@twin.org/trust-generators 0.0.3-next.20 → 0.0.3-next.24

package/dist/es/generators/jwtVerifiableCredentialGenerator.js

@@ -32,37 +32,33 @@ export class JwtVerifiableCredentialGenerator {
      */
     _tokenTtlInSeconds;
     /**
-     * Create a new instance of JwtVerifiableCredentialGenerator.
-     * @param options The options for the service.
+     * Creates a new instance of JwtVerifiableCredentialGenerator.
+     * @param options The options for the generator.
      */
     constructor(options) {
-        this._loggingComponent = ComponentFactory.getIfExists(options?.loggingComponentType ?? "logging");
+        this._loggingComponent = ComponentFactory.getIfExists(options?.loggingComponentType);
         this._identityComponent = ComponentFactory.get(options?.identityComponentType ?? "identity");
         this._verificationMethodId = options.config.verificationMethodId;
         this._tokenTtlInSeconds = options.config.tokenTtlInSeconds;
     }
     /**
      * Returns the class name of the component.
-     * @returns The class name of the component.
+     * @returns The runtime class name string
      */
     className() {
         return JwtVerifiableCredentialGenerator.CLASS_NAME;
     }
     /**
-     * Generate a trust payload.
-     * @param identity The identity for which to generate the payload.
+     * Generates a JWT Verifiable Credential for the given organization identity.
+     * @param organizationId The identity for which to generate the credential.
      * @param info Information to use in the generation.
-     * @param info.subject The subject of the verifiable credential (JSON-LD).
-     * @param tenantIdHash Optional tenant identifier, should be an opaque hashed version. Embedded directly in the JWT as the tid claim.
-     * @param organizationId Optional organization identifier. Embedded directly in
-     * the JWT payload as the `org` claim.
+     * @param info.subject The subject of the verifiable credential as a JSON-LD node object; defaults to `{ id: organizationId }` when omitted.
      * @param options Per-call generation options.
-     * @param options.tokenTtlInSeconds TTL override in seconds for this token only. Takes precedence over the
-     * config-level `tokenTtlInSeconds` when provided.
-     * @returns The generated JWT.
+     * @param options.tokenTtlInSeconds TTL override in seconds for this token only; takes precedence over the config-level value when provided.
+     * @returns A promise that resolves to the signed JWT string.
      */
-    async generate(identity, info, tenantIdHash, organizationId, options) {
-        Guards.stringValue(JwtVerifiableCredentialGenerator.CLASS_NAME, "identity", identity);
+    async generate(organizationId, info, options) {
+        Guards.stringValue(JwtVerifiableCredentialGenerator.CLASS_NAME, "organizationId", organizationId);
         const ttlInSeconds = Is.integer(options?.tokenTtlInSeconds)
             ? options.tokenTtlInSeconds
             : this._tokenTtlInSeconds;
@@ -71,18 +67,12 @@ export class JwtVerifiableCredentialGenerator {
             const ttlMs = ttlInSeconds * 1000;
             expirationDate = new Date(Date.now() + ttlMs);
         }
-        const jwtPayloadFields = {};
-        if (Is.stringValue(tenantIdHash)) {
-            jwtPayloadFields.tid = tenantIdHash;
-        }
-        if (Is.stringValue(organizationId)) {
-            jwtPayloadFields.org = organizationId;
-        }
-        const issuer = DocumentHelper.joinId(identity, this._verificationMethodId);
-        const credential = await this._identityComponent.verifiableCredentialCreate(issuer, undefined, info?.subject ?? { id: issuer }, {
-            expirationDate,
-            jwtPayloadFields
-        }, identity);
+        const credential = await this._identityComponent.verifiableCredentialCreate(DocumentHelper.joinId(organizationId, this._verificationMethodId), undefined, 
+        // Identity subject can not be empty object, so fall back to the organization id
+        // when the subject is missing or an empty object (e.g. an empty PIP output).
+        Is.objectValue(info?.subject) ? info.subject : { id: organizationId }, {
+            expirationDate
+        }, organizationId);
         return credential.jwt;
     }
 }

package/dist/es/generators/jwtVerifiableCredentialGenerator.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwtVerifiableCredentialGenerator.js","sourceRoot":"","sources":["../../../src/generators/jwtVerifiableCredentialGenerator.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,uCAAuC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAE9D,OAAO,EAAE,cAAc,EAA2B,MAAM,2BAA2B,CAAC;AAMpF;;GAEG;AACH,MAAM,OAAO,gCAAgC;IAC5C;;OAEG;IACI,MAAM,CAAU,UAAU,sCAAsD;IAEvF;;;OAGG;IACH,8EAA8E;IAC7D,iBAAiB,CAAqB;IAEvD;;;OAGG;IACc,kBAAkB,CAAqB;IAExD;;;OAGG;IACc,qBAAqB,CAAS;IAE/C;;;OAGG;IACc,kBAAkB,CAAU;IAE7C;;;OAGG;IACH,YAAY,OAA4D;QACvE,IAAI,CAAC,iBAAiB,GAAG,gBAAgB,CAAC,WAAW,CACpD,OAAO,EAAE,oBAAoB,IAAI,SAAS,CAC1C,CAAC;QAEF,IAAI,CAAC,kBAAkB,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,qBAAqB,IAAI,UAAU,CAAC,CAAC;QAE7F,IAAI,CAAC,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC;QACjE,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC;IAC5D,CAAC;IAED;;;OAGG;IACI,SAAS;QACf,OAAO,gCAAgC,CAAC,UAAU,CAAC;IACpD,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,KAAK,CAAC,QAAQ,CACpB,QAAgB,EAChB,IAAsC,EACtC,YAAqB,EACrB,cAAuB,EACvB,OAAuC;QAEvC,MAAM,CAAC,WAAW,CAAC,gCAAgC,CAAC,UAAU,cAAoB,QAAQ,CAAC,CAAC;QAE5F,MAAM,YAAY,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,iBAAiB,CAAC;YAC1D,CAAC,CAAC,OAAO,CAAC,iBAAiB;YAC3B,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;QAE3B,IAAI,cAAc,CAAC;QAEnB,IAAI,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,YAAY,GAAG,IAAI,CAAC;YAClC,cAAc,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,gBAAgB,GAA8B,EAAE,CAAC;QACvD,IAAI,EAAE,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;YAClC,gBAAgB,CAAC,GAAG,GAAG,YAAY,CAAC;QACrC,CAAC;QACD,IAAI,EAAE,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE,CAAC;YACpC,gBAAgB,CAAC,GAAG,GAAG,cAAc,CAAC;QACvC,CAAC;QAED,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAE3E,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,0BAA0B,CAC1E,MAAM,EACN,SAAS,EACT,IAAI,EAAE,OAAO,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAC/B;YACC,cAAc;YACd,gBAAgB;SAChB,EACD,QAAQ,CACR,CAAC;QAEF,OAAO,UAAU,CAAC,GAAG,CAAC;IACvB,CAAC","sourcesContent":["// Copyright 2025 IOTA Stiftung.\n// SPDX-License-Identifier: Apache-2.0.\nimport { ComponentFactory, Guards, Is } from \"@twin.org/core\";\nimport type { IJsonLdNodeObject } from \"@twin.org/data-json-ld\";\nimport { DocumentHelper, type IIdentityComponent } from \"@twin.org/identity-models\";\nimport type { ILoggingComponent } from \"@twin.org/logging-models\";\nimport { nameof } from \"@twin.org/nameof\";\nimport type { ITrustGenerator } from \"@twin.org/trust-models\";\nimport type { IJwtVerifiableCredentialGeneratorConstructorOptions } from \"../models/IJwtVerifiableCredentialGeneratorConstructorOptions.js\";\n\n/**\n * Class to generate a JWT Verifiable Credential.\n */\nexport class JwtVerifiableCredentialGenerator implements ITrustGenerator {\n\t/**\n\t * Runtime name for the class.\n\t */\n\tpublic static readonly CLASS_NAME: string = nameof<JwtVerifiableCredentialGenerator>();\n\n\t/**\n\t * The logging component.\n\t * @internal\n\t */\n\t// eslint-disable-next-line @typescript-eslint/no-unused-private-class-members\n\tprivate readonly _loggingComponent?: ILoggingComponent;\n\n\t/**\n\t * The identity component.\n\t * @internal\n\t */\n\tprivate readonly _identityComponent: IIdentityComponent;\n\n\t/**\n\t * The verification method ID for the connector to use.\n\t * @internal\n\t */\n\tprivate readonly _verificationMethodId: string;\n\n\t/**\n\t * The time-to-live (TTL) for token in seconds.\n\t * @internal\n\t */\n\tprivate readonly _tokenTtlInSeconds?: number;\n\n\t/**\n\t * Create a new instance of JwtVerifiableCredentialGenerator.\n\t * @param options The options for the service.\n\t */\n\tconstructor(options: IJwtVerifiableCredentialGeneratorConstructorOptions) {\n\t\tthis._loggingComponent = ComponentFactory.getIfExists(\n\t\t\toptions?.loggingComponentType ?? \"logging\"\n\t\t);\n\n\t\tthis._identityComponent = ComponentFactory.get(options?.identityComponentType ?? \"identity\");\n\n\t\tthis._verificationMethodId = options.config.verificationMethodId;\n\t\tthis._tokenTtlInSeconds = options.config.tokenTtlInSeconds;\n\t}\n\n\t/**\n\t * Returns the class name of the component.\n\t * @returns The class name of the component.\n\t */\n\tpublic className(): string {\n\t\treturn JwtVerifiableCredentialGenerator.CLASS_NAME;\n\t}\n\n\t/**\n\t * Generate a trust payload.\n\t * @param identity The identity for which to generate the payload.\n\t * @param info Information to use in the generation.\n\t * @param info.subject The subject of the verifiable credential (JSON-LD).\n\t * @param tenantIdHash Optional tenant identifier, should be an opaque hashed version. Embedded directly in the JWT as the tid claim.\n\t * @param organizationId Optional organization identifier. Embedded directly in\n\t * the JWT payload as the `org` claim.\n\t * @param options Per-call generation options.\n\t * @param options.tokenTtlInSeconds TTL override in seconds for this token only. Takes precedence over the\n\t * config-level `tokenTtlInSeconds` when provided.\n\t * @returns The generated JWT.\n\t */\n\tpublic async generate(\n\t\tidentity: string,\n\t\tinfo?: { subject?: IJsonLdNodeObject },\n\t\ttenantIdHash?: string,\n\t\torganizationId?: string,\n\t\toptions?: { tokenTtlInSeconds: number }\n\t): Promise<unknown> {\n\t\tGuards.stringValue(JwtVerifiableCredentialGenerator.CLASS_NAME, nameof(identity), identity);\n\n\t\tconst ttlInSeconds = Is.integer(options?.tokenTtlInSeconds)\n\t\t\t? options.tokenTtlInSeconds\n\t\t\t: this._tokenTtlInSeconds;\n\n\t\tlet expirationDate;\n\n\t\tif (Is.integer(ttlInSeconds)) {\n\t\t\tconst ttlMs = ttlInSeconds * 1000;\n\t\t\texpirationDate = new Date(Date.now() + ttlMs);\n\t\t}\n\n\t\tconst jwtPayloadFields: { [key: string]: string } = {};\n\t\tif (Is.stringValue(tenantIdHash)) {\n\t\t\tjwtPayloadFields.tid = tenantIdHash;\n\t\t}\n\t\tif (Is.stringValue(organizationId)) {\n\t\t\tjwtPayloadFields.org = organizationId;\n\t\t}\n\n\t\tconst issuer = DocumentHelper.joinId(identity, this._verificationMethodId);\n\n\t\tconst credential = await this._identityComponent.verifiableCredentialCreate(\n\t\t\tissuer,\n\t\t\tundefined,\n\t\t\tinfo?.subject ?? { id: issuer },\n\t\t\t{\n\t\t\t\texpirationDate,\n\t\t\t\tjwtPayloadFields\n\t\t\t},\n\t\t\tidentity\n\t\t);\n\n\t\treturn credential.jwt;\n\t}\n}\n"]}
+{"version":3,"file":"jwtVerifiableCredentialGenerator.js","sourceRoot":"","sources":["../../../src/generators/jwtVerifiableCredentialGenerator.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,uCAAuC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAE9D,OAAO,EAAE,cAAc,EAA2B,MAAM,2BAA2B,CAAC;AAMpF;;GAEG;AACH,MAAM,OAAO,gCAAgC;IAC5C;;OAEG;IACI,MAAM,CAAU,UAAU,sCAAsD;IAEvF;;;OAGG;IACH,8EAA8E;IAC7D,iBAAiB,CAAqB;IAEvD;;;OAGG;IACc,kBAAkB,CAAqB;IAExD;;;OAGG;IACc,qBAAqB,CAAS;IAE/C;;;OAGG;IACc,kBAAkB,CAAU;IAE7C;;;OAGG;IACH,YAAY,OAA4D;QACvE,IAAI,CAAC,iBAAiB,GAAG,gBAAgB,CAAC,WAAW,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;QAErF,IAAI,CAAC,kBAAkB,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,qBAAqB,IAAI,UAAU,CAAC,CAAC;QAE7F,IAAI,CAAC,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC;QACjE,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC;IAC5D,CAAC;IAED;;;OAGG;IACI,SAAS;QACf,OAAO,gCAAgC,CAAC,UAAU,CAAC;IACpD,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,QAAQ,CACpB,cAAsB,EACtB,IAAsC,EACtC,OAAuC;QAEvC,MAAM,CAAC,WAAW,CACjB,gCAAgC,CAAC,UAAU,oBAE3C,cAAc,CACd,CAAC;QAEF,MAAM,YAAY,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,iBAAiB,CAAC;YAC1D,CAAC,CAAC,OAAO,CAAC,iBAAiB;YAC3B,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;QAE3B,IAAI,cAAc,CAAC;QAEnB,IAAI,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,YAAY,GAAG,IAAI,CAAC;YAClC,cAAc,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,0BAA0B,CAC1E,cAAc,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,qBAAqB,CAAC,EACjE,SAAS;QACT,gFAAgF;QAChF,6EAA6E;QAC7E,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,EACrE;YACC,cAAc;SACd,EACD,cAAc,CACd,CAAC;QAEF,OAAO,UAAU,CAAC,GAAG,CAAC;IACvB,CAAC","sourcesContent":["// Copyright 2025 IOTA Stiftung.\n// SPDX-License-Identifier: Apache-2.0.\nimport { ComponentFactory, Guards, Is } from \"@twin.org/core\";\nimport type { IJsonLdNodeObject } from \"@twin.org/data-json-ld\";\nimport { DocumentHelper, type IIdentityComponent } from \"@twin.org/identity-models\";\nimport type { ILoggingComponent } from \"@twin.org/logging-models\";\nimport { nameof } from \"@twin.org/nameof\";\nimport type { ITrustGenerator } from \"@twin.org/trust-models\";\nimport type { IJwtVerifiableCredentialGeneratorConstructorOptions } from \"../models/IJwtVerifiableCredentialGeneratorConstructorOptions.js\";\n\n/**\n * Class to generate a JWT Verifiable Credential.\n */\nexport class JwtVerifiableCredentialGenerator implements ITrustGenerator {\n\t/**\n\t * Runtime name for the class.\n\t */\n\tpublic static readonly CLASS_NAME: string = nameof<JwtVerifiableCredentialGenerator>();\n\n\t/**\n\t * The logging component.\n\t * @internal\n\t */\n\t// eslint-disable-next-line @typescript-eslint/no-unused-private-class-members\n\tprivate readonly _loggingComponent?: ILoggingComponent;\n\n\t/**\n\t * The identity component.\n\t * @internal\n\t */\n\tprivate readonly _identityComponent: IIdentityComponent;\n\n\t/**\n\t * The verification method ID for the connector to use.\n\t * @internal\n\t */\n\tprivate readonly _verificationMethodId: string;\n\n\t/**\n\t * The time-to-live (TTL) for token in seconds.\n\t * @internal\n\t */\n\tprivate readonly _tokenTtlInSeconds?: number;\n\n\t/**\n\t * Creates a new instance of JwtVerifiableCredentialGenerator.\n\t * @param options The options for the generator.\n\t */\n\tconstructor(options: IJwtVerifiableCredentialGeneratorConstructorOptions) {\n\t\tthis._loggingComponent = ComponentFactory.getIfExists(options?.loggingComponentType);\n\n\t\tthis._identityComponent = ComponentFactory.get(options?.identityComponentType ?? \"identity\");\n\n\t\tthis._verificationMethodId = options.config.verificationMethodId;\n\t\tthis._tokenTtlInSeconds = options.config.tokenTtlInSeconds;\n\t}\n\n\t/**\n\t * Returns the class name of the component.\n\t * @returns The runtime class name string\n\t */\n\tpublic className(): string {\n\t\treturn JwtVerifiableCredentialGenerator.CLASS_NAME;\n\t}\n\n\t/**\n\t * Generates a JWT Verifiable Credential for the given organization identity.\n\t * @param organizationId The identity for which to generate the credential.\n\t * @param info Information to use in the generation.\n\t * @param info.subject The subject of the verifiable credential as a JSON-LD node object; defaults to `{ id: organizationId }` when omitted.\n\t * @param options Per-call generation options.\n\t * @param options.tokenTtlInSeconds TTL override in seconds for this token only; takes precedence over the config-level value when provided.\n\t * @returns A promise that resolves to the signed JWT string.\n\t */\n\tpublic async generate(\n\t\torganizationId: string,\n\t\tinfo?: { subject?: IJsonLdNodeObject },\n\t\toptions?: { tokenTtlInSeconds: number }\n\t): Promise<unknown> {\n\t\tGuards.stringValue(\n\t\t\tJwtVerifiableCredentialGenerator.CLASS_NAME,\n\t\t\tnameof(organizationId),\n\t\t\torganizationId\n\t\t);\n\n\t\tconst ttlInSeconds = Is.integer(options?.tokenTtlInSeconds)\n\t\t\t? options.tokenTtlInSeconds\n\t\t\t: this._tokenTtlInSeconds;\n\n\t\tlet expirationDate;\n\n\t\tif (Is.integer(ttlInSeconds)) {\n\t\t\tconst ttlMs = ttlInSeconds * 1000;\n\t\t\texpirationDate = new Date(Date.now() + ttlMs);\n\t\t}\n\n\t\tconst credential = await this._identityComponent.verifiableCredentialCreate(\n\t\t\tDocumentHelper.joinId(organizationId, this._verificationMethodId),\n\t\t\tundefined,\n\t\t\t// Identity subject can not be empty object, so fall back to the organization id\n\t\t\t// when the subject is missing or an empty object (e.g. an empty PIP output).\n\t\t\tIs.objectValue(info?.subject) ? info.subject : { id: organizationId },\n\t\t\t{\n\t\t\t\texpirationDate\n\t\t\t},\n\t\t\torganizationId\n\t\t);\n\n\t\treturn credential.jwt;\n\t}\n}\n"]}

package/dist/es/models/IJwtVerifiableCredentialGeneratorConstructorOptions.js.map

@@ -1 +1 @@
-{"version":3,"file":"IJwtVerifiableCredentialGeneratorConstructorOptions.js","sourceRoot":"","sources":["../../../src/models/IJwtVerifiableCredentialGeneratorConstructorOptions.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,uCAAuC","sourcesContent":["// Copyright 2025 IOTA Stiftung.\n// SPDX-License-Identifier: Apache-2.0.\n\nimport type { IJwtVerifiableCredentialGeneratorConfig } from \"./IJwtVerifiableCredentialGeneratorConfig.js\";\n\n/**\n * The options for the JWT Verifiable Credential Generator.\n */\nexport interface IJwtVerifiableCredentialGeneratorConstructorOptions {\n\t/**\n\t * The logging component type.\n\t * @default logging\n\t */\n\tloggingComponentType?: string;\n\n\t/**\n\t * The identity component type.\n\t * @default identity\n\t */\n\tidentityComponentType?: string;\n\n\t/**\n\t * The configuration for the generator.\n\t */\n\tconfig: IJwtVerifiableCredentialGeneratorConfig;\n}\n"]}
+{"version":3,"file":"IJwtVerifiableCredentialGeneratorConstructorOptions.js","sourceRoot":"","sources":["../../../src/models/IJwtVerifiableCredentialGeneratorConstructorOptions.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,uCAAuC","sourcesContent":["// Copyright 2025 IOTA Stiftung.\n// SPDX-License-Identifier: Apache-2.0.\n\nimport type { IJwtVerifiableCredentialGeneratorConfig } from \"./IJwtVerifiableCredentialGeneratorConfig.js\";\n\n/**\n * The options for the JWT Verifiable Credential Generator.\n */\nexport interface IJwtVerifiableCredentialGeneratorConstructorOptions {\n\t/**\n\t * The logging component type.\n\t */\n\tloggingComponentType?: string;\n\n\t/**\n\t * The identity component type.\n\t * @default identity\n\t */\n\tidentityComponentType?: string;\n\n\t/**\n\t * The configuration for the generator.\n\t */\n\tconfig: IJwtVerifiableCredentialGeneratorConfig;\n}\n"]}

package/dist/types/generators/jwtVerifiableCredentialGenerator.d.ts

@@ -10,31 +10,27 @@ export declare class JwtVerifiableCredentialGenerator implements ITrustGenerator
      */
     static readonly CLASS_NAME: string;
     /**
-     * Create a new instance of JwtVerifiableCredentialGenerator.
-     * @param options The options for the service.
+     * Creates a new instance of JwtVerifiableCredentialGenerator.
+     * @param options The options for the generator.
      */
     constructor(options: IJwtVerifiableCredentialGeneratorConstructorOptions);
     /**
      * Returns the class name of the component.
-     * @returns The class name of the component.
+     * @returns The runtime class name string
      */
     className(): string;
     /**
-     * Generate a trust payload.
-     * @param identity The identity for which to generate the payload.
+     * Generates a JWT Verifiable Credential for the given organization identity.
+     * @param organizationId The identity for which to generate the credential.
      * @param info Information to use in the generation.
-     * @param info.subject The subject of the verifiable credential (JSON-LD).
-     * @param tenantIdHash Optional tenant identifier, should be an opaque hashed version. Embedded directly in the JWT as the tid claim.
-     * @param organizationId Optional organization identifier. Embedded directly in
-     * the JWT payload as the `org` claim.
+     * @param info.subject The subject of the verifiable credential as a JSON-LD node object; defaults to `{ id: organizationId }` when omitted.
      * @param options Per-call generation options.
-     * @param options.tokenTtlInSeconds TTL override in seconds for this token only. Takes precedence over the
-     * config-level `tokenTtlInSeconds` when provided.
-     * @returns The generated JWT.
+     * @param options.tokenTtlInSeconds TTL override in seconds for this token only; takes precedence over the config-level value when provided.
+     * @returns A promise that resolves to the signed JWT string.
      */
-    generate(identity: string, info?: {
+    generate(organizationId: string, info?: {
         subject?: IJsonLdNodeObject;
-    }, tenantIdHash?: string, organizationId?: string, options?: {
+    }, options?: {
         tokenTtlInSeconds: number;
     }): Promise<unknown>;
 }

package/dist/types/models/IJwtVerifiableCredentialGeneratorConstructorOptions.d.ts

@@ -5,7 +5,6 @@ import type { IJwtVerifiableCredentialGeneratorConfig } from "./IJwtVerifiableCr
 export interface IJwtVerifiableCredentialGeneratorConstructorOptions {
     /**
      * The logging component type.
-     * @default logging
      */
     loggingComponentType?: string;
     /**

package/docs/changelog.md

@@ -1,5 +1,63 @@
 # Changelog
 
+## [0.0.3-next.24](https://github.com/iotaledger/twin-trust/compare/trust-generators-v0.0.3-next.23...trust-generators-v0.0.3-next.24) (2026-06-18)
+
+
+### Bug Fixes
+
+* fall back to organization id when policy subject is empty ([#44](https://github.com/iotaledger/twin-trust/issues/44)) ([ee5e31c](https://github.com/iotaledger/twin-trust/commit/ee5e31c32c3ad465c9ffb9fa0c4cdfbaf3295e54))
+
+
+### Dependencies
+
+* The following workspace dependencies were updated
+  * dependencies
+    * @twin.org/trust-models bumped from 0.0.3-next.23 to 0.0.3-next.24
+
+## [0.0.3-next.23](https://github.com/iotaledger/twin-trust/compare/trust-generators-v0.0.3-next.22...trust-generators-v0.0.3-next.23) (2026-06-11)
+
+
+### Features
+
+* add default generator config ([54d98ba](https://github.com/iotaledger/twin-trust/commit/54d98ba53b7450b56337daeda504437be0d21943))
+* add generators ([6228c88](https://github.com/iotaledger/twin-trust/commit/6228c88a8f0244b7bdfc76b8624c427c81d23f7b))
+* add optional tenantId + organizationId to trust VC payload ([#19](https://github.com/iotaledger/twin-trust/issues/19)) ([1e93f6b](https://github.com/iotaledger/twin-trust/commit/1e93f6b0eacbfa725f3c3515d4255b39dd122ce7))
+* add TrustHelper hashTenantId ([#22](https://github.com/iotaledger/twin-trust/issues/22)) ([1efa9dc](https://github.com/iotaledger/twin-trust/commit/1efa9dc7ef0534dbb1a789fac300409190452273))
+* organization identifiers ([#39](https://github.com/iotaledger/twin-trust/issues/39)) ([a5891b9](https://github.com/iotaledger/twin-trust/commit/a5891b9d57ef209c20f53302442d1910dce963d2))
+* ttl-token per generation ([#26](https://github.com/iotaledger/twin-trust/issues/26)) ([a35e925](https://github.com/iotaledger/twin-trust/commit/a35e925560d05f30dd8c02eb4184c0c503ca075a))
+* typescript 6 update ([a232da2](https://github.com/iotaledger/twin-trust/commit/a232da293afbd3b42843e187e4952dabd7917397))
+* update dependencies ([367d7fc](https://github.com/iotaledger/twin-trust/commit/367d7fc1f970522650c776d231bfacc84f97be67))
+* update param names ([4c78d57](https://github.com/iotaledger/twin-trust/commit/4c78d5703ce7adef3fb5d3bbb1d2cde5db4376cc))
+
+
+### Bug Fixes
+
+* default VC credentialSubject to the issuer when none is provided ([#37](https://github.com/iotaledger/twin-trust/issues/37)) ([9c7653d](https://github.com/iotaledger/twin-trust/commit/9c7653d6c34cc2014aac45ed7a3aa4ae720c3f63))
+* jwt verifier return just token on creation ([9778491](https://github.com/iotaledger/twin-trust/commit/97784917c0ce53c3908e91a0db9137f8473eadeb))
+* pass correct parameters to vc create ([bca9529](https://github.com/iotaledger/twin-trust/commit/bca95292605720f45f1f9dd2cec34053734b2d7f))
+* tests ([fcadcf1](https://github.com/iotaledger/twin-trust/commit/fcadcf1f4e9bab4acbfc1722b0112f1d9723d7fa))
+
+
+### Dependencies
+
+* The following workspace dependencies were updated
+  * dependencies
+    * @twin.org/trust-models bumped from 0.0.3-next.21 to 0.0.3-next.23
+
+## [0.0.3-next.21](https://github.com/iotaledger/twin-trust/compare/trust-generators-v0.0.3-next.20...trust-generators-v0.0.3-next.21) (2026-06-11)
+
+
+### Features
+
+* organization identifiers ([#39](https://github.com/iotaledger/twin-trust/issues/39)) ([a5891b9](https://github.com/iotaledger/twin-trust/commit/a5891b9d57ef209c20f53302442d1910dce963d2))
+
+
+### Dependencies
+
+* The following workspace dependencies were updated
+  * dependencies
+    * @twin.org/trust-models bumped from 0.0.3-next.20 to 0.0.3-next.21
+
 ## [0.0.3-next.20](https://github.com/iotaledger/twin-trust/compare/trust-generators-v0.0.3-next.19...trust-generators-v0.0.3-next.20) (2026-06-10)
 
 

package/docs/reference/classes/JwtVerifiableCredentialGenerator.md

@@ -12,7 +12,7 @@ Class to generate a JWT Verifiable Credential.
 
 > **new JwtVerifiableCredentialGenerator**(`options`): `JwtVerifiableCredentialGenerator`
 
-Create a new instance of JwtVerifiableCredentialGenerator.
+Creates a new instance of JwtVerifiableCredentialGenerator.
 
 #### Parameters
 
@@ -20,7 +20,7 @@ Create a new instance of JwtVerifiableCredentialGenerator.
 
 [`IJwtVerifiableCredentialGeneratorConstructorOptions`](../interfaces/IJwtVerifiableCredentialGeneratorConstructorOptions.md)
 
-The options for the service.
+The options for the generator.
 
 #### Returns
 
@@ -46,7 +46,7 @@ Returns the class name of the component.
 
 `string`
 
-The class name of the component.
+The runtime class name string
 
 #### Implementation of
 
@@ -56,17 +56,17 @@ The class name of the component.
 
 ### generate() {#generate}
 
-> **generate**(`identity`, `info?`, `tenantIdHash?`, `organizationId?`, `options?`): `Promise`\<`unknown`\>
+> **generate**(`organizationId`, `info?`, `options?`): `Promise`\<`unknown`\>
 
-Generate a trust payload.
+Generates a JWT Verifiable Credential for the given organization identity.
 
 #### Parameters
 
-##### identity
+##### organizationId
 
 `string`
 
-The identity for which to generate the payload.
+The identity for which to generate the credential.
 
 ##### info?
 
@@ -76,20 +76,7 @@ Information to use in the generation.
 
 `IJsonLdNodeObject`
 
-The subject of the verifiable credential (JSON-LD).
-
-##### tenantIdHash?
-
-`string`
-
-Optional tenant identifier, should be an opaque hashed version. Embedded directly in the JWT as the tid claim.
-
-##### organizationId?
-
-`string`
-
-Optional organization identifier. Embedded directly in
-the JWT payload as the `org` claim.
+The subject of the verifiable credential as a JSON-LD node object; defaults to `{ id: organizationId }` when omitted.
 
 ##### options?
 
@@ -99,14 +86,13 @@ Per-call generation options.
 
 `number`
 
-TTL override in seconds for this token only. Takes precedence over the
-config-level `tokenTtlInSeconds` when provided.
+TTL override in seconds for this token only; takes precedence over the config-level value when provided.
 
 #### Returns
 
 `Promise`\<`unknown`\>
 
-The generated JWT.
+A promise that resolves to the signed JWT string.
 
 #### Implementation of
 

package/docs/reference/interfaces/IJwtVerifiableCredentialGeneratorConstructorOptions.md

@@ -10,12 +10,6 @@ The options for the JWT Verifiable Credential Generator.
 
 The logging component type.
 
-#### Default
-
-```ts
-logging
-```
-
 ***
 
 ### identityComponentType? {#identitycomponenttype}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@twin.org/trust-generators",
-	"version": "0.0.3-next.20",
+	"version": "0.0.3-next.24",
 	"description": "Implements trust credential generators that produce signed verifiable credential artefacts",
 	"repository": {
 		"type": "git",
@@ -19,7 +19,7 @@
 		"@twin.org/identity-models": "next",
 		"@twin.org/logging-models": "next",
 		"@twin.org/nameof": "next",
-		"@twin.org/trust-models": "0.0.3-next.20",
+		"@twin.org/trust-models": "0.0.3-next.24",
 		"@twin.org/web": "next"
 	},
 	"main": "./dist/es/index.js",