gdc-sdk-node-ts 2.3.5 → 2.3.7

package/README.md

@@ -66,43 +66,46 @@ If you are integrating this package for the first time, open these in order:
 1. [gdc-sdk-core-ts/docs/101-SDK_PACKAGE_BOUNDARIES.md](https://github.com/Global-DataCare/gdc-sdk-core-ts/blob/main/docs/101-SDK_PACKAGE_BOUNDARIES.md)
    Why `core`, `node`, and `front` are separate packages, what belongs in each
    one, and why actor-scoped facades must stay aligned across runtimes.
-1. [docs/101-SDK_END_TO_END.md](./docs/101-SDK_END_TO_END.md)
+2. [docs/101-SDK_END_TO_END.md](./docs/101-SDK_END_TO_END.md)
   Ordered onboarding guide with end-to-end journeys, copy/paste snippets, and
   the recommended reading path for new backend integrators.
-2. [docs/101-SDK_INTEGRATION.md](./docs/101-SDK_INTEGRATION.md)
+3. [docs/101-PROFESSIONAL-CONSENT-SMART.md](./docs/101-PROFESSIONAL-CONSENT-SMART.md)
+   Canonical professional DID, consent, VP and SMART flow without literal
+   sections or caller-built audience URLs.
+4. [docs/101-SDK_INTEGRATION.md](./docs/101-SDK_INTEGRATION.md)
    Real backend setup plus the public runtime entrypoints:
    `HostOnboardingSdk`, `OrganizationControllerSdk`,
    `IndividualControllerSdk`, `ProfessionalSdk`, route-context usage, and the
    canonical `ProfileRuntime -> loadProfile(...) -> workspace/session -> actor facade -> submit/poll` shape.
-3. [tests/101-live-full-cycle-bff-runtime.e2e.test.mjs](./tests/101-live-full-cycle-bff-runtime.e2e.test.mjs)
+5. [tests/101-live-full-cycle-bff-runtime.e2e.test.mjs](./tests/101-live-full-cycle-bff-runtime.e2e.test.mjs)
    Canonical live backend/BFF walkthrough on a fresh local GW lifecycle:
    host/tenant activation, employee provisioning, individual bootstrap,
    consent grant, professional SMART token, clinical read, and final cleanup.
-4. [docs/101-LIVE_GW_LOCAL.md](./docs/101-LIVE_GW_LOCAL.md)
+6. [docs/101-LIVE_GW_LOCAL.md](./docs/101-LIVE_GW_LOCAL.md)
    Exact TTY/local/Docker commands for running the SDK against a real local GW
    CORE, including tenant bootstrap and employee-seat setup.
-5. [docs/101-DISCOVERY.md](./docs/101-DISCOVERY.md)
+7. [docs/101-DISCOVERY.md](./docs/101-DISCOVERY.md)
    Node/BFF dataspace discovery, hosting-operator resolution, provider
    resolution, and the correct integration boundary for fallback and cache.
-6. [gdc-sdk-core-ts/docs/101-SDK_FLOWS.md](https://github.com/Global-DataCare/gdc-sdk-core-ts/blob/main/docs/101-SDK_FLOWS.md)
+8. [gdc-sdk-core-ts/docs/101-SDK_FLOWS.md](https://github.com/Global-DataCare/gdc-sdk-core-ts/blob/main/docs/101-SDK_FLOWS.md)
    Actor split and business-flow map across organization, individual,
    permissions, invitation, import, and SMART flows.
-7. [gwtemplate-node-ts/docs/PORTAL_API_TO_GW_CORE.md](https://github.com/Global-DataCare/gwtemplate-node-ts/blob/main/docs/PORTAL_API_TO_GW_CORE.md)
+9. [gwtemplate-node-ts/docs/PORTAL_API_TO_GW_CORE.md](https://github.com/Global-DataCare/gwtemplate-node-ts/blob/main/docs/PORTAL_API_TO_GW_CORE.md)
    Canonical portal/BFF functional map over GW CORE, including the domain
    split between `employees`, `related persons`, `members`, and `consents`.
-8. [gdc-common-utils-ts/src/examples/](https://github.com/Global-DataCare/gdc-common-utils-ts/tree/main/src/examples)
+10. [gdc-common-utils-ts/src/examples/](https://github.com/Global-DataCare/gdc-common-utils-ts/tree/main/src/examples)
    Shared payload values used by the docs and tests.
-9. [gdc-common-utils-ts/docs/101-LIFECYCLE.md](https://github.com/Global-DataCare/gdc-common-utils-ts/blob/main/docs/101-LIFECYCLE.md)
+11. [gdc-common-utils-ts/docs/101-LIFECYCLE.md](https://github.com/Global-DataCare/gdc-common-utils-ts/blob/main/docs/101-LIFECYCLE.md)
    Canonical `enable/disable/delete` semantics and copy/paste placeholders.
-10. [tests/101-backend-profile-runtime.test.mjs](./tests/101-backend-profile-runtime.test.mjs)
+12. [tests/101-backend-profile-runtime.test.mjs](./tests/101-backend-profile-runtime.test.mjs)
    Technical runtime slice for profile/device/session orchestration internals.
    Read this after the public actor SDK guides, not before them.
-11. [tests/101-individual-controller-backend-runtime.test.mjs](./tests/101-individual-controller-backend-runtime.test.mjs)
+13. [tests/101-individual-controller-backend-runtime.test.mjs](./tests/101-individual-controller-backend-runtime.test.mjs)
    Technical wrapper slice around the generic profile runtime. This is not the
    main onboarding path for new integrators.
-12. [docs/V2_INDIVIDUAL_REGISTRATION_RECONCILIATION.md](./docs/V2_INDIVIDUAL_REGISTRATION_RECONCILIATION.md)
+14. [docs/V2_INDIVIDUAL_REGISTRATION_RECONCILIATION.md](./docs/V2_INDIVIDUAL_REGISTRATION_RECONCILIATION.md)
    Historical reconciliation note for the current CORE registration baseline.
-13. [docs/NEXT_STEPS.md](./docs/NEXT_STEPS.md)
+15. [docs/NEXT_STEPS.md](./docs/NEXT_STEPS.md)
    Follow-up scope after GW CORE live validation, including the future user job
    manager boundary.
 

package/dist/node-runtime-client.d.ts

@@ -57,6 +57,12 @@ export type HttpRuntimeClientOptions = {
     communicationFormatRenderers?: CommunicationClinicalFormatRenderers;
     /** Injectable fetch implementation for BFF adapters and deterministic tests. */
     fetchImpl?: typeof fetch;
+    /**
+     * Optional trusted provider-index/DID resolver for subject-scoped SMART
+     * requests. The runtime uses the resolved endpoint for transport and JWT
+     * audience; application-level callers do not need to pass `audience`.
+     */
+    smartTokenEndpointResolver?: (subjectDid: string) => Promise<string | undefined>;
 };
 /**
  * @deprecated Prefer `HttpRuntimeClientOptions`.
@@ -82,6 +88,7 @@ export declare class HttpRuntimeClient implements NodeRuntimeClient {
     private readonly secureTransportAdapter?;
     private readonly communicationFormatRenderers;
     private readonly fetchImpl?;
+    private readonly smartTokenEndpointResolver?;
     private readonly httpTraceFile?;
     private readonly tokenCache;
     private readonly paths;

package/dist/node-runtime-client.js

@@ -68,6 +68,7 @@ export class HttpRuntimeClient {
         this.secureTransportAdapter = options.secureTransportAdapter;
         this.communicationFormatRenderers = options.communicationFormatRenderers || {};
         this.fetchImpl = options.fetchImpl;
+        this.smartTokenEndpointResolver = options.smartTokenEndpointResolver;
         this.httpTraceFile = String(process.env.SDK_HTTP_TRACE_FILE || '').trim() || undefined;
         this.paths = new RuntimeClientPaths(this.ctx);
     }
@@ -690,6 +691,7 @@ export class HttpRuntimeClient {
             identityTokenExchangePollPath: this.paths.identityTokenExchangePollPath.bind(this.paths),
             identityOpenIdSmartTokenPath: this.paths.identityOpenIdSmartTokenPath.bind(this.paths),
             identityOpenIdSmartTokenPollPath: this.paths.identityOpenIdSmartTokenPollPath.bind(this.paths),
+            resolveSmartTokenEndpoint: this.smartTokenEndpointResolver,
             submitAndPoll: this.submitAndPoll.bind(this),
             setTokenCache: (tokenCacheKey, token) => this.tokenCache.set(tokenCacheKey, token),
         });

package/dist/orchestration/professional-sdk.d.ts

@@ -26,6 +26,11 @@ export declare class ProfessionalSdk {
      * - `subjectDid`
      * - requested `scopes`
      *
+     * The actor DID must be the same identifier used by the consent grant and
+     * the professional VP. High-level callers omit `audience`; the runtime
+     * resolves the subject provider's SMART endpoint or uses the exact endpoint
+     * of its configured GW route.
+     *
      * Tenant route context can be inherited from the configured
      * `NodeHttpClient({ ctx })` instead of being repeated on every call.
      */

package/dist/orchestration/professional-sdk.js

@@ -26,6 +26,11 @@ export class ProfessionalSdk {
      * - `subjectDid`
      * - requested `scopes`
      *
+     * The actor DID must be the same identifier used by the consent grant and
+     * the professional VP. High-level callers omit `audience`; the runtime
+     * resolves the subject provider's SMART endpoint or uses the exact endpoint
+     * of its configured GW route.
+     *
      * Tenant route context can be inherited from the configured
      * `NodeHttpClient({ ctx })` instead of being repeated on every call.
      */

package/dist/resource-operations.d.ts

@@ -365,15 +365,19 @@ export type GrantProfessionalAccessInput = {
     /**
      * Canonical flat actor identifier for the actor receiving the permission.
      *
-     * Preferred input forms:
-     * - `did:web:...`
+     * Canonical professional grant input:
+     * - the exact `did:web:...:employee:<multibase>:<role>` actor DID reused by
+     *   the employee profile, VP credential subject and SMART request
+     *
+     * Compatibility input forms:
      * - `user@example.org`
      * - `tel:+34600111222`
      * - `ES`
      * - comma-separated lists or string arrays of those tokens
      *
-     * A legacy structured object is still accepted for compatibility, but new
-     * integrations should send canonical strings or string arrays.
+     * Email/phone targets and legacy structured objects remain accepted for
+     * compatibility, but they do not automatically authorize a later SMART
+     * request made with a different derived professional DID.
      */
     actorId?: ConsentActorTargetInput;
     /**

package/dist/server-profile-session.js

@@ -2,6 +2,7 @@
 import { randomBytes } from 'node:crypto';
 import { NodeManagedWallet } from './node-managed-wallet.js';
 import { NodeHttpClient } from './node-runtime-client.js';
+import { buildIdentityOpenIdSmartTokenPath } from './runtime-paths.js';
 import { ProfilePinRejectedError, openServerProfileSecret, protectServerProfileSecret, } from './server-profile-protection.js';
 /**
  * Coordinates device registration, two-factor profile protection and SMART sessions.
@@ -95,14 +96,18 @@ export class ServerProfileSessionManager {
         }
         profile = await this.ensureRequiredStorageProfile(profile, seed);
         const wallet = await this.createWallet(profile.profileId, seed);
-        const assertion = await buildWalletClientAssertion(wallet, profile, this.options.gatewayBaseUrl, now);
+        const smartTokenEndpoint = [
+            this.options.gatewayBaseUrl.replace(/\/+$/, ''),
+            buildIdentityOpenIdSmartTokenPath(profile.routeContext),
+        ].join('');
+        const assertion = await buildWalletClientAssertion(wallet, profile, smartTokenEndpoint, now);
         const token = await this.createClient(profile.routeContext, input.idToken).requestSmartToken({
             ...profile.routeContext,
             actorDid: profile.actorDid,
             subjectDid: input.subjectDid,
             clientId: profile.clientId,
             issuer: profile.clientId,
-            audience: this.options.gatewayBaseUrl,
+            audience: smartTokenEndpoint,
             idToken: input.idToken,
             vpToken,
             clientAssertion: assertion,

package/dist/smart-token.d.ts

@@ -93,6 +93,13 @@ type RequestSmartTokenDeps = {
     identityTokenExchangePollPath: (ctx: RouteContext) => string;
     identityOpenIdSmartTokenPath: (ctx: RouteContext) => string;
     identityOpenIdSmartTokenPollPath: (ctx: RouteContext) => string;
+    /**
+     * Trusted runtime resolver for the provider that owns the subject.
+     *
+     * Product code may back this with an index/DID discovery adapter. The
+     * high-level caller does not receive or manage the resolver's cache.
+     */
+    resolveSmartTokenEndpoint?: (subjectDid: string) => Promise<string | undefined>;
     submitAndPoll: (submitPath: string, pollPath: string, payload: {
         thid?: string;
     } & Record<string, unknown>, options?: PollOptions) => Promise<SubmitAndPollResult>;

package/dist/smart-token.js

@@ -27,7 +27,19 @@ export async function requestSmartTokenWithDeps(deps) {
     if (deps.input.smartTokenKind === 'openid-smart') {
         const actorDid = String(deps.input.actorDid || '').trim() || undefined;
         const resolvedClientId = deps.input.clientId || actorDid || deps.input.subjectDid || deps.routeCtx.tenantId;
-        const resolvedAudience = deps.input.audience || deps.routeCtx.tenantId;
+        const configuredSubmitPath = deps.identityOpenIdSmartTokenPath(deps.routeCtx);
+        const configuredPollPath = deps.identityOpenIdSmartTokenPollPath(deps.routeCtx);
+        const explicitAudience = String(deps.input.audience || '').trim();
+        const subjectDid = String(deps.input.subjectDid || '').trim();
+        const discoveredEndpoint = !explicitAudience && subjectDid && deps.resolveSmartTokenEndpoint
+            ? normalizeResolvedSmartTokenEndpoint(await deps.resolveSmartTokenEndpoint(subjectDid))
+            : undefined;
+        const configuredEndpoint = joinRuntimeUrl(deps.baseUrl, configuredSubmitPath);
+        const resolvedAudience = explicitAudience || discoveredEndpoint || configuredEndpoint;
+        const submitPath = discoveredEndpoint || configuredSubmitPath;
+        const pollPath = discoveredEndpoint
+            ? smartTokenPollEndpointFromTokenEndpoint(discoveredEndpoint)
+            : configuredPollPath;
         const clientAssertion = await resolveClientAssertion({
             clientAssertion: deps.input.clientAssertion,
             clientAssertionBuilder: deps.input.clientAssertionBuilder,
@@ -59,7 +71,7 @@ export async function requestSmartTokenWithDeps(deps) {
             },
             ...(deps.input.additionalClaims || {}),
         };
-        const exchange = await deps.submitAndPoll(deps.identityOpenIdSmartTokenPath(deps.routeCtx), deps.identityOpenIdSmartTokenPollPath(deps.routeCtx), smartPayload, pollOptions);
+        const exchange = await deps.submitAndPoll(submitPath, pollPath, smartPayload, pollOptions);
         return resolveTokenExchangeResult(exchange, normalizedScopes, tokenCacheKey, deps.setTokenCache);
     }
     const payload = {
@@ -75,6 +87,33 @@ export async function requestSmartTokenWithDeps(deps) {
     const exchange = await deps.submitAndPoll(deps.identityTokenExchangePath(deps.routeCtx), deps.identityTokenExchangePollPath(deps.routeCtx), payload, pollOptions);
     return resolveTokenExchangeResult(exchange, normalizedScopes, tokenCacheKey, deps.setTokenCache);
 }
+function joinRuntimeUrl(baseUrl, path) {
+    return `${String(baseUrl || '').replace(/\/+$/, '')}/${String(path || '').replace(/^\/+/, '')}`;
+}
+function normalizeResolvedSmartTokenEndpoint(value) {
+    const normalized = String(value || '').trim();
+    if (!normalized)
+        return undefined;
+    let endpoint;
+    try {
+        endpoint = new URL(normalized);
+    }
+    catch {
+        throw new Error('Resolved SMART token endpoint must be an absolute HTTP(S) URL.');
+    }
+    if (!['http:', 'https:'].includes(endpoint.protocol)) {
+        throw new Error('Resolved SMART token endpoint must use HTTP(S).');
+    }
+    if (!endpoint.pathname.endsWith('/identity/openid/smart/token')) {
+        throw new Error('Resolved SMART token endpoint must target /identity/openid/smart/token.');
+    }
+    return endpoint.toString();
+}
+function smartTokenPollEndpointFromTokenEndpoint(tokenEndpoint) {
+    const endpoint = new URL(tokenEndpoint);
+    endpoint.pathname = endpoint.pathname.replace(/\/identity\/openid\/smart\/token$/, '/identity/openid/smart/_batch-response');
+    return endpoint.toString();
+}
 async function resolveClientAssertion(input) {
     const explicit = String(input.clientAssertion || '').trim();
     if (explicit)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-sdk-node-ts",
-  "version": "2.3.5",
+  "version": "2.3.7",
   "description": "Next-generation Node runtime package for the GDC SDK family",
   "license": "Apache-2.0",
   "author": "Antifraud Services Inc.",
@@ -36,8 +36,8 @@
     "test:e2e:live-gw:clean": "bash ./scripts/run-live-gw-clean.sh"
   },
   "dependencies": {
-    "gdc-common-utils-ts": "^2.3.6",
-    "gdc-sdk-core-ts": "~2.3.4"
+    "gdc-common-utils-ts": "^2.3.9",
+    "gdc-sdk-core-ts": "~2.3.6"
   },
   "devDependencies": {
     "@types/node": "^20.14.10",