gdc-sdk-node-ts 2.6.5 → 2.6.7

package/README.md

@@ -699,7 +699,9 @@ modules below.
 - draft/outbox helpers
 - document facade helpers
 - `cloneImportedClinicalDocumentForDemo(...)` for an explicit editable demo
-  copy owned by an authenticated profile `actorDid`
+  copy owned by an authenticated profile `actorDid`; direct summary updates
+  use that same value as `sender` and the real hosted provider-tenant DID as
+  `recipient`, never a portal alias
 - vital-sign helpers
 
 ### Node runtime client

package/dist/authorized-subject-directory.js

@@ -34,11 +34,11 @@ export async function listAuthorizedIndividualSubjectsWithDeps(routeContext, inp
             data: [{
                     type: 'Family-search-v1.0',
                     request: { method: 'POST' },
-                    meta: { claims: {
-                            '@context': SCHEMA_CONTEXT,
-                            ...(email ? { [CLAIM_ORGANIZATION_OWNER_EMAIL]: email } : {}),
-                            ...(telephone ? { [CLAIM_ORGANIZATION_OWNER_TELEPHONE]: telephone } : {}),
-                        } },
+                    resource: { meta: { claims: {
+                                '@context': SCHEMA_CONTEXT,
+                                ...(email ? { [CLAIM_ORGANIZATION_OWNER_EMAIL]: email } : {}),
+                                ...(telephone ? { [CLAIM_ORGANIZATION_OWNER_TELEPHONE]: telephone } : {}),
+                            } } },
                 }],
         },
     }, input.pollOptions);
@@ -58,7 +58,7 @@ export async function listAuthorizedIndividualSubjectsWithDeps(routeContext, inp
             type: 'batch',
             data: [{
                     request: { method: 'POST' },
-                    meta: { status: 'active', claims: licenseClaims },
+                    resource: { meta: { status: 'active', claims: licenseClaims } },
                 }],
         },
     }, input.pollOptions);
@@ -76,7 +76,7 @@ export async function listAuthorizedIndividualSubjectsWithDeps(routeContext, inp
                 data: [{
                         type: 'Family-search-v1.0',
                         request: { method: 'POST' },
-                        meta: { claims: organizationClaims },
+                        resource: { meta: { claims: organizationClaims } },
                     }],
             },
         }, input.pollOptions);
@@ -155,7 +155,7 @@ function readAcceptedLicenses(result) {
 }
 function readFirstClaims(result) {
     const entry = readData(result)[0];
-    const claims = entry?.meta?.claims || entry?.resource?.meta?.claims;
+    const claims = entry?.resource?.meta?.claims || entry?.meta?.claims;
     return claims && typeof claims === 'object' ? claims : {};
 }
 function readData(result) {

package/dist/backend-profile-runtime.d.ts

@@ -50,16 +50,19 @@ export type BackendLoadedActorProfile = LoadedActorProfile & {
 };
 export type BackendIndividualControllerProfile = {
     profile: BackendLoadedActorProfile;
+    /** Loaded actor session; its `actorDid` is the operational DID to use as a direct clinical sender. */
     session: ActorSession;
     sdk: IndividualControllerSdk;
 };
 export type BackendPersonalProfile = {
     profile: BackendLoadedActorProfile;
+    /** Loaded actor session; its `actorDid` is the operational DID to use as a direct clinical sender. */
     session: ActorSession;
     sdk: PersonalSdk;
 };
 export type BackendIndividualMemberProfile = {
     profile: BackendLoadedActorProfile;
+    /** Loaded caregiver/member session; its `actorDid` is the operational DID for that relationship role. */
     session: ActorSession;
     sdk: IndividualMemberSdk;
 };
@@ -70,6 +73,7 @@ export type BackendOrganizationControllerProfile = {
 };
 export type BackendProfessionalProfile = {
     profile: BackendLoadedActorProfile;
+    /** Loaded professional session; its `actorDid` is the operational professional DID. */
     session: ActorSession;
     sdk: ProfessionalSdk;
 };

package/dist/digital-twin.js

@@ -234,12 +234,13 @@ export async function searchDigitalTwinsWithDeps(ctx, input, deps) {
         ? {
             data: [{
                     type: `${resourceType}-search-request-v1.0`,
-                    resource: { resourceType: 'Parameters', parameter: parameters },
-                    meta: {
-                        claims: Object.fromEntries([
-                            ['@context', format],
-                            ...parameters.map((parameter) => [parameter.name, parameter.valueString || parameter.valueDate || '']),
-                        ]),
+                    resource: {
+                        resourceType: 'Parameters',
+                        parameter: parameters,
+                        meta: { claims: Object.fromEntries([
+                                ['@context', format],
+                                ...parameters.map((parameter) => [parameter.name, parameter.valueString || parameter.valueDate || '']),
+                            ]) },
                     },
                 }],
         }

package/dist/family-organization-search.js

@@ -35,7 +35,6 @@ export async function searchFamilyOrganizationWithDeps(deps) {
         body: {
             data: [{
                     type: 'Family-search-v1.0',
-                    meta: { claims },
                     resource: { meta: { claims } },
                 }],
         },

package/dist/individual-onboarding.js

@@ -27,7 +27,6 @@ export async function confirmIndividualOrganizationOrderWithDeps(deps) {
         body: {
             data: [{
                     type: 'Family-order-request-v1.0',
-                    meta: { claims: orderClaims },
                     resource: { meta: { claims: orderClaims } },
                 }],
         },

package/dist/individual-start.js

@@ -54,7 +54,6 @@ export async function startIndividualOrganizationWithDeps(deps) {
         body: {
             data: [{
                     type: GwCoreLifecycleRequestType.IndividualOrganizationRegistration,
-                    meta: { claims },
                     resource: { meta: { claims } },
                 }],
         },

package/dist/node-runtime-client.d.ts

@@ -523,6 +523,9 @@ export declare class HttpRuntimeClient implements NodeRuntimeClient {
      *
      * The attached payload must be `Bundle.type=document` with `Composition` in
      * `entry[0]`; its `section[].entry[]` references delimit the updated data.
+     * Direct callers pass the authenticated profile `actorDid` as `sender` and
+     * the real hosted provider-tenant DID as `recipient`. A stable multibase URN
+     * or portal DID/alias is never the authenticated clinical actor.
      */
     updateClinicalSummary(ctx: RouteContext, input: ClinicalSummaryUpdateInput): Promise<SubmitAndPollResult>;
     /**

package/dist/node-runtime-client.js

@@ -1020,6 +1020,9 @@ export class HttpRuntimeClient {
      *
      * The attached payload must be `Bundle.type=document` with `Composition` in
      * `entry[0]`; its `section[].entry[]` references delimit the updated data.
+     * Direct callers pass the authenticated profile `actorDid` as `sender` and
+     * the real hosted provider-tenant DID as `recipient`. A stable multibase URN
+     * or portal DID/alias is never the authenticated clinical actor.
      */
     async updateClinicalSummary(ctx, input) {
         return this.ingestCommunicationAndUpdateIndex(ctx, buildClinicalSummaryUpdateIngestion(input));

package/dist/orchestration/individual-controller-sdk.d.ts

@@ -107,7 +107,11 @@ export declare class IndividualControllerSdk {
      * DELETE entries contain no resource body.
      */
     updateClinicalSection(ctx: RouteContext, input: ClinicalSectionUpdateInput): Promise<SubmitAndPollResult>;
-    /** Updates the multi-section summary through a Composition-first document. */
+    /**
+     * Updates the multi-section summary through a Composition-first document.
+     * On a direct call, use the authenticated profile `actorDid` as `sender` and
+     * the real hosted provider-tenant DID as `recipient`.
+     */
     updateClinicalSummary(ctx: RouteContext, input: ClinicalSummaryUpdateInput): Promise<SubmitAndPollResult>;
     /**
      * Reads the subject's available clinical document through

package/dist/orchestration/individual-controller-sdk.js

@@ -158,7 +158,11 @@ export class IndividualControllerSdk {
         assertFacadeCapability(this.capabilities, ActorCapabilities.IndividualIngestCommunication, ActorKinds.IndividualController, 'updateClinicalSection');
         return requireClientMethod(this.client, 'updateClinicalSection')(ctx, input);
     }
-    /** Updates the multi-section summary through a Composition-first document. */
+    /**
+     * Updates the multi-section summary through a Composition-first document.
+     * On a direct call, use the authenticated profile `actorDid` as `sender` and
+     * the real hosted provider-tenant DID as `recipient`.
+     */
     updateClinicalSummary(ctx, input) {
         assertFacadeCapability(this.capabilities, ActorCapabilities.IndividualIngestCommunication, ActorKinds.IndividualController, 'updateClinicalSummary');
         return requireClientMethod(this.client, 'updateClinicalSummary')(ctx, input);

package/dist/organization-controller-recovery.js

@@ -68,7 +68,10 @@ export const recoverOrganizationControllerWithIssueWithDeps = recoverOrganizatio
 export function readLegalOrganizationCredentialReissuanceActivationCode(result) {
     const pollBody = (result?.poll?.body || {});
     for (const candidate of nestedObjects(pollBody)) {
-        const claims = candidate.meta?.claims;
+        const resource = candidate.resource;
+        const resourceClaims = resource?.meta?.claims;
+        const legacyClaims = candidate.meta?.claims;
+        const claims = resourceClaims || legacyClaims;
         const activationCode = String(claims?.['org.schema.IndividualProduct.serialNumber'] || '').trim();
         if (activationCode)
             return activationCode;

package/dist/organization-employee-lifecycle.js

@@ -84,8 +84,10 @@ export function readEmployeeLicenseOfferId(value) {
     for (const candidate of nestedRecords(value)) {
         if (candidate.type !== 'Employee-license-offer-v1.0')
             continue;
-        const meta = record(candidate.meta);
-        const claims = record(meta?.claims);
+        const resource = record(candidate.resource);
+        const resourceMeta = record(resource?.meta);
+        const legacyMeta = record(candidate.meta);
+        const claims = record(resourceMeta?.claims) || record(legacyMeta?.claims);
         const offerId = String(claims?.[ClaimsOfferSchemaorg.identifier] || '').trim();
         if (offerId)
             return offerId;

package/dist/organization-license-order.js

@@ -27,7 +27,6 @@ export async function confirmOrganizationLicenseOrderWithDeps(deps) {
         body: {
             data: [{
                     type: deps.input.dataType || 'Organization-order-request-v1.0',
-                    meta: { claims },
                     resource: { meta: { claims } },
                 }],
         },

package/dist/resource-operations.d.ts

@@ -314,7 +314,14 @@ type ClinicalUpdateRuntimeOptions = Readonly<{
  * controller cannot subsequently update or delete that source-authored fact.
  */
 export type ClinicalSectionUpdateInput = ClinicalSectionUpdateCommunicationInput & ClinicalUpdateRuntimeOptions;
-/** Updates one complete multi-section clinical summary document. */
+/**
+ * Updates one complete multi-section clinical summary document.
+ *
+ * For the direct call, `sender` is the authenticated profile's operational
+ * `actorDid`, and `recipient` is the real provider-tenant DID inside the host
+ * that accommodates it. Neither value is a portal alias. When the document is
+ * an editable demo clone, its `Composition.author` is that same `actorDid`.
+ */
 export type ClinicalSummaryUpdateInput = ClinicalUpdateCommunicationInput & ClinicalUpdateRuntimeOptions;
 export declare function buildClinicalSectionUpdateIngestion(input: ClinicalSectionUpdateInput): CommunicationIngestionInput;
 export declare function buildClinicalSummaryUpdateIngestion(input: ClinicalSummaryUpdateInput): CommunicationIngestionInput;

package/dist/resource-operations.js

@@ -340,11 +340,11 @@ export async function transitionIndividualMemberLicenseWithDeps(routeCtx, action
                         ...(input.ownerOrganizationId ? { ownerOrganizationId: input.ownerOrganizationId } : {}),
                         ...(input.subjectId ? { subjectId: input.subjectId } : {}),
                         ...(input.verifiedActorIdentifier ? { verifiedActorIdentifier: input.verifiedActorIdentifier } : {}),
-                        claims: {
-                            '@context': 'org.schema',
-                            'org.schema.IndividualProduct.serialNumber': input.activationCode,
-                        },
                     },
+                    resource: { meta: { claims: {
+                                '@context': 'org.schema',
+                                'org.schema.IndividualProduct.serialNumber': input.activationCode,
+                            } } },
                     request: { method: 'POST' },
                 }],
         },
@@ -414,7 +414,6 @@ export async function disableIndividualMemberWithDeps(routeCtx, input, options,
             type: 'batch',
             entry: [{
                     request: { method: GwCoreLifecycleRequestMethod.Post },
-                    meta: { claims },
                     resource: {
                         ...resource,
                         ...(input.resourceId ? { id: input.resourceId } : {}),
@@ -444,7 +443,6 @@ export async function purgeIndividualMemberWithDeps(routeCtx, input, options, de
             entry: [{
                     type: input.dataType || GwCoreLifecycleRequestType.IndividualMemberPurge,
                     request: { method: GwCoreLifecycleRequestMethod.Post },
-                    meta: { claims },
                     resource: {
                         ...resource,
                         ...(input.resourceId ? { id: input.resourceId } : {}),
@@ -550,7 +548,6 @@ export async function requestProfessionalAccessWithDeps(routeCtx, input, deps) {
             type: 'batch',
             data: [{
                     type: 'CommMsgExtended',
-                    meta: { claims: communicationClaims },
                     resource: communicationResource,
                 }],
         },
@@ -701,7 +698,6 @@ export function buildBlockchainArtifactBundleFromSearchResponse(input) {
         });
         return {
             type: 'DocumentReference',
-            meta: { claims: artifact.documentReference.meta?.claims || {} },
             resource: artifact.documentReference,
             request: {
                 method: 'POST',
@@ -762,7 +758,6 @@ export async function registerBlockchainArtifactAndUpdateIndexWithDeps(routeCtx,
             type: 'batch',
             data: [{
                     type: 'DocumentReference',
-                    meta: { claims: artifact.documentReference.meta?.claims || {} },
                     resource: artifact.documentReference,
                     request: {
                         method: 'POST',
@@ -840,7 +835,6 @@ export async function grantProfessionalAccessWithDeps(routeCtx, input, deps) {
         body: {
             data: [{
                     type: input.dataType || 'Consent-grant-request-v1.0',
-                    meta: { claims: built.consentClaims },
                     resource: { resourceType: 'Consent', meta: { claims: built.consentClaims } },
                 }],
         },
@@ -983,7 +977,6 @@ export async function revokeProfessionalAccessWithDeps(routeCtx, input, deps) {
         body: {
             data: [{
                     type: input.dataType || 'Consent-grant-request-v1.0',
-                    meta: { claims: revokedClaims },
                     resource: { resourceType: 'Consent', meta: { claims: revokedClaims } },
                 }],
         },

package/dist/runtime-host-submission.js

@@ -65,13 +65,6 @@ export async function activateOrganizationInGatewayFromIcaProofWithDeps(input) {
             ...(input.activationInput.controller ? { controller: input.activationInput.controller } : {}),
             data: [{
                     type: 'Organization-activation-request-v1.0',
-                    meta: {
-                        claims: {
-                            '@context': 'org.schema',
-                            ...serviceClaims,
-                            ...(input.activationInput.additionalClaims || {}),
-                        },
-                    },
                     resource: {
                         meta: {
                             claims: {

package/dist/runtime-paths.js

@@ -1,6 +1,7 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
 import { buildGwCoreTenantResourceActionPath } from 'gdc-common-utils-ts/utils/gw-core-path';
-import { IdentityAuthActions, IdentityAuthRouteSegments } from 'gdc-common-utils-ts/constants/identity-auth';
+import { IdentityAuthActions, IdentityAuthResourceTypes, IdentityAuthRouteSegments, SmartPostDcrActions, } from 'gdc-common-utils-ts/constants/identity-auth';
+import { GatewayRouteFormats, GatewayRouteSections, } from 'gdc-common-utils-ts/constants/gateway-response';
 export function buildV1Path(routeCtx, section, format, resourceType, action) {
     return buildGwCoreTenantResourceActionPath({
         tenantId: routeCtx.tenantId,
@@ -60,8 +61,8 @@ function buildIdentityAuthPath(ctx, action) {
     return `/${encodeURIComponent(IdentityAuthRouteSegments.Host)}/cds-${encodeURIComponent(ctx.jurisdiction)}/${IdentityAuthRouteSegments.Version}/${encodeURIComponent(ctx.sector)}/${encodeURIComponent(ctx.tenantId)}/${IdentityAuthRouteSegments.Section}/${IdentityAuthRouteSegments.Format}/${encodeURIComponent(action)}`;
 }
 export function buildIdentityOpenIdSmartTokenPath(ctx) {
-    return `/${encodeURIComponent(ctx.tenantId)}/cds-${encodeURIComponent(ctx.jurisdiction)}/v1/${encodeURIComponent(ctx.sector)}/identity/openid/smart/token`;
+    return buildV1Path(ctx, GatewayRouteSections.Identity, GatewayRouteFormats.OpenId, IdentityAuthResourceTypes.Smart, SmartPostDcrActions.Token);
 }
 export function buildIdentityOpenIdSmartTokenPollPath(ctx) {
-    return `/${encodeURIComponent(ctx.tenantId)}/cds-${encodeURIComponent(ctx.jurisdiction)}/v1/${encodeURIComponent(ctx.sector)}/identity/openid/smart/_batch-response`;
+    return buildV1Path(ctx, GatewayRouteSections.Identity, GatewayRouteFormats.OpenId, IdentityAuthResourceTypes.Smart, SmartPostDcrActions.TokenResponse);
 }

package/dist/server-profile-session.d.ts

@@ -379,6 +379,7 @@ export declare class ServerProfileSessionManager {
     openProfessional(input: ServerProfessionalOpenInput): Promise<OpenedServerProfessional>;
     lock(ownerId: string, sessionId: string): Promise<void>;
     private createClient;
+    private createRegisteredProfileClient;
     private createWallet;
     /**
      * Upgrade legacy profiles deterministically after successful PIN unlock.

package/dist/server-profile-session.js

@@ -328,12 +328,13 @@ export class ServerProfileSessionManager {
         profile = await this.ensureRequiredStorageProfile(profile, seed);
         const walletKeyDerivationId = profile.walletKeyDerivationId || profile.profileId;
         const wallet = await this.createWallet(walletKeyDerivationId, seed);
+        const context = walletContext(walletKeyDerivationId);
         const smartTokenEndpoint = [
             this.options.gatewayBaseUrl.replace(/\/+$/, ''),
             buildIdentityOpenIdSmartTokenPath(profile.routeContext),
         ].join('');
         const assertion = await buildWalletClientAssertion(wallet, profile, smartTokenEndpoint, now);
-        const token = await this.createClient(profile.routeContext, input.idToken).requestSmartToken({
+        const token = await this.createRegisteredProfileClient(profile, wallet, context, input.idToken).requestSmartToken({
             ...profile.routeContext,
             actorDid: profile.actorDid,
             subjectDid: input.subjectDid,
@@ -394,13 +395,14 @@ export class ServerProfileSessionManager {
             : undefined;
         const walletKeyDerivationId = profile.walletKeyDerivationId || profile.profileId;
         const wallet = await this.createWallet(walletKeyDerivationId, seed);
+        const context = walletContext(walletKeyDerivationId);
         const now = this.now();
         const smartTokenEndpoint = [
             this.options.gatewayBaseUrl.replace(/\/+$/, ''),
             buildIdentityOpenIdSmartTokenPath(profile.routeContext),
         ].join('');
         const assertion = await buildWalletClientAssertion(wallet, profile, smartTokenEndpoint, now);
-        const token = await this.createClient(profile.routeContext, normalizedIdToken).requestSmartToken({
+        const token = await this.createRegisteredProfileClient(profile, wallet, context, normalizedIdToken).requestSmartToken({
             ...profile.routeContext,
             actorDid: profile.actorDid,
             subjectDid: session.subjectDid,
@@ -546,13 +548,11 @@ export class ServerProfileSessionManager {
             transportProfile: TransportProfiles.DidcommEncryptedForm,
             secureTransportAdapter,
         });
-        // SMART/OpenID uses its own JSON/form protocol and must not be wrapped in
-        // the encrypted resource transport selected for later business actions.
-        // Professional business operations are authored by the registered employee
-        // wallet and therefore use the encrypted DIDComm client. SMART/OpenID below
-        // remains an independent JSON/form exchange through its dedicated method.
+        // Both SMART and later business operations are post-DCR profile actions.
+        // Strict GW therefore resolves the same registered employee wallet for the
+        // encrypted request and poll transport used by both facades.
         const sdk = new ProfessionalSdk(operationalClient);
-        const smartSdk = new ProfessionalSdk(this.createClient(profile.routeContext, idToken));
+        const smartSdk = sdk;
         const digitalTwin = new DigitalTwinSdk(operationalClient, profile.actorDid);
         let digitalTwinAccessToken;
         const request = async (smart) => {
@@ -625,6 +625,20 @@ export class ServerProfileSessionManager {
             appInfo: this.options.appInfo,
         });
     }
+    createRegisteredProfileClient(profile, wallet, context, bearerToken) {
+        return new NodeHttpClient({
+            baseUrl: this.options.gatewayBaseUrl,
+            ctx: profile.routeContext,
+            bearerToken,
+            fetchImpl: this.options.fetchImpl,
+            appInfo: this.options.appInfo,
+            transportProfile: TransportProfiles.DidcommEncryptedForm,
+            secureTransportAdapter: {
+                pack: (message) => wallet.packForRecipientWithContext(bindOrganizationControllerTransport(message, profile), profile.providerDid, { context }),
+                unpack: async (jwe) => (await wallet.unpackWithContext(jwe, { context })).content,
+            },
+        });
+    }
     async createWallet(walletKeyDerivationId, seed) {
         const wallet = new NodeManagedWallet({ resolveRecipientJwk: this.options.resolveRecipientJwk });
         const context = walletContext(walletKeyDerivationId);

package/dist/session.d.ts

@@ -34,6 +34,7 @@ export type DemoClinicalDocumentCloneOptions = Readonly<{
  */
 export declare class ActorSession {
     readonly actorKind: ActorKind;
+    /** Operational DID returned with the loaded actor profile, including its role-bearing path. */
     readonly actorDid?: string;
     readonly subjectDid?: string;
     readonly capabilities: NodeCapability[];
@@ -54,7 +55,11 @@ export declare class ActorSession {
     asProfessional(): ProfessionalSdk;
     /** Materializes the digital-twin facade for an organization employee or professional actor. */
     asDigitalTwin(): DigitalTwinSdk;
-    /** Creates an editable demo copy owned by this session's authenticated actor DID. */
+    /**
+     * Creates an editable demo copy whose `Composition.author` is this
+     * authenticated profile's operational `actorDid`. The actor is never taken
+     * from a stable multibase URN or a DID/alias supplied by a portal.
+     */
     cloneImportedClinicalDocumentForDemo(bundle: Record<string, unknown>, options?: DemoClinicalDocumentCloneOptions): Record<string, any>;
     private requireClient;
 }

package/dist/session.js

@@ -70,7 +70,11 @@ export class ActorSession {
         }
         return new DigitalTwinSdk(this.requireClient(), this.actorDid);
     }
-    /** Creates an editable demo copy owned by this session's authenticated actor DID. */
+    /**
+     * Creates an editable demo copy whose `Composition.author` is this
+     * authenticated profile's operational `actorDid`. The actor is never taken
+     * from a stable multibase URN or a DID/alias supplied by a portal.
+     */
     cloneImportedClinicalDocumentForDemo(bundle, options = {}) {
         const actorDid = String(this.actorDid || '').trim();
         if (!actorDid) {

package/dist/smart-token.js

@@ -1,5 +1,7 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
 import { HealthcareConsentPurposes } from 'gdc-common-utils-ts/constants';
+import { IdentityAuthResourceTypes, SmartPostDcrActions, } from 'gdc-common-utils-ts/constants/identity-auth';
+import { GatewayRouteFormats, GatewayRouteSections, } from 'gdc-common-utils-ts/constants/gateway-response';
 import { buildClientAssertionJwt } from 'gdc-common-utils-ts/utils/client-assertion';
 import { resolvePollOptionsFromSeconds } from './poll-options.js';
 /**
@@ -109,16 +111,19 @@ function normalizeResolvedSmartTokenEndpoint(value) {
     if (!['http:', 'https:'].includes(endpoint.protocol)) {
         throw new Error('Resolved SMART token endpoint must use HTTP(S).');
     }
-    if (!endpoint.pathname.endsWith('/identity/openid/smart/token')) {
-        throw new Error('Resolved SMART token endpoint must target /identity/openid/smart/token.');
+    if (!endpoint.pathname.endsWith(smartTokenRouteSuffix(SmartPostDcrActions.Token))) {
+        throw new Error(`Resolved SMART token endpoint must target ${smartTokenRouteSuffix(SmartPostDcrActions.Token)}.`);
     }
     return endpoint.toString();
 }
 function smartTokenPollEndpointFromTokenEndpoint(tokenEndpoint) {
     const endpoint = new URL(tokenEndpoint);
-    endpoint.pathname = endpoint.pathname.replace(/\/identity\/openid\/smart\/token$/, '/identity/openid/smart/_batch-response');
+    endpoint.pathname = `${endpoint.pathname.slice(0, -smartTokenRouteSuffix(SmartPostDcrActions.Token).length)}${smartTokenRouteSuffix(SmartPostDcrActions.TokenResponse)}`;
     return endpoint.toString();
 }
+function smartTokenRouteSuffix(action) {
+    return `/${GatewayRouteSections.Identity}/${GatewayRouteFormats.OpenId}/${IdentityAuthResourceTypes.Smart}/${action}`;
+}
 async function resolveClientAssertion(input) {
     const explicit = String(input.clientAssertion || '').trim();
     if (explicit)
@@ -132,7 +137,10 @@ async function resolveClientAssertion(input) {
     });
 }
 function resolveTokenExchangeResult(exchange, normalizedScopes, tokenCacheKey, setTokenCache) {
-    const exchangeBody = exchange.poll.body ?? {};
+    const pollBody = exchange.poll.body ?? {};
+    // Encrypted DIDComm returns the token in the authenticated message body;
+    // plain compatibility transports may still expose the token at the root.
+    const exchangeBody = pollBody.body || pollBody;
     const accessToken = String(exchangeBody.access_token || '').trim();
     if (exchange.poll.status >= 400 || !accessToken) {
         return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-sdk-node-ts",
-  "version": "2.6.5",
+  "version": "2.6.7",
   "description": "Next-generation Node runtime package for the GDC SDK family",
   "license": "Apache-2.0",
   "author": "Antifraud Services Inc.",
@@ -38,8 +38,8 @@
     "test:e2e:live-gw:clean": "bash ./scripts/run-live-gw-clean.sh"
   },
   "dependencies": {
-    "gdc-common-utils-ts": "2.7.4",
-    "gdc-sdk-core-ts": "2.4.5"
+    "gdc-common-utils-ts": "2.7.8",
+    "gdc-sdk-core-ts": "2.4.9"
   },
   "devDependencies": {
     "@types/node": "^20.14.10",