gdc-sdk-node-ts 2.1.4 → 2.3.0

package/dist/runtime-client-paths.js

@@ -66,6 +66,10 @@ export class RuntimeClientPaths {
     individualFamilyOrganizationPurgePollPath(ctx) { return this.v1Path(ctx, 'individual', 'org.schema', 'Organization', `${GwCoreLifecycleAction.Purge}-response`); }
     individualLicenseSearchPath(ctx) { return this.v1Path(ctx, 'individual', 'org.schema', 'License', '_search'); }
     individualLicenseSearchPollPath(ctx) { return this.v1Path(ctx, 'individual', 'org.schema', 'License', '_search-response'); }
+    /** Builds one individual-member license mutation path. */
+    individualLicenseActionPath(ctx, action) { return this.v1Path(ctx, 'individual', 'org.schema', 'License', action); }
+    /** Builds the poll path paired with one individual-member license mutation. */
+    individualLicenseActionPollPath(ctx, action) { return this.v1Path(ctx, 'individual', 'org.schema', 'License', `${action}-response`); }
     individualLicenseOfferSearchPath(ctx) { return this.v1Path(ctx, 'individual', 'org.schema', 'Offer', '_search'); }
     individualLicenseOfferSearchPollPath(ctx) { return this.v1Path(ctx, 'individual', 'org.schema', 'Offer', '_search-response'); }
     individualLicenseOrderSearchPath(ctx) { return this.v1Path(ctx, 'individual', 'org.schema', 'Order', '_search'); }
@@ -82,6 +86,8 @@ export class RuntimeClientPaths {
     individualCommunicationPollPath(ctx, format) { return this.v1Path(ctx, 'individual', format, 'Communication', '_batch-response'); }
     individualCommunicationSearchPath(ctx) { return this.v1Path(ctx, 'individual', 'org.hl7.fhir.r4', 'Communication', '_search'); }
     individualCommunicationSearchPollPath(ctx) { return this.v1Path(ctx, 'individual', 'org.hl7.fhir.r4', 'Communication', '_search-response'); }
+    individualDocumentReferenceBatchPath(ctx) { return this.v1Path(ctx, 'individual', 'org.hl7.fhir.r4', 'DocumentReference', '_batch'); }
+    individualDocumentReferencePollPath(ctx) { return this.v1Path(ctx, 'individual', 'org.hl7.fhir.r4', 'DocumentReference', '_batch-response'); }
     individualBundleSearchPath(ctx) { return this.v1Path(ctx, 'individual', 'org.hl7.fhir.r4', 'Bundle', '_search'); }
     individualBundleSearchPollPath(ctx) { return this.v1Path(ctx, 'individual', 'org.hl7.fhir.r4', 'Bundle', '_search-response'); }
     identityTokenExchangePath(ctx) { return buildIdentityTokenExchangePath(ctx); }

package/dist/runtime-route-context.js

@@ -1,4 +1,6 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+import { extractTenantIdFromHostedDidWeb } from 'gdc-common-utils-ts';
+let warnedServiceProviderDidRouteTenant = false;
 export function requireRouteContext(ctx, defaultCtx) {
     const resolved = ctx || defaultCtx;
     const tenantId = String(resolved?.tenantId || '').trim();
@@ -10,7 +12,22 @@ export function requireRouteContext(ctx, defaultCtx) {
     return { tenantId, jurisdiction, sector };
 }
 export function routeCtxFromInput(input, defaultCtx) {
-    const tenantId = String(input.serviceProviderDid || input.tenantId || '').trim();
+    const explicitTenantId = String(input.tenantId || '').trim();
+    const serviceProviderDid = String(input.serviceProviderDid || '').trim();
+    let tenantId = explicitTenantId;
+    if (!tenantId && serviceProviderDid) {
+        const extractedTenantId = extractTenantIdFromHostedDidWeb(serviceProviderDid);
+        if (extractedTenantId) {
+            if (!warnedServiceProviderDidRouteTenant) {
+                warnedServiceProviderDidRouteTenant = true;
+                console.warn(`[gdc-sdk-node-ts] serviceProviderDid is a compatibility alias for route tenant ids. Pass tenantId instead. Extracted tenantId='${extractedTenantId}' from hosted did:web '${serviceProviderDid}'.`);
+            }
+            tenantId = extractedTenantId;
+        }
+        else {
+            tenantId = serviceProviderDid;
+        }
+    }
     return requireRouteContext(tenantId && input.jurisdiction && input.sector
         ? { tenantId, jurisdiction: input.jurisdiction, sector: input.sector }
         : undefined, defaultCtx);

package/dist/runtime-transport.d.ts

@@ -4,8 +4,9 @@ export type RuntimeTransportConfig = Readonly<{
     defaultHeaders: Record<string, string>;
     requestTimeoutMs: number;
     httpTraceFile?: string;
+    fetchImpl?: typeof fetch;
 }>;
-export declare function buildRuntimeHeaders(config: RuntimeTransportConfig, contentType: string): Record<string, string>;
+export declare function buildRuntimeHeaders(config: RuntimeTransportConfig, contentType: string, accept?: string): Record<string, string>;
 export declare function pollBatchResponseWithRuntimeConfig(config: RuntimeTransportConfig, path: string, request: {
     thid: string;
 }): Promise<{
@@ -18,5 +19,16 @@ export declare function postJsonWithRuntimeConfig(config: RuntimeTransportConfig
     location?: string;
     body: unknown;
 }>;
+/** Submits an already-rendered JSON, FHIR, DIDComm or secure-form request. */
+export declare function postRenderedWithRuntimeConfig(config: RuntimeTransportConfig, path: string, request: {
+    contentType: string;
+    accept: string;
+    body: Record<string, unknown> | string;
+}): Promise<{
+    status: number;
+    location?: string;
+    body: unknown;
+    retryAfterMs?: number;
+}>;
 export declare function fetchWithTimeout(config: RuntimeTransportConfig, path: string, init: RequestInit): Promise<Response>;
 export declare function parseResponseBody(response: Response): Promise<unknown>;

package/dist/runtime-transport.js

@@ -1,11 +1,11 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
 import { DIDCOMM_DEFAULT_ACCEPT_HEADER } from 'gdc-common-utils-ts/utils/didcomm-submit';
 import { appendHttpTrace, parseTraceBody, parseTraceRawText, redactTraceValue, } from './runtime-http-trace.js';
-export function buildRuntimeHeaders(config, contentType) {
+export function buildRuntimeHeaders(config, contentType, accept = DIDCOMM_DEFAULT_ACCEPT_HEADER) {
     const headers = {
         ...config.defaultHeaders,
         'Content-Type': contentType,
-        Accept: DIDCOMM_DEFAULT_ACCEPT_HEADER,
+        Accept: accept,
     };
     if (config.bearerToken)
         headers.Authorization = `Bearer ${config.bearerToken}`;
@@ -36,6 +36,21 @@ export async function postJsonWithRuntimeConfig(config, path, payload, contentTy
         body: await parseResponseBody(response),
     };
 }
+/** Submits an already-rendered JSON, FHIR, DIDComm or secure-form request. */
+export async function postRenderedWithRuntimeConfig(config, path, request) {
+    const response = await fetchWithTimeout(config, path, {
+        method: 'POST',
+        headers: buildRuntimeHeaders(config, request.contentType, request.accept),
+        body: typeof request.body === 'string' ? request.body : JSON.stringify(request.body),
+    });
+    const retryAfter = Number(response.headers.get('retry-after'));
+    return {
+        status: response.status,
+        location: response.headers.get('location') || undefined,
+        body: await parseResponseBody(response),
+        retryAfterMs: Number.isFinite(retryAfter) ? retryAfter * 1000 : undefined,
+    };
+}
 export async function fetchWithTimeout(config, path, init) {
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), config.requestTimeoutMs);
@@ -51,7 +66,7 @@ export async function fetchWithTimeout(config, path, init) {
         },
     };
     try {
-        const response = await fetch(url, { ...init, signal: controller.signal });
+        const response = await (config.fetchImpl || fetch)(url, { ...init, signal: controller.signal });
         const responseClone = response.clone();
         const responseRaw = await responseClone.text();
         appendHttpTrace(config.httpTraceFile, {

package/dist/server-profile-protection.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Host-controlled KEK boundary.
+ *
+ * A BFF normally implements this with Cloud KMS. A native confidential app
+ * implements the same boundary with a non-exportable Keychain/Keystore key.
+ * The adapter never receives the user's PIN.
+ */
+export type ServerProfileSealer = Readonly<{
+    seal(cleartext: string, aad: string): Promise<string>;
+    unseal(ciphertext: string, aad: string): Promise<string>;
+}>;
+/** Persisted scrypt work factor. The salt and parameters are public metadata. */
+export type ProfileScryptParameters = Readonly<{
+    name: 'scrypt';
+    saltBase64Url: string;
+    cost: number;
+    blockSize: number;
+    parallelization: number;
+    keyLength: 32;
+}>;
+/**
+ * Portable v1 envelope for a profile secret.
+ *
+ * `ciphertext` contains the secret encrypted by a random DEK. The host first
+ * wraps that DEK; the PIN-derived key then encrypts the host-wrapped value.
+ * Opening therefore requires both factors without exposing either factor to
+ * the other adapter.
+ */
+export type PinProtectedProfileSecret = Readonly<{
+    version: 'gdc-pin-host-envelope-v1';
+    kdf: ProfileScryptParameters;
+    payload: AesGcmCiphertext;
+    pinWrappedHostDek: AesGcmCiphertext;
+}>;
+export type AesGcmCiphertext = Readonly<{
+    ivBase64Url: string;
+    ciphertextBase64Url: string;
+    tagBase64Url: string;
+}>;
+export type ProfileProtectionOptions = Readonly<{
+    cost?: number;
+    blockSize?: number;
+    parallelization?: number;
+}>;
+/** Distinguishes a wrong PIN from a host KMS outage or corrupted payload. */
+export declare class ProfilePinRejectedError extends Error {
+    constructor();
+}
+/**
+ * Encrypt one seed, private-key export or credential using a fresh DEK.
+ *
+ * The returned salt is intentionally stored in clear. Security comes from the
+ * PIN work factor, the independent host KEK and authenticated encryption, not
+ * from hiding the salt or algorithm parameters.
+ */
+export declare function protectServerProfileSecret(cleartext: string, pin: string, aad: string, hostSealer: ServerProfileSealer, options?: ProfileProtectionOptions): Promise<PinProtectedProfileSecret>;
+/**
+ * Open one protected profile secret using both PIN and host protection.
+ *
+ * The PIN layer is authenticated before the host adapter is called. A wrong
+ * PIN therefore neither reaches KMS nor becomes indistinguishable from a KMS
+ * availability failure in audit logs.
+ */
+export declare function openServerProfileSecret(envelope: PinProtectedProfileSecret, pin: string, aad: string, hostSealer: ServerProfileSealer): Promise<string>;

package/dist/server-profile-protection.js

@@ -0,0 +1,110 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from 'node:crypto';
+/** Distinguishes a wrong PIN from a host KMS outage or corrupted payload. */
+export class ProfilePinRejectedError extends Error {
+    constructor() {
+        super('Profile PIN rejected.');
+        this.name = 'ProfilePinRejectedError';
+    }
+}
+/**
+ * Encrypt one seed, private-key export or credential using a fresh DEK.
+ *
+ * The returned salt is intentionally stored in clear. Security comes from the
+ * PIN work factor, the independent host KEK and authenticated encryption, not
+ * from hiding the salt or algorithm parameters.
+ */
+export async function protectServerProfileSecret(cleartext, pin, aad, hostSealer, options = {}) {
+    requirePin(pin);
+    const kdf = {
+        name: 'scrypt',
+        saltBase64Url: randomBytes(16).toString('base64url'),
+        cost: options.cost ?? 16384,
+        blockSize: options.blockSize ?? 8,
+        parallelization: options.parallelization ?? 1,
+        keyLength: 32,
+    };
+    const pinKey = derivePinKey(pin, kdf);
+    const dek = randomBytes(32);
+    const hostWrappedDek = await hostSealer.seal(dek.toString('base64url'), `${aad}:dek`);
+    try {
+        return {
+            version: 'gdc-pin-host-envelope-v1',
+            kdf,
+            payload: encryptAesGcm(Buffer.from(cleartext), dek, `${aad}:payload`),
+            pinWrappedHostDek: encryptAesGcm(Buffer.from(hostWrappedDek), pinKey, `${aad}:host-wrapped-dek`),
+        };
+    }
+    finally {
+        pinKey.fill(0);
+        dek.fill(0);
+    }
+}
+/**
+ * Open one protected profile secret using both PIN and host protection.
+ *
+ * The PIN layer is authenticated before the host adapter is called. A wrong
+ * PIN therefore neither reaches KMS nor becomes indistinguishable from a KMS
+ * availability failure in audit logs.
+ */
+export async function openServerProfileSecret(envelope, pin, aad, hostSealer) {
+    validateEnvelope(envelope);
+    const pinKey = derivePinKey(pin, envelope.kdf);
+    let hostWrappedDek;
+    try {
+        hostWrappedDek = decryptAesGcm(envelope.pinWrappedHostDek, pinKey, `${aad}:host-wrapped-dek`).toString('utf8');
+    }
+    catch {
+        throw new ProfilePinRejectedError();
+    }
+    finally {
+        pinKey.fill(0);
+    }
+    const dek = Buffer.from(await hostSealer.unseal(hostWrappedDek, `${aad}:dek`), 'base64url');
+    try {
+        if (dek.length !== 32)
+            throw new Error('Profile host returned an invalid DEK.');
+        return decryptAesGcm(envelope.payload, dek, `${aad}:payload`).toString('utf8');
+    }
+    finally {
+        dek.fill(0);
+    }
+}
+function derivePinKey(pin, parameters) {
+    requirePin(pin);
+    return scryptSync(pin, Buffer.from(parameters.saltBase64Url, 'base64url'), parameters.keyLength, {
+        N: parameters.cost,
+        r: parameters.blockSize,
+        p: parameters.parallelization,
+        maxmem: Math.max(64 * 1024 * 1024, 256 * parameters.cost * parameters.blockSize),
+    });
+}
+function encryptAesGcm(cleartext, key, aad) {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv('aes-256-gcm', key, iv);
+    cipher.setAAD(Buffer.from(aad));
+    const ciphertext = Buffer.concat([cipher.update(cleartext), cipher.final()]);
+    return {
+        ivBase64Url: iv.toString('base64url'),
+        ciphertextBase64Url: ciphertext.toString('base64url'),
+        tagBase64Url: cipher.getAuthTag().toString('base64url'),
+    };
+}
+function decryptAesGcm(value, key, aad) {
+    const decipher = createDecipheriv('aes-256-gcm', key, Buffer.from(value.ivBase64Url, 'base64url'));
+    decipher.setAAD(Buffer.from(aad));
+    decipher.setAuthTag(Buffer.from(value.tagBase64Url, 'base64url'));
+    return Buffer.concat([
+        decipher.update(Buffer.from(value.ciphertextBase64Url, 'base64url')),
+        decipher.final(),
+    ]);
+}
+function requirePin(pin) {
+    if (String(pin).length < 6)
+        throw new Error('Production profile PIN must contain at least 6 characters.');
+}
+function validateEnvelope(value) {
+    if (value?.version !== 'gdc-pin-host-envelope-v1' || value.kdf?.name !== 'scrypt') {
+        throw new Error('Unsupported protected profile envelope.');
+    }
+}

package/dist/server-profile-session.d.ts

@@ -0,0 +1,115 @@
+import type { JWK } from 'gdc-common-utils-ts/models/jwk';
+import type { ActorKind } from 'gdc-common-utils-ts/models/actor-session';
+import type { RouteContext } from './individual-onboarding.js';
+import type { SecureDidcommTransportAdapter } from 'gdc-sdk-core-ts';
+import { type PinProtectedProfileSecret, type ProfileProtectionOptions, type ServerProfileSealer } from './server-profile-protection.js';
+export type { ServerProfileSealer } from './server-profile-protection.js';
+export type ServerActorMode = 'self' | 'controller' | 'member';
+/** Durable public metadata plus PIN-and-host protected private material. */
+export type ServerProfileRecord = Readonly<{
+    profileId: string;
+    ownerId: string;
+    actorKind: ActorKind;
+    actorMode: ServerActorMode;
+    actorDid: string;
+    profileDid: string;
+    providerDid: string;
+    routeContext: RouteContext;
+    allowedSubjectDids: string[];
+    clientId: string;
+    deviceDid: string;
+    publicJwks: Record<string, unknown>[];
+    protectedWalletSeed: PinProtectedProfileSecret;
+    protectedVpToken: PinProtectedProfileSecret;
+    failedUnlocks: number;
+    lockedUntil?: string;
+    createdAt: string;
+    updatedAt: string;
+}>;
+export type ServerProfileSessionRecord = Readonly<{
+    sessionId: string;
+    ownerId: string;
+    profileId: string;
+    subjectDid: string;
+    scopes: string[];
+    sealedUnlockedWalletSeed: string;
+    sealedAccessToken: string;
+    expiresAt: string;
+}>;
+/** Persistence port; implementations must isolate environment and tenant data. */
+export type ServerProfileStore = Readonly<{
+    listProfiles(ownerId: string): Promise<ServerProfileRecord[]>;
+    getProfile(profileId: string): Promise<ServerProfileRecord | undefined>;
+    putProfile(profile: ServerProfileRecord): Promise<void>;
+    getSession(sessionId: string): Promise<ServerProfileSessionRecord | undefined>;
+    putSession(session: ServerProfileSessionRecord): Promise<void>;
+    deleteSession(sessionId: string): Promise<void>;
+}>;
+export type ServerProfileEnrollmentInput = Readonly<{
+    ownerId: string;
+    profileId: string;
+    actorKind: ActorKind;
+    actorMode: ServerActorMode;
+    actorDid: string;
+    profileDid: string;
+    providerDid: string;
+    routeContext: RouteContext;
+    allowedSubjectDids: string[];
+    pin: string;
+    idToken: string;
+    activationCode: string;
+    vpToken: string;
+}>;
+/** One explicit unlock request; scopes and subject remain session-bound. */
+export type ServerProfileUnlockInput = Readonly<{
+    ownerId: string;
+    profileId: string;
+    subjectDid: string;
+    scopes: string[];
+    pin: string;
+    idToken: string;
+}>;
+/** Material available only during an authenticated, unexpired server session. */
+export type ResolvedServerProfileSession = Readonly<{
+    sessionId: string;
+    profile: ServerProfileRecord;
+    subjectDid: string;
+    scopes: string[];
+    accessToken: string;
+    secureTransportAdapter: SecureDidcommTransportAdapter;
+}>;
+export type ServerProfileSessionManagerOptions = Readonly<{
+    store: ServerProfileStore;
+    sealer: ServerProfileSealer;
+    gatewayBaseUrl: string;
+    recipientDid: string;
+    resolveRecipientJwk: (recipientDid: string) => Promise<JWK>;
+    fetchImpl?: typeof fetch;
+    sessionTtlSeconds?: number;
+    maxFailedUnlocks?: number;
+    lockSeconds?: number;
+    profileProtection?: ProfileProtectionOptions;
+    now?: () => Date;
+}>;
+/**
+ * Coordinates device registration, two-factor profile protection and SMART sessions.
+ *
+ * Persisted seeds require both the PIN-derived key and the host KEK. After a
+ * successful unlock, a short-lived host-sealed seed is copied into the server
+ * session so subsequent requests do not need to resend the PIN. Expiring or
+ * locking the session removes that temporary bypass.
+ */
+export declare class ServerProfileSessionManager {
+    private readonly options;
+    constructor(options: ServerProfileSessionManagerOptions);
+    enroll(input: ServerProfileEnrollmentInput): Promise<ServerProfileRecord>;
+    listProfiles(ownerId: string): Promise<ServerProfileRecord[]>;
+    unlock(input: ServerProfileUnlockInput): Promise<ResolvedServerProfileSession>;
+    resolveSession(ownerId: string, sessionId: string): Promise<ResolvedServerProfileSession>;
+    lock(ownerId: string, sessionId: string): Promise<void>;
+    private createClient;
+    private createWallet;
+    private requireOwnedProfile;
+    private requireSubject;
+    private now;
+}

package/dist/server-profile-session.js

@@ -0,0 +1,259 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+import { randomBytes } from 'node:crypto';
+import { NodeManagedWallet } from './node-managed-wallet.js';
+import { NodeHttpClient } from './node-runtime-client.js';
+import { ProfilePinRejectedError, openServerProfileSecret, protectServerProfileSecret, } from './server-profile-protection.js';
+/**
+ * Coordinates device registration, two-factor profile protection and SMART sessions.
+ *
+ * Persisted seeds require both the PIN-derived key and the host KEK. After a
+ * successful unlock, a short-lived host-sealed seed is copied into the server
+ * session so subsequent requests do not need to resend the PIN. Expiring or
+ * locking the session removes that temporary bypass.
+ */
+export class ServerProfileSessionManager {
+    constructor(options) {
+        this.options = options;
+    }
+    async enroll(input) {
+        requireEnrollment(input);
+        const seed = randomBytes(32).toString('base64url');
+        const wallet = await this.createWallet(input.profileId, seed);
+        const context = walletContext(input.profileId);
+        const publicKeys = await wallet.getPublicJwks(context, {});
+        const client = this.createClient(input.routeContext, input.idToken);
+        const activation = await client.activateProfileDeviceWithActivationRequest({
+            ...input.routeContext,
+            activationCode: input.activationCode,
+            idToken: input.idToken,
+            dcrPayload: {
+                application_type: 'web',
+                actor_did: input.actorDid,
+                profile_did: input.profileDid,
+                jwks: { keys: publicKeys.map((entry) => entry.publicJwk) },
+            },
+        });
+        const dcrBody = terminalBody(activation.dcr.poll.body);
+        const clientId = findText(dcrBody, ['client_id', 'clientId']);
+        if (!clientId)
+            throw new Error('GW DCR did not return client_id.');
+        const deviceDid = findText(dcrBody, ['device_did', 'deviceDid', 'did']) || clientId;
+        const now = this.now();
+        const record = {
+            profileId: input.profileId,
+            ownerId: input.ownerId,
+            actorKind: input.actorKind,
+            actorMode: input.actorMode,
+            actorDid: input.actorDid,
+            profileDid: input.profileDid,
+            providerDid: input.providerDid,
+            routeContext: input.routeContext,
+            allowedSubjectDids: unique(input.allowedSubjectDids),
+            clientId,
+            deviceDid,
+            publicJwks: publicKeys.map((entry) => entry.publicJwk),
+            protectedWalletSeed: await protectServerProfileSecret(seed, input.pin, `${input.profileId}:wallet-seed`, this.options.sealer, this.options.profileProtection),
+            protectedVpToken: await protectServerProfileSecret(input.vpToken, input.pin, `${input.profileId}:vp-token`, this.options.sealer, this.options.profileProtection),
+            failedUnlocks: 0,
+            createdAt: now.toISOString(),
+            updatedAt: now.toISOString(),
+        };
+        await this.options.store.putProfile(record);
+        return record;
+    }
+    listProfiles(ownerId) {
+        return this.options.store.listProfiles(ownerId);
+    }
+    async unlock(input) {
+        const profile = await this.requireOwnedProfile(input.ownerId, input.profileId);
+        this.requireSubject(profile, input.subjectDid);
+        const now = this.now();
+        if (profile.lockedUntil && new Date(profile.lockedUntil) > now) {
+            throw new Error('Profile is temporarily locked after failed PIN attempts.');
+        }
+        let seed;
+        let vpToken;
+        try {
+            seed = await openServerProfileSecret(profile.protectedWalletSeed, input.pin, `${profile.profileId}:wallet-seed`, this.options.sealer);
+            vpToken = await openServerProfileSecret(profile.protectedVpToken, input.pin, `${profile.profileId}:vp-token`, this.options.sealer);
+        }
+        catch (reason) {
+            if (!(reason instanceof ProfilePinRejectedError))
+                throw reason;
+            const failures = profile.failedUnlocks + 1;
+            const max = this.options.maxFailedUnlocks ?? 5;
+            const lockedUntil = failures >= max
+                ? new Date(now.getTime() + (this.options.lockSeconds ?? 300) * 1000).toISOString()
+                : undefined;
+            await this.options.store.putProfile({ ...profile, failedUnlocks: failures, lockedUntil, updatedAt: now.toISOString() });
+            throw new Error('Profile PIN rejected.');
+        }
+        const wallet = await this.createWallet(profile.profileId, seed);
+        const assertion = await buildWalletClientAssertion(wallet, profile, this.options.gatewayBaseUrl, now);
+        const token = await this.createClient(profile.routeContext, input.idToken).requestSmartToken({
+            ...profile.routeContext,
+            actorDid: profile.actorDid,
+            subjectDid: input.subjectDid,
+            clientId: profile.clientId,
+            issuer: profile.clientId,
+            audience: this.options.gatewayBaseUrl,
+            idToken: input.idToken,
+            vpToken,
+            clientAssertion: assertion,
+            clientAssertionType: 'private_key_jwt',
+            smartTokenKind: 'openid-smart',
+            scopes: unique(input.scopes),
+            tokenCacheKey: `profile:${profile.profileId}:${input.subjectDid}:${unique(input.scopes).join(',')}`,
+        });
+        if (token.status !== 'fetched' || !token.accessToken)
+            throw new Error('SMART token exchange failed.');
+        const sessionId = randomBytes(32).toString('base64url');
+        const expiresAt = new Date(now.getTime() + (this.options.sessionTtlSeconds ?? 300) * 1000);
+        await this.options.store.putProfile({ ...profile, failedUnlocks: 0, lockedUntil: undefined, updatedAt: now.toISOString() });
+        await this.options.store.putSession({
+            sessionId,
+            ownerId: input.ownerId,
+            profileId: profile.profileId,
+            subjectDid: input.subjectDid,
+            scopes: unique(input.scopes),
+            sealedUnlockedWalletSeed: await this.options.sealer.seal(seed, `${sessionId}:unlocked-wallet-seed`),
+            sealedAccessToken: await this.options.sealer.seal(token.accessToken, `${sessionId}:access-token`),
+            expiresAt: expiresAt.toISOString(),
+        });
+        return this.resolveSession(input.ownerId, sessionId);
+    }
+    async resolveSession(ownerId, sessionId) {
+        const session = await this.options.store.getSession(sessionId);
+        if (!session || session.ownerId !== ownerId)
+            throw new Error('Profile session not found.');
+        if (new Date(session.expiresAt) <= this.now()) {
+            await this.options.store.deleteSession(sessionId);
+            throw new Error('Profile session expired.');
+        }
+        const profile = await this.requireOwnedProfile(ownerId, session.profileId);
+        const seed = await this.options.sealer.unseal(session.sealedUnlockedWalletSeed, `${sessionId}:unlocked-wallet-seed`);
+        const wallet = await this.createWallet(profile.profileId, seed);
+        const context = walletContext(profile.profileId);
+        return {
+            sessionId,
+            profile,
+            subjectDid: session.subjectDid,
+            scopes: session.scopes,
+            accessToken: await this.options.sealer.unseal(session.sealedAccessToken, `${sessionId}:access-token`),
+            secureTransportAdapter: {
+                pack: (message) => wallet.packForRecipientWithContext(message, this.options.recipientDid, { context }),
+                unpack: async (jwe) => (await wallet.unpackWithContext(jwe, { context })).content,
+            },
+        };
+    }
+    async lock(ownerId, sessionId) {
+        const session = await this.options.store.getSession(sessionId);
+        if (session?.ownerId === ownerId)
+            await this.options.store.deleteSession(sessionId);
+    }
+    createClient(ctx, bearerToken) {
+        return new NodeHttpClient({
+            baseUrl: this.options.gatewayBaseUrl,
+            ctx,
+            bearerToken,
+            fetchImpl: this.options.fetchImpl,
+        });
+    }
+    async createWallet(profileId, seed) {
+        const wallet = new NodeManagedWallet({ resolveRecipientJwk: this.options.resolveRecipientJwk });
+        const context = walletContext(profileId);
+        await wallet.provisionManagedKeys(context, {
+            ownerScope: 'profile',
+            purposes: ['actor-signing'],
+            mode: 'deterministic',
+            seedMaterial: seed,
+        });
+        await wallet.provisionManagedKeys(context, {
+            ownerScope: 'runtime',
+            purposes: ['openid-id-token-signing', 'vp-token-signing', 'comm-signing', 'comm-encryption'],
+            mode: 'deterministic',
+            seedMaterial: seed,
+        });
+        return wallet;
+    }
+    async requireOwnedProfile(ownerId, profileId) {
+        const profile = await this.options.store.getProfile(profileId);
+        if (!profile || profile.ownerId !== ownerId)
+            throw new Error('Profile not found.');
+        return profile;
+    }
+    requireSubject(profile, subjectDid) {
+        if (!profile.allowedSubjectDids.includes(subjectDid))
+            throw new Error('Subject is not linked to this profile.');
+    }
+    now() { return this.options.now?.() || new Date(); }
+}
+async function buildWalletClientAssertion(wallet, profile, audience, now) {
+    const seconds = Math.floor(now.getTime() / 1000);
+    return wallet.signCompactJws(walletContext(profile.profileId), {
+        header: { alg: 'ES384', typ: 'JWT' },
+        claims: {
+            iss: profile.clientId,
+            sub: profile.clientId,
+            aud: audience,
+            iat: seconds,
+            exp: seconds + 300,
+            jti: randomBytes(16).toString('base64url'),
+        },
+        key: { ownerScope: 'runtime', purpose: 'openid-id-token-signing' },
+    });
+}
+function walletContext(profileId) {
+    return {
+        profile: { profileId },
+        runtime: { runtimeId: `${profileId}:server-runtime`, runtimeType: 'backend-service' },
+    };
+}
+function requireEnrollment(input) {
+    for (const [name, value] of Object.entries({
+        ownerId: input.ownerId,
+        profileId: input.profileId,
+        actorDid: input.actorDid,
+        profileDid: input.profileDid,
+        providerDid: input.providerDid,
+        activationCode: input.activationCode,
+        vpToken: input.vpToken,
+    }))
+        if (!String(value || '').trim())
+            throw new Error(`Profile enrollment requires ${name}.`);
+    if (!input.allowedSubjectDids.length)
+        throw new Error('Profile enrollment requires an allowed subject.');
+}
+function unique(values) {
+    return [...new Set(values.map((value) => String(value).trim()).filter(Boolean))].sort();
+}
+function terminalBody(value) {
+    if (value && typeof value === 'object' && !Array.isArray(value) && 'body' in value) {
+        return value.body || value;
+    }
+    return value;
+}
+function findText(value, keys) {
+    if (!value || typeof value !== 'object')
+        return undefined;
+    if (Array.isArray(value)) {
+        for (const item of value) {
+            const found = findText(item, keys);
+            if (found)
+                return found;
+        }
+        return undefined;
+    }
+    const record = value;
+    for (const key of keys) {
+        const found = String(record[key] || '').trim();
+        if (found)
+            return found;
+    }
+    for (const child of Object.values(record)) {
+        const found = findText(child, keys);
+        if (found)
+            return found;
+    }
+    return undefined;
+}