gdc-sdk-node-ts 2.4.36 → 2.4.37

package/dist/device-activation.d.ts

@@ -68,6 +68,28 @@ export type EmployeeDeviceActivationResult = {
     exchange: SubmitAndPollResult;
     dcr: SubmitAndPollResult;
 };
+export type EmployeeDeviceOtpRecoveryInput = Readonly<{
+    idToken: string;
+    clientInstanceId: string;
+    pollOptions?: PollOptions;
+}>;
+export type EmployeeDeviceOtpRecoveryResult = Readonly<{
+    activationCode: string;
+    licenseId: string;
+    employeeRole: string;
+    employeeActorIdentifier: string;
+    recovery: SubmitAndPollResult;
+}>;
+/** Requests a fresh replacement credential for one OTP-authenticated installation. */
+export declare function recoverEmployeeDeviceWithOtpWithDeps(deps: Readonly<{
+    routeCtx: RouteContext;
+    input: EmployeeDeviceOtpRecoveryInput;
+    identityEmployeeRecoveryPath: (ctx: RouteContext) => string;
+    identityEmployeeRecoveryPollPath: (ctx: RouteContext) => string;
+    submitAndPollWithBearerToken: (bearerToken: string | undefined, submitPath: string, pollPath: string, payload: {
+        thid?: string;
+    } & Record<string, unknown>, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
+}>): Promise<EmployeeDeviceOtpRecoveryResult>;
 export type EmployeeDeviceRevocationInput = {
     licenseId: string;
     clientId: string;

package/dist/device-activation.js

@@ -56,6 +56,26 @@ export function createProfileDeviceActivationRequest(input) {
     };
     return draft;
 }
+/** Requests a fresh replacement credential for one OTP-authenticated installation. */
+export async function recoverEmployeeDeviceWithOtpWithDeps(deps) {
+    const idToken = requiredText(deps.input.idToken, 'fresh OTP identity token');
+    const clientInstanceId = requiredText(deps.input.clientInstanceId, 'client instance id');
+    const recovery = await deps.submitAndPollWithBearerToken(idToken, deps.identityEmployeeRecoveryPath(deps.routeCtx), deps.identityEmployeeRecoveryPollPath(deps.routeCtx), { thid: `employee-recovery-${createRuntimeUuid()}`, client_instance_id: clientInstanceId }, deps.input.pollOptions);
+    const failedStatus = [recovery.submit.status, recovery.poll.status]
+        .find(status => status < 200 || status >= 300);
+    if (failedStatus !== undefined) {
+        throw new Error(`recoverEmployeeDeviceWithOtp: recovery failed (HTTP ${failedStatus}).`);
+    }
+    const terminal = responseBody(recovery.poll.body);
+    const activationCode = findResponseText(terminal, 'activation_code');
+    const licenseId = findResponseText(terminal, 'license_id');
+    const employeeRole = findResponseText(terminal, 'employee_role');
+    const employeeActorIdentifier = findResponseText(terminal, 'employee_same_as');
+    if (!activationCode || !licenseId || !employeeRole || !employeeActorIdentifier) {
+        throw new Error('recoverEmployeeDeviceWithOtp: incomplete recovery response.');
+    }
+    return { activationCode, licenseId, employeeRole, employeeActorIdentifier, recovery };
+}
 export async function revokeEmployeeDeviceWithDeps(deps) {
     const licenseId = String(deps.input.licenseId || '').trim();
     const clientId = String(deps.input.clientId || '').trim();
@@ -147,6 +167,44 @@ function resolveDcrPayload(input) {
         return { ...input.dcrPayload };
     throw new Error('Device activation requires a device registration built by createProfileDeviceActivationRequest.');
 }
+function responseBody(value) {
+    if (typeof value === 'string') {
+        try {
+            return responseBody(JSON.parse(value));
+        }
+        catch {
+            return {};
+        }
+    }
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return {};
+    const record = value;
+    return record.body && typeof record.body === 'object' && !Array.isArray(record.body)
+        ? record.body
+        : record;
+}
+function findResponseText(value, key) {
+    if (!value || typeof value !== 'object')
+        return '';
+    if (Array.isArray(value)) {
+        for (const child of value) {
+            const found = findResponseText(child, key);
+            if (found)
+                return found;
+        }
+        return '';
+    }
+    const record = value;
+    const direct = normalizedText(record[key]);
+    if (direct)
+        return direct;
+    for (const child of Object.values(record)) {
+        const found = findResponseText(child, key);
+        if (found)
+            return found;
+    }
+    return '';
+}
 function normalizedText(value) {
     return typeof value === 'string' ? value.trim() : '';
 }

package/dist/node-runtime-client.d.ts

@@ -9,7 +9,7 @@ import { type IndividualOrganizationConfirmOrderInput, type IndividualOrganizati
 import { type EnsureFamilyOrganizationRegistrationInput } from './family-organization-registration.js';
 import { type FamilyOrganizationSearchInput } from './family-organization-search.js';
 import { type SmartTokenRequestInput } from './smart-token.js';
-import { type EmployeeDeviceActivationRequestInput, type EmployeeDeviceActivationResult, type EmployeeDeviceRevocationInput } from './device-activation.js';
+import { type EmployeeDeviceActivationRequestInput, type EmployeeDeviceActivationResult, type EmployeeDeviceOtpRecoveryInput, type EmployeeDeviceOtpRecoveryResult, type EmployeeDeviceRevocationInput } from './device-activation.js';
 import { type OrganizationLicenseOrderConfirmInput } from './organization-license-order.js';
 import { type IndividualOrganizationBootstrapInput, type IndividualOrganizationStartResult } from './individual-start.js';
 import { type CommunicationIngestionInput, type BlockchainArtifactRegistrationInput, type VitalSignBatchCommunicationFromSearchResponseInput, type CommunicationParticipantRuntimeSearchInput, type ClinicalBundleSearchInput, type ClinicalSectionUpdateInput, type ClinicalSummaryReadResult, type ClinicalSummaryRequestInput, type ClinicalSummaryUpdateInput, type GrantProfessionalAccessInput, type GrantProfessionalAccessResult, type DigitalTwinSecondaryUseConsentInput, type DigitalTwinSecondaryUseConsentResult, type DigitalTwinSubjectLinkPurgeInput, type DigitalTwinSubjectLinkPurgeResult, type IndividualMemberLifecycleInput, type IndividualMemberLicenseAddInput, type IndividualMemberLicenseInvitationInput, type IndividualMemberLicenseTransitionInput, type LicenseListRuntimeSearchInput, type LicenseOfferRuntimeSearchInput, type LicenseOrderRuntimeSearchInput, type OrganizationEmployeeCreationInput, type OrganizationEmployeeLicenseAddInput, type OrganizationEmployeeLicenseOfferInput, type OrganizationEmployeeLicenseInvitationInput, type OrganizationEmployeeLifecycleInput, type OrganizationEmployeeSearchInput, type ProfessionalAccessRequestInput, type ProfessionalAccessRequestResult, type RevokeProfessionalAccessInput, type RevokeProfessionalAccessResult, type RelatedPersonUpsertInput } from './resource-operations.js';
@@ -465,6 +465,8 @@ export declare class HttpRuntimeClient implements NodeRuntimeClient {
      * The implementation is actor-neutral and shares the profile-device flow.
      */
     activateEmployeeDeviceWithActivationRequest(input: EmployeeDeviceActivationRequestInput): Promise<EmployeeDeviceActivationResult>;
+    /** Obtains a replacement activation credential after fresh OTP verification. */
+    recoverEmployeeDeviceWithOtp(input: EmployeeDeviceOtpRecoveryInput & Partial<RouteContext>): Promise<EmployeeDeviceOtpRecoveryResult>;
     /**
      * Creates or updates a `RelatedPerson` for non-employee family/caregiver
      * roles such as a grandfather, guardian, or external caregiver.

package/dist/node-runtime-client.js

@@ -6,7 +6,7 @@ import { confirmIndividualOrganizationOrderWithDeps, } from './individual-onboar
 import { ensureFamilyOrganizationRegistrationWithDeps, } from './family-organization-registration.js';
 import { searchFamilyOrganizationWithDeps } from './family-organization-search.js';
 import { requestSmartTokenWithDeps } from './smart-token.js';
-import { activateEmployeeDeviceWithActivationCodeWithDeps, activateEmployeeDeviceWithActivationRequestWithDeps, revokeEmployeeDeviceWithDeps, } from './device-activation.js';
+import { activateEmployeeDeviceWithActivationCodeWithDeps, activateEmployeeDeviceWithActivationRequestWithDeps, recoverEmployeeDeviceWithOtpWithDeps, revokeEmployeeDeviceWithDeps, } from './device-activation.js';
 import { extractOfferIdFromResponseBody, extractOfferPreviewFromResponseBody, } from './order-offer-summary.js';
 import { confirmOrganizationLicenseOrderWithDeps } from './organization-license-order.js';
 import { startIndividualOrganizationWithDeps } from './individual-start.js';
@@ -909,6 +909,17 @@ export class HttpRuntimeClient {
     async activateEmployeeDeviceWithActivationRequest(input) {
         return this.activateProfileDeviceWithActivationRequest(input);
     }
+    /** Obtains a replacement activation credential after fresh OTP verification. */
+    async recoverEmployeeDeviceWithOtp(input) {
+        const routeCtx = this.paths.routeCtxFromInput(input);
+        return recoverEmployeeDeviceWithOtpWithDeps({
+            routeCtx,
+            input,
+            identityEmployeeRecoveryPath: this.paths.identityEmployeeRecoveryPath.bind(this.paths),
+            identityEmployeeRecoveryPollPath: this.paths.identityEmployeeRecoveryPollPath.bind(this.paths),
+            submitAndPollWithBearerToken: this.submitAndPollWithBearerToken.bind(this),
+        });
+    }
     /**
      * Creates or updates a `RelatedPerson` for non-employee family/caregiver
      * roles such as a grandfather, guardian, or external caregiver.

package/dist/runtime-client-paths.d.ts

@@ -109,6 +109,8 @@ export declare class RuntimeClientPaths {
     digitalTwinCommunicationPollPath(ctx: RouteContext, format: string): string;
     identityTokenExchangePath(ctx: RouteContext): string;
     identityTokenExchangePollPath(ctx: RouteContext): string;
+    identityEmployeeRecoveryPath(ctx: RouteContext): string;
+    identityEmployeeRecoveryPollPath(ctx: RouteContext): string;
     identityDeviceDcrPath(ctx: RouteContext): string;
     identityDeviceDcrPollPath(ctx: RouteContext): string;
     identityDeviceRevokePath(ctx: RouteContext): string;

package/dist/runtime-client-paths.js

@@ -1,6 +1,6 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
 import { GwCoreLifecycleAction } from './constants/lifecycle.js';
-import { buildHostRegistryPath, buildIdentityDeviceDcrPath, buildIdentityDeviceDcrPollPath, buildIdentityDeviceRevokePath, buildIdentityDeviceRevokePollPath, buildIdentityLicenseIssuePath, buildIdentityLicenseIssuePollPath, buildIdentityOpenIdSmartTokenPath, buildIdentityOpenIdSmartTokenPollPath, buildIdentityTokenExchangePath, buildIdentityTokenExchangePollPath, buildOrganizationDidBindingPath, buildOrganizationDidBindingPollPath, buildV1Path, } from './runtime-paths.js';
+import { buildHostRegistryPath, buildIdentityDeviceDcrPath, buildIdentityDeviceDcrPollPath, buildIdentityDeviceRevokePath, buildIdentityDeviceRevokePollPath, buildIdentityEmployeeRecoveryPath, buildIdentityEmployeeRecoveryPollPath, buildIdentityLicenseIssuePath, buildIdentityLicenseIssuePollPath, buildIdentityOpenIdSmartTokenPath, buildIdentityOpenIdSmartTokenPollPath, buildIdentityTokenExchangePath, buildIdentityTokenExchangePollPath, buildOrganizationDidBindingPath, buildOrganizationDidBindingPollPath, buildV1Path, } from './runtime-paths.js';
 import { requireHostRouteContext, requireRouteContext, routeCtxFromInput, } from './runtime-route-context.js';
 export class RuntimeClientPaths {
     constructor(defaultCtx) {
@@ -123,6 +123,8 @@ export class RuntimeClientPaths {
     digitalTwinCommunicationPollPath(ctx, format) { return this.v1Path(ctx, 'digitaltwin', format, 'Communication', '_batch-response'); }
     identityTokenExchangePath(ctx) { return buildIdentityTokenExchangePath(ctx); }
     identityTokenExchangePollPath(ctx) { return buildIdentityTokenExchangePollPath(ctx); }
+    identityEmployeeRecoveryPath(ctx) { return buildIdentityEmployeeRecoveryPath(ctx); }
+    identityEmployeeRecoveryPollPath(ctx) { return buildIdentityEmployeeRecoveryPollPath(ctx); }
     identityDeviceDcrPath(ctx) { return buildIdentityDeviceDcrPath(ctx); }
     identityDeviceDcrPollPath(ctx) { return buildIdentityDeviceDcrPollPath(ctx); }
     identityDeviceRevokePath(ctx) { return buildIdentityDeviceRevokePath(ctx); }

package/dist/runtime-paths.d.ts

@@ -6,6 +6,10 @@ export declare function buildOrganizationDidBindingPath(routeCtx: RouteContext):
 export declare function buildOrganizationDidBindingPollPath(routeCtx: RouteContext): string;
 export declare function buildIdentityTokenExchangePath(ctx: RouteContext): string;
 export declare function buildIdentityTokenExchangePollPath(ctx: RouteContext): string;
+/** Fresh OTP-assisted replacement credential for one existing installation. */
+export declare function buildIdentityEmployeeRecoveryPath(ctx: RouteContext): string;
+/** Poll endpoint paired with employee wallet recovery. */
+export declare function buildIdentityEmployeeRecoveryPollPath(ctx: RouteContext): string;
 export declare function buildIdentityDeviceDcrPath(ctx: RouteContext): string;
 export declare function buildIdentityDeviceDcrPollPath(ctx: RouteContext): string;
 /** Canonical controller operation that reserves an employee seat activation credential. */

package/dist/runtime-paths.js

@@ -28,6 +28,14 @@ export function buildIdentityTokenExchangePath(ctx) {
 export function buildIdentityTokenExchangePollPath(ctx) {
     return buildIdentityAuthPath(ctx, IdentityAuthActions.ExchangeResponse);
 }
+/** Fresh OTP-assisted replacement credential for one existing installation. */
+export function buildIdentityEmployeeRecoveryPath(ctx) {
+    return buildIdentityAuthPath(ctx, '_recover');
+}
+/** Poll endpoint paired with employee wallet recovery. */
+export function buildIdentityEmployeeRecoveryPollPath(ctx) {
+    return buildIdentityAuthPath(ctx, '_recover-response');
+}
 export function buildIdentityDeviceDcrPath(ctx) {
     return buildIdentityAuthPath(ctx, IdentityAuthActions.Dcr);
 }

package/dist/server-profile-session.d.ts

@@ -45,6 +45,7 @@ export type ServerProfileSessionRecord = Readonly<{
     subjectDid: string;
     scopes: string[];
     sealedUnlockedWalletSeed: string;
+    sealedUnlockedVpToken?: string;
     sealedAccessToken: string;
     expiresAt: string;
 }>;
@@ -56,7 +57,18 @@ export type ServerProfileStore = Readonly<{
     getSession(sessionId: string): Promise<ServerProfileSessionRecord | undefined>;
     putSession(session: ServerProfileSessionRecord): Promise<void>;
     deleteSession(sessionId: string): Promise<void>;
+    /** Required by key rotation so no session can retain the superseded seed. */
+    deleteSessionsForProfile?(profileId: string): Promise<void>;
 }>;
+export type ServerEmployeeProfileOtpRotationInput = Readonly<{
+    ownerId: string;
+    profileId: string;
+    idToken: string;
+    newPin: string;
+    redirectUris: string[];
+    clientName: string;
+}>;
+export type ServerEmployeeProfileOtpRotationResult = ServerProfileRecord;
 export type ServerProfileEnrollmentInput = Readonly<{
     /** Stable confidential id of the authenticated portal account that owns and lists this profile. */
     ownerId: string;
@@ -221,6 +233,13 @@ export declare class ServerProfileSessionManager {
     private readonly options;
     constructor(options: ServerProfileSessionManagerOptions);
     enroll(input: ServerProfileEnrollmentInput): Promise<ServerProfileRecord>;
+    /**
+     * Rotates an employee wallet after a fresh OTP-authenticated GW recovery.
+     * The old PIN and seed are never opened: DCR replaces the installation with
+     * newly generated keys, all old BFF sessions are removed, and the new wallet
+     * is opened once with the new PIN.
+     */
+    rotateEmployeeProfileWithOtp(input: ServerEmployeeProfileOtpRotationInput): Promise<ServerEmployeeProfileOtpRotationResult>;
     /**
      * Derives only the public enrollment descriptors for a server-governed
      * recovery seed. This is intended for pre-DCR controller binding requests;
@@ -249,6 +268,12 @@ export declare class ServerProfileSessionManager {
     submitLegalOrganizationIssueWithBootstrapWallet(input: ServerProfileOrganizationIssueInput): Promise<SubmitAndPollResult>;
     listProfiles(ownerId: string): Promise<ServerProfileRecord[]>;
     unlock(input: ServerProfileUnlockInput): Promise<ResolvedServerProfileSession>;
+    /**
+     * Renews the short SMART bearer while retaining the already-open server
+     * wallet session. The caller must supply a fresh authenticated account
+     * token; neither the PIN nor wallet keys return to the browser.
+     */
+    refreshSession(ownerId: string, sessionId: string, idToken: string): Promise<ResolvedServerProfileSession>;
     resolveSession(ownerId: string, sessionId: string): Promise<ResolvedServerProfileSession>;
     lock(ownerId: string, sessionId: string): Promise<void>;
     private createClient;

package/dist/server-profile-session.js

@@ -100,6 +100,53 @@ export class ServerProfileSessionManager {
         await this.options.store.putProfile(record);
         return record;
     }
+    /**
+     * Rotates an employee wallet after a fresh OTP-authenticated GW recovery.
+     * The old PIN and seed are never opened: DCR replaces the installation with
+     * newly generated keys, all old BFF sessions are removed, and the new wallet
+     * is opened once with the new PIN.
+     */
+    async rotateEmployeeProfileWithOtp(input) {
+        const previous = await this.requireOwnedProfile(input.ownerId, input.profileId);
+        if (previous.actorKind !== ActorKinds.OrganizationEmployee || previous.actorMode !== 'member') {
+            throw new Error('OTP wallet rotation is restricted to organization employee profiles.');
+        }
+        const clientInstanceId = String(previous.clientInstanceId || '').trim();
+        if (!clientInstanceId)
+            throw new Error('Employee profile has no registered installation id.');
+        if (!this.options.store.deleteSessionsForProfile) {
+            throw new Error('Employee wallet rotation requires profile-session invalidation support.');
+        }
+        const client = this.createClient(previous.routeContext, input.idToken);
+        const replacement = await client.recoverEmployeeDeviceWithOtp({
+            ...previous.routeContext,
+            idToken: input.idToken,
+            clientInstanceId,
+        });
+        const profile = await this.enroll({
+            ownerId: previous.ownerId,
+            profileId: previous.profileId,
+            actorKind: previous.actorKind,
+            actorMode: previous.actorMode,
+            actorDid: previous.actorDid,
+            profileDid: previous.profileDid,
+            providerDid: previous.providerDid,
+            routeContext: previous.routeContext,
+            allowedSubjectDids: previous.allowedSubjectDids,
+            pin: input.newPin,
+            idToken: input.idToken,
+            activationCode: replacement.activationCode,
+            clientInstanceId,
+            redirectUris: input.redirectUris,
+            clientName: input.clientName,
+            professionalProof: {
+                role: replacement.employeeRole,
+                sameAs: replacement.employeeActorIdentifier,
+            },
+        });
+        await this.options.store.deleteSessionsForProfile(profile.profileId);
+        return profile;
+    }
     /**
      * Derives only the public enrollment descriptors for a server-governed
      * recovery seed. This is intended for pre-DCR controller binding requests;
@@ -269,11 +316,69 @@ export class ServerProfileSessionManager {
             subjectDid: input.subjectDid,
             scopes: unique(input.scopes),
             sealedUnlockedWalletSeed: await this.options.sealer.seal(seed, `${sessionId}:unlocked-wallet-seed`),
+            ...(vpToken ? {
+                sealedUnlockedVpToken: await this.options.sealer.seal(vpToken, `${sessionId}:unlocked-vp-token`),
+            } : {}),
             sealedAccessToken: await this.options.sealer.seal(token.accessToken, `${sessionId}:access-token`),
             expiresAt: expiresAt.toISOString(),
         });
         return this.resolveSession(input.ownerId, sessionId);
     }
+    /**
+     * Renews the short SMART bearer while retaining the already-open server
+     * wallet session. The caller must supply a fresh authenticated account
+     * token; neither the PIN nor wallet keys return to the browser.
+     */
+    async refreshSession(ownerId, sessionId, idToken) {
+        const session = await this.options.store.getSession(sessionId);
+        if (!session || session.ownerId !== ownerId)
+            throw new Error('Profile session not found.');
+        if (new Date(session.expiresAt) <= this.now()) {
+            await this.options.store.deleteSession(sessionId);
+            throw new Error('Profile session expired.');
+        }
+        const normalizedIdToken = String(idToken || '').trim();
+        if (!normalizedIdToken)
+            throw new Error('Profile session refresh requires idToken.');
+        const profile = await this.requireOwnedProfile(ownerId, session.profileId);
+        this.requireSubject(profile, session.subjectDid);
+        const seed = await this.options.sealer.unseal(session.sealedUnlockedWalletSeed, `${sessionId}:unlocked-wallet-seed`);
+        const vpToken = session.sealedUnlockedVpToken
+            ? await this.options.sealer.unseal(session.sealedUnlockedVpToken, `${sessionId}:unlocked-vp-token`)
+            : undefined;
+        const walletKeyDerivationId = profile.walletKeyDerivationId || profile.profileId;
+        const wallet = await this.createWallet(walletKeyDerivationId, seed);
+        const now = this.now();
+        const smartTokenEndpoint = [
+            this.options.gatewayBaseUrl.replace(/\/+$/, ''),
+            buildIdentityOpenIdSmartTokenPath(profile.routeContext),
+        ].join('');
+        const assertion = await buildWalletClientAssertion(wallet, profile, smartTokenEndpoint, now);
+        const token = await this.createClient(profile.routeContext, normalizedIdToken).requestSmartToken({
+            ...profile.routeContext,
+            actorDid: profile.actorDid,
+            subjectDid: session.subjectDid,
+            clientId: profile.clientId,
+            issuer: profile.clientId,
+            audience: smartTokenEndpoint,
+            idToken: normalizedIdToken,
+            vpToken,
+            vpTokenFallback: vpToken ? undefined : 'omit',
+            clientAssertion: assertion,
+            clientAssertionType: 'private_key_jwt',
+            smartTokenKind: 'openid-smart',
+            acrValues: profileSmartAcrValues(profile.actorKind),
+            scopes: unique(session.scopes),
+            tokenCacheKey: `profile-refresh:${sessionId}:${now.getTime()}`,
+        });
+        if (token.status !== 'fetched' || !token.accessToken)
+            throw new Error('SMART token refresh failed.');
+        await this.options.store.putSession({
+            ...session,
+            sealedAccessToken: await this.options.sealer.seal(token.accessToken, `${sessionId}:access-token`),
+        });
+        return this.resolveSession(ownerId, sessionId);
+    }
     async resolveSession(ownerId, sessionId) {
         const session = await this.options.store.getSession(sessionId);
         if (!session || session.ownerId !== ownerId)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-sdk-node-ts",
-  "version": "2.4.36",
+  "version": "2.4.37",
   "description": "Next-generation Node runtime package for the GDC SDK family",
   "license": "Apache-2.0",
   "author": "Antifraud Services Inc.",