gdc-sdk-node-ts 2.5.0 → 2.5.1

package/dist/authorized-subject-directory.js

@@ -7,6 +7,9 @@ const CLAIM_ITEM_CONDITION = 'org.schema.IndividualProduct.itemCondition';
 const CLAIM_PERSON_EMAIL = 'org.schema.Person.email';
 const CLAIM_PERSON_TELEPHONE = 'org.schema.Person.telephone';
 const CLAIM_ORGANIZATION_SAME_AS = 'org.schema.Organization.sameAs';
+const CLAIM_ORGANIZATION_OWNER_EMAIL = 'org.schema.Organization.owner.email';
+const CLAIM_ORGANIZATION_OWNER_TELEPHONE = 'org.schema.Organization.owner.telephone';
+const CLAIM_ORGANIZATION_MEMBER_ROLE = 'org.schema.Organization.member.role';
 const CLAIM_RELATED_PERSON_ROLE = 'RelatedPerson.role';
 const CLAIM_OCCUPATION_IDENTIFIER = 'org.schema.Person.hasOccupation.identifier.value';
 /**
@@ -23,6 +26,24 @@ export async function listAuthorizedIndividualSubjectsWithDeps(routeContext, inp
     if (!email && !telephone) {
         throw new Error('A verified email or telephone is required to list authorized subjects.');
     }
+    const ownerResult = await deps.submitAndPoll(deps.individualOrganizationSearchPath(routeContext), deps.individualOrganizationSearchPollPath(routeContext), {
+        thid: input.requestThid || createThreadId('authorized-subject-owner'),
+        body: {
+            resourceType: 'Bundle',
+            type: 'batch',
+            data: [{
+                    type: 'Family-search-v1.0',
+                    request: { method: 'POST' },
+                    meta: { claims: {
+                            '@context': SCHEMA_CONTEXT,
+                            ...(email ? { [CLAIM_ORGANIZATION_OWNER_EMAIL]: email } : {}),
+                            ...(telephone ? { [CLAIM_ORGANIZATION_OWNER_TELEPHONE]: telephone } : {}),
+                        } },
+                }],
+        },
+    }, input.pollOptions);
+    const ownedSubjects = readOwnedSubjects(ownerResult, { email, telephone });
+    const subjectsByDid = new Map(ownedSubjects.map((subject) => [subject.subjectDid, subject]));
     const licenseClaims = {
         '@context': SCHEMA_CONTEXT,
         [CLAIM_AUDIENCE_TYPE]: INDIVIDUAL_AUDIENCE_TYPE,
@@ -42,7 +63,7 @@ export async function listAuthorizedIndividualSubjectsWithDeps(routeContext, inp
         },
     }, input.pollOptions);
     const licenses = readAcceptedLicenses(licenseResult);
-    const resolved = await Promise.all(licenses.map(async (license) => {
+    const resolved = await Promise.all(licenses.filter((license) => !subjectsByDid.has(license.subjectDid)).map(async (license) => {
         const organizationClaims = {
             '@context': SCHEMA_CONTEXT,
             [CLAIM_ORGANIZATION_SAME_AS]: license.subjectDid,
@@ -74,7 +95,38 @@ export async function listAuthorizedIndividualSubjectsWithDeps(routeContext, inp
             subjectClaims,
         };
     }));
-    return resolved.filter((value) => Boolean(value));
+    for (const subject of resolved.filter((value) => Boolean(value))) {
+        subjectsByDid.set(subject.subjectDid, subject);
+    }
+    return [...subjectsByDid.values()];
+}
+function readOwnedSubjects(result, verified) {
+    const resources = readData(result).flatMap((entry) => {
+        if (entry?.resource?.resourceType === 'Bundle' && Array.isArray(entry.resource.entry)) {
+            return entry.resource.entry.map((item) => item?.resource).filter(Boolean);
+        }
+        return [];
+    });
+    return resources.flatMap((resource) => {
+        const claims = resource?.meta?.claims;
+        if (!claims || typeof claims !== 'object')
+            return [];
+        const ownerEmail = String(claims[CLAIM_ORGANIZATION_OWNER_EMAIL] || '').trim().toLowerCase();
+        const ownerTelephone = String(claims[CLAIM_ORGANIZATION_OWNER_TELEPHONE] || '').trim();
+        if (!((verified.email && ownerEmail === verified.email) || (verified.telephone && ownerTelephone === verified.telephone))) {
+            return [];
+        }
+        const subjectDid = String(claims[CLAIM_ORGANIZATION_SAME_AS] || '').trim();
+        if (!subjectDid)
+            return [];
+        const role = String(claims[CLAIM_ORGANIZATION_MEMBER_ROLE] || '').trim();
+        return [{
+                subjectDid,
+                ...(role ? { role } : {}),
+                grantClaims: {},
+                subjectClaims: claims,
+            }];
+    });
 }
 function readAcceptedLicenses(result) {
     const rows = readData(result)[0]?.resource?.data;

package/dist/node-managed-wallet.d.ts

@@ -180,6 +180,16 @@ export declare class NodeManagedWallet implements IWallet {
      * Packs one payload into a transport envelope signed and encrypted by the runtime.
      */
     packForRecipientWithContext(content: any, recipientDidOrJwk: string | JWK, options: WalletPackOptions): Promise<string>;
+    /**
+     * Packs the first activation/DCR requests before GW can resolve this
+     * installation's communication keys from a registered DID document.
+     *
+     * The embedded public keys are bootstrap response and signature material;
+     * callers must still authenticate the HTTP request with the trusted OIDC
+     * token and one server-authorized activation code. Post-DCR operations must
+     * use `packForRecipientWithContext` so registered key custody is resolved.
+     */
+    packProfileBootstrapForRecipientWithContext(content: any, recipientDidOrJwk: string | JWK, options: WalletPackOptions): Promise<string>;
     /**
      * Legacy unpack shape retained for app compatibility.
      */

package/dist/node-managed-wallet.js

@@ -467,6 +467,46 @@ export class NodeManagedWallet {
             key: encryptionKey,
         });
     }
+    /**
+     * Packs the first activation/DCR requests before GW can resolve this
+     * installation's communication keys from a registered DID document.
+     *
+     * The embedded public keys are bootstrap response and signature material;
+     * callers must still authenticate the HTTP request with the trusted OIDC
+     * token and one server-authorized activation code. Post-DCR operations must
+     * use `packForRecipientWithContext` so registered key custody is resolved.
+     */
+    async packProfileBootstrapForRecipientWithContext(content, recipientDidOrJwk, options) {
+        const recipientJwk = typeof recipientDidOrJwk === 'string'
+            ? await this.resolveRecipientPublicJwk(recipientDidOrJwk)
+            : recipientDidOrJwk;
+        const signingKey = this.requireManagedKey(options.context, {
+            ownerScope: 'runtime',
+            purpose: 'comm-signing',
+        }, 'sig');
+        const encryptionKey = this.requireManagedKey(options.context, {
+            ownerScope: 'runtime',
+            purpose: 'comm-encryption',
+        }, 'enc');
+        const compactJws = await this.signCompactJws(options.context, {
+            header: {
+                typ: 'JWS',
+                jwk: signingKey.descriptor.publicJwk,
+            },
+            claims: content,
+            key: { keyId: signingKey.descriptor.kid },
+        });
+        const senderEncryptionKey = {
+            ...encryptionKey.descriptor.publicJwk,
+            dBytes: encryptionKey.privateMaterial,
+        };
+        return this.cryptography.encryptJweToCompact(compactJws, {
+            enc: 'A256GCM',
+            skid: encryptionKey.descriptor.kid,
+            jwk: encryptionKey.descriptor.publicJwk,
+            cty: 'JWS',
+        }, senderEncryptionKey, recipientJwk);
+    }
     /**
      * Legacy unpack shape retained for app compatibility.
      */

package/dist/organization-registration-authorization.d.ts

@@ -0,0 +1,16 @@
+import type { VerifiableCredentialV2 } from 'gdc-common-utils-ts/models/verifiable-credential';
+import type { IWallet, WalletExecutionContext, WalletKeySelection } from 'gdc-sdk-core-ts';
+/** Input required to add one human-authorizer proof to the out-of-band VC. */
+export type SignOrganizationRegistrationAuthorizationInput = Readonly<{
+    credential: VerifiableCredentialV2;
+    wallet: IWallet;
+    context: WalletExecutionContext;
+    key: WalletKeySelection;
+    verificationMethod: string;
+    createdAt?: string;
+}>;
+/**
+ * Adds one detached JWS proof made by the already-unlocked professional
+ * profile. The browser never receives the private key or clear wallet seed.
+ */
+export declare function signOrganizationRegistrationAuthorizationCredential(input: SignOrganizationRegistrationAuthorizationInput): Promise<VerifiableCredentialV2>;

package/dist/organization-registration-authorization.js

@@ -0,0 +1,34 @@
+import { canonicalizeOrganizationRegistrationAuthorizationCredential, } from 'gdc-common-utils-ts/utils/organization-registration-authorization';
+/**
+ * Adds one detached JWS proof made by the already-unlocked professional
+ * profile. The browser never receives the private key or clear wallet seed.
+ */
+export async function signOrganizationRegistrationAuthorizationCredential(input) {
+    if (!input.wallet.signDetachedJws) {
+        throw new Error('Wallet does not support detached organization authorization proofs.');
+    }
+    const verificationMethod = String(input.verificationMethod || '').trim();
+    if (!verificationMethod)
+        throw new Error('Organization authorization proof requires verificationMethod.');
+    const payload = canonicalizeOrganizationRegistrationAuthorizationCredential(input.credential);
+    const jws = await input.wallet.signDetachedJws(input.context, {
+        payload,
+        header: { typ: 'application/vc+ld+json' },
+        key: input.key,
+    });
+    const existingProofs = Array.isArray(input.credential.proof)
+        ? input.credential.proof
+        : input.credential.proof
+            ? [input.credential.proof]
+            : [];
+    return {
+        ...input.credential,
+        proof: [...existingProofs, {
+                type: 'JsonWebSignature2020',
+                created: input.createdAt || new Date().toISOString(),
+                proofPurpose: 'contractAgreement',
+                verificationMethod,
+                jws,
+            }],
+    };
+}

package/dist/server-profile-session.js

@@ -44,7 +44,18 @@ export class ServerProfileSessionManager {
         const idToken = String(input.idToken || '').trim();
         if (!idToken)
             throw new Error('Profile enrollment requires a signed OIDC idToken for account/email binding.');
-        const client = this.createClient(input.routeContext, idToken);
+        const client = new NodeHttpClient({
+            baseUrl: this.options.gatewayBaseUrl,
+            ctx: input.routeContext,
+            bearerToken: idToken,
+            appInfo: this.options.appInfo,
+            fetchImpl: this.options.fetchImpl,
+            transportProfile: TransportProfiles.DidcommEncryptedForm,
+            secureTransportAdapter: {
+                pack: (message) => wallet.packProfileBootstrapForRecipientWithContext({ ...message, iss: input.actorDid }, input.providerDid, { context }),
+                unpack: async (jwe) => (await wallet.unpackWithContext(jwe, { context })).content,
+            },
+        });
         const redirectUris = input.redirectUris || input.dcrRedirectUris || [];
         const clientName = String(input.clientName || input.dcrClientName || '').trim();
         const activationRequest = createProfileDeviceActivationRequest({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-sdk-node-ts",
-  "version": "2.5.0",
+  "version": "2.5.1",
   "description": "Next-generation Node runtime package for the GDC SDK family",
   "license": "Apache-2.0",
   "author": "Antifraud Services Inc.",