gdc-sdk-node-ts 2.0.8 → 2.0.10

package/dist/wallet-backed-job-manager.js

@@ -0,0 +1,301 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+import { JobStatus } from 'gdc-common-utils-ts/models/confidential-job';
+import { VaultMemRepository } from 'gdc-common-utils-ts/storage';
+const JOB_COLLECTION = 'wallet-backed-jobs';
+const RESPONSE_COLLECTION = 'wallet-backed-job-responses';
+function clone(value) {
+    return JSON.parse(JSON.stringify(value));
+}
+function createRuntimeUuid() {
+    const cryptoLike = globalThis;
+    if (typeof cryptoLike.crypto?.randomUUID === 'function') {
+        return cryptoLike.crypto.randomUUID();
+    }
+    return `job-${Date.now()}-${Math.random().toString(16).slice(2)}`;
+}
+function inferFormType(content) {
+    const first = Array.isArray(content?.body?.data) ? content.body.data[0] : undefined;
+    return String(first?.type || content?.type || '').trim();
+}
+function updateJobShape(job, patch) {
+    return {
+        ...job,
+        ...patch,
+        sequence: (job.sequence || 0) + 1,
+        previousSequence: job.sequence,
+    };
+}
+/**
+ * Creates one backend/session job manager that stores protected job payloads in
+ * one local vault while reusing one shared wallet for protect/unprotect and
+ * transport packing.
+ *
+ * Intended for:
+ * - portal/BFF runtimes
+ * - short-lived service sessions
+ * - send-first or cache-first orchestration over one local in-memory vault
+ */
+export function createWalletBackedJobManager(options) {
+    const wallet = options.wallet;
+    const vaultRepository = options.vaultRepository ?? new VaultMemRepository();
+    const context = options.walletContext;
+    const localEntityId = context.profile?.profileId ?? context.runtime?.runtimeId ?? options.descriptor.profileId;
+    let isInitialized = false;
+    let listener;
+    let lastAccessToken = '';
+    async function notify() {
+        listener?.();
+    }
+    async function protectJob(job) {
+        if (wallet.protectManagedConfidentialData) {
+            return wallet.protectManagedConfidentialData(job, context);
+        }
+        return wallet.protectConfidentialData(job, localEntityId);
+    }
+    async function unprotectJob(job) {
+        if (!job?.jwe)
+            return clone(job);
+        if (wallet.unprotectManagedConfidentialData) {
+            return wallet.unprotectManagedConfidentialData(job, context);
+        }
+        return wallet.unprotectConfidentialData(job, localEntityId);
+    }
+    async function putProtectedJob(job) {
+        const protectedJob = await protectJob(job);
+        await vaultRepository.put(JOB_COLLECTION, protectedJob);
+        await notify();
+        return clone(job);
+    }
+    async function readProtectedJob(jobId) {
+        return vaultRepository.get(JOB_COLLECTION, jobId);
+    }
+    async function readUnprotectedJob(jobId) {
+        const stored = await readProtectedJob(jobId);
+        if (!stored)
+            return undefined;
+        return unprotectJob(stored);
+    }
+    async function listUnprotectedJobs(query) {
+        const stored = await vaultRepository.query(JOB_COLLECTION, query);
+        const out = [];
+        for (const job of stored) {
+            out.push(await unprotectJob(job));
+        }
+        return out;
+    }
+    async function buildEnvelope(job) {
+        if (!job.content) {
+            throw new Error(`WalletBackedJobManager cannot build an envelope for job '${job.id}' without plaintext content.`);
+        }
+        if (options.recipientDidOrJwk) {
+            if (wallet.packForRecipientWithContext) {
+                return wallet.packForRecipientWithContext(job.content, options.recipientDidOrJwk, { context });
+            }
+            if (typeof options.recipientDidOrJwk === 'string' && wallet.packForRecipient) {
+                return wallet.packForRecipient(job.content, options.recipientDidOrJwk);
+            }
+        }
+        return JSON.stringify(job.content);
+    }
+    async function putResponse(thid, responseBody) {
+        const responseId = createRuntimeUuid();
+        const response = {
+            id: responseId,
+            thid,
+            content: clone(responseBody),
+            createdAtTimestamp: Date.now(),
+        };
+        await vaultRepository.put(RESPONSE_COLLECTION, response);
+        return responseId;
+    }
+    async function markCompleted(job, responseBody) {
+        const responseMessageId = await putResponse(String(job.thid || job.id), responseBody);
+        const updated = updateJobShape(job, {
+            status: JobStatus.COMPLETED,
+            responseMessageId,
+            errorMessage: undefined,
+        });
+        await putProtectedJob(updated);
+        return updated;
+    }
+    return {
+        descriptor: { ...options.descriptor },
+        get isInitialized() {
+            return isInitialized;
+        },
+        async initialize() {
+            isInitialized = true;
+        },
+        shutdown() {
+            isInitialized = false;
+            listener = undefined;
+        },
+        setListener(nextListener) {
+            listener = nextListener;
+        },
+        async createJob(content, selector) {
+            const now = Date.now();
+            const draft = {
+                id: createRuntimeUuid(),
+                thid: String(content?.thid || '').trim() || undefined,
+                status: JobStatus.DRAFT,
+                sequence: 1,
+                createdAtTimestamp: now,
+                content: clone(content),
+                ...selector,
+            };
+            await putProtectedJob(draft);
+            return clone(draft);
+        },
+        async findDraftJobByFormType(formType) {
+            const normalizedFormType = String(formType || '').trim();
+            const drafts = await listUnprotectedJobs({
+                where: [{ attribute: 'status', equals: JobStatus.DRAFT }],
+            });
+            return drafts.find((job) => inferFormType(job.content) === normalizedFormType) ?? null;
+        },
+        async createOrUpdateDraftJob(content, selector) {
+            const formType = inferFormType(content);
+            const existing = formType ? await this.findDraftJobByFormType(formType) : null;
+            if (!existing) {
+                return this.createJob(content, selector);
+            }
+            const updated = updateJobShape(existing, {
+                content: clone(content),
+                thid: String(content?.thid || '').trim() || existing.thid,
+                ...selector,
+            });
+            await putProtectedJob(updated);
+            return clone(updated);
+        },
+        async sync(accessToken) {
+            lastAccessToken = accessToken;
+            const pending = await listUnprotectedJobs({
+                where: [{
+                        attribute: 'status',
+                        in: [JobStatus.DRAFT, JobStatus.ERROR_RETRYABLE, JobStatus.SENT],
+                    }],
+            });
+            for (const job of pending) {
+                if (job.status === JobStatus.SENT && options.transport?.poll) {
+                    const poll = await options.transport.poll({
+                        job,
+                        accessToken,
+                        context,
+                    });
+                    if (poll.pending)
+                        continue;
+                    if (poll.completed && poll.responseBody !== undefined) {
+                        await markCompleted(job, poll.responseBody);
+                        continue;
+                    }
+                    const failed = updateJobShape(job, {
+                        status: poll.retryable ? JobStatus.ERROR_RETRYABLE : JobStatus.FAILED,
+                        errorMessage: poll.errorMessage,
+                    });
+                    await putProtectedJob(failed);
+                    continue;
+                }
+                await this.submitJob(job);
+            }
+        },
+        async queryJobs(query) {
+            return listUnprotectedJobs(query);
+        },
+        async submitJob(job) {
+            if (!options.transport) {
+                const sent = updateJobShape(job, {
+                    status: JobStatus.SENT,
+                });
+                await putProtectedJob(sent);
+                return;
+            }
+            if (!lastAccessToken) {
+                throw new Error('WalletBackedJobManager.submitJob requires sync(accessToken) before transport submission.');
+            }
+            const submitting = updateJobShape(job, {
+                status: JobStatus.SUBMITTING,
+            });
+            await putProtectedJob(submitting);
+            const envelope = await buildEnvelope(submitting);
+            const submitResult = await options.transport.submit({
+                job: submitting,
+                envelope,
+                accessToken: lastAccessToken,
+                context,
+            });
+            if (submitResult.completed && submitResult.responseBody !== undefined) {
+                await markCompleted(submitting, submitResult.responseBody);
+                return;
+            }
+            const nextStatus = submitResult.retryable
+                ? JobStatus.ERROR_RETRYABLE
+                : submitResult.accepted === false
+                    ? JobStatus.FAILED
+                    : JobStatus.SENT;
+            const updated = updateJobShape(submitting, {
+                status: nextStatus,
+                locationUrl: submitResult.locationUrl,
+                errorMessage: submitResult.errorMessage,
+            });
+            await putProtectedJob(updated);
+            if (updated.status === JobStatus.SENT && options.transport.poll) {
+                const pollResult = await options.transport.poll({
+                    job: updated,
+                    accessToken: lastAccessToken,
+                    context,
+                });
+                if (pollResult.completed && pollResult.responseBody !== undefined) {
+                    await markCompleted(updated, pollResult.responseBody);
+                    return;
+                }
+                if (!pollResult.pending) {
+                    const failedAfterPoll = updateJobShape(updated, {
+                        status: pollResult.retryable ? JobStatus.ERROR_RETRYABLE : JobStatus.FAILED,
+                        errorMessage: pollResult.errorMessage,
+                    });
+                    await putProtectedJob(failedAfterPoll);
+                }
+            }
+        },
+        async sealJobWithToken(job, accessToken) {
+            if (!job.content)
+                return job;
+            const sealed = updateJobShape(job, {
+                content: {
+                    ...clone(job.content),
+                    meta: {
+                        ...(job.content.meta || {}),
+                        bearer: {
+                            compact: accessToken,
+                            jwt: {},
+                        },
+                    },
+                },
+            });
+            await putProtectedJob(sealed);
+            return sealed;
+        },
+        async getJobResponseByThid(thid) {
+            const responses = await vaultRepository.query(RESPONSE_COLLECTION, {
+                where: [{ attribute: 'thid', equals: thid }],
+                orderBy: { attribute: 'createdAtTimestamp', direction: 'desc' },
+                limit: 1,
+            });
+            return responses[0]?.content ?? null;
+        },
+        generateId() {
+            return createRuntimeUuid();
+        },
+    };
+}
+/**
+ * Convenience helper for the default transient backend/session mode where one
+ * in-memory vault is enough and durable cloud sync is optional.
+ */
+export function createWalletBackedJobManagerInMemory(options) {
+    return createWalletBackedJobManager({
+        ...options,
+        vaultRepository: options.vaultRepository ?? new VaultMemRepository(),
+    });
+}

package/dist/wallet-backed-job-manager.types.d.ts

@@ -0,0 +1,57 @@
+import type { JobRequest } from 'gdc-common-utils-ts/models/confidential-job';
+import type { JWK } from 'gdc-common-utils-ts/models/jwk';
+import type { IVaultRepository } from 'gdc-common-utils-ts/storage';
+import type { ActorProfileDescriptor, IWallet } from 'gdc-sdk-core-ts';
+export type WalletExecutionContextLike = Readonly<{
+    profile?: Readonly<{
+        profileId: string;
+        actorType?: string;
+        actorId?: string;
+    }>;
+    runtime?: Readonly<{
+        runtimeId: string;
+        runtimeType?: string;
+    }>;
+    route?: Readonly<{
+        tenantId?: string;
+        jurisdiction?: string;
+        sector?: string;
+    }>;
+    walletId?: string;
+}>;
+export type WalletBackedJobSubmitResult = Readonly<{
+    accepted?: boolean;
+    completed?: boolean;
+    locationUrl?: string;
+    responseBody?: unknown;
+    errorMessage?: string;
+    retryable?: boolean;
+}>;
+export type WalletBackedJobPollResult = Readonly<{
+    pending?: boolean;
+    completed?: boolean;
+    responseBody?: unknown;
+    errorMessage?: string;
+    retryable?: boolean;
+}>;
+export type WalletBackedJobTransport = Readonly<{
+    submit: (input: Readonly<{
+        job: JobRequest;
+        envelope: string;
+        accessToken: string;
+        context: WalletExecutionContextLike;
+    }>) => Promise<WalletBackedJobSubmitResult>;
+    poll?: (input: Readonly<{
+        job: JobRequest;
+        accessToken: string;
+        context: WalletExecutionContextLike;
+    }>) => Promise<WalletBackedJobPollResult>;
+}>;
+export type WalletBackedJobManagerOptions = Readonly<{
+    descriptor: ActorProfileDescriptor;
+    wallet: IWallet;
+    walletContext: WalletExecutionContextLike;
+    vaultRepository?: IVaultRepository;
+    transport?: WalletBackedJobTransport;
+    recipientDidOrJwk?: string | JWK;
+}>;

package/dist/wallet-backed-job-manager.types.js

@@ -0,0 +1,2 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-sdk-node-ts",
-  "version": "2.0.8",
+  "version": "2.0.10",
   "description": "Next-generation Node runtime package for the GDC SDK family",
   "license": "Apache-2.0",
   "author": "Antifraud Services Inc.",
@@ -16,7 +16,10 @@
     "local:close": "PORTS=3000 bash ./scripts/local-close.sh",
     "docker:close": "PORTS=8000 bash ./scripts/local-close.sh",
     "test": "npm run build && node --test tests/*.test.mjs",
-    "test:e2e:101:live-full-cycle": "npm run build && RUN_LIVE_101_FULL_CYCLE_E2E=1 node --test tests/101-live-full-cycle-bff-runtime.e2e.test.mjs",
+    "test:e2e:live-controller-lifecycle": "bash ./scripts/run-live-controller-lifecycle.sh",
+    "test:e2e:live-controller-lifecycle:direct": "npm run build && RUN_LIVE_101_ORGANIZATION_CONTROLLER_LIFECYCLE_E2E=1 node --test tests/101-organization-controller-lifecycle.live.test.mjs",
+    "test:e2e:live-full-cycle": "bash ./scripts/run-live-101-full-cycle-clean.sh",
+    "test:e2e:live-full-cycle:direct": "npm run build && RUN_LIVE_101_FULL_CYCLE_E2E=1 node --test tests/101-live-full-cycle-bff-runtime.e2e.test.mjs",
     "test:e2e:live-gw": "npm run build && RUN_LIVE_GW_E2E=1 node --test tests/live-gw-node-runtime.e2e.test.mjs",
     "test:e2e:live-gw:professional": "npm run build && RUN_LIVE_GW_E2E=1 LIVE_GW_E2E_SUITE=professional node --test tests/live-gw-node-runtime.e2e.test.mjs",
     "test:e2e:live-gw:individual": "npm run build && RUN_LIVE_GW_E2E=1 LIVE_GW_E2E_SUITE=individual node --test tests/live-gw-node-runtime.e2e.test.mjs",
@@ -32,8 +35,8 @@
     "test:e2e:live-gw:clean": "bash ./scripts/run-live-gw-clean.sh"
   },
   "dependencies": {
-    "gdc-common-utils-ts": "^2.0.10",
-    "gdc-sdk-core-ts": "^2.0.7"
+    "gdc-common-utils-ts": "^2.0.15",
+    "gdc-sdk-core-ts": "^2.0.9"
   },
   "devDependencies": {
     "@types/node": "^20.14.10",