gdc-sdk-node-ts 2.0.6 → 2.0.8

package/README.md

@@ -682,6 +682,19 @@ For legal-organization onboarding from a Node BFF/runtime, keep the host steps s
 Use `OrganizationControllerSdk.submitLegalOrganizationVerificationTransaction(...)` or
 `NodeHttpClient.submitLegalOrganizationVerificationTransaction(...)` for step 1.
 
+Existing-tenant recovery/reverification:
+
+- use `OrganizationControllerSdk.submitLegalOrganizationIssue(...)` or
+  `NodeHttpClient.submitLegalOrganizationIssue(...)` to refresh the ICA-backed
+  verification for an already registered tenant without creating a new Offer
+- GW is expected to return one new controller activation code as
+  `org.schema.IndividualProduct.serialNumber`
+- then continue with the existing helper chain:
+  `recoverOrganizationControllerWithIssueWithDeps(...)`
+  or directly `_exchange -> _dcr`
+- for a reproducible local/staging runtime check, use:
+  `npm run test:e2e:live-gw:issue-recovery`
+
 Rules:
 
 - `_transaction` and `_activate` are different flows
@@ -714,3 +727,23 @@ Live E2E legal PDF source:
 - public URL: set `LIVE_GW_HOST_VERIFICATION_PDF_URL=https://.../file.pdf`
 - if both are present, the live suite prefers `LIVE_GW_HOST_VERIFICATION_PDF_URL`
 - Dropbox-style links are normalized to `dl=1` direct-download mode automatically
+
+Recovery-specific live rule:
+
+- `Organization/_issue` can succeed and still be followed by `_exchange` failure
+  if the controller `id_token` is not production-shaped enough
+- the current GW `_exchange` path expects at least:
+  - syntactically valid JWT format
+  - `tenant_id` claim matching the target tenant
+- the bundled recovery runner generates a syntactically valid demo JWT if
+  `CONTROLLER_ID_TOKEN` is not provided, but production/staging should use a
+  real IdP-issued token
+
+Minimal live recovery command:
+
+```bash
+PDF_PATH=/Users/fernando/GITS/gdc-workspace/examples/TEST-A4-Antifraud.pdf \
+BASE_URL=http://127.0.0.1:3000 \
+TENANT_ID=acme-id \
+npm run test:e2e:live-gw:issue-recovery
+```

package/dist/constants/lifecycle.d.ts

@@ -9,6 +9,8 @@
 export declare const GwCoreLifecycleAction: Readonly<{
     readonly Batch: "_batch";
     readonly BatchResponse: "_batch-response";
+    readonly Issue: "_issue";
+    readonly IssueResponse: "_issue-response";
     readonly Transaction: "_transaction";
     readonly TransactionResponse: "_transaction-response";
     readonly Disable: "_disable";

package/dist/constants/lifecycle.js

@@ -11,6 +11,8 @@ import { LifecycleRequestType } from 'gdc-common-utils-ts';
 export const GwCoreLifecycleAction = Object.freeze({
     Batch: '_batch',
     BatchResponse: '_batch-response',
+    Issue: '_issue',
+    IssueResponse: '_issue-response',
     Transaction: '_transaction',
     TransactionResponse: '_transaction-response',
     Disable: '_disable',

package/dist/device-activation.js

@@ -14,6 +14,7 @@ export async function activateEmployeeDeviceWithActivationCodeWithDeps(deps) {
     }
     const dcrPayload = {
         thid: `dcr-${createRuntimeUuid()}`,
+        code: deps.input.activationCode,
         ...deps.input.dcrPayload,
     };
     const dcr = await deps.submitAndPollWithBearerToken(initialAccessToken, deps.identityDeviceDcrPath(deps.routeCtx), deps.identityDeviceDcrPollPath(deps.routeCtx), dcrPayload, deps.input.pollOptions);

package/dist/index.d.ts

@@ -13,6 +13,7 @@ export * from './family-organization-search.js';
 export * from './family-organization-registration.js';
 export * from './individual-onboarding.js';
 export * from './device-activation.js';
+export * from './organization-controller-recovery.js';
 export * from './smart-token.js';
 export * from './order-offer-summary.js';
 export * from './organization-license-order.js';

package/dist/index.js

@@ -14,6 +14,7 @@ export * from './family-organization-search.js';
 export * from './family-organization-registration.js';
 export * from './individual-onboarding.js';
 export * from './device-activation.js';
+export * from './organization-controller-recovery.js';
 export * from './smart-token.js';
 export * from './order-offer-summary.js';
 export * from './organization-license-order.js';

package/dist/node-runtime-client.d.ts

@@ -127,6 +127,16 @@ export declare class HttpRuntimeClient implements NodeRuntimeClient {
      * - `_activate` remains available only for the older ICA `_verify` based flow
      */
     submitLegalOrganizationVerificationTransaction(hostCtx: HostRouteContext, input: NodeLegalOrganizationVerificationTransactionInput, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
+    /**
+     * Starts the host-side existing-tenant legal-organization reissue flow that
+     * GW CORE forwards to ICA `_verify`.
+     *
+     * Semantics:
+     * - reuse the same signed evidence/controller binding contract as `_transaction`
+     * - do not create a new Offer
+     * - expect GW CORE to reissue one controller activation code in the response
+     */
+    submitLegalOrganizationIssue(hostCtx: HostRouteContext, input: NodeLegalOrganizationVerificationTransactionInput, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
     /**
      * Submits one tenant-scoped DID document binding request.
      *
@@ -411,6 +421,8 @@ export declare class HttpRuntimeClient implements NodeRuntimeClient {
     private requireHostRouteContext;
     hostRegistryOrganizationTransactionPath(ctx?: HostRouteContext): string;
     hostRegistryOrganizationTransactionPollPath(ctx?: HostRouteContext): string;
+    hostRegistryOrganizationIssuePath(ctx?: HostRouteContext): string;
+    hostRegistryOrganizationIssuePollPath(ctx?: HostRouteContext): string;
     hostRegistryOrganizationActivatePath(ctx?: HostRouteContext): string;
     hostRegistryOrganizationActivatePollPath(ctx?: HostRouteContext): string;
     hostRegistryOrganizationDisablePath(ctx?: HostRouteContext): string;
@@ -465,6 +477,8 @@ export declare class HttpRuntimeClient implements NodeRuntimeClient {
     individualBundleSearchPollPath(ctx: RouteContext): string;
     identityTokenExchangePath(ctx: RouteContext): string;
     identityTokenExchangePollPath(ctx: RouteContext): string;
+    identityDeviceDcrPath(ctx: RouteContext): string;
+    identityDeviceDcrPollPath(ctx: RouteContext): string;
     identityOpenIdSmartTokenPath(ctx: RouteContext): string;
     identityOpenIdSmartTokenPollPath(ctx: RouteContext): string;
     private appendHttpTrace;

package/dist/node-runtime-client.js

@@ -126,6 +126,27 @@ export class HttpRuntimeClient {
         });
         return this.submitAndPoll(this.hostRegistryOrganizationTransactionPath(hostCtx), this.hostRegistryOrganizationTransactionPollPath(hostCtx), payload, pollOptions);
     }
+    /**
+     * Starts the host-side existing-tenant legal-organization reissue flow that
+     * GW CORE forwards to ICA `_verify`.
+     *
+     * Semantics:
+     * - reuse the same signed evidence/controller binding contract as `_transaction`
+     * - do not create a new Offer
+     * - expect GW CORE to reissue one controller activation code in the response
+     */
+    async submitLegalOrganizationIssue(hostCtx, input, pollOptions) {
+        const thid = `organization-issue-${runtimeUuid()}`;
+        const jti = `organization-issue-jti-${runtimeUuid()}`;
+        const verificationBundle = buildLegalOrganizationVerificationGatewayRequestBundle(input);
+        const payload = this.wrapBundleAsGatewayTransactionMessage({
+            thid,
+            jti,
+            hostCtx,
+            bundle: verificationBundle,
+        });
+        return this.submitAndPoll(this.hostRegistryOrganizationIssuePath(hostCtx), this.hostRegistryOrganizationIssuePollPath(hostCtx), payload, pollOptions);
+    }
     /**
      * Submits one tenant-scoped DID document binding request.
      *
@@ -152,7 +173,7 @@ export class HttpRuntimeClient {
      *
      * Plaintext transport note:
      * - this Node runtime currently submits `_activate` as
-     *   `application/didcomm-plaintext+json`
+     *   `application/didcomm-plain+json`
      * - because there is no real outer JWS/JWE envelope in that mode, the
      *   runtime mirrors the technical communication metadata derived from
      *   `controller.publicKeyJwk` / `controller.jwks` into `meta.jws.protected`
@@ -173,7 +194,7 @@ export class HttpRuntimeClient {
         const serviceClaims = activationDraft.buildServiceClaims();
         const transportMeta = buildDidcommPlaintextTransportMetadata({
             controller: input.controller,
-            contentType: 'application/didcomm-plaintext+json',
+            contentType: 'application/didcomm-plain+json',
         });
         const payload = {
             thid,
@@ -895,6 +916,8 @@ export class HttpRuntimeClient {
     }
     hostRegistryOrganizationTransactionPath(ctx) { return this.hostRegistryPath(ctx, 'Organization', GwCoreLifecycleAction.Transaction); }
     hostRegistryOrganizationTransactionPollPath(ctx) { return this.hostRegistryPath(ctx, 'Organization', GwCoreLifecycleAction.TransactionResponse); }
+    hostRegistryOrganizationIssuePath(ctx) { return this.hostRegistryPath(ctx, 'Organization', GwCoreLifecycleAction.Issue); }
+    hostRegistryOrganizationIssuePollPath(ctx) { return this.hostRegistryPath(ctx, 'Organization', GwCoreLifecycleAction.IssueResponse); }
     hostRegistryOrganizationActivatePath(ctx) { return this.hostRegistryPath(ctx, 'Organization', '_activate'); }
     hostRegistryOrganizationActivatePollPath(ctx) { return this.hostRegistryPath(ctx, 'Organization', '_activate-response'); }
     hostRegistryOrganizationDisablePath(ctx) { return this.hostRegistryPath(ctx, 'Organization', GwCoreLifecycleAction.Disable); }
@@ -959,6 +982,12 @@ export class HttpRuntimeClient {
     identityTokenExchangePollPath(ctx) {
         return `/${encodeURIComponent('host')}/cds-${encodeURIComponent(ctx.jurisdiction)}/v1/${encodeURIComponent(ctx.sector)}/${encodeURIComponent(ctx.tenantId)}/identity/auth/_exchange-response`;
     }
+    identityDeviceDcrPath(ctx) {
+        return `/${encodeURIComponent('host')}/cds-${encodeURIComponent(ctx.jurisdiction)}/v1/${encodeURIComponent(ctx.sector)}/${encodeURIComponent(ctx.tenantId)}/identity/auth/_dcr`;
+    }
+    identityDeviceDcrPollPath(ctx) {
+        return `/${encodeURIComponent('host')}/cds-${encodeURIComponent(ctx.jurisdiction)}/v1/${encodeURIComponent(ctx.sector)}/${encodeURIComponent(ctx.tenantId)}/identity/auth/_dcr-response`;
+    }
     identityOpenIdSmartTokenPath(ctx) {
         return `/${encodeURIComponent(ctx.tenantId)}/cds-${encodeURIComponent(ctx.jurisdiction)}/v1/${encodeURIComponent(ctx.sector)}/identity/openid/smart/token`;
     }

package/dist/orchestration/client-port.d.ts

@@ -54,6 +54,7 @@ export type NodeOrganizationDidBindingInput = OrganizationDidBindingInput;
  */
 export type RuntimeClient = {
     submitLegalOrganizationVerificationTransaction?: (hostCtx: HostRouteContext, input: NodeLegalOrganizationVerificationTransactionInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
+    submitLegalOrganizationIssue?: (hostCtx: HostRouteContext, input: NodeLegalOrganizationVerificationTransactionInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
     submitOrganizationDidBinding?: (ctx: RouteContext, input: NodeOrganizationDidBindingInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
     activateOrganizationInGatewayFromIcaProof?: (hostCtx: HostRouteContext, input: NodeOrganizationActivationInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
     confirmLegalOrganizationOrder?: (hostCtx: HostRouteContext, input: LegalOrganizationOrderInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;

package/dist/orchestration/organization-controller-sdk.d.ts

@@ -29,6 +29,11 @@ export declare class OrganizationControllerSdk {
      * - `_activate` remains only for the legacy ICA `_verify` compatibility path
      */
     submitLegalOrganizationVerificationTransaction(hostCtx: HostRouteContext, input: NodeLegalOrganizationVerificationTransactionInput, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
+    /**
+     * Starts the host-side existing-tenant legal-organization reissue flow that
+     * refreshes verification and reissues one controller activation code.
+     */
+    submitLegalOrganizationIssue(hostCtx: HostRouteContext, input: NodeLegalOrganizationVerificationTransactionInput, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
     /**
      * Binds the current tenant organization DID document to one public alias
      * view.

package/dist/orchestration/organization-controller-sdk.js

@@ -28,6 +28,13 @@ export class OrganizationControllerSdk {
     submitLegalOrganizationVerificationTransaction(hostCtx, input, pollOptions) {
         return requireClientMethod(this.client, 'submitLegalOrganizationVerificationTransaction')(hostCtx, input, pollOptions);
     }
+    /**
+     * Starts the host-side existing-tenant legal-organization reissue flow that
+     * refreshes verification and reissues one controller activation code.
+     */
+    submitLegalOrganizationIssue(hostCtx, input, pollOptions) {
+        return requireClientMethod(this.client, 'submitLegalOrganizationIssue')(hostCtx, input, pollOptions);
+    }
     /**
      * Binds the current tenant organization DID document to one public alias
      * view.

package/dist/organization-controller-recovery.d.ts

@@ -0,0 +1,31 @@
+import type { NodeLegalOrganizationVerificationTransactionInput, PollOptions, SubmitAndPollResult } from './orchestration/client-port.js';
+import type { HostRouteContext } from './host-onboarding.js';
+import type { RouteContext } from './individual-onboarding.js';
+import type { EmployeeDeviceActivationResult } from './device-activation.js';
+export type OrganizationControllerRecoveryInput = {
+    issueInput: NodeLegalOrganizationVerificationTransactionInput;
+    controllerIdToken: string;
+    dcrPayload: Record<string, unknown>;
+    issuePollOptions?: PollOptions;
+    activationPollOptions?: PollOptions;
+};
+export type OrganizationControllerRecoveryResult = {
+    issue: SubmitAndPollResult;
+    activationCode: string;
+    activation: EmployeeDeviceActivationResult;
+};
+type RecoverOrganizationControllerWithIssueDeps = {
+    hostCtx: HostRouteContext;
+    tenantCtx: RouteContext;
+    input: OrganizationControllerRecoveryInput;
+    submitLegalOrganizationIssue: (hostCtx: HostRouteContext, input: NodeLegalOrganizationVerificationTransactionInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
+    identityTokenExchangePath: (ctx: RouteContext) => string;
+    identityTokenExchangePollPath: (ctx: RouteContext) => string;
+    identityDeviceDcrPath: (ctx: RouteContext) => string;
+    identityDeviceDcrPollPath: (ctx: RouteContext) => string;
+    submitAndPollWithBearerToken: (bearerToken: string | undefined, submitPath: string, pollPath: string, payload: {
+        thid?: string;
+    } & Record<string, unknown>, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
+};
+export declare function recoverOrganizationControllerWithIssueWithDeps(deps: RecoverOrganizationControllerWithIssueDeps): Promise<OrganizationControllerRecoveryResult>;
+export {};

package/dist/organization-controller-recovery.js

@@ -0,0 +1,48 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+import { activateEmployeeDeviceWithActivationCodeWithDeps } from './device-activation.js';
+export async function recoverOrganizationControllerWithIssueWithDeps(deps) {
+    const issue = await deps.submitLegalOrganizationIssue(deps.hostCtx, deps.input.issueInput, deps.input.issuePollOptions);
+    const activationCode = readActivationCodeFromIssueResult(issue);
+    if (!activationCode) {
+        throw new Error('recoverOrganizationControllerWithIssue: missing org.schema.IndividualProduct.serialNumber in Organization/_issue response.');
+    }
+    const activation = await activateEmployeeDeviceWithActivationCodeWithDeps({
+        routeCtx: deps.tenantCtx,
+        input: {
+            activationCode,
+            idToken: deps.input.controllerIdToken,
+            dcrPayload: deps.input.dcrPayload,
+            pollOptions: deps.input.activationPollOptions,
+        },
+        identityTokenExchangePath: deps.identityTokenExchangePath,
+        identityTokenExchangePollPath: deps.identityTokenExchangePollPath,
+        identityDeviceDcrPath: deps.identityDeviceDcrPath,
+        identityDeviceDcrPollPath: deps.identityDeviceDcrPollPath,
+        submitAndPollWithBearerToken: deps.submitAndPollWithBearerToken,
+    });
+    return {
+        issue,
+        activationCode,
+        activation,
+    };
+}
+function readActivationCodeFromIssueResult(result) {
+    const pollBody = (result?.poll?.body || {});
+    const body = (pollBody.body || pollBody);
+    const data = Array.isArray(body.data) ? body.data : Array.isArray(pollBody.data) ? pollBody.data : [];
+    const firstEntry = data[0] || {};
+    const claims = firstEntry.meta?.claims;
+    const activationCode = String(claims?.['org.schema.IndividualProduct.serialNumber'] || '').trim();
+    if (activationCode) {
+        return activationCode;
+    }
+    const diagnostics = firstEntry.response?.outcome
+        ?.issue
+        ?.map((issue) => String(issue?.diagnostics || '').trim())
+        .filter(Boolean)
+        .join(' | ');
+    if (diagnostics) {
+        throw new Error(`recoverOrganizationControllerWithIssue: Organization/_issue failed: ${diagnostics}`);
+    }
+    return '';
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-sdk-node-ts",
-  "version": "2.0.6",
+  "version": "2.0.8",
   "description": "Next-generation Node runtime package for the GDC SDK family",
   "license": "Apache-2.0",
   "author": "Antifraud Services Inc.",
@@ -25,14 +25,15 @@
     "test:e2e:live-gw:legacy-fhir": "npm run build && RUN_LIVE_GW_E2E=1 LIVE_GW_E2E_TRANSPORT=legacy-fhir node --test tests/live-gw-node-runtime.e2e.test.mjs",
     "test:e2e:live-gw:all": "npm run build && RUN_LIVE_GW_E2E=1 LIVE_GW_E2E_TRANSPORT=all node --test tests/live-gw-node-runtime.e2e.test.mjs",
     "test:e2e:live-gw:host-transaction:clean": "bash ./scripts/run-live-gw-host-transaction-clean.sh",
+    "test:e2e:live-gw:issue-recovery": "npm run build && node ./scripts/run-live-organization-issue-recovery.mjs",
     "test:e2e:live-profile-runtime:individual": "npm run build && RUN_LIVE_PROFILE_RUNTIME_E2E=1 node --test tests/live-profile-runtime-individual.e2e.test.mjs",
     "test:e2e:live-profile-runtime:professional": "npm run build && RUN_LIVE_PROFILE_RUNTIME_PROFESSIONAL_E2E=1 node --test tests/live-profile-runtime-professional.e2e.test.mjs",
     "test:e2e:live-dialogue:consent-professional": "npm run build && RUN_LIVE_DIALOGUE_CONSENT_PROFESSIONAL_E2E=1 node --test tests/live-dialogue-consent-professional-access.e2e.test.mjs",
     "test:e2e:live-gw:clean": "bash ./scripts/run-live-gw-clean.sh"
   },
   "dependencies": {
-    "gdc-common-utils-ts": "^2.0.6",
-    "gdc-sdk-core-ts": "^2.0.5"
+    "gdc-common-utils-ts": "^2.0.10",
+    "gdc-sdk-core-ts": "^2.0.7"
   },
   "devDependencies": {
     "@types/node": "^20.14.10",