gdc-sdk-node-ts 2.4.23 → 2.4.30

package/dist/server-profile-session.d.ts

@@ -57,24 +57,53 @@ export type ServerProfileStore = Readonly<{
     deleteSession(sessionId: string): Promise<void>;
 }>;
 export type ServerProfileEnrollmentInput = Readonly<{
+    /** Stable confidential id of the authenticated portal account that owns and lists this profile. */
     ownerId: string;
+    /** Stable local id of this wallet/profile record. This is not the DCR `client_id`. */
     profileId: string;
+    /** SDK capability family being enrolled, for example an organization controller or employee. */
     actorKind: ActorKind;
+    /** Authorization semantics already granted to the profile; never take this from an untrusted UI field. */
     actorMode: ServerActorMode;
+    /** Exact role/controller DID used by the actor proof, including the VP issuer when a VP is supplied. */
     actorDid: string;
+    /** DID represented by the managed wallet. It may equal `actorDid`, as in a controller enrollment. */
     profileDid: string;
+    /** Organization/provider DID whose configured route and policies this profile will use. */
     providerDid: string;
+    /** Server-owned tenant, jurisdiction and sector routing context. */
     routeContext: RouteContext;
+    /** Server-derived subject authorization boundary; never accept arbitrary browser-selected DIDs here. */
     allowedSubjectDids: string[];
+    /**
+     * Unlock secret for the locally protected wallet seed. It is neither sent
+     * to GW nor persisted by the SDK. The integrating product decides whether
+     * it is user-entered or a separately stored, high-entropy per-profile BFF
+     * secret; it must never be logged or reused as one shared deployment PIN.
+     */
     pin: string;
+    /**
+     * Signed OIDC `id_token` used by GW to bind the activation code to an
+     * authenticated account/email. Its issuer, audience, signature `kid` and
+     * public JWKS must be trusted by GW. A controller VP cannot replace it.
+     */
     idToken: string;
+    /** One-time code returned by the completed organization flow or employee `License/_issue`. */
     activationCode: string;
-    /** Explicit per-installation id. Older callers fall back to the first DCR key id. */
+    /**
+     * Optional explicit installation identity. Normally omit it so the SDK
+     * derives the identity from the wallet key it creates for this profile.
+     */
     clientInstanceId?: string;
+    /** Signed actor/controller VP protected with the profile for later proof and session operations. */
     vpToken: string;
-    /** Registered web redirect URIs included in the OpenID DCR metadata. */
+    /** Redirect URIs owned by this portal/app installation. */
+    redirectUris?: string[];
+    /** Human-readable portal/app name. */
+    clientName?: string;
+    /** @deprecated Use `redirectUris`; OpenID metadata is authored internally. */
     dcrRedirectUris?: string[];
-    /** Human-readable DCR client name. */
+    /** @deprecated Use `clientName`; OpenID metadata is authored internally. */
     dcrClientName?: string;
     /**
      * Optional server-only recovery seed. It must be 32 bytes encoded as

package/dist/server-profile-session.js

@@ -1,11 +1,11 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
 import { randomBytes } from 'node:crypto';
-import { IdentityDcrMetadataFields, IdentityDeviceInfoFields } from 'gdc-common-utils-ts/constants/identity-auth';
 import { ActorKinds } from 'gdc-common-utils-ts/constants/actor-session';
 import { TransportProfiles, } from 'gdc-sdk-core-ts';
 import { NodeManagedWallet } from './node-managed-wallet.js';
 import { NodeHttpClient } from './node-runtime-client.js';
 import { buildIdentityOpenIdSmartTokenPath } from './runtime-paths.js';
+import { createProfileDeviceActivationRequest } from './device-activation.js';
 import { ProfilePinRejectedError, openServerProfileSecret, protectServerProfileSecret, } from './server-profile-protection.js';
 /**
  * Coordinates device registration, two-factor profile protection and SMART sessions.
@@ -36,23 +36,26 @@ export class ServerProfileSessionManager {
         const storagePublicJwk = publicKeys.find((entry) => entry.purpose === 'document-at-rest')?.publicJwk;
         if (!storagePublicJwk)
             throw new Error('Server profile enrollment requires a document-at-rest ML-KEM key.');
-        const client = this.createClient(input.routeContext, input.idToken);
-        const activation = await client.activateProfileDeviceWithActivationRequest({
-            ...input.routeContext,
+        const idToken = String(input.idToken || '').trim();
+        if (!idToken)
+            throw new Error('Profile enrollment requires a signed OIDC idToken for account/email binding.');
+        const client = this.createClient(input.routeContext, idToken);
+        const redirectUris = input.redirectUris || input.dcrRedirectUris || [];
+        const clientName = String(input.clientName || input.dcrClientName || '').trim();
+        const activationRequest = createProfileDeviceActivationRequest({
             activationCode: input.activationCode,
-            idToken: input.idToken,
-            dcrPayload: {
-                [IdentityDcrMetadataFields.ExtendedDeviceInfo]: {
-                    [IdentityDeviceInfoFields.DeviceId]: clientInstanceId,
-                },
-                application_type: 'web',
-                ...(input.dcrRedirectUris?.length ? { redirect_uris: unique(input.dcrRedirectUris) } : {}),
-                ...(input.dcrClientName ? { client_name: input.dcrClientName } : {}),
-                actor_did: input.actorDid,
-                profile_did: input.profileDid,
-                jwks: { keys: publicKeys.filter((entry) => entry.purpose !== 'document-at-rest').map((entry) => entry.publicJwk) },
-            },
-        });
+            idToken,
+            ...input.routeContext,
+        })
+            .setClientInstanceId(clientInstanceId)
+            .setClientName(clientName)
+            .setApplicationType('web')
+            .setRedirectUris(redirectUris)
+            .setPublicJwks(publicKeys.filter((entry) => entry.purpose !== 'document-at-rest').map((entry) => entry.publicJwk))
+            .setActorDid(input.actorDid)
+            .setProfileDid(input.profileDid)
+            .build();
+        const activation = await client.activateProfileDeviceWithActivationRequest(activationRequest);
         const dcrBody = terminalBody(activation.dcr.poll.body);
         const clientId = findText(dcrBody, ['client_id', 'clientId']);
         if (!clientId)
@@ -357,6 +360,7 @@ function requireEnrollment(input) {
         profileDid: input.profileDid,
         providerDid: input.providerDid,
         activationCode: input.activationCode,
+        idToken: input.idToken,
         vpToken: input.vpToken,
     }))
         if (!String(value || '').trim())

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-sdk-node-ts",
-  "version": "2.4.23",
+  "version": "2.4.30",
   "description": "Next-generation Node runtime package for the GDC SDK family",
   "license": "Apache-2.0",
   "author": "Antifraud Services Inc.",