gdc-sdk-node-ts 2.1.1 → 2.2.2

package/dist/runtime-host-submission.js

@@ -0,0 +1,82 @@
+import { buildLegalOrganizationVerificationGatewayRequestBundle, buildOrganizationDidBindingBundle, } from 'gdc-sdk-core-ts';
+import { buildDidcommPlaintextTransportMetadata } from 'gdc-common-utils-ts/utils/activation-request';
+export async function submitLegalOrganizationVerificationTransactionWithDeps(input) {
+    const thid = `organization-verification-transaction-${input.createRuntimeUuid()}`;
+    const jti = `organization-verification-transaction-jti-${input.createRuntimeUuid()}`;
+    const verificationBundle = buildLegalOrganizationVerificationGatewayRequestBundle(input.verificationInput);
+    const payload = input.wrapBundleAsGatewayTransactionMessage({
+        thid,
+        jti,
+        hostCtx: input.hostCtx,
+        bundle: verificationBundle,
+    });
+    return input.submitAndPoll(input.submitPath(input.hostCtx), input.pollPath(input.hostCtx), payload, input.pollOptions);
+}
+export async function submitLegalOrganizationIssueWithDeps(input) {
+    const thid = `organization-issue-${input.createRuntimeUuid()}`;
+    const jti = `organization-issue-jti-${input.createRuntimeUuid()}`;
+    const verificationBundle = buildLegalOrganizationVerificationGatewayRequestBundle(input.verificationInput);
+    const payload = input.wrapBundleAsGatewayTransactionMessage({
+        thid,
+        jti,
+        hostCtx: input.hostCtx,
+        bundle: verificationBundle,
+    });
+    return input.submitAndPoll(input.submitPath(input.hostCtx), input.pollPath(input.hostCtx), payload, input.pollOptions);
+}
+export async function submitOrganizationDidBindingWithDeps(input) {
+    const thid = `organization-did-binding-${input.createRuntimeUuid()}`;
+    const jti = `organization-did-binding-jti-${input.createRuntimeUuid()}`;
+    const payload = {
+        jti,
+        thid,
+        type: 'application/api+json',
+        body: buildOrganizationDidBindingBundle(input.bindingInput),
+    };
+    return input.submitAndPoll(input.organizationDidBindingPath(input.routeCtx), input.organizationDidBindingPollPath(input.routeCtx), payload, input.pollOptions);
+}
+export async function activateOrganizationInGatewayFromIcaProofWithDeps(input) {
+    const thid = `activate-org-${input.createRuntimeUuid()}`;
+    const activationDraft = input.activationDraftFactory({
+        vpToken: input.activationInput.vpToken,
+        controller: input.activationInput.controller,
+        service: input.activationInput.service,
+        additionalClaims: input.activationInput.additionalClaims,
+    });
+    const serviceClaims = activationDraft.buildServiceClaims();
+    const transportMeta = buildDidcommPlaintextTransportMetadata({
+        controller: input.activationInput.controller,
+        contentType: 'application/didcomm-plain+json',
+    });
+    const payload = {
+        thid,
+        iss: String(input.hostCtx.controllerDid || '').trim() || undefined,
+        aud: String(input.hostCtx.hostDid || '').trim() || undefined,
+        type: 'application/api+json',
+        ...(transportMeta ? { meta: transportMeta } : {}),
+        body: {
+            vp_token: input.activationInput.vpToken,
+            ...(input.activationInput.controller ? { controller: input.activationInput.controller } : {}),
+            data: [{
+                    type: 'Organization-activation-request-v1.0',
+                    meta: {
+                        claims: {
+                            '@context': 'org.schema',
+                            ...serviceClaims,
+                            ...(input.activationInput.additionalClaims || {}),
+                        },
+                    },
+                    resource: {
+                        meta: {
+                            claims: {
+                                '@context': 'org.schema',
+                                ...serviceClaims,
+                                ...(input.activationInput.additionalClaims || {}),
+                            },
+                        },
+                    },
+                }],
+        },
+    };
+    return input.submitAndPoll(input.submitPath(input.hostCtx), input.pollPath(input.hostCtx), payload, input.pollOptions);
+}

package/dist/runtime-http-trace.d.ts

@@ -0,0 +1,4 @@
+export declare function appendHttpTrace(traceFile: string | undefined, entry: Record<string, unknown>): void;
+export declare function parseTraceBody(body: BodyInit | null | undefined): unknown;
+export declare function parseTraceRawText(raw: string): unknown;
+export declare function redactTraceValue<T>(value: T): T;

package/dist/runtime-http-trace.js

@@ -0,0 +1,44 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+import fs from 'node:fs';
+import path from 'node:path';
+export function appendHttpTrace(traceFile, entry) {
+    if (!traceFile)
+        return;
+    try {
+        fs.mkdirSync(path.dirname(traceFile), { recursive: true });
+        fs.appendFileSync(traceFile, `${JSON.stringify(entry)}\n`);
+    }
+    catch {
+        // Tracing must never break runtime requests.
+    }
+}
+export function parseTraceBody(body) {
+    if (body == null)
+        return undefined;
+    if (typeof body === 'string')
+        return parseTraceRawText(body);
+    if (body instanceof URLSearchParams)
+        return Object.fromEntries(body.entries());
+    return '[non-text-body]';
+}
+export function parseTraceRawText(raw) {
+    if (!raw)
+        return '';
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return raw;
+    }
+}
+export function redactTraceValue(value) {
+    if (value === undefined)
+        return value;
+    const serialized = JSON.stringify(value, (key, nestedValue) => {
+        if (/token|authorization|secret|password/i.test(String(key || ''))) {
+            return '[redacted]';
+        }
+        return nestedValue;
+    });
+    return serialized === undefined ? value : JSON.parse(serialized);
+}

package/dist/runtime-message.d.ts

@@ -0,0 +1,10 @@
+import type { BundleJsonApi } from 'gdc-common-utils-ts/models/bundle';
+import type { HostRouteContext } from './host-onboarding.js';
+import type { SubmitPayload } from './orchestration/client-port.js';
+export declare function wrapBundleAsGatewayTransactionMessage(input: Readonly<{
+    thid: string;
+    jti: string;
+    hostCtx: HostRouteContext;
+    bundle: BundleJsonApi;
+}>): SubmitPayload;
+export declare function runtimeUuid(): string;

package/dist/runtime-message.js

@@ -0,0 +1,19 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+import { runtimeUuid as buildRuntimeUuid } from 'gdc-common-utils-ts/utils/communication-attached-bundle-session-helpers';
+export function wrapBundleAsGatewayTransactionMessage(input) {
+    const rawBundle = (input.bundle || {});
+    const attachments = Array.isArray(rawBundle.attachments) ? rawBundle.attachments : undefined;
+    const { attachments: _ignoredAttachments, ...body } = rawBundle;
+    return {
+        jti: input.jti,
+        thid: input.thid,
+        iss: String(input.hostCtx.controllerDid || '').trim() || undefined,
+        aud: String(input.hostCtx.hostDid || '').trim() || undefined,
+        type: 'application/api+json',
+        body,
+        ...(attachments && attachments.length > 0 ? { attachments } : {}),
+    };
+}
+export function runtimeUuid() {
+    return buildRuntimeUuid('runtime');
+}

package/dist/runtime-paths.d.ts

@@ -0,0 +1,12 @@
+import type { HostRouteContext } from './host-onboarding.js';
+import type { RouteContext } from './individual-onboarding.js';
+export declare function buildV1Path(routeCtx: RouteContext, section: string, format: string, resourceType: string, action: string): string;
+export declare function buildHostRegistryPath(hostCtx: HostRouteContext, resourceType: string, action: string): string;
+export declare function buildOrganizationDidBindingPath(routeCtx: RouteContext): string;
+export declare function buildOrganizationDidBindingPollPath(routeCtx: RouteContext): string;
+export declare function buildIdentityTokenExchangePath(ctx: RouteContext): string;
+export declare function buildIdentityTokenExchangePollPath(ctx: RouteContext): string;
+export declare function buildIdentityDeviceDcrPath(ctx: RouteContext): string;
+export declare function buildIdentityDeviceDcrPollPath(ctx: RouteContext): string;
+export declare function buildIdentityOpenIdSmartTokenPath(ctx: RouteContext): string;
+export declare function buildIdentityOpenIdSmartTokenPollPath(ctx: RouteContext): string;

package/dist/runtime-paths.js

@@ -0,0 +1,41 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+import { buildGwCoreTenantResourceActionPath } from 'gdc-common-utils-ts/utils/gw-core-path';
+export function buildV1Path(routeCtx, section, format, resourceType, action) {
+    return buildGwCoreTenantResourceActionPath({
+        tenantId: routeCtx.tenantId,
+        jurisdiction: routeCtx.jurisdiction,
+        version: 'v1',
+        sector: routeCtx.sector,
+        section,
+        format,
+        resourceType,
+        action,
+    });
+}
+export function buildHostRegistryPath(hostCtx, resourceType, action) {
+    return `/host/cds-${encodeURIComponent(hostCtx.jurisdiction)}/v1/${encodeURIComponent(hostCtx.hostNetwork || '')}/registry/org.schema/${encodeURIComponent(resourceType)}/${encodeURIComponent(action)}`;
+}
+export function buildOrganizationDidBindingPath(routeCtx) {
+    return `/${encodeURIComponent(routeCtx.tenantId)}/cds-${encodeURIComponent(routeCtx.jurisdiction)}/v1/${encodeURIComponent(routeCtx.sector)}/did/document/_binding`;
+}
+export function buildOrganizationDidBindingPollPath(routeCtx) {
+    return `/${encodeURIComponent(routeCtx.tenantId)}/cds-${encodeURIComponent(routeCtx.jurisdiction)}/v1/${encodeURIComponent(routeCtx.sector)}/did/document/_binding-response`;
+}
+export function buildIdentityTokenExchangePath(ctx) {
+    return `/${encodeURIComponent('host')}/cds-${encodeURIComponent(ctx.jurisdiction)}/v1/${encodeURIComponent(ctx.sector)}/${encodeURIComponent(ctx.tenantId)}/identity/auth/_exchange`;
+}
+export function buildIdentityTokenExchangePollPath(ctx) {
+    return `/${encodeURIComponent('host')}/cds-${encodeURIComponent(ctx.jurisdiction)}/v1/${encodeURIComponent(ctx.sector)}/${encodeURIComponent(ctx.tenantId)}/identity/auth/_exchange-response`;
+}
+export function buildIdentityDeviceDcrPath(ctx) {
+    return `/${encodeURIComponent('host')}/cds-${encodeURIComponent(ctx.jurisdiction)}/v1/${encodeURIComponent(ctx.sector)}/${encodeURIComponent(ctx.tenantId)}/identity/auth/_dcr`;
+}
+export function buildIdentityDeviceDcrPollPath(ctx) {
+    return `/${encodeURIComponent('host')}/cds-${encodeURIComponent(ctx.jurisdiction)}/v1/${encodeURIComponent(ctx.sector)}/${encodeURIComponent(ctx.tenantId)}/identity/auth/_dcr-response`;
+}
+export function buildIdentityOpenIdSmartTokenPath(ctx) {
+    return `/${encodeURIComponent(ctx.tenantId)}/cds-${encodeURIComponent(ctx.jurisdiction)}/v1/${encodeURIComponent(ctx.sector)}/identity/openid/smart/token`;
+}
+export function buildIdentityOpenIdSmartTokenPollPath(ctx) {
+    return `/${encodeURIComponent(ctx.tenantId)}/cds-${encodeURIComponent(ctx.jurisdiction)}/v1/${encodeURIComponent(ctx.sector)}/identity/openid/smart/_batch-response`;
+}

package/dist/runtime-route-context.d.ts

@@ -0,0 +1,20 @@
+import type { HostRouteContext } from './host-onboarding.js';
+import type { RouteContext } from './individual-onboarding.js';
+export type HostNetworkWarningState = {
+    warnedDefaultHostNetwork: boolean;
+};
+export declare function requireRouteContext(ctx?: RouteContext, defaultCtx?: RouteContext): RouteContext;
+export declare function routeCtxFromInput(input: {
+    serviceProviderDid?: string;
+    tenantId?: string;
+    jurisdiction?: string;
+    sector?: string;
+}, defaultCtx?: RouteContext): RouteContext;
+export declare function requireHostRouteContext(ctx: HostRouteContext | undefined, options: Readonly<{
+    defaultJurisdiction?: string;
+    defaultHostNetwork?: string;
+    defaultHostNetworkOrTenantSector?: string;
+    warningState: HostNetworkWarningState;
+    warn: (message: string) => void;
+}>): HostRouteContext;
+export declare function isSupportedHostNetwork(value: string): boolean;

package/dist/runtime-route-context.js

@@ -0,0 +1,68 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+import { extractTenantIdFromHostedDidWeb } from 'gdc-common-utils-ts';
+let warnedServiceProviderDidRouteTenant = false;
+export function requireRouteContext(ctx, defaultCtx) {
+    const resolved = ctx || defaultCtx;
+    const tenantId = String(resolved?.tenantId || '').trim();
+    const jurisdiction = String(resolved?.jurisdiction || '').trim();
+    const sector = String(resolved?.sector || '').trim();
+    if (!tenantId || !jurisdiction || !sector) {
+        throw new Error('Route context is required.');
+    }
+    return { tenantId, jurisdiction, sector };
+}
+export function routeCtxFromInput(input, defaultCtx) {
+    const explicitTenantId = String(input.tenantId || '').trim();
+    const serviceProviderDid = String(input.serviceProviderDid || '').trim();
+    let tenantId = explicitTenantId;
+    if (!tenantId && serviceProviderDid) {
+        const extractedTenantId = extractTenantIdFromHostedDidWeb(serviceProviderDid);
+        if (extractedTenantId) {
+            if (!warnedServiceProviderDidRouteTenant) {
+                warnedServiceProviderDidRouteTenant = true;
+                console.warn(`[gdc-sdk-node-ts] serviceProviderDid is a compatibility alias for route tenant ids. Pass tenantId instead. Extracted tenantId='${extractedTenantId}' from hosted did:web '${serviceProviderDid}'.`);
+            }
+            tenantId = extractedTenantId;
+        }
+        else {
+            tenantId = serviceProviderDid;
+        }
+    }
+    return requireRouteContext(tenantId && input.jurisdiction && input.sector
+        ? { tenantId, jurisdiction: input.jurisdiction, sector: input.sector }
+        : undefined, defaultCtx);
+}
+export function requireHostRouteContext(ctx, options) {
+    const hostCtx = (ctx || {});
+    const jurisdiction = String(hostCtx.jurisdiction || options.defaultJurisdiction || '').trim();
+    const explicitHostNetwork = String(hostCtx.hostNetwork || options.defaultHostNetwork || '').trim();
+    const compatibilityHostNetwork = String(hostCtx.hostNetworkOrTenantSector
+        || options.defaultHostNetworkOrTenantSector
+        || '').trim();
+    const deprecatedSector = String(hostCtx.sector || '').trim();
+    if (!explicitHostNetwork && !compatibilityHostNetwork && deprecatedSector) {
+        throw new Error(`Host route context must use 'hostNetwork', not 'sector'. Received deprecated sector='${deprecatedSector}'.`);
+    }
+    const hostNetwork = String(explicitHostNetwork
+        || compatibilityHostNetwork
+        || '').trim();
+    if (!jurisdiction)
+        throw new Error('Host route context is required.');
+    if (!hostNetwork) {
+        if (!options.warningState.warnedDefaultHostNetwork) {
+            options.warningState.warnedDefaultHostNetwork = true;
+            options.warn("[gdc-sdk-node-ts] Missing hostNetwork in host route context. Defaulting to 'test'. Pass hostNetwork explicitly to avoid environment drift.");
+        }
+        return { jurisdiction, hostNetwork: 'test' };
+    }
+    if (!isSupportedHostNetwork(hostNetwork)) {
+        throw new Error(`Invalid hostNetwork '${hostNetwork}'. Allowed values: test, local-network, test-network, network.`);
+    }
+    return { jurisdiction, hostNetwork };
+}
+export function isSupportedHostNetwork(value) {
+    return (value === 'test'
+        || value === 'local-network'
+        || value === 'test-network'
+        || value === 'network');
+}

package/dist/runtime-transport.d.ts

@@ -0,0 +1,22 @@
+export type RuntimeTransportConfig = Readonly<{
+    baseUrl: string;
+    bearerToken?: string;
+    defaultHeaders: Record<string, string>;
+    requestTimeoutMs: number;
+    httpTraceFile?: string;
+}>;
+export declare function buildRuntimeHeaders(config: RuntimeTransportConfig, contentType: string): Record<string, string>;
+export declare function pollBatchResponseWithRuntimeConfig(config: RuntimeTransportConfig, path: string, request: {
+    thid: string;
+}): Promise<{
+    status: number;
+    body: unknown;
+    retryAfterMs?: number;
+}>;
+export declare function postJsonWithRuntimeConfig(config: RuntimeTransportConfig, path: string, payload: unknown, contentType: string): Promise<{
+    status: number;
+    location?: string;
+    body: unknown;
+}>;
+export declare function fetchWithTimeout(config: RuntimeTransportConfig, path: string, init: RequestInit): Promise<Response>;
+export declare function parseResponseBody(response: Response): Promise<unknown>;

package/dist/runtime-transport.js

@@ -0,0 +1,91 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+import { DIDCOMM_DEFAULT_ACCEPT_HEADER } from 'gdc-common-utils-ts/utils/didcomm-submit';
+import { appendHttpTrace, parseTraceBody, parseTraceRawText, redactTraceValue, } from './runtime-http-trace.js';
+export function buildRuntimeHeaders(config, contentType) {
+    const headers = {
+        ...config.defaultHeaders,
+        'Content-Type': contentType,
+        Accept: DIDCOMM_DEFAULT_ACCEPT_HEADER,
+    };
+    if (config.bearerToken)
+        headers.Authorization = `Bearer ${config.bearerToken}`;
+    return headers;
+}
+export async function pollBatchResponseWithRuntimeConfig(config, path, request) {
+    const response = await fetchWithTimeout(config, path, {
+        method: 'POST',
+        headers: buildRuntimeHeaders(config, 'application/json'),
+        body: JSON.stringify(request),
+    });
+    const retryAfter = Number(response.headers.get('retry-after'));
+    return {
+        status: response.status,
+        body: await parseResponseBody(response),
+        retryAfterMs: Number.isFinite(retryAfter) ? retryAfter * 1000 : undefined,
+    };
+}
+export async function postJsonWithRuntimeConfig(config, path, payload, contentType) {
+    const response = await fetchWithTimeout(config, path, {
+        method: 'POST',
+        headers: buildRuntimeHeaders(config, contentType),
+        body: JSON.stringify(payload),
+    });
+    return {
+        status: response.status,
+        location: response.headers.get('location') || undefined,
+        body: await parseResponseBody(response),
+    };
+}
+export async function fetchWithTimeout(config, path, init) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), config.requestTimeoutMs);
+    const url = /^https?:\/\//.test(path) ? path : `${config.baseUrl}${path.startsWith('/') ? path : `/${path}`}`;
+    const requestBody = parseTraceBody(init.body);
+    const traceBase = {
+        ts: new Date().toISOString(),
+        request: {
+            url,
+            method: String(init.method || 'GET').toUpperCase(),
+            headers: redactTraceValue(init.headers || {}),
+            body: redactTraceValue(requestBody),
+        },
+    };
+    try {
+        const response = await fetch(url, { ...init, signal: controller.signal });
+        const responseClone = response.clone();
+        const responseRaw = await responseClone.text();
+        appendHttpTrace(config.httpTraceFile, {
+            ...traceBase,
+            response: {
+                status: response.status,
+                headers: redactTraceValue(Object.fromEntries(response.headers.entries())),
+                body: redactTraceValue(parseTraceRawText(responseRaw)),
+            },
+        });
+        return response;
+    }
+    catch (error) {
+        appendHttpTrace(config.httpTraceFile, {
+            ...traceBase,
+            error: {
+                name: error instanceof Error ? error.name : 'Error',
+                message: error instanceof Error ? error.message : String(error),
+            },
+        });
+        throw error;
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+export async function parseResponseBody(response) {
+    const raw = await response.text();
+    if (!raw)
+        return {};
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return raw;
+    }
+}

package/dist/smart-token.d.ts

@@ -1,3 +1,5 @@
+import { type BuildClientAssertionJwtInput } from 'gdc-common-utils-ts/utils/client-assertion';
+import type { SmartTokenRequestContract } from 'gdc-sdk-core-ts';
 import type { PollOptions, SubmitAndPollResult } from './orchestration/client-port.js';
 import type { RouteContext } from './individual-onboarding.js';
 /**
@@ -30,7 +32,7 @@ import type { RouteContext } from './individual-onboarding.js';
  * Canonical payload examples for both token-exchange and OpenID4VP SMART flows
  * live in `gdc-common-utils-ts/examples`.
  */
-export type SmartTokenRequestInput = {
+export type SmartTokenRequestInput = SmartTokenRequestContract & {
     /**
      * @deprecated Prefer configuring `NodeHttpClient({ ctx })`.
      */
@@ -46,36 +48,14 @@ export type SmartTokenRequestInput = {
     /**
      * OpenID token or subject token already obtained by the caller.
      */
-    idToken: string;
     /**
-     * Requested SMART/GW scopes.
+     * Optional helper input used by the Node SDK to auto-generate one
+     * `client_assertion` when the caller does not provide one explicitly.
      *
-     * Under the current CORE GW contract this should normally include the pinned
-     * `organization/Composition...` root scope for the target subject, and may
-     * include additional items such as `organization/Consent.cruds`.
+     * `clientId` and `audience` are resolved from the surrounding SMART request
+     * input and therefore omitted here.
      */
-    scopes: string[];
-    /**
-     * Actor/profile DID that is requesting access.
-     *
-     * Typical values are a professional DID or a `RelatedPerson` DID. This is
-     * distinct from the `subjectDid` whose data is being accessed.
-     */
-    actorDid?: string;
-    /**
-     * Subject/individual DID whose data is being requested.
-     */
-    subjectDid?: string;
-    /**
-     * Optional VP token used by the OpenID4VP-based GW smart token flow.
-     */
-    vpToken?: string;
-    /**
-     * Client/device/portal DID used as OAuth/OpenID `client_id`.
-     */
-    clientId?: string;
-    audience?: string;
-    issuer?: string;
+    clientAssertionBuilder?: Omit<BuildClientAssertionJwtInput, 'clientId' | 'audience'>;
     redirectUri?: string;
     acrValues?: string;
     codeChallenge?: string;
@@ -88,7 +68,6 @@ export type SmartTokenRequestInput = {
     endpointId?: string;
     timeoutSeconds?: number;
     intervalSeconds?: number;
-    additionalClaims?: Record<string, unknown>;
 };
 export type SmartTokenExchangeResult = {
     status: 'fetched' | 'cached' | 'failed';

package/dist/smart-token.js

@@ -1,5 +1,6 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
 import { HealthcareConsentPurposes } from 'gdc-common-utils-ts/constants';
+import { buildClientAssertionJwt } from 'gdc-common-utils-ts/utils/client-assertion';
 import { resolvePollOptionsFromSeconds } from './poll-options.js';
 /**
  * Executes the current GW token flow using injected transport dependencies.
@@ -25,12 +26,24 @@ export async function requestSmartTokenWithDeps(deps) {
     });
     if (deps.input.smartTokenKind === 'openid-smart') {
         const actorDid = String(deps.input.actorDid || '').trim() || undefined;
+        const resolvedClientId = deps.input.clientId || actorDid || deps.input.subjectDid || deps.routeCtx.tenantId;
+        const resolvedAudience = deps.input.audience || deps.routeCtx.tenantId;
+        const clientAssertion = await resolveClientAssertion({
+            clientAssertion: deps.input.clientAssertion,
+            clientAssertionBuilder: deps.input.clientAssertionBuilder,
+            clientId: resolvedClientId,
+            audience: resolvedAudience,
+        });
         const smartPayload = {
             thid: `smart-${createRuntimeUuid()}`,
-            iss: deps.input.issuer || deps.input.clientId || deps.routeCtx.tenantId,
-            aud: deps.input.audience || deps.routeCtx.tenantId,
+            iss: deps.input.issuer || resolvedClientId || deps.routeCtx.tenantId,
+            aud: resolvedAudience,
             body: {
-                client_id: deps.input.clientId || actorDid || deps.input.subjectDid || deps.routeCtx.tenantId,
+                client_id: resolvedClientId,
+                ...(clientAssertion ? {
+                    client_assertion: clientAssertion,
+                    client_assertion_type: deps.input.clientAssertionType || 'private_key_jwt',
+                } : {}),
                 redirect_uri: deps.input.redirectUri || `${deps.baseUrl}/callback`,
                 code_challenge: deps.input.codeChallenge || 'demo-code-challenge',
                 code_challenge_method: deps.input.codeChallengeMethod || 'S256',
@@ -62,6 +75,18 @@ export async function requestSmartTokenWithDeps(deps) {
     const exchange = await deps.submitAndPoll(deps.identityTokenExchangePath(deps.routeCtx), deps.identityTokenExchangePollPath(deps.routeCtx), payload, pollOptions);
     return resolveTokenExchangeResult(exchange, normalizedScopes, tokenCacheKey, deps.setTokenCache);
 }
+async function resolveClientAssertion(input) {
+    const explicit = String(input.clientAssertion || '').trim();
+    if (explicit)
+        return explicit;
+    if (!input.clientAssertionBuilder)
+        return undefined;
+    return buildClientAssertionJwt({
+        ...input.clientAssertionBuilder,
+        clientId: input.clientId,
+        audience: input.audience,
+    });
+}
 function resolveTokenExchangeResult(exchange, normalizedScopes, tokenCacheKey, setTokenCache) {
     const exchangeBody = exchange.poll.body ?? {};
     const accessToken = String(exchangeBody.access_token || '').trim();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-sdk-node-ts",
-  "version": "2.1.1",
+  "version": "2.2.2",
   "description": "Next-generation Node runtime package for the GDC SDK family",
   "license": "Apache-2.0",
   "author": "Antifraud Services Inc.",
@@ -35,8 +35,8 @@
     "test:e2e:live-gw:clean": "bash ./scripts/run-live-gw-clean.sh"
   },
   "dependencies": {
-    "gdc-common-utils-ts": "^2.1.0",
-    "gdc-sdk-core-ts": "^2.1.0"
+    "gdc-common-utils-ts": "^2.2.2",
+    "gdc-sdk-core-ts": "~2.2.1"
   },
   "devDependencies": {
     "@types/node": "^20.14.10",