gdc-sdk-node-ts 2.6.6 → 2.6.7

package/dist/authorized-subject-directory.js

@@ -34,11 +34,11 @@ export async function listAuthorizedIndividualSubjectsWithDeps(routeContext, inp
             data: [{
                     type: 'Family-search-v1.0',
                     request: { method: 'POST' },
-                    meta: { claims: {
-                            '@context': SCHEMA_CONTEXT,
-                            ...(email ? { [CLAIM_ORGANIZATION_OWNER_EMAIL]: email } : {}),
-                            ...(telephone ? { [CLAIM_ORGANIZATION_OWNER_TELEPHONE]: telephone } : {}),
-                        } },
+                    resource: { meta: { claims: {
+                                '@context': SCHEMA_CONTEXT,
+                                ...(email ? { [CLAIM_ORGANIZATION_OWNER_EMAIL]: email } : {}),
+                                ...(telephone ? { [CLAIM_ORGANIZATION_OWNER_TELEPHONE]: telephone } : {}),
+                            } } },
                 }],
         },
     }, input.pollOptions);
@@ -58,7 +58,7 @@ export async function listAuthorizedIndividualSubjectsWithDeps(routeContext, inp
             type: 'batch',
             data: [{
                     request: { method: 'POST' },
-                    meta: { status: 'active', claims: licenseClaims },
+                    resource: { meta: { status: 'active', claims: licenseClaims } },
                 }],
         },
     }, input.pollOptions);
@@ -76,7 +76,7 @@ export async function listAuthorizedIndividualSubjectsWithDeps(routeContext, inp
                 data: [{
                         type: 'Family-search-v1.0',
                         request: { method: 'POST' },
-                        meta: { claims: organizationClaims },
+                        resource: { meta: { claims: organizationClaims } },
                     }],
             },
         }, input.pollOptions);
@@ -155,7 +155,7 @@ function readAcceptedLicenses(result) {
 }
 function readFirstClaims(result) {
     const entry = readData(result)[0];
-    const claims = entry?.meta?.claims || entry?.resource?.meta?.claims;
+    const claims = entry?.resource?.meta?.claims || entry?.meta?.claims;
     return claims && typeof claims === 'object' ? claims : {};
 }
 function readData(result) {

package/dist/digital-twin.js

@@ -234,12 +234,13 @@ export async function searchDigitalTwinsWithDeps(ctx, input, deps) {
         ? {
             data: [{
                     type: `${resourceType}-search-request-v1.0`,
-                    resource: { resourceType: 'Parameters', parameter: parameters },
-                    meta: {
-                        claims: Object.fromEntries([
-                            ['@context', format],
-                            ...parameters.map((parameter) => [parameter.name, parameter.valueString || parameter.valueDate || '']),
-                        ]),
+                    resource: {
+                        resourceType: 'Parameters',
+                        parameter: parameters,
+                        meta: { claims: Object.fromEntries([
+                                ['@context', format],
+                                ...parameters.map((parameter) => [parameter.name, parameter.valueString || parameter.valueDate || '']),
+                            ]) },
                     },
                 }],
         }

package/dist/family-organization-search.js

@@ -35,7 +35,6 @@ export async function searchFamilyOrganizationWithDeps(deps) {
         body: {
             data: [{
                     type: 'Family-search-v1.0',
-                    meta: { claims },
                     resource: { meta: { claims } },
                 }],
         },

package/dist/individual-onboarding.js

@@ -27,7 +27,6 @@ export async function confirmIndividualOrganizationOrderWithDeps(deps) {
         body: {
             data: [{
                     type: 'Family-order-request-v1.0',
-                    meta: { claims: orderClaims },
                     resource: { meta: { claims: orderClaims } },
                 }],
         },

package/dist/individual-start.js

@@ -54,7 +54,6 @@ export async function startIndividualOrganizationWithDeps(deps) {
         body: {
             data: [{
                     type: GwCoreLifecycleRequestType.IndividualOrganizationRegistration,
-                    meta: { claims },
                     resource: { meta: { claims } },
                 }],
         },

package/dist/organization-controller-recovery.js

@@ -68,7 +68,10 @@ export const recoverOrganizationControllerWithIssueWithDeps = recoverOrganizatio
 export function readLegalOrganizationCredentialReissuanceActivationCode(result) {
     const pollBody = (result?.poll?.body || {});
     for (const candidate of nestedObjects(pollBody)) {
-        const claims = candidate.meta?.claims;
+        const resource = candidate.resource;
+        const resourceClaims = resource?.meta?.claims;
+        const legacyClaims = candidate.meta?.claims;
+        const claims = resourceClaims || legacyClaims;
         const activationCode = String(claims?.['org.schema.IndividualProduct.serialNumber'] || '').trim();
         if (activationCode)
             return activationCode;

package/dist/organization-employee-lifecycle.js

@@ -84,8 +84,10 @@ export function readEmployeeLicenseOfferId(value) {
     for (const candidate of nestedRecords(value)) {
         if (candidate.type !== 'Employee-license-offer-v1.0')
             continue;
-        const meta = record(candidate.meta);
-        const claims = record(meta?.claims);
+        const resource = record(candidate.resource);
+        const resourceMeta = record(resource?.meta);
+        const legacyMeta = record(candidate.meta);
+        const claims = record(resourceMeta?.claims) || record(legacyMeta?.claims);
         const offerId = String(claims?.[ClaimsOfferSchemaorg.identifier] || '').trim();
         if (offerId)
             return offerId;

package/dist/organization-license-order.js

@@ -27,7 +27,6 @@ export async function confirmOrganizationLicenseOrderWithDeps(deps) {
         body: {
             data: [{
                     type: deps.input.dataType || 'Organization-order-request-v1.0',
-                    meta: { claims },
                     resource: { meta: { claims } },
                 }],
         },

package/dist/resource-operations.js

@@ -340,11 +340,11 @@ export async function transitionIndividualMemberLicenseWithDeps(routeCtx, action
                         ...(input.ownerOrganizationId ? { ownerOrganizationId: input.ownerOrganizationId } : {}),
                         ...(input.subjectId ? { subjectId: input.subjectId } : {}),
                         ...(input.verifiedActorIdentifier ? { verifiedActorIdentifier: input.verifiedActorIdentifier } : {}),
-                        claims: {
-                            '@context': 'org.schema',
-                            'org.schema.IndividualProduct.serialNumber': input.activationCode,
-                        },
                     },
+                    resource: { meta: { claims: {
+                                '@context': 'org.schema',
+                                'org.schema.IndividualProduct.serialNumber': input.activationCode,
+                            } } },
                     request: { method: 'POST' },
                 }],
         },
@@ -414,7 +414,6 @@ export async function disableIndividualMemberWithDeps(routeCtx, input, options,
             type: 'batch',
             entry: [{
                     request: { method: GwCoreLifecycleRequestMethod.Post },
-                    meta: { claims },
                     resource: {
                         ...resource,
                         ...(input.resourceId ? { id: input.resourceId } : {}),
@@ -444,7 +443,6 @@ export async function purgeIndividualMemberWithDeps(routeCtx, input, options, de
             entry: [{
                     type: input.dataType || GwCoreLifecycleRequestType.IndividualMemberPurge,
                     request: { method: GwCoreLifecycleRequestMethod.Post },
-                    meta: { claims },
                     resource: {
                         ...resource,
                         ...(input.resourceId ? { id: input.resourceId } : {}),
@@ -550,7 +548,6 @@ export async function requestProfessionalAccessWithDeps(routeCtx, input, deps) {
             type: 'batch',
             data: [{
                     type: 'CommMsgExtended',
-                    meta: { claims: communicationClaims },
                     resource: communicationResource,
                 }],
         },
@@ -701,7 +698,6 @@ export function buildBlockchainArtifactBundleFromSearchResponse(input) {
         });
         return {
             type: 'DocumentReference',
-            meta: { claims: artifact.documentReference.meta?.claims || {} },
             resource: artifact.documentReference,
             request: {
                 method: 'POST',
@@ -762,7 +758,6 @@ export async function registerBlockchainArtifactAndUpdateIndexWithDeps(routeCtx,
             type: 'batch',
             data: [{
                     type: 'DocumentReference',
-                    meta: { claims: artifact.documentReference.meta?.claims || {} },
                     resource: artifact.documentReference,
                     request: {
                         method: 'POST',
@@ -840,7 +835,6 @@ export async function grantProfessionalAccessWithDeps(routeCtx, input, deps) {
         body: {
             data: [{
                     type: input.dataType || 'Consent-grant-request-v1.0',
-                    meta: { claims: built.consentClaims },
                     resource: { resourceType: 'Consent', meta: { claims: built.consentClaims } },
                 }],
         },
@@ -983,7 +977,6 @@ export async function revokeProfessionalAccessWithDeps(routeCtx, input, deps) {
         body: {
             data: [{
                     type: input.dataType || 'Consent-grant-request-v1.0',
-                    meta: { claims: revokedClaims },
                     resource: { resourceType: 'Consent', meta: { claims: revokedClaims } },
                 }],
         },

package/dist/runtime-host-submission.js

@@ -65,13 +65,6 @@ export async function activateOrganizationInGatewayFromIcaProofWithDeps(input) {
             ...(input.activationInput.controller ? { controller: input.activationInput.controller } : {}),
             data: [{
                     type: 'Organization-activation-request-v1.0',
-                    meta: {
-                        claims: {
-                            '@context': 'org.schema',
-                            ...serviceClaims,
-                            ...(input.activationInput.additionalClaims || {}),
-                        },
-                    },
                     resource: {
                         meta: {
                             claims: {

package/dist/runtime-paths.js

@@ -1,6 +1,7 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
 import { buildGwCoreTenantResourceActionPath } from 'gdc-common-utils-ts/utils/gw-core-path';
-import { IdentityAuthActions, IdentityAuthRouteSegments } from 'gdc-common-utils-ts/constants/identity-auth';
+import { IdentityAuthActions, IdentityAuthResourceTypes, IdentityAuthRouteSegments, SmartPostDcrActions, } from 'gdc-common-utils-ts/constants/identity-auth';
+import { GatewayRouteFormats, GatewayRouteSections, } from 'gdc-common-utils-ts/constants/gateway-response';
 export function buildV1Path(routeCtx, section, format, resourceType, action) {
     return buildGwCoreTenantResourceActionPath({
         tenantId: routeCtx.tenantId,
@@ -60,8 +61,8 @@ function buildIdentityAuthPath(ctx, action) {
     return `/${encodeURIComponent(IdentityAuthRouteSegments.Host)}/cds-${encodeURIComponent(ctx.jurisdiction)}/${IdentityAuthRouteSegments.Version}/${encodeURIComponent(ctx.sector)}/${encodeURIComponent(ctx.tenantId)}/${IdentityAuthRouteSegments.Section}/${IdentityAuthRouteSegments.Format}/${encodeURIComponent(action)}`;
 }
 export function buildIdentityOpenIdSmartTokenPath(ctx) {
-    return `/${encodeURIComponent(ctx.tenantId)}/cds-${encodeURIComponent(ctx.jurisdiction)}/v1/${encodeURIComponent(ctx.sector)}/identity/openid/smart/token`;
+    return buildV1Path(ctx, GatewayRouteSections.Identity, GatewayRouteFormats.OpenId, IdentityAuthResourceTypes.Smart, SmartPostDcrActions.Token);
 }
 export function buildIdentityOpenIdSmartTokenPollPath(ctx) {
-    return `/${encodeURIComponent(ctx.tenantId)}/cds-${encodeURIComponent(ctx.jurisdiction)}/v1/${encodeURIComponent(ctx.sector)}/identity/openid/smart/_batch-response`;
+    return buildV1Path(ctx, GatewayRouteSections.Identity, GatewayRouteFormats.OpenId, IdentityAuthResourceTypes.Smart, SmartPostDcrActions.TokenResponse);
 }

package/dist/server-profile-session.d.ts

@@ -379,6 +379,7 @@ export declare class ServerProfileSessionManager {
     openProfessional(input: ServerProfessionalOpenInput): Promise<OpenedServerProfessional>;
     lock(ownerId: string, sessionId: string): Promise<void>;
     private createClient;
+    private createRegisteredProfileClient;
     private createWallet;
     /**
      * Upgrade legacy profiles deterministically after successful PIN unlock.

package/dist/server-profile-session.js

@@ -328,12 +328,13 @@ export class ServerProfileSessionManager {
         profile = await this.ensureRequiredStorageProfile(profile, seed);
         const walletKeyDerivationId = profile.walletKeyDerivationId || profile.profileId;
         const wallet = await this.createWallet(walletKeyDerivationId, seed);
+        const context = walletContext(walletKeyDerivationId);
         const smartTokenEndpoint = [
             this.options.gatewayBaseUrl.replace(/\/+$/, ''),
             buildIdentityOpenIdSmartTokenPath(profile.routeContext),
         ].join('');
         const assertion = await buildWalletClientAssertion(wallet, profile, smartTokenEndpoint, now);
-        const token = await this.createClient(profile.routeContext, input.idToken).requestSmartToken({
+        const token = await this.createRegisteredProfileClient(profile, wallet, context, input.idToken).requestSmartToken({
             ...profile.routeContext,
             actorDid: profile.actorDid,
             subjectDid: input.subjectDid,
@@ -394,13 +395,14 @@ export class ServerProfileSessionManager {
             : undefined;
         const walletKeyDerivationId = profile.walletKeyDerivationId || profile.profileId;
         const wallet = await this.createWallet(walletKeyDerivationId, seed);
+        const context = walletContext(walletKeyDerivationId);
         const now = this.now();
         const smartTokenEndpoint = [
             this.options.gatewayBaseUrl.replace(/\/+$/, ''),
             buildIdentityOpenIdSmartTokenPath(profile.routeContext),
         ].join('');
         const assertion = await buildWalletClientAssertion(wallet, profile, smartTokenEndpoint, now);
-        const token = await this.createClient(profile.routeContext, normalizedIdToken).requestSmartToken({
+        const token = await this.createRegisteredProfileClient(profile, wallet, context, normalizedIdToken).requestSmartToken({
             ...profile.routeContext,
             actorDid: profile.actorDid,
             subjectDid: session.subjectDid,
@@ -546,13 +548,11 @@ export class ServerProfileSessionManager {
             transportProfile: TransportProfiles.DidcommEncryptedForm,
             secureTransportAdapter,
         });
-        // SMART/OpenID uses its own JSON/form protocol and must not be wrapped in
-        // the encrypted resource transport selected for later business actions.
-        // Professional business operations are authored by the registered employee
-        // wallet and therefore use the encrypted DIDComm client. SMART/OpenID below
-        // remains an independent JSON/form exchange through its dedicated method.
+        // Both SMART and later business operations are post-DCR profile actions.
+        // Strict GW therefore resolves the same registered employee wallet for the
+        // encrypted request and poll transport used by both facades.
         const sdk = new ProfessionalSdk(operationalClient);
-        const smartSdk = new ProfessionalSdk(this.createClient(profile.routeContext, idToken));
+        const smartSdk = sdk;
         const digitalTwin = new DigitalTwinSdk(operationalClient, profile.actorDid);
         let digitalTwinAccessToken;
         const request = async (smart) => {
@@ -625,6 +625,20 @@ export class ServerProfileSessionManager {
             appInfo: this.options.appInfo,
         });
     }
+    createRegisteredProfileClient(profile, wallet, context, bearerToken) {
+        return new NodeHttpClient({
+            baseUrl: this.options.gatewayBaseUrl,
+            ctx: profile.routeContext,
+            bearerToken,
+            fetchImpl: this.options.fetchImpl,
+            appInfo: this.options.appInfo,
+            transportProfile: TransportProfiles.DidcommEncryptedForm,
+            secureTransportAdapter: {
+                pack: (message) => wallet.packForRecipientWithContext(bindOrganizationControllerTransport(message, profile), profile.providerDid, { context }),
+                unpack: async (jwe) => (await wallet.unpackWithContext(jwe, { context })).content,
+            },
+        });
+    }
     async createWallet(walletKeyDerivationId, seed) {
         const wallet = new NodeManagedWallet({ resolveRecipientJwk: this.options.resolveRecipientJwk });
         const context = walletContext(walletKeyDerivationId);

package/dist/smart-token.js

@@ -1,5 +1,7 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
 import { HealthcareConsentPurposes } from 'gdc-common-utils-ts/constants';
+import { IdentityAuthResourceTypes, SmartPostDcrActions, } from 'gdc-common-utils-ts/constants/identity-auth';
+import { GatewayRouteFormats, GatewayRouteSections, } from 'gdc-common-utils-ts/constants/gateway-response';
 import { buildClientAssertionJwt } from 'gdc-common-utils-ts/utils/client-assertion';
 import { resolvePollOptionsFromSeconds } from './poll-options.js';
 /**
@@ -109,16 +111,19 @@ function normalizeResolvedSmartTokenEndpoint(value) {
     if (!['http:', 'https:'].includes(endpoint.protocol)) {
         throw new Error('Resolved SMART token endpoint must use HTTP(S).');
     }
-    if (!endpoint.pathname.endsWith('/identity/openid/smart/token')) {
-        throw new Error('Resolved SMART token endpoint must target /identity/openid/smart/token.');
+    if (!endpoint.pathname.endsWith(smartTokenRouteSuffix(SmartPostDcrActions.Token))) {
+        throw new Error(`Resolved SMART token endpoint must target ${smartTokenRouteSuffix(SmartPostDcrActions.Token)}.`);
     }
     return endpoint.toString();
 }
 function smartTokenPollEndpointFromTokenEndpoint(tokenEndpoint) {
     const endpoint = new URL(tokenEndpoint);
-    endpoint.pathname = endpoint.pathname.replace(/\/identity\/openid\/smart\/token$/, '/identity/openid/smart/_batch-response');
+    endpoint.pathname = `${endpoint.pathname.slice(0, -smartTokenRouteSuffix(SmartPostDcrActions.Token).length)}${smartTokenRouteSuffix(SmartPostDcrActions.TokenResponse)}`;
     return endpoint.toString();
 }
+function smartTokenRouteSuffix(action) {
+    return `/${GatewayRouteSections.Identity}/${GatewayRouteFormats.OpenId}/${IdentityAuthResourceTypes.Smart}/${action}`;
+}
 async function resolveClientAssertion(input) {
     const explicit = String(input.clientAssertion || '').trim();
     if (explicit)
@@ -132,7 +137,10 @@ async function resolveClientAssertion(input) {
     });
 }
 function resolveTokenExchangeResult(exchange, normalizedScopes, tokenCacheKey, setTokenCache) {
-    const exchangeBody = exchange.poll.body ?? {};
+    const pollBody = exchange.poll.body ?? {};
+    // Encrypted DIDComm returns the token in the authenticated message body;
+    // plain compatibility transports may still expose the token at the root.
+    const exchangeBody = pollBody.body || pollBody;
     const accessToken = String(exchangeBody.access_token || '').trim();
     if (exchange.poll.status >= 400 || !accessToken) {
         return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-sdk-node-ts",
-  "version": "2.6.6",
+  "version": "2.6.7",
   "description": "Next-generation Node runtime package for the GDC SDK family",
   "license": "Apache-2.0",
   "author": "Antifraud Services Inc.",
@@ -38,8 +38,8 @@
     "test:e2e:live-gw:clean": "bash ./scripts/run-live-gw-clean.sh"
   },
   "dependencies": {
-    "gdc-common-utils-ts": "2.7.4",
-    "gdc-sdk-core-ts": "2.4.6"
+    "gdc-common-utils-ts": "2.7.8",
+    "gdc-sdk-core-ts": "2.4.9"
   },
   "devDependencies": {
     "@types/node": "^20.14.10",