gdc-sdk-node-ts 2.3.15 → 2.3.17

package/dist/node-runtime-client.js

@@ -154,7 +154,9 @@ export class HttpRuntimeClient {
             wrapBundleAsGatewayTransactionMessage: this.wrapBundleAsGatewayTransactionMessage.bind(this),
             submitPath: this.hostRegistryOrganizationTransactionPath.bind(this),
             pollPath: this.hostRegistryOrganizationTransactionPollPath.bind(this),
-            submitAndPoll: this.submitAndPoll.bind(this),
+            submitAndPoll: this.transportProfile === TransportProfiles.DidcommEncryptedForm
+                ? (submitPath, pollPath, payload, pollOptions) => this.submitClinicalMessageAndPoll(submitPath, pollPath, payload, this.transportProfile, pollOptions)
+                : this.submitAndPoll.bind(this),
         });
     }
     /**
@@ -176,7 +178,9 @@ export class HttpRuntimeClient {
             wrapBundleAsGatewayTransactionMessage: this.wrapBundleAsGatewayTransactionMessage.bind(this),
             submitPath: this.hostRegistryOrganizationIssuePath.bind(this),
             pollPath: this.hostRegistryOrganizationIssuePollPath.bind(this),
-            submitAndPoll: this.submitAndPoll.bind(this),
+            submitAndPoll: this.transportProfile === TransportProfiles.DidcommEncryptedForm
+                ? (submitPath, pollPath, payload, pollOptions) => this.submitClinicalMessageAndPoll(submitPath, pollPath, payload, this.transportProfile, pollOptions)
+                : this.submitAndPoll.bind(this),
         });
     }
     /**
@@ -800,7 +804,9 @@ export class HttpRuntimeClient {
                 status: response.status,
                 body: response.status === 202
                     ? response.body
-                    : await decodeTransportResponse(response.body, profile, this.secureTransportAdapter),
+                    : response.status >= 200 && response.status < 300
+                        ? await decodeTransportResponse(response.body, profile, this.secureTransportAdapter)
+                        : response.body,
                 retryAfterMs: response.retryAfterMs,
             };
         }, pollPath, { thid: job.thid }, input.pollOptions);
@@ -824,7 +830,9 @@ export class HttpRuntimeClient {
                 status: response.status,
                 body: response.status === 202
                     ? response.body
-                    : await decodeTransportResponse(response.body, profile, this.secureTransportAdapter),
+                    : response.status >= 200 && response.status < 300
+                        ? await decodeTransportResponse(response.body, profile, this.secureTransportAdapter)
+                        : response.body,
                 retryAfterMs: response.retryAfterMs,
             };
         }, pollPath, { thid: renderedSubmit.thid }, pollOptions);

package/dist/server-profile-session.d.ts

@@ -1,7 +1,9 @@
 import type { JWK } from 'gdc-common-utils-ts/models/jwk';
 import type { ActorKind } from 'gdc-common-utils-ts/models/actor-session';
-import type { ConfidentialStorageProfile } from 'gdc-sdk-core-ts';
+import type { LegalOrganizationVerificationTransactionInput } from 'gdc-common-utils-ts/utils/legal-organization-verification-transaction';
+import { type ConfidentialStorageProfile, type PollOptions, type SubmitAndPollResult } from 'gdc-sdk-core-ts';
 import type { RouteContext } from './individual-onboarding.js';
+import type { HostRouteContext } from './host-onboarding.js';
 import type { SecureDidcommTransportAdapter } from 'gdc-sdk-core-ts';
 import { type PinProtectedProfileSecret, type ProfileProtectionOptions, type ServerProfileSealer } from './server-profile-protection.js';
 export type { ServerProfileSealer } from './server-profile-protection.js';
@@ -66,6 +68,10 @@ export type ServerProfileEnrollmentInput = Readonly<{
     idToken: string;
     activationCode: string;
     vpToken: string;
+    /** Registered web redirect URIs included in the OpenID DCR metadata. */
+    dcrRedirectUris?: string[];
+    /** Human-readable DCR client name. */
+    dcrClientName?: string;
     /**
      * Optional server-only recovery seed. It must be 32 bytes encoded as
      * base64url and must never be accepted from an untrusted browser payload.
@@ -82,6 +88,17 @@ export type ServerProfileEnrollmentPublicKey = Readonly<{
     kid: string;
     publicJwk: Record<string, unknown>;
 }>;
+/** Server-only existing-tenant reissue performed with deterministic bootstrap keys. */
+export type ServerProfileOrganizationIssueInput = Readonly<{
+    walletSeed: string;
+    walletKeyDerivationId: string;
+    bearerToken: string;
+    providerDid: string;
+    routeContext: RouteContext;
+    hostContext: HostRouteContext;
+    verificationInput: LegalOrganizationVerificationTransactionInput;
+    pollOptions?: PollOptions;
+}>;
 /** One explicit unlock request; scopes and subject remain session-bound. */
 export type ServerProfileUnlockInput = Readonly<{
     ownerId: string;
@@ -146,6 +163,12 @@ export declare class ServerProfileSessionManager {
         walletSeed: string;
         walletKeyDerivationId: string;
     }>): Promise<ServerProfileEnrollmentPublicKey[]>;
+    /**
+     * Reissues an existing organization controller activation through protected
+     * DIDComm transport before a durable profile exists. The deterministic seed
+     * remains server-only and the caller receives only the normal GW response.
+     */
+    submitLegalOrganizationIssueWithBootstrapWallet(input: ServerProfileOrganizationIssueInput): Promise<SubmitAndPollResult>;
     listProfiles(ownerId: string): Promise<ServerProfileRecord[]>;
     unlock(input: ServerProfileUnlockInput): Promise<ResolvedServerProfileSession>;
     resolveSession(ownerId: string, sessionId: string): Promise<ResolvedServerProfileSession>;

package/dist/server-profile-session.js

@@ -1,5 +1,6 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
 import { randomBytes } from 'node:crypto';
+import { TransportProfiles, } from 'gdc-sdk-core-ts';
 import { NodeManagedWallet } from './node-managed-wallet.js';
 import { NodeHttpClient } from './node-runtime-client.js';
 import { buildIdentityOpenIdSmartTokenPath } from './runtime-paths.js';
@@ -35,6 +36,8 @@ export class ServerProfileSessionManager {
             idToken: input.idToken,
             dcrPayload: {
                 application_type: 'web',
+                ...(input.dcrRedirectUris?.length ? { redirect_uris: unique(input.dcrRedirectUris) } : {}),
+                ...(input.dcrClientName ? { client_name: input.dcrClientName } : {}),
                 actor_did: input.actorDid,
                 profile_did: input.profileDid,
                 jwks: { keys: publicKeys.filter((entry) => entry.purpose !== 'document-at-rest').map((entry) => entry.publicJwk) },
@@ -92,6 +95,32 @@ export class ServerProfileSessionManager {
             publicJwk: entry.publicJwk,
         }));
     }
+    /**
+     * Reissues an existing organization controller activation through protected
+     * DIDComm transport before a durable profile exists. The deterministic seed
+     * remains server-only and the caller receives only the normal GW response.
+     */
+    async submitLegalOrganizationIssueWithBootstrapWallet(input) {
+        requireBase64UrlSeed32(input.walletSeed);
+        const walletKeyDerivationId = normalizedWalletKeyDerivationId(input.walletKeyDerivationId, '');
+        if (!walletKeyDerivationId) {
+            throw new Error('submitLegalOrganizationIssueWithBootstrapWallet requires walletKeyDerivationId.');
+        }
+        const wallet = await this.createWallet(walletKeyDerivationId, input.walletSeed);
+        const context = walletContext(walletKeyDerivationId);
+        const client = new NodeHttpClient({
+            baseUrl: this.options.gatewayBaseUrl,
+            ctx: input.routeContext,
+            bearerToken: input.bearerToken,
+            fetchImpl: this.options.fetchImpl,
+            transportProfile: TransportProfiles.DidcommEncryptedForm,
+            secureTransportAdapter: {
+                pack: (message) => wallet.packForRecipientWithContext(message, input.providerDid, { context }),
+                unpack: async (jwe) => (await wallet.unpackWithContext(jwe, { context })).content,
+            },
+        });
+        return client.submitLegalOrganizationIssue(input.hostContext, input.verificationInput, input.pollOptions);
+    }
     listProfiles(ownerId) {
         return this.options.store.listProfiles(ownerId);
     }

package/dist/smart-token.d.ts

@@ -63,6 +63,8 @@ export type SmartTokenRequestInput = SmartTokenRequestContract & {
     presentationSubmission?: Record<string, unknown>;
     purpose?: string;
     requestBodyClaims?: Record<string, unknown>;
+    /** Compatibility bridge until every installed gdc-sdk-core-ts carries this field. */
+    vpTokenFallback?: 'id-token' | 'omit';
     smartTokenKind?: 'token-exchange' | 'openid-smart';
     tokenCacheKey?: string;
     endpointId?: string;

package/dist/smart-token.js

@@ -60,7 +60,12 @@ export async function requestSmartTokenWithDeps(deps) {
                 code_challenge: deps.input.codeChallenge || 'demo-code-challenge',
                 code_challenge_method: deps.input.codeChallengeMethod || 'S256',
                 acr_values: deps.input.acrValues || 'urn:antifraud:acr:openid4vp:employee',
-                vp_token: deps.input.vpToken || deps.input.idToken,
+                id_token: deps.input.idToken,
+                ...(deps.input.vpToken
+                    ? { vp_token: deps.input.vpToken }
+                    : deps.input.vpTokenFallback === 'omit'
+                        ? {}
+                        : { vp_token: deps.input.idToken }),
                 presentation_submission: deps.input.presentationSubmission,
                 expires_in: 300,
                 token_type: 'Bearer',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-sdk-node-ts",
-  "version": "2.3.15",
+  "version": "2.3.17",
   "description": "Next-generation Node runtime package for the GDC SDK family",
   "license": "Apache-2.0",
   "author": "Antifraud Services Inc.",
@@ -38,7 +38,7 @@
   },
   "dependencies": {
     "gdc-common-utils-ts": "^2.3.18",
-    "gdc-sdk-core-ts": "~2.3.13"
+    "gdc-sdk-core-ts": "~2.3.14"
   },
   "devDependencies": {
     "@types/node": "^20.14.10",