gdc-sdk-node-ts 2.2.2 → 2.3.0

package/dist/server-profile-session.d.ts

@@ -0,0 +1,115 @@
+import type { JWK } from 'gdc-common-utils-ts/models/jwk';
+import type { ActorKind } from 'gdc-common-utils-ts/models/actor-session';
+import type { RouteContext } from './individual-onboarding.js';
+import type { SecureDidcommTransportAdapter } from 'gdc-sdk-core-ts';
+import { type PinProtectedProfileSecret, type ProfileProtectionOptions, type ServerProfileSealer } from './server-profile-protection.js';
+export type { ServerProfileSealer } from './server-profile-protection.js';
+export type ServerActorMode = 'self' | 'controller' | 'member';
+/** Durable public metadata plus PIN-and-host protected private material. */
+export type ServerProfileRecord = Readonly<{
+    profileId: string;
+    ownerId: string;
+    actorKind: ActorKind;
+    actorMode: ServerActorMode;
+    actorDid: string;
+    profileDid: string;
+    providerDid: string;
+    routeContext: RouteContext;
+    allowedSubjectDids: string[];
+    clientId: string;
+    deviceDid: string;
+    publicJwks: Record<string, unknown>[];
+    protectedWalletSeed: PinProtectedProfileSecret;
+    protectedVpToken: PinProtectedProfileSecret;
+    failedUnlocks: number;
+    lockedUntil?: string;
+    createdAt: string;
+    updatedAt: string;
+}>;
+export type ServerProfileSessionRecord = Readonly<{
+    sessionId: string;
+    ownerId: string;
+    profileId: string;
+    subjectDid: string;
+    scopes: string[];
+    sealedUnlockedWalletSeed: string;
+    sealedAccessToken: string;
+    expiresAt: string;
+}>;
+/** Persistence port; implementations must isolate environment and tenant data. */
+export type ServerProfileStore = Readonly<{
+    listProfiles(ownerId: string): Promise<ServerProfileRecord[]>;
+    getProfile(profileId: string): Promise<ServerProfileRecord | undefined>;
+    putProfile(profile: ServerProfileRecord): Promise<void>;
+    getSession(sessionId: string): Promise<ServerProfileSessionRecord | undefined>;
+    putSession(session: ServerProfileSessionRecord): Promise<void>;
+    deleteSession(sessionId: string): Promise<void>;
+}>;
+export type ServerProfileEnrollmentInput = Readonly<{
+    ownerId: string;
+    profileId: string;
+    actorKind: ActorKind;
+    actorMode: ServerActorMode;
+    actorDid: string;
+    profileDid: string;
+    providerDid: string;
+    routeContext: RouteContext;
+    allowedSubjectDids: string[];
+    pin: string;
+    idToken: string;
+    activationCode: string;
+    vpToken: string;
+}>;
+/** One explicit unlock request; scopes and subject remain session-bound. */
+export type ServerProfileUnlockInput = Readonly<{
+    ownerId: string;
+    profileId: string;
+    subjectDid: string;
+    scopes: string[];
+    pin: string;
+    idToken: string;
+}>;
+/** Material available only during an authenticated, unexpired server session. */
+export type ResolvedServerProfileSession = Readonly<{
+    sessionId: string;
+    profile: ServerProfileRecord;
+    subjectDid: string;
+    scopes: string[];
+    accessToken: string;
+    secureTransportAdapter: SecureDidcommTransportAdapter;
+}>;
+export type ServerProfileSessionManagerOptions = Readonly<{
+    store: ServerProfileStore;
+    sealer: ServerProfileSealer;
+    gatewayBaseUrl: string;
+    recipientDid: string;
+    resolveRecipientJwk: (recipientDid: string) => Promise<JWK>;
+    fetchImpl?: typeof fetch;
+    sessionTtlSeconds?: number;
+    maxFailedUnlocks?: number;
+    lockSeconds?: number;
+    profileProtection?: ProfileProtectionOptions;
+    now?: () => Date;
+}>;
+/**
+ * Coordinates device registration, two-factor profile protection and SMART sessions.
+ *
+ * Persisted seeds require both the PIN-derived key and the host KEK. After a
+ * successful unlock, a short-lived host-sealed seed is copied into the server
+ * session so subsequent requests do not need to resend the PIN. Expiring or
+ * locking the session removes that temporary bypass.
+ */
+export declare class ServerProfileSessionManager {
+    private readonly options;
+    constructor(options: ServerProfileSessionManagerOptions);
+    enroll(input: ServerProfileEnrollmentInput): Promise<ServerProfileRecord>;
+    listProfiles(ownerId: string): Promise<ServerProfileRecord[]>;
+    unlock(input: ServerProfileUnlockInput): Promise<ResolvedServerProfileSession>;
+    resolveSession(ownerId: string, sessionId: string): Promise<ResolvedServerProfileSession>;
+    lock(ownerId: string, sessionId: string): Promise<void>;
+    private createClient;
+    private createWallet;
+    private requireOwnedProfile;
+    private requireSubject;
+    private now;
+}

package/dist/server-profile-session.js

@@ -0,0 +1,259 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+import { randomBytes } from 'node:crypto';
+import { NodeManagedWallet } from './node-managed-wallet.js';
+import { NodeHttpClient } from './node-runtime-client.js';
+import { ProfilePinRejectedError, openServerProfileSecret, protectServerProfileSecret, } from './server-profile-protection.js';
+/**
+ * Coordinates device registration, two-factor profile protection and SMART sessions.
+ *
+ * Persisted seeds require both the PIN-derived key and the host KEK. After a
+ * successful unlock, a short-lived host-sealed seed is copied into the server
+ * session so subsequent requests do not need to resend the PIN. Expiring or
+ * locking the session removes that temporary bypass.
+ */
+export class ServerProfileSessionManager {
+    constructor(options) {
+        this.options = options;
+    }
+    async enroll(input) {
+        requireEnrollment(input);
+        const seed = randomBytes(32).toString('base64url');
+        const wallet = await this.createWallet(input.profileId, seed);
+        const context = walletContext(input.profileId);
+        const publicKeys = await wallet.getPublicJwks(context, {});
+        const client = this.createClient(input.routeContext, input.idToken);
+        const activation = await client.activateProfileDeviceWithActivationRequest({
+            ...input.routeContext,
+            activationCode: input.activationCode,
+            idToken: input.idToken,
+            dcrPayload: {
+                application_type: 'web',
+                actor_did: input.actorDid,
+                profile_did: input.profileDid,
+                jwks: { keys: publicKeys.map((entry) => entry.publicJwk) },
+            },
+        });
+        const dcrBody = terminalBody(activation.dcr.poll.body);
+        const clientId = findText(dcrBody, ['client_id', 'clientId']);
+        if (!clientId)
+            throw new Error('GW DCR did not return client_id.');
+        const deviceDid = findText(dcrBody, ['device_did', 'deviceDid', 'did']) || clientId;
+        const now = this.now();
+        const record = {
+            profileId: input.profileId,
+            ownerId: input.ownerId,
+            actorKind: input.actorKind,
+            actorMode: input.actorMode,
+            actorDid: input.actorDid,
+            profileDid: input.profileDid,
+            providerDid: input.providerDid,
+            routeContext: input.routeContext,
+            allowedSubjectDids: unique(input.allowedSubjectDids),
+            clientId,
+            deviceDid,
+            publicJwks: publicKeys.map((entry) => entry.publicJwk),
+            protectedWalletSeed: await protectServerProfileSecret(seed, input.pin, `${input.profileId}:wallet-seed`, this.options.sealer, this.options.profileProtection),
+            protectedVpToken: await protectServerProfileSecret(input.vpToken, input.pin, `${input.profileId}:vp-token`, this.options.sealer, this.options.profileProtection),
+            failedUnlocks: 0,
+            createdAt: now.toISOString(),
+            updatedAt: now.toISOString(),
+        };
+        await this.options.store.putProfile(record);
+        return record;
+    }
+    listProfiles(ownerId) {
+        return this.options.store.listProfiles(ownerId);
+    }
+    async unlock(input) {
+        const profile = await this.requireOwnedProfile(input.ownerId, input.profileId);
+        this.requireSubject(profile, input.subjectDid);
+        const now = this.now();
+        if (profile.lockedUntil && new Date(profile.lockedUntil) > now) {
+            throw new Error('Profile is temporarily locked after failed PIN attempts.');
+        }
+        let seed;
+        let vpToken;
+        try {
+            seed = await openServerProfileSecret(profile.protectedWalletSeed, input.pin, `${profile.profileId}:wallet-seed`, this.options.sealer);
+            vpToken = await openServerProfileSecret(profile.protectedVpToken, input.pin, `${profile.profileId}:vp-token`, this.options.sealer);
+        }
+        catch (reason) {
+            if (!(reason instanceof ProfilePinRejectedError))
+                throw reason;
+            const failures = profile.failedUnlocks + 1;
+            const max = this.options.maxFailedUnlocks ?? 5;
+            const lockedUntil = failures >= max
+                ? new Date(now.getTime() + (this.options.lockSeconds ?? 300) * 1000).toISOString()
+                : undefined;
+            await this.options.store.putProfile({ ...profile, failedUnlocks: failures, lockedUntil, updatedAt: now.toISOString() });
+            throw new Error('Profile PIN rejected.');
+        }
+        const wallet = await this.createWallet(profile.profileId, seed);
+        const assertion = await buildWalletClientAssertion(wallet, profile, this.options.gatewayBaseUrl, now);
+        const token = await this.createClient(profile.routeContext, input.idToken).requestSmartToken({
+            ...profile.routeContext,
+            actorDid: profile.actorDid,
+            subjectDid: input.subjectDid,
+            clientId: profile.clientId,
+            issuer: profile.clientId,
+            audience: this.options.gatewayBaseUrl,
+            idToken: input.idToken,
+            vpToken,
+            clientAssertion: assertion,
+            clientAssertionType: 'private_key_jwt',
+            smartTokenKind: 'openid-smart',
+            scopes: unique(input.scopes),
+            tokenCacheKey: `profile:${profile.profileId}:${input.subjectDid}:${unique(input.scopes).join(',')}`,
+        });
+        if (token.status !== 'fetched' || !token.accessToken)
+            throw new Error('SMART token exchange failed.');
+        const sessionId = randomBytes(32).toString('base64url');
+        const expiresAt = new Date(now.getTime() + (this.options.sessionTtlSeconds ?? 300) * 1000);
+        await this.options.store.putProfile({ ...profile, failedUnlocks: 0, lockedUntil: undefined, updatedAt: now.toISOString() });
+        await this.options.store.putSession({
+            sessionId,
+            ownerId: input.ownerId,
+            profileId: profile.profileId,
+            subjectDid: input.subjectDid,
+            scopes: unique(input.scopes),
+            sealedUnlockedWalletSeed: await this.options.sealer.seal(seed, `${sessionId}:unlocked-wallet-seed`),
+            sealedAccessToken: await this.options.sealer.seal(token.accessToken, `${sessionId}:access-token`),
+            expiresAt: expiresAt.toISOString(),
+        });
+        return this.resolveSession(input.ownerId, sessionId);
+    }
+    async resolveSession(ownerId, sessionId) {
+        const session = await this.options.store.getSession(sessionId);
+        if (!session || session.ownerId !== ownerId)
+            throw new Error('Profile session not found.');
+        if (new Date(session.expiresAt) <= this.now()) {
+            await this.options.store.deleteSession(sessionId);
+            throw new Error('Profile session expired.');
+        }
+        const profile = await this.requireOwnedProfile(ownerId, session.profileId);
+        const seed = await this.options.sealer.unseal(session.sealedUnlockedWalletSeed, `${sessionId}:unlocked-wallet-seed`);
+        const wallet = await this.createWallet(profile.profileId, seed);
+        const context = walletContext(profile.profileId);
+        return {
+            sessionId,
+            profile,
+            subjectDid: session.subjectDid,
+            scopes: session.scopes,
+            accessToken: await this.options.sealer.unseal(session.sealedAccessToken, `${sessionId}:access-token`),
+            secureTransportAdapter: {
+                pack: (message) => wallet.packForRecipientWithContext(message, this.options.recipientDid, { context }),
+                unpack: async (jwe) => (await wallet.unpackWithContext(jwe, { context })).content,
+            },
+        };
+    }
+    async lock(ownerId, sessionId) {
+        const session = await this.options.store.getSession(sessionId);
+        if (session?.ownerId === ownerId)
+            await this.options.store.deleteSession(sessionId);
+    }
+    createClient(ctx, bearerToken) {
+        return new NodeHttpClient({
+            baseUrl: this.options.gatewayBaseUrl,
+            ctx,
+            bearerToken,
+            fetchImpl: this.options.fetchImpl,
+        });
+    }
+    async createWallet(profileId, seed) {
+        const wallet = new NodeManagedWallet({ resolveRecipientJwk: this.options.resolveRecipientJwk });
+        const context = walletContext(profileId);
+        await wallet.provisionManagedKeys(context, {
+            ownerScope: 'profile',
+            purposes: ['actor-signing'],
+            mode: 'deterministic',
+            seedMaterial: seed,
+        });
+        await wallet.provisionManagedKeys(context, {
+            ownerScope: 'runtime',
+            purposes: ['openid-id-token-signing', 'vp-token-signing', 'comm-signing', 'comm-encryption'],
+            mode: 'deterministic',
+            seedMaterial: seed,
+        });
+        return wallet;
+    }
+    async requireOwnedProfile(ownerId, profileId) {
+        const profile = await this.options.store.getProfile(profileId);
+        if (!profile || profile.ownerId !== ownerId)
+            throw new Error('Profile not found.');
+        return profile;
+    }
+    requireSubject(profile, subjectDid) {
+        if (!profile.allowedSubjectDids.includes(subjectDid))
+            throw new Error('Subject is not linked to this profile.');
+    }
+    now() { return this.options.now?.() || new Date(); }
+}
+async function buildWalletClientAssertion(wallet, profile, audience, now) {
+    const seconds = Math.floor(now.getTime() / 1000);
+    return wallet.signCompactJws(walletContext(profile.profileId), {
+        header: { alg: 'ES384', typ: 'JWT' },
+        claims: {
+            iss: profile.clientId,
+            sub: profile.clientId,
+            aud: audience,
+            iat: seconds,
+            exp: seconds + 300,
+            jti: randomBytes(16).toString('base64url'),
+        },
+        key: { ownerScope: 'runtime', purpose: 'openid-id-token-signing' },
+    });
+}
+function walletContext(profileId) {
+    return {
+        profile: { profileId },
+        runtime: { runtimeId: `${profileId}:server-runtime`, runtimeType: 'backend-service' },
+    };
+}
+function requireEnrollment(input) {
+    for (const [name, value] of Object.entries({
+        ownerId: input.ownerId,
+        profileId: input.profileId,
+        actorDid: input.actorDid,
+        profileDid: input.profileDid,
+        providerDid: input.providerDid,
+        activationCode: input.activationCode,
+        vpToken: input.vpToken,
+    }))
+        if (!String(value || '').trim())
+            throw new Error(`Profile enrollment requires ${name}.`);
+    if (!input.allowedSubjectDids.length)
+        throw new Error('Profile enrollment requires an allowed subject.');
+}
+function unique(values) {
+    return [...new Set(values.map((value) => String(value).trim()).filter(Boolean))].sort();
+}
+function terminalBody(value) {
+    if (value && typeof value === 'object' && !Array.isArray(value) && 'body' in value) {
+        return value.body || value;
+    }
+    return value;
+}
+function findText(value, keys) {
+    if (!value || typeof value !== 'object')
+        return undefined;
+    if (Array.isArray(value)) {
+        for (const item of value) {
+            const found = findText(item, keys);
+            if (found)
+                return found;
+        }
+        return undefined;
+    }
+    const record = value;
+    for (const key of keys) {
+        const found = String(record[key] || '').trim();
+        if (found)
+            return found;
+    }
+    for (const child of Object.values(record)) {
+        const found = findText(child, keys);
+        if (found)
+            return found;
+    }
+    return undefined;
+}

package/dist/session.d.ts

@@ -2,6 +2,7 @@ import type { ActorKind, Capability } from 'gdc-common-utils-ts/models/actor-ses
 import { HostOnboardingSdk } from './orchestration/host-onboarding-sdk.js';
 import { IndividualControllerSdk } from './orchestration/individual-controller-sdk.js';
 import { IndividualMemberSdk } from './orchestration/individual-member-sdk.js';
+import { PersonalSdk } from './orchestration/personal-sdk.js';
 import { OrganizationControllerSdk } from './orchestration/organization-controller-sdk.js';
 import { OrganizationEmployeeSdk } from './orchestration/organization-employee-sdk.js';
 import { ProfessionalSdk } from './orchestration/professional-sdk.js';
@@ -39,6 +40,11 @@ export declare class ActorSession {
     asOrganizationController(): OrganizationControllerSdk;
     asOrganizationEmployee(): OrganizationEmployeeSdk;
     asIndividualController(): IndividualControllerSdk;
+    /**
+     * Presents the reduced self-service surface for an individual-controller
+     * actor whose selected relationship mode is ONESELF.
+     */
+    asPersonal(): PersonalSdk;
     asIndividualMember(): IndividualMemberSdk;
     asProfessional(): ProfessionalSdk;
     private requireClient;
@@ -59,6 +65,7 @@ export declare class NodeActorSession {
     asOrganizationController(): OrganizationControllerSdk;
     asOrganizationEmployee(): OrganizationEmployeeSdk;
     asIndividualController(): IndividualControllerSdk;
+    asPersonal(): PersonalSdk;
     asIndividualMember(): IndividualMemberSdk;
     asProfessional(): ProfessionalSdk;
 }

package/dist/session.js

@@ -3,6 +3,7 @@ import { ActorKinds } from 'gdc-common-utils-ts/constants/actor-session';
 import { HostOnboardingSdk } from './orchestration/host-onboarding-sdk.js';
 import { IndividualControllerSdk } from './orchestration/individual-controller-sdk.js';
 import { IndividualMemberSdk } from './orchestration/individual-member-sdk.js';
+import { PersonalSdk } from './orchestration/personal-sdk.js';
 import { OrganizationControllerSdk } from './orchestration/organization-controller-sdk.js';
 import { OrganizationEmployeeSdk } from './orchestration/organization-employee-sdk.js';
 import { ProfessionalSdk } from './orchestration/professional-sdk.js';
@@ -44,6 +45,14 @@ export class ActorSession {
         this.assertActorKind(ActorKinds.IndividualController);
         return new IndividualControllerSdk(this.requireClient(), this.capabilities);
     }
+    /**
+     * Presents the reduced self-service surface for an individual-controller
+     * actor whose selected relationship mode is ONESELF.
+     */
+    asPersonal() {
+        this.assertActorKind(ActorKinds.IndividualController);
+        return new PersonalSdk(this.requireClient());
+    }
     asIndividualMember() {
         this.assertActorKind(ActorKinds.IndividualMember);
         return new IndividualMemberSdk(this.requireClient());
@@ -76,6 +85,7 @@ export class NodeActorSession {
     asOrganizationController() { return this.inner.asOrganizationController(); }
     asOrganizationEmployee() { return this.inner.asOrganizationEmployee(); }
     asIndividualController() { return this.inner.asIndividualController(); }
+    asPersonal() { return this.inner.asPersonal(); }
     asIndividualMember() { return this.inner.asIndividualMember(); }
     asProfessional() { return this.inner.asProfessional(); }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-sdk-node-ts",
-  "version": "2.2.2",
+  "version": "2.3.0",
   "description": "Next-generation Node runtime package for the GDC SDK family",
   "license": "Apache-2.0",
   "author": "Antifraud Services Inc.",
@@ -35,8 +35,8 @@
     "test:e2e:live-gw:clean": "bash ./scripts/run-live-gw-clean.sh"
   },
   "dependencies": {
-    "gdc-common-utils-ts": "^2.2.2",
-    "gdc-sdk-core-ts": "~2.2.1"
+    "gdc-common-utils-ts": "^2.3.0",
+    "gdc-sdk-core-ts": "~2.3.0"
   },
   "devDependencies": {
     "@types/node": "^20.14.10",

package/dist/legal-organization-onboarding-facade.d.ts

@@ -1,70 +0,0 @@
-import type { LegalOrganizationVerificationRouting, LegalOrganizationVerificationTransactionController, LegalOrganizationVerificationTransactionInput, LegalOrganizationVerificationTransactionOrganization, LegalOrganizationVerificationRepresentativePayload } from 'gdc-common-utils-ts/utils/legal-organization-verification-transaction';
-import type { NodeOrganizationActivationInput } from './orchestration/client-port.js';
-export type LegalOrganizationFormFields = Readonly<{
-    legalName?: string;
-    legalIdentifierType?: string;
-    legalIdentifierValue?: string;
-    taxId?: string;
-    addressCountry?: string;
-    controllerEmail?: string;
-    controllerRole?: string;
-    serviceCategory?: string;
-    serviceIdentifier?: string;
-    serviceUrl?: string;
-}>;
-export type LegalOrganizationOnboardingValidationIssue = Readonly<{
-    severity: 'error' | 'warning';
-    code: string;
-    message: string;
-    field?: keyof LegalOrganizationFormFields | 'claims' | string;
-}>;
-export type LegalOrganizationOnboardingValidationResult = Readonly<{
-    ok: boolean;
-    errors: LegalOrganizationOnboardingValidationIssue[];
-    warnings: LegalOrganizationOnboardingValidationIssue[];
-    normalizedClaims: Record<string, unknown>;
-}>;
-export interface LegalOrganizationOnboardingEditor {
-    setLegalName(value: string): LegalOrganizationOnboardingEditor;
-    setLegalIdentifierType(value: string): LegalOrganizationOnboardingEditor;
-    setLegalIdentifierValue(value: string): LegalOrganizationOnboardingEditor;
-    setTaxId(value: string): LegalOrganizationOnboardingEditor;
-    setAddressCountry(value: string): LegalOrganizationOnboardingEditor;
-    setControllerEmail(value: string): LegalOrganizationOnboardingEditor;
-    setControllerRole(value: string): LegalOrganizationOnboardingEditor;
-    setServiceCategory(value: string): LegalOrganizationOnboardingEditor;
-    setServiceIdentifier(value: string): LegalOrganizationOnboardingEditor;
-    setServiceUrl(value: string): LegalOrganizationOnboardingEditor;
-    getFormFields(): LegalOrganizationFormFields;
-    buildClaims(): Record<string, unknown>;
-    validate(): LegalOrganizationOnboardingValidationResult;
-    buildVerificationTransactionInput(input: Readonly<{
-        controller: LegalOrganizationVerificationTransactionController;
-        organization?: LegalOrganizationVerificationTransactionOrganization;
-        legalRepresentativePayload?: LegalOrganizationVerificationRepresentativePayload;
-        verification?: LegalOrganizationVerificationRouting;
-        attachments?: unknown[];
-    }>): LegalOrganizationVerificationTransactionInput;
-    buildActivationInput(input: Readonly<{
-        vpToken: string;
-        controller: LegalOrganizationVerificationTransactionController;
-        capabilities?: readonly string[];
-    }>): NodeOrganizationActivationInput;
-}
-export interface LegalOrganizationOnboardingFacade {
-    createDraft(initial?: LegalOrganizationFormFields): LegalOrganizationFormFields;
-    createEditor(initial?: LegalOrganizationFormFields): LegalOrganizationOnboardingEditor;
-    setLegalName(fields: LegalOrganizationFormFields, value: string): LegalOrganizationFormFields;
-    setLegalIdentifierType(fields: LegalOrganizationFormFields, value: string): LegalOrganizationFormFields;
-    setLegalIdentifierValue(fields: LegalOrganizationFormFields, value: string): LegalOrganizationFormFields;
-    setTaxId(fields: LegalOrganizationFormFields, value: string): LegalOrganizationFormFields;
-    setAddressCountry(fields: LegalOrganizationFormFields, value: string): LegalOrganizationFormFields;
-    setControllerEmail(fields: LegalOrganizationFormFields, value: string): LegalOrganizationFormFields;
-    setControllerRole(fields: LegalOrganizationFormFields, value: string): LegalOrganizationFormFields;
-    setServiceCategory(fields: LegalOrganizationFormFields, value: string): LegalOrganizationFormFields;
-    setServiceIdentifier(fields: LegalOrganizationFormFields, value: string): LegalOrganizationFormFields;
-    setServiceUrl(fields: LegalOrganizationFormFields, value: string): LegalOrganizationFormFields;
-    buildClaims(fields: LegalOrganizationFormFields): Record<string, unknown>;
-    validate(fields: LegalOrganizationFormFields): LegalOrganizationOnboardingValidationResult;
-}
-export declare function createLegalOrganizationOnboardingFacade(): LegalOrganizationOnboardingFacade;