gdc-sdk-node-ts 2.4.10 → 2.4.12

package/dist/node-managed-wallet.js

@@ -358,9 +358,11 @@ export class NodeManagedWallet {
             header: {
                 typ: 'JWS',
             },
-            claims: {
-                payload: content,
-            },
+            // GW KMS decodes the JWS claims as the DIDComm message itself. Wrapping
+            // the message in `{ payload: ... }` hides `iss`, `thid` and `body` one
+            // level too deep and makes every encrypted resource action fail before
+            // routing or signature verification.
+            claims: content,
             key: signingKey,
         });
         return this.buildCompactJwe(options.context, {
@@ -404,8 +406,16 @@ export class NodeManagedWallet {
                     throw new Error('NodeManagedWallet.unpackWithContext expected a compact JWS payload.');
                 }
                 const payload = Content.base64UrlSafeToJSON(parts[1]);
+                const decodedPayload = payload;
+                const legacyWrappedContent = Object.keys(decodedPayload).length === 1
+                    && decodedPayload.payload
+                    && typeof decodedPayload.payload === 'object'
+                    ? decodedPayload.payload
+                    : decodedPayload;
                 return {
-                    content: payload.payload,
+                    // Read the canonical direct-message JWS and retain compatibility
+                    // with SDK <=2.4.11 envelopes already queued by an outbox.
+                    content: legacyWrappedContent,
                     meta: {
                         jwe: { protected: decodedProtectedHeader },
                         jws: {

package/dist/resource-operations.d.ts

@@ -673,6 +673,8 @@ type OrganizationLicenseMutationDeps = {
  * Requests additional zero-cost employee seats from a GW test-network.
  * Production callers must use the provider-payment and confirmed Order flow;
  * the gateway enforces that environment boundary independently of this SDK.
+ * The request keeps the canonical outer DIDComm identity fields because secure
+ * transports sign this envelope before encrypting it for the gateway.
  */
 export declare function addFreeOrganizationEmployeeLicensesWithDeps(routeCtx: RouteContext, input: OrganizationEmployeeLicenseAddInput, deps: OrganizationLicenseMutationDeps): Promise<SubmitAndPollResult>;
 /**

package/dist/resource-operations.js

@@ -247,6 +247,8 @@ export async function listIndividualLicensesWithDeps(routeCtx, input, deps) {
  * Requests additional zero-cost employee seats from a GW test-network.
  * Production callers must use the provider-payment and confirmed Order flow;
  * the gateway enforces that environment boundary independently of this SDK.
+ * The request keeps the canonical outer DIDComm identity fields because secure
+ * transports sign this envelope before encrypting it for the gateway.
  */
 export async function addFreeOrganizationEmployeeLicensesWithDeps(routeCtx, input, deps) {
     const entry = buildLicensePurchaseEntry({
@@ -257,6 +259,10 @@ export async function addFreeOrganizationEmployeeLicensesWithDeps(routeCtx, inpu
         priceCurrency: 'EUR',
     });
     return deps.submitAndPoll(deps.organizationLicenseActionPath(routeCtx, '_add'), deps.organizationLicenseActionPollPath(routeCtx, '_add'), {
+        jti: `jti-${createRuntimeUuid()}`,
+        iss: routeCtx.tenantId,
+        aud: routeCtx.tenantId,
+        type: 'application/didcomm-plain+json',
         thid: input.requestThid || `organization-license-add-${createRuntimeUuid()}`,
         body: { resourceType: 'Bundle', type: 'batch', data: [entry] },
     }, input.pollOptions);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-sdk-node-ts",
-  "version": "2.4.10",
+  "version": "2.4.12",
   "description": "Next-generation Node runtime package for the GDC SDK family",
   "license": "Apache-2.0",
   "author": "Antifraud Services Inc.",