('derivePasskeyEncryptionKey', () => {
+      it('should derive encryption key from PRF output and identifier', async () => {
+        const result = await derivePasskeyEncryptionKey(prfOutput, identifier);
+
+        expect(mockDeriveBiometricEncryptionKey).toHaveBeenCalledWith(
+          expect.any(Buffer),
+          identifier,
+        );
+        expect(result).toHaveProperty('key');
+        expect(result).toHaveProperty('iv');
+      });
+    });
+
+    describe('initializePasskeyKeyMappingVault', () => {
+      it('should initialize the EDV with derived vault keys', async () => {
+        await initializePasskeyKeyMappingVault(
+          edvUrl,
+          authKey,
+          prfOutput,
+          identifier,
+        );
+
+        expect(mockInitialize).toHaveBeenCalledWith({
+          hmacKey: 'mock-hmac',
+          agreementKey: 'mock-agreement',
+          verificationKey: 'mock-verification',
+          edvUrl,
+          authKey,
+        });
+      });
+    });
+
+    describe('enrollUserWithPasskey', () => {
+      beforeEach(() => {
+        mockMnemonicGenerate.mockResolvedValue('mock mnemonic phrase');
+        mockMnemonicToMiniSecret.mockResolvedValue(
+          new Uint8Array([1, 2, 3, 4]),
+        );
+      });
+
+      it('should generate a master key and store it encrypted in the vault', async () => {
+        const result = await enrollUserWithPasskey(
+          edvUrl,
+          authKey,
+          prfOutput,
+          identifier,
+        );
+
+        expect(result.mnemonic).toBe('mock mnemonic phrase');
+        expect(result.masterKey).toEqual(new Uint8Array([1, 2, 3, 4]));
+      });
+
+      it('should encrypt the master key before storing', async () => {
+        await enrollUserWithPasskey(edvUrl, authKey, prfOutput, identifier);
+
+        expect(mockEncryptMasterKey).toHaveBeenCalledWith(
+          new Uint8Array([1, 2, 3, 4]),
+          expect.any(Buffer),
+          expect.any(Buffer),
+        );
+      });
+
+      it('should insert document with PASSKEY_KEY_MAPPING_TYPE', async () => {
+        await enrollUserWithPasskey(edvUrl, authKey, prfOutput, identifier);
+
+        expect(mockInsert).toHaveBeenCalledWith({
+          document: {
+            content: {
+              id: 'mock-controller#master-key',
+              type: PASSKEY_KEY_MAPPING_TYPE,
+              encryptedKey: expect.objectContaining({
+                data: expect.any(Array),
+                iv: expect.any(Array),
+              }),
+            },
+          },
+        });
+      });
+    });
+
+    describe('authenticateWithPasskey', () => {
+      it('should initialize vault and retrieve decrypted master key', async () => {
+        mockFind.mockResolvedValueOnce({
+          documents: [
+            {
+              content: {
+                id: 'mock-controller#master-key',
+                encryptedKey: {
+                  data: [99, 99],
+                  iv: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
+                },
+              },
+            },
+          ],
+        });
+
+        const result = await authenticateWithPasskey(
+          edvUrl,
+          authKey,
+          prfOutput,
+          identifier,
+        );
+
+        expect(mockInitialize).toHaveBeenCalled();
+        expect(mockDecryptMasterKey).toHaveBeenCalled();
+        expect(result).toEqual(new Uint8Array([1, 2, 3]));
+      });
+
+      it('should throw when no key mapping document is found', async () => {
+        mockFind.mockResolvedValueOnce({documents: []});
+
+        await expect(
+          authenticateWithPasskey(edvUrl, authKey, prfOutput, identifier),
+        ).rejects.toThrow('Authentication failed: Invalid identifier');
+      });
+    });
+
+    describe('initializeCloudWalletWithPasskey', () => {
+      it('should authenticate and initialize cloud wallet', async () => {
+        mockFind.mockResolvedValueOnce({
+          documents: [
+            {
+              content: {
+                id: 'mock-controller#master-key',
+                encryptedKey: {
+                  data: [99, 99],
+                  iv: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
+                },
+              },
+            },
+          ],
+        });
+
+        const dataStore = createMockDataStore();
+        await initializeCloudWalletWithPasskey(
+          edvUrl,
+          authKey,
+          prfOutput,
+          identifier,
+          dataStore,
+        );
+
+        expect(mockInitializeFromMasterKey).toHaveBeenCalledWith({
+          masterKey: new Uint8Array([1, 2, 3]),
+          edvUrl,
+          authKey,
+        });
+      });
+    });
+  });
+});

package/src/cloud-wallet.ts

@@ -15,6 +15,7 @@ import { utilCryptoService } from '@docknetwork/wallet-sdk-wasm/src/services/uti
 export const SYNC_MARKER_TYPE = 'SyncMarkerDocument';
 export const MNEMONIC_WORD_COUNT = 12;
 export const KEY_MAPPING_TYPE = 'KeyMappingDocument';
+export const PASSKEY_KEY_MAPPING_TYPE = 'PasskeyKeyMappingDocument';
 const MASTER_KEY_SUFFIX = 'master-key';
 
 /**
@@ -269,6 +270,167 @@ export async function initializeCloudWalletWithBiometrics(
   });
 }
 
+/**
+ * Derives EDV keys from passkey PRF output for the KeyMappingVault
+ * @param prfOutput 32-byte PRF output from WebAuthn assertion
+ * @param identifier User's identifier as additional entropy (email, phone number, etc.)
+ * @returns Keys for accessing the KeyMappingVault
+ */
+export async function derivePasskeyVaultKeys(
+  prfOutput: Uint8Array,
+  identifier: string
+): Promise<{ hmacKey: string; agreementKey: string; verificationKey: string }> {
+  const seedBuffer = deriveBiometricKey(Buffer.from(prfOutput), identifier);
+  return edvService.deriveKeys(new Uint8Array(seedBuffer));
+}
+
+/**
+ * Generates a key for encrypting/decrypting the master key from passkey PRF output
+ * @param prfOutput 32-byte PRF output from WebAuthn assertion
+ * @param identifier User's identifier as salt (email, phone number, etc.)
+ * @returns Encryption key and IV for AES encryption
+ */
+export async function derivePasskeyEncryptionKey(
+  prfOutput: Uint8Array,
+  identifier: string
+): Promise<{ key: Buffer; iv: Buffer }> {
+  return edvService.deriveBiometricEncryptionKey(Buffer.from(prfOutput), identifier);
+}
+
+/**
+ * Initializes the KeyMappingVault using passkey PRF output
+ * @param edvUrl URL for the edv
+ * @param authKey Auth key for the edv
+ * @param prfOutput 32-byte PRF output from WebAuthn assertion
+ * @param identifier User's identifier (email, phone number, etc.)
+ * @returns Initialized EDV service
+ */
+export async function initializePasskeyKeyMappingVault(
+  edvUrl: string,
+  authKey: string,
+  prfOutput: Uint8Array,
+  identifier: string
+): Promise<typeof edvService> {
+  const {
+    hmacKey,
+    agreementKey,
+    verificationKey
+  } = await derivePasskeyVaultKeys(prfOutput, identifier);
+
+  const keyMappingEdvService = edvService;
+  await keyMappingEdvService.initialize({
+    hmacKey,
+    agreementKey,
+    verificationKey,
+    edvUrl,
+    authKey
+  });
+
+  return keyMappingEdvService;
+}
+
+/**
+ * Enrolls a user by creating a passkey-protected master key in the KeyMappingVault
+ * @param edvUrl URL for the edv
+ * @param authKey Auth key for the edv
+ * @param prfOutput 32-byte PRF output from WebAuthn assertion
+ * @param identifier User's identifier (email, phone number, etc.)
+ * @returns The master key and mnemonic for backup
+ */
+export async function enrollUserWithPasskey(
+  edvUrl: string,
+  authKey: string,
+  prfOutput: Uint8Array,
+  identifier: string
+): Promise<{ masterKey: Uint8Array; mnemonic: string }> {
+  const keyMappingEdv = await initializePasskeyKeyMappingVault(
+    edvUrl,
+    authKey,
+    prfOutput,
+    identifier
+  );
+  const { mnemonic, masterKey } = await generateCloudWalletMasterKey();
+  const { key: encryptionKey, iv } = await derivePasskeyEncryptionKey(prfOutput, identifier);
+  const encryptedMasterKey = await encryptMasterKey(masterKey, encryptionKey, iv);
+
+  const encryptedData = {
+    data: Array.from(encryptedMasterKey),
+    iv: Array.from(iv)
+  };
+
+  const contentId = `${await keyMappingEdv.getController()}#${MASTER_KEY_SUFFIX}`;
+
+  await keyMappingEdv.insert({
+    document: {
+      content: {
+        id: contentId,
+        type: PASSKEY_KEY_MAPPING_TYPE,
+        encryptedKey: encryptedData
+      }
+    }
+  });
+
+  return { masterKey, mnemonic };
+}
+
+/**
+ * Authenticates a user with passkey PRF output and identifier
+ * @param edvUrl URL for the edv
+ * @param authKey Auth key for the edv
+ * @param prfOutput 32-byte PRF output from WebAuthn assertion
+ * @param identifier User's identifier (email, phone number, etc.)
+ * @returns The decrypted master key for CloudWalletVault
+ */
+export async function authenticateWithPasskey(
+  edvUrl: string,
+  authKey: string,
+  prfOutput: Uint8Array,
+  identifier: string
+): Promise<Uint8Array> {
+  const keyMappingEdv = await initializePasskeyKeyMappingVault(
+    edvUrl,
+    authKey,
+    prfOutput,
+    identifier
+  );
+  const { key: decryptionKey } = await derivePasskeyEncryptionKey(prfOutput, identifier);
+
+  const contentId = `${await keyMappingEdv.getController()}#${MASTER_KEY_SUFFIX}`;
+
+  return getKeyMappingMasterKey(keyMappingEdv, contentId, decryptionKey);
+}
+
+/**
+ * Initializes the Cloud Wallet using passkey authentication
+ * @param edvUrl Cloud wallet vault URL
+ * @param authKey Cloud wallet auth key
+ * @param prfOutput 32-byte PRF output from WebAuthn assertion
+ * @param identifier User's identifier (email, phone number, etc.)
+ * @param dataStore Optional data store for the wallet
+ * @returns Initialized cloud wallet
+ */
+export async function initializeCloudWalletWithPasskey(
+  edvUrl: string,
+  authKey: string,
+  prfOutput: Uint8Array,
+  identifier: string,
+  dataStore?: any
+): Promise<any> {
+  const masterKey = await authenticateWithPasskey(
+    edvUrl,
+    authKey,
+    prfOutput,
+    identifier
+  );
+
+  return initializeCloudWallet({
+    dataStore,
+    edvUrl,
+    authKey,
+    masterKey
+  });
+}
+
 interface QueuedOperation {
   operation: () => Promise<any>;
   resolve: (value: any) => void;
@@ -283,7 +445,12 @@ interface DocumentQueue {
 export async function generateCloudWalletMasterKey(): Promise<{ mnemonic: string; masterKey: Uint8Array }> {
   const mnemonic = await utilCryptoService.mnemonicGenerate(MNEMONIC_WORD_COUNT);
 
-  const masterKey = await utilCryptoService.mnemonicToMiniSecret(mnemonic);
+  const masterKeyResult = await utilCryptoService.mnemonicToMiniSecret(mnemonic);
+
+  // Ensure masterKey is a proper Uint8Array (JSON-RPC serialization converts it to a plain object)
+  const masterKey = masterKeyResult instanceof Uint8Array
+    ? masterKeyResult
+    : new Uint8Array(Object.values(masterKeyResult));
 
   return {
     mnemonic,
@@ -292,35 +459,47 @@ export async function generateCloudWalletMasterKey(): Promise<{ mnemonic: string
 }
 
 export async function recoverCloudWalletMasterKey(mnemonic: string): Promise<Uint8Array> {
-  const masterKey = await utilCryptoService.mnemonicToMiniSecret(mnemonic);
+  const masterKeyResult = await utilCryptoService.mnemonicToMiniSecret(mnemonic);
 
-  return masterKey;
+  // Ensure masterKey is a proper Uint8Array (JSON-RPC serialization converts it to a plain object)
+  return masterKeyResult instanceof Uint8Array
+    ? masterKeyResult
+    : new Uint8Array(Object.values(masterKeyResult));
 }
 
+/**
+ * Initialize the cloud wallet EDV service.
+ *
+ * Either `masterKey` or `mnemonic` must be provided. When both are supplied,
+ * `masterKey` takes precedence since it is the derived key ready for use.
+ *
+ * @param {Object} params
+ * @param {DataStore} [params.dataStore] - Optional data store
+ * @param {string} params.edvUrl - EDV service URL
+ * @param {string} params.authKey - Authentication key
+ * @param {Uint8Array} [params.masterKey] - Pre-derived master key (takes precedence over mnemonic)
+ * @param {string} [params.mnemonic] - BIP-39 mnemonic used to derive the master key
+ */
 export async function initializeCloudWallet({
   dataStore,
   edvUrl,
   authKey,
   masterKey,
+  mnemonic,
 }: {
   dataStore?: DataStore;
   edvUrl: string;
   authKey: string;
-  masterKey: Uint8Array;
+  masterKey?: Uint8Array;
+  mnemonic?: string;
 }) {
-  const {
-    hmacKey,
-    agreementKey,
-    verificationKey,
-  } = await edvService.deriveKeys(masterKey);
-
-  await edvService.initialize({
-    hmacKey,
-    agreementKey,
-    verificationKey,
-    edvUrl,
-    authKey
-  });
+  if (masterKey) {
+    await edvService.initializeFromMasterKey({ masterKey, edvUrl, authKey });
+  } else if (mnemonic) {
+    await edvService.initializeFromMnemonic({ mnemonic, edvUrl, authKey });
+  } else {
+    throw new Error('Either masterKey or mnemonic is required');
+  }
 
   const documentQueues = new Map<string, DocumentQueue>();
   const activeOperations = new Set<Promise<any>>();
@@ -498,18 +677,26 @@ export async function initializeCloudWallet({
   }
 
   async function pullDocuments() {
+    logger.debug('Pulling documents from EDV');
+
     const allDocs = await edvService.find({});
 
+    logger.debug(`Documents found in EDV: ${allDocs.documents.length}`);
+
     for (const doc of allDocs.documents) {
       const edvDoc = doc.content;
       const walletDoc = await dataStore.documents.getDocumentById(edvDoc.id);
 
       if (!walletDoc) {
-        const result = await dataStore.documents.addDocument(edvDoc, {
+        logger.debug(
+          `Document ${edvDoc.id} not found in data store, adding to data store`,
+        );
+        await dataStore.documents.addDocument(edvDoc, {
           stopPropagation: true,
         });
       }
     }
+    return allDocs;
   }
 
   async function clearEdvDocuments() {
@@ -517,6 +704,7 @@ export async function initializeCloudWallet({
 
     for (const doc of allDocs.documents) {
       await edvService.delete({ document: doc });
+      await new Promise(resolve => setTimeout(resolve, 100));
     }
   }
 

package/src/credential-provider.ts

@@ -173,13 +173,16 @@ export const ACUMM_WITNESS_PROP_KEY = '$$accum__witness$$';
  * @private
  */
 export async function addCredential({wallet, credential}) {
-  // Check if the credential is an SD-JWT (string format)
-  if (typeof credential === 'string') {
+  if (
+    credential &&
+    (typeof credential === 'string' || typeof credential === 'object')
+  ) {
     try {
-      const isSDJWT = await credentialServiceRPC.isSDJWTCredential({credential});
+      const isSDJWT = await credentialServiceRPC.isSDJWTCredential({
+        credential,
+      });
 
       if (isSDJWT) {
-        // Convert SD-JWT to W3C format (includes _sd_jwt metadata for unwrapping)
         credential = await credentialServiceRPC.credentialToW3C({credential});
       }
     } catch (error) {
@@ -203,6 +206,12 @@ export async function addCredential({wallet, credential}) {
       value: acummWitness,
       initialWitness: acummWitness,
     });
+
+    // Pre-fetch and cache the witness blockchain data in the background
+    credentialServiceRPC.prefetchWitnessCache({
+      credential,
+      membershipWitness: acummWitness,
+    });
   }
 
   syncCredentialStatus({wallet, credentialIds: [credential.id]});