gdc-sdk-node-ts 2.4.33 → 2.4.34

package/README.md

@@ -113,6 +113,8 @@ If you need the shortest path:
 
 - main onboarding guide:
   [docs/101-SDK_END_TO_END.md](./docs/101-SDK_END_TO_END.md)
+- wallet `context`, stable `runtimeId` and KMS-encrypted seed custody:
+  [docs/101-WALLET_CONTEXT_AND_KEY_CUSTODY.md](./docs/101-WALLET_CONTEXT_AND_KEY_CUSTODY.md)
 - first public actor surfaces:
   `HostOnboardingSdk`, `OrganizationControllerSdk`,
   `IndividualControllerSdk`, `ProfessionalSdk`

package/dist/node-managed-wallet.d.ts

@@ -76,10 +76,12 @@ export declare class NodeManagedWallet implements IWallet {
      * representative; these runtime keys protect DIDComm communications.
      *
      * The caller owns durable wallet custody. When deterministic provisioning is
-     * used, protect `seedMaterial` in the portal wallet store (for example behind
-     * the user's PIN and a server-held KEK) so the same private keys can be
-     * reconstructed after restart. ICA and GW receive only this returned public
-     * JWKS.
+     * used, protect `seedMaterial` in the portal wallet store (for example with
+     * its KMS/KEK and optionally a user PIN) and persist the same non-secret
+     * `context.runtime.runtimeId`. A fresh `NodeManagedWallet` reconstructs the
+     * same private keys from that seed and context after restart, so private JWKs
+     * do not need separate persistence. ICA and GW receive only this returned
+     * public JWKS.
      */
     initializeCommunicationJsonWebKeySet(context: WalletExecutionContext, options?: NodeCommunicationWalletInitialization): Promise<JwkSet>;
     /**

package/dist/node-managed-wallet.js

@@ -143,10 +143,12 @@ export class NodeManagedWallet {
      * representative; these runtime keys protect DIDComm communications.
      *
      * The caller owns durable wallet custody. When deterministic provisioning is
-     * used, protect `seedMaterial` in the portal wallet store (for example behind
-     * the user's PIN and a server-held KEK) so the same private keys can be
-     * reconstructed after restart. ICA and GW receive only this returned public
-     * JWKS.
+     * used, protect `seedMaterial` in the portal wallet store (for example with
+     * its KMS/KEK and optionally a user PIN) and persist the same non-secret
+     * `context.runtime.runtimeId`. A fresh `NodeManagedWallet` reconstructs the
+     * same private keys from that seed and context after restart, so private JWKs
+     * do not need separate persistence. ICA and GW receive only this returned
+     * public JWKS.
      */
     async initializeCommunicationJsonWebKeySet(context, options = {}) {
         if (!context.runtime?.runtimeId) {

package/dist/organization-registration-authorization.d.ts

@@ -0,0 +1,16 @@
+import type { VerifiableCredentialV2 } from 'gdc-common-utils-ts/models/verifiable-credential';
+import type { IWallet, WalletExecutionContext, WalletKeySelection } from 'gdc-sdk-core-ts';
+/** Input required to add one human-authorizer proof to the out-of-band VC. */
+export type SignOrganizationRegistrationAuthorizationInput = Readonly<{
+    credential: VerifiableCredentialV2;
+    wallet: IWallet;
+    context: WalletExecutionContext;
+    key: WalletKeySelection;
+    verificationMethod: string;
+    createdAt?: string;
+}>;
+/**
+ * Adds one detached JWS proof made by the already-unlocked professional
+ * profile. The browser never receives the private key or clear wallet seed.
+ */
+export declare function signOrganizationRegistrationAuthorizationCredential(input: SignOrganizationRegistrationAuthorizationInput): Promise<VerifiableCredentialV2>;

package/dist/organization-registration-authorization.js

@@ -0,0 +1,34 @@
+import { canonicalizeOrganizationRegistrationAuthorizationCredential, } from 'gdc-common-utils-ts/utils/organization-registration-authorization';
+/**
+ * Adds one detached JWS proof made by the already-unlocked professional
+ * profile. The browser never receives the private key or clear wallet seed.
+ */
+export async function signOrganizationRegistrationAuthorizationCredential(input) {
+    if (!input.wallet.signDetachedJws) {
+        throw new Error('Wallet does not support detached organization authorization proofs.');
+    }
+    const verificationMethod = String(input.verificationMethod || '').trim();
+    if (!verificationMethod)
+        throw new Error('Organization authorization proof requires verificationMethod.');
+    const payload = canonicalizeOrganizationRegistrationAuthorizationCredential(input.credential);
+    const jws = await input.wallet.signDetachedJws(input.context, {
+        payload,
+        header: { typ: 'application/vc+ld+json' },
+        key: input.key,
+    });
+    const existingProofs = Array.isArray(input.credential.proof)
+        ? input.credential.proof
+        : input.credential.proof
+            ? [input.credential.proof]
+            : [];
+    return {
+        ...input.credential,
+        proof: [...existingProofs, {
+                type: 'JsonWebSignature2020',
+                created: input.createdAt || new Date().toISOString(),
+                proofPurpose: 'contractAgreement',
+                verificationMethod,
+                jws,
+            }],
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-sdk-node-ts",
-  "version": "2.4.33",
+  "version": "2.4.34",
   "description": "Next-generation Node runtime package for the GDC SDK family",
   "license": "Apache-2.0",
   "author": "Antifraud Services Inc.",