gdc-sdk-node-ts 2.3.1 → 2.3.3

package/dist/did-web-recipient.d.ts

@@ -0,0 +1,18 @@
+import type { JWK } from 'gdc-common-utils-ts/models/jwk';
+export type ResolveDidWebKeyAgreementJwkOptions = Readonly<{
+    fetchImpl?: typeof fetch;
+    /**
+     * Transport override for a local/private route serving the same DID document.
+     * The returned document must still identify itself with the requested DID.
+     */
+    didDocumentUrl?: string;
+}>;
+/**
+ * Resolves the first public key-agreement JWK from a did:web document.
+ *
+ * The DID remains the recipient identity and the document remains the source
+ * of its public keys. `didDocumentUrl` changes only the HTTP route used to
+ * retrieve that same document, which is useful when a local GW publishes its
+ * external DID while being reached through localhost.
+ */
+export declare function resolveDidWebKeyAgreementJwk(recipientDid: string, options?: ResolveDidWebKeyAgreementJwkOptions): Promise<JWK>;

package/dist/did-web-recipient.js

@@ -0,0 +1,46 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+import { getBaseUrlFromDidWeb, normalizeDidWeb } from 'gdc-common-utils-ts/utils/did';
+/**
+ * Resolves the first public key-agreement JWK from a did:web document.
+ *
+ * The DID remains the recipient identity and the document remains the source
+ * of its public keys. `didDocumentUrl` changes only the HTTP route used to
+ * retrieve that same document, which is useful when a local GW publishes its
+ * external DID while being reached through localhost.
+ */
+export async function resolveDidWebKeyAgreementJwk(recipientDid, options = {}) {
+    const did = normalizeDidWeb(String(recipientDid || '').trim());
+    if (!did.startsWith('did:web:')) {
+        throw new Error('resolveDidWebKeyAgreementJwk requires a did:web recipient.');
+    }
+    const didDocumentUrl = String(options.didDocumentUrl || '').trim()
+        || `${getBaseUrlFromDidWeb(did)}.well-known/did.json`;
+    const response = await (options.fetchImpl || fetch)(didDocumentUrl, {
+        headers: { Accept: 'application/did+json, application/json' },
+    });
+    if (!response.ok) {
+        throw new Error(`Could not resolve DID document '${did}' (HTTP ${response.status}).`);
+    }
+    const document = await response.json();
+    if (normalizeDidWeb(String(document.id || '').trim()) !== did) {
+        throw new Error(`Resolved DID document does not belong to '${did}'.`);
+    }
+    const methods = new Map((document.verificationMethod || []).map((method) => [method.id, method]));
+    for (const agreement of document.keyAgreement || []) {
+        const method = typeof agreement === 'string' ? methods.get(agreement) : agreement;
+        const jwk = publicKeyAgreementJwk(method);
+        if (jwk)
+            return jwk;
+    }
+    throw new Error(`DID document '${did}' has no public keyAgreement JWK.`);
+}
+function publicKeyAgreementJwk(method) {
+    const publicKeyJwk = method?.publicKeyJwk;
+    if (!publicKeyJwk || typeof publicKeyJwk !== 'object')
+        return undefined;
+    if (publicKeyJwk.use && publicKeyJwk.use !== 'enc')
+        return undefined;
+    if (publicKeyJwk.kid || !method?.id.includes('#'))
+        return publicKeyJwk;
+    return { ...publicKeyJwk, kid: method.id.slice(method.id.lastIndexOf('#') + 1) };
+}

package/dist/gdc-session-bridge.js

@@ -21,6 +21,7 @@ const capabilityMap = {
     [ActorCapabilities.IndividualImportIps]: ActorCapabilities.IndividualImportIps,
     [ActorCapabilities.IndividualGenerateDigitalTwin]: ActorCapabilities.IndividualGenerateDigitalTwin,
     [ActorCapabilities.IndividualIngestCommunication]: ActorCapabilities.IndividualIngestCommunication,
+    [ActorCapabilities.IndividualReadClinicalSummary]: ActorCapabilities.IndividualReadClinicalSummary,
     [ActorCapabilities.IndividualUpsertRelatedPerson]: ActorCapabilities.IndividualUpsertRelatedPerson,
     [ActorCapabilities.IndividualMemberDisable]: ActorCapabilities.IndividualMemberDisable,
     [ActorCapabilities.IndividualMemberPurge]: ActorCapabilities.IndividualMemberPurge,

package/dist/index.d.ts

@@ -26,6 +26,7 @@ export * from './UserProfileIndexStore.js';
 export * from './wallet-backed-job-manager.js';
 export * from './node-crypto-helper.js';
 export * from './node-managed-wallet.js';
+export * from './did-web-recipient.js';
 export * from './constants/lifecycle.js';
 export * from './consent-claim-helpers.js';
 export * from './session.js';

package/dist/index.js

@@ -27,6 +27,7 @@ export * from './UserProfileIndexStore.js';
 export * from './wallet-backed-job-manager.js';
 export * from './node-crypto-helper.js';
 export * from './node-managed-wallet.js';
+export * from './did-web-recipient.js';
 export * from './constants/lifecycle.js';
 export * from './consent-claim-helpers.js';
 export * from './session.js';

package/dist/individual-controller-backend-runtime.d.ts

@@ -4,7 +4,7 @@ import type { IndividualOrganizationConfirmOrderInput, RouteContext } from './in
 import type { IndividualOrganizationBootstrapInput, IndividualOrganizationStartResult } from './individual-start.js';
 import type { EnsureFamilyOrganizationRegistrationInput, EnsureFamilyOrganizationRegistrationResult } from './family-organization-registration.js';
 import type { FamilyOrganizationSearchInput } from './family-organization-search.js';
-import type { BlockchainArtifactRegistrationInput, ClinicalBundleSearchInput } from './resource-operations.js';
+import type { BlockchainArtifactRegistrationInput, ClinicalBundleSearchInput, ClinicalSummaryReadResult, ClinicalSummaryRequestInput } from './resource-operations.js';
 import { type BackendIndividualControllerProfile, type BackendProfileRuntimeClient } from './backend-profile-runtime.js';
 import type { ProfileLoadRequest } from 'gdc-sdk-core-ts';
 /**
@@ -17,8 +17,8 @@ import type { ProfileLoadRequest } from 'gdc-sdk-core-ts';
  * - load an individual-controller profile
  * - start individual registration/bootstrap
  * - confirm the returned order/offer
- * - search the subject clinical index
- * - request the latest IPS-oriented bundle
+ * - request the available subject clinical summary through Communication
+ * - use direct index searches only for compatibility/specialized queries
  */
 export declare class IndividualControllerBackendRuntime {
     private readonly profileRuntime;
@@ -47,8 +47,13 @@ export declare class IndividualControllerBackendRuntime {
      */
     confirmIndividualOrganizationOrder(profile: BackendIndividualControllerProfile, input: IndividualOrganizationConfirmOrderInput): Promise<SubmitAndPollResult>;
     /**
-     * Searches the current subject clinical bundle index through the loaded
-     * individual-controller facade.
+     * Reads the authoritative subject document through the canonical
+     * `Communication -> Subject/$summary -> FHIR Parameters` lifecycle.
+     */
+    requestClinicalSummary(profile: BackendIndividualControllerProfile, ctx: RouteContext, input: ClinicalSummaryRequestInput): Promise<ClinicalSummaryReadResult>;
+    /**
+     * Compatibility/specialized direct search over the subject bundle index.
+     * Prefer `requestClinicalSummary(...)` for the available clinical document.
      */
     searchClinicalBundle(profile: BackendIndividualControllerProfile, ctx: RouteContext, input: ClinicalBundleSearchInput): Promise<SubmitAndPollResult>;
     /**

package/dist/individual-controller-backend-runtime.js

@@ -10,8 +10,8 @@ import { loadBackendIndividualControllerProfile, } from './backend-profile-runti
  * - load an individual-controller profile
  * - start individual registration/bootstrap
  * - confirm the returned order/offer
- * - search the subject clinical index
- * - request the latest IPS-oriented bundle
+ * - request the available subject clinical summary through Communication
+ * - use direct index searches only for compatibility/specialized queries
  */
 export class IndividualControllerBackendRuntime {
     constructor(profileRuntime) {
@@ -51,8 +51,15 @@ export class IndividualControllerBackendRuntime {
         return profile.sdk.confirmIndividualOrganizationOrder(input);
     }
     /**
-     * Searches the current subject clinical bundle index through the loaded
-     * individual-controller facade.
+     * Reads the authoritative subject document through the canonical
+     * `Communication -> Subject/$summary -> FHIR Parameters` lifecycle.
+     */
+    requestClinicalSummary(profile, ctx, input) {
+        return profile.sdk.requestClinicalSummary(ctx, input);
+    }
+    /**
+     * Compatibility/specialized direct search over the subject bundle index.
+     * Prefer `requestClinicalSummary(...)` for the available clinical document.
      */
     searchClinicalBundle(profile, ctx, input) {
         return profile.sdk.searchClinicalBundle(ctx, input);

package/dist/node-managed-wallet.d.ts

@@ -51,9 +51,7 @@ export declare class NodeManagedWallet implements IWallet {
      * Computes a digest of a string using the configured runtime helper.
      */
     digest(data: string, algorithm: string): Promise<string>;
-    /**
-     * Protects one confidential document using one owner-specific symmetric storage key.
-     */
+    /** Protects one document with a random AES-256-GCM CEK wrapped to the owner's storage ML-KEM key. */
     protectConfidentialData(doc: any, entityId: string): Promise<any>;
     /**
      * Protects one confidential document using the richer execution-context model.
@@ -140,8 +138,6 @@ export declare class NodeManagedWallet implements IWallet {
     private resolveOwnerId;
     private resolveStorageOwnerId;
     private createManagedKey;
-    private createStorageKey;
-    private requireStorageKey;
     private requireManagedKey;
     private inferRelevantScopes;
     private matchesSelection;

package/dist/node-managed-wallet.js

@@ -13,6 +13,7 @@ const DEFAULT_POLICY = {
         'vc-signing': 'ES384',
         'comm-signing': 'ML-DSA-44',
         'comm-encryption': 'ML-KEM-768',
+        'document-at-rest': 'ML-KEM-768',
     },
 };
 /**
@@ -99,9 +100,6 @@ export class NodeManagedWallet {
             ownerState.keys.push(descriptor);
             created.push(descriptor.descriptor.publicJwk);
         }
-        if (!ownerState.storageKey) {
-            ownerState.storageKey = await this.createStorageKey(request, ownerId);
-        }
         return { keys: created };
     }
     /**
@@ -136,9 +134,7 @@ export class NodeManagedWallet {
     async digest(data, algorithm) {
         return this.cryptoHelper.digestString(data, algorithm);
     }
-    /**
-     * Protects one confidential document using one owner-specific symmetric storage key.
-     */
+    /** Protects one document with a random AES-256-GCM CEK wrapped to the owner's storage ML-KEM key. */
     async protectConfidentialData(doc, entityId) {
         return this.protectManagedConfidentialData(doc, {
             profile: { profileId: entityId },
@@ -151,10 +147,24 @@ export class NodeManagedWallet {
     async protectManagedConfidentialData(doc, context, _options) {
         if (!doc?.content)
             return doc;
-        const storageKey = this.requireStorageKey(context);
+        const storageKey = this.requireManagedKey(context, {
+            ownerScope: context.profile?.profileId ? 'profile' : 'runtime',
+            purpose: 'document-at-rest',
+        }, 'enc');
         const ownerId = this.resolveStorageOwnerId(context);
-        const contentString = JSON.stringify(doc.content);
-        const encrypted = await this.cryptography.encrypt(contentString, storageKey, ownerId);
+        const ownerBinding = createHash('sha256').update(ownerId).digest('base64url');
+        const privateJwk = {
+            ...storageKey.descriptor.publicJwk,
+            dBytes: storageKey.privateMaterial,
+        };
+        const encrypted = await this.cryptography.encryptJweToCompact(JSON.stringify(doc.content), {
+            typ: 'gdc-confidential-document+jwe',
+            cty: 'application/json',
+            enc: 'A256GCM',
+            gdc_pq_profile: 'confidential-pqc-v1',
+            gdc_key_purpose: 'document-at-rest',
+            gdc_owner_binding: ownerBinding,
+        }, privateJwk, storageKey.descriptor.publicJwk);
         const { content, ...docWithoutContent } = doc;
         return {
             ...docWithoutContent,
@@ -176,13 +186,26 @@ export class NodeManagedWallet {
     async unprotectManagedConfidentialData(doc, context, _options) {
         if (!doc?.jwe)
             return doc;
-        const storageKey = this.requireStorageKey(context);
+        const storageKey = this.requireManagedKey(context, {
+            ownerScope: context.profile?.profileId ? 'profile' : 'runtime',
+            purpose: 'document-at-rest',
+        }, 'enc');
         const ownerId = this.resolveStorageOwnerId(context);
-        const decrypted = await this.cryptography.decrypt(doc.jwe, storageKey, ownerId);
+        const privateJwk = {
+            ...storageKey.descriptor.publicJwk,
+            dBytes: storageKey.privateMaterial,
+        };
+        const decrypted = await this.cryptography.decryptJwe(doc.jwe, privateJwk);
+        const header = decrypted.protectedHeader;
+        if (header.gdc_pq_profile !== 'confidential-pqc-v1'
+            || header.gdc_key_purpose !== 'document-at-rest'
+            || header.gdc_owner_binding !== createHash('sha256').update(ownerId).digest('base64url')) {
+            throw new Error('Confidential document is not bound to this storage owner and policy.');
+        }
         const { jwe, ...docWithoutJwe } = doc;
         return {
             ...docWithoutJwe,
-            content: JSON.parse(decrypted),
+            content: JSON.parse(Content.bytesToStringUTF8(decrypted.decryptedBytes)),
         };
     }
     /**
@@ -480,25 +503,6 @@ export class NodeManagedWallet {
             privateMaterial: signer.getPrivateMaterial(),
         };
     }
-    async createStorageKey(request, ownerId) {
-        if (request.mode === 'deterministic' && request.seedMaterial !== undefined) {
-            return this.deriveSeedBytes(request.seedMaterial, ownerId, 'document-at-rest', 32);
-        }
-        return this.cryptoHelper.getRandomBytes(32);
-    }
-    requireStorageKey(context) {
-        if (context.profile?.profileId) {
-            const state = this.owners.get(`profile:${context.profile.profileId}:${context.walletId ?? 'default'}`);
-            if (state?.storageKey)
-                return state.storageKey;
-        }
-        if (context.runtime?.runtimeId) {
-            const state = this.owners.get(`runtime:${context.runtime.runtimeId}:${context.walletId ?? 'default'}`);
-            if (state?.storageKey)
-                return state.storageKey;
-        }
-        throw new Error('NodeManagedWallet has no storage key for the provided context. Provision keys first.');
-    }
     requireManagedKey(context, selection, expectedUse) {
         if (selection.keyId) {
             for (const ownerState of this.owners.values()) {

package/dist/node-runtime-client.d.ts

@@ -11,7 +11,7 @@ import { type SmartTokenRequestInput } from './smart-token.js';
 import { type EmployeeDeviceActivationRequestInput, type EmployeeDeviceActivationResult } from './device-activation.js';
 import { type OrganizationLicenseOrderConfirmInput } from './organization-license-order.js';
 import { type IndividualOrganizationBootstrapInput, type IndividualOrganizationStartResult } from './individual-start.js';
-import { type CommunicationIngestionInput, type BlockchainArtifactRegistrationInput, type VitalSignBatchCommunicationFromSearchResponseInput, type CommunicationParticipantRuntimeSearchInput, type ClinicalBundleSearchInput, type GrantProfessionalAccessInput, type GrantProfessionalAccessResult, type IndividualMemberLifecycleInput, type IndividualMemberLicenseAddInput, type IndividualMemberLicenseInvitationInput, type IndividualMemberLicenseTransitionInput, type LicenseListRuntimeSearchInput, type LicenseOfferRuntimeSearchInput, type LicenseOrderRuntimeSearchInput, type OrganizationEmployeeCreationInput, type OrganizationEmployeeLifecycleInput, type OrganizationEmployeeSearchInput, type RevokeProfessionalAccessInput, type RevokeProfessionalAccessResult, type RelatedPersonUpsertInput } from './resource-operations.js';
+import { type CommunicationIngestionInput, type BlockchainArtifactRegistrationInput, type VitalSignBatchCommunicationFromSearchResponseInput, type CommunicationParticipantRuntimeSearchInput, type ClinicalBundleSearchInput, type ClinicalSummaryReadResult, type ClinicalSummaryRequestInput, type GrantProfessionalAccessInput, type GrantProfessionalAccessResult, type IndividualMemberLifecycleInput, type IndividualMemberLicenseAddInput, type IndividualMemberLicenseInvitationInput, type IndividualMemberLicenseTransitionInput, type LicenseListRuntimeSearchInput, type LicenseOfferRuntimeSearchInput, type LicenseOrderRuntimeSearchInput, type OrganizationEmployeeCreationInput, type OrganizationEmployeeLifecycleInput, type OrganizationEmployeeSearchInput, type RevokeProfessionalAccessInput, type RevokeProfessionalAccessResult, type RelatedPersonUpsertInput } from './resource-operations.js';
 import type { LegalOrganizationOrderInput } from './host-onboarding.js';
 import type { SmartTokenExchangeResult } from './smart-token.js';
 import type { NodeRuntimeClient, PollOptions, PollResult, SubmitAndPollResult, SubmitPayload, SubmitResponse } from './orchestration/client-port.js';
@@ -402,6 +402,15 @@ export declare class HttpRuntimeClient implements NodeRuntimeClient {
      * @param input Communication payload plus route/format options.
      */
     ingestCommunicationAndUpdateIndex(ctx: RouteContext, input: CommunicationIngestionInput): Promise<SubmitAndPollResult>;
+    /**
+     * Reads the authoritative clinical document currently available for one
+     * subject through an auditable `Communication` request to `Subject/$summary`.
+     *
+     * Unlike `ingestCommunicationAndUpdateIndex(...)`, this method does not
+     * represent a write or projection lifecycle. It returns the GW document and
+     * a `BundleReader` for section-by-section navigation.
+     */
+    requestClinicalSummary(ctx: RouteContext, input: ClinicalSummaryRequestInput): Promise<ClinicalSummaryReadResult>;
     /**
      * Renders and submits one canonical clinical outbox job without requiring
      * BFF, portal or assistant consumers to know GW wire envelopes.

package/dist/node-runtime-client.js

@@ -12,7 +12,7 @@ import { activateEmployeeDeviceWithActivationCodeWithDeps, activateEmployeeDevic
 import { extractOfferIdFromResponseBody, extractOfferPreviewFromResponseBody, } from './order-offer-summary.js';
 import { confirmOrganizationLicenseOrderWithDeps } from './organization-license-order.js';
 import { startIndividualOrganizationWithDeps } from './individual-start.js';
-import { createOrganizationEmployeeWithDeps, disableIndividualMemberWithDeps, disableIndividualOrganizationWithDeps, disableOrganizationEmployeeWithDeps, listIndividualLicenseOffersWithDeps, listIndividualLicenseOrdersWithDeps, listIndividualLicensesWithDeps, addFreeIndividualMemberLicensesWithDeps, issueIndividualMemberLicenseWithDeps, transitionIndividualMemberLicenseWithDeps, listOrganizationLicenseOffersWithDeps, listOrganizationLicenseOrdersWithDeps, listOrganizationLicensesWithDeps, grantProfessionalAccessWithDeps, ingestCommunicationAndUpdateIndexWithDeps, buildVitalSignBatchCommunicationFromSearchResponse, registerBlockchainArtifactAndUpdateIndexWithDeps, revokeProfessionalAccessWithDeps, searchCommunicationParticipantsWithDeps, purgeIndividualMemberWithDeps, purgeIndividualOrganizationWithDeps, purgeOrganizationEmployeeWithDeps, searchIndividualLicensesWithDeps, searchIndividualLicenseOffersWithDeps, searchIndividualLicenseOrdersWithDeps, searchOrganizationLicensesWithDeps, searchOrganizationLicenseOffersWithDeps, searchOrganizationLicenseOrdersWithDeps, searchOrganizationEmployeesWithDeps, searchClinicalBundleWithDeps, searchLatestIpsWithDeps, upsertRelatedPersonAndPollWithDeps, normalizeCommunicationPathFormatSegment, } from './resource-operations.js';
+import { createOrganizationEmployeeWithDeps, disableIndividualMemberWithDeps, disableIndividualOrganizationWithDeps, disableOrganizationEmployeeWithDeps, listIndividualLicenseOffersWithDeps, listIndividualLicenseOrdersWithDeps, listIndividualLicensesWithDeps, addFreeIndividualMemberLicensesWithDeps, issueIndividualMemberLicenseWithDeps, transitionIndividualMemberLicenseWithDeps, listOrganizationLicenseOffersWithDeps, listOrganizationLicenseOrdersWithDeps, listOrganizationLicensesWithDeps, grantProfessionalAccessWithDeps, ingestCommunicationAndUpdateIndexWithDeps, buildVitalSignBatchCommunicationFromSearchResponse, registerBlockchainArtifactAndUpdateIndexWithDeps, requestClinicalSummaryWithDeps, revokeProfessionalAccessWithDeps, searchCommunicationParticipantsWithDeps, purgeIndividualMemberWithDeps, purgeIndividualOrganizationWithDeps, purgeOrganizationEmployeeWithDeps, searchIndividualLicensesWithDeps, searchIndividualLicenseOffersWithDeps, searchIndividualLicenseOrdersWithDeps, searchOrganizationLicensesWithDeps, searchOrganizationLicenseOffersWithDeps, searchOrganizationLicenseOrdersWithDeps, searchOrganizationEmployeesWithDeps, searchClinicalBundleWithDeps, searchLatestIpsWithDeps, upsertRelatedPersonAndPollWithDeps, normalizeCommunicationPathFormatSegment, } from './resource-operations.js';
 import { submitAndPollWithMethods } from './orchestration/client-port.js';
 import { buildRuntimeHeaders, fetchWithTimeout, parseResponseBody, pollBatchResponseWithRuntimeConfig, postJsonWithRuntimeConfig, postRenderedWithRuntimeConfig, } from './runtime-transport.js';
 import { activateOrganizationInGatewayFromIcaProofWithDeps, submitLegalOrganizationIssueWithDeps, submitLegalOrganizationVerificationTransactionWithDeps, submitOrganizationDidBindingWithDeps, } from './runtime-host-submission.js';
@@ -743,6 +743,19 @@ export class HttpRuntimeClient {
             submitAndPoll: this.submitAndPoll.bind(this),
         });
     }
+    /**
+     * Reads the authoritative clinical document currently available for one
+     * subject through an auditable `Communication` request to `Subject/$summary`.
+     *
+     * Unlike `ingestCommunicationAndUpdateIndex(...)`, this method does not
+     * represent a write or projection lifecycle. It returns the GW document and
+     * a `BundleReader` for section-by-section navigation.
+     */
+    async requestClinicalSummary(ctx, input) {
+        return requestClinicalSummaryWithDeps(ctx, input, {
+            submitSummaryCommunication: this.submitCommunicationOutboxJobAndPoll.bind(this),
+        });
+    }
     /**
      * Renders and submits one canonical clinical outbox job without requiring
      * BFF, portal or assistant consumers to know GW wire envelopes.

package/dist/orchestration/client-port.d.ts

@@ -13,7 +13,7 @@ import type { FamilyOrganizationSearchInput } from '../family-organization-searc
 import type { EnsureFamilyOrganizationRegistrationInput, EnsureFamilyOrganizationRegistrationResult } from '../family-organization-registration.js';
 import type { OrganizationLicenseOrderConfirmInput } from '../organization-license-order.js';
 import type { SmartTokenExchangeResult, SmartTokenRequestInput } from '../smart-token.js';
-import type { CommunicationIngestionInput, BlockchainArtifactRegistrationInput, CommunicationParticipantRuntimeSearchInput, ClinicalBundleSearchInput, VitalSignBatchCommunicationFromSearchResponseInput, DigitalTwinGenerationInput, GrantProfessionalAccessInput, GrantProfessionalAccessResult, IndividualMemberLifecycleInput, IndividualMemberLicenseAddInput, IndividualMemberLicenseInvitationInput, IndividualMemberLicenseTransitionInput, IpsOrFhirImportInput, OrganizationEmployeeCreationInput, OrganizationEmployeeLifecycleInput, OrganizationEmployeeSearchInput, RevokeProfessionalAccessInput, RevokeProfessionalAccessResult, RelatedPersonUpsertInput } from '../resource-operations.js';
+import type { CommunicationIngestionInput, BlockchainArtifactRegistrationInput, CommunicationParticipantRuntimeSearchInput, ClinicalBundleSearchInput, ClinicalSummaryReadResult, ClinicalSummaryRequestInput, VitalSignBatchCommunicationFromSearchResponseInput, DigitalTwinGenerationInput, GrantProfessionalAccessInput, GrantProfessionalAccessResult, IndividualMemberLifecycleInput, IndividualMemberLicenseAddInput, IndividualMemberLicenseInvitationInput, IndividualMemberLicenseTransitionInput, IpsOrFhirImportInput, OrganizationEmployeeCreationInput, OrganizationEmployeeLifecycleInput, OrganizationEmployeeSearchInput, RevokeProfessionalAccessInput, RevokeProfessionalAccessResult, RelatedPersonUpsertInput } from '../resource-operations.js';
 /**
  * Shared node-runtime activation input.
  *
@@ -89,6 +89,7 @@ export type RuntimeClient = {
     disableIndividualOrganization?: (ctx: RouteContext, input: IndividualOrganizationLifecycleInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
     purgeIndividualOrganization?: (ctx: RouteContext, input: IndividualOrganizationLifecycleInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
     ingestCommunicationAndUpdateIndex?: (ctx: RouteContext, input: CommunicationIngestionInput) => Promise<SubmitAndPollResult>;
+    requestClinicalSummary?: (ctx: RouteContext, input: ClinicalSummaryRequestInput) => Promise<ClinicalSummaryReadResult>;
     registerBlockchainArtifactAndUpdateIndex?: (ctx: RouteContext, input: BlockchainArtifactRegistrationInput) => Promise<SubmitAndPollResult>;
     searchCommunicationParticipants?: (ctx: RouteContext, input: CommunicationParticipantRuntimeSearchInput) => Promise<SubmitAndPollResult>;
     grantProfessionalAccess?: (ctx: RouteContext, input: GrantProfessionalAccessInput) => Promise<GrantProfessionalAccessResult>;

package/dist/orchestration/individual-controller-sdk.d.ts

@@ -7,7 +7,7 @@ import type { IndividualOrganizationConfirmOrderInput, RouteContext } from '../i
 import type { IndividualOrganizationBootstrapInput, IndividualOrganizationStartResult } from '../individual-start.js';
 import type { NodeCapability } from '../session.js';
 import type { IndividualOrganizationLifecycleInput } from 'gdc-sdk-core-ts';
-import type { BlockchainArtifactRegistrationInput, ClinicalBundleSearchInput, CommunicationIngestionInput, CommunicationParticipantRuntimeSearchInput, DigitalTwinGenerationInput, GrantProfessionalAccessInput, GrantProfessionalAccessResult, IndividualMemberLifecycleInput, IndividualMemberLicenseAddInput, IndividualMemberLicenseInvitationInput, IndividualMemberLicenseTransitionInput, IpsOrFhirImportInput, LicenseListRuntimeSearchInput, LicenseOfferRuntimeSearchInput, LicenseOrderRuntimeSearchInput, RevokeProfessionalAccessInput, RevokeProfessionalAccessResult, RelatedPersonUpsertInput } from '../resource-operations.js';
+import type { BlockchainArtifactRegistrationInput, ClinicalBundleSearchInput, ClinicalSummaryReadResult, ClinicalSummaryRequestInput, CommunicationIngestionInput, CommunicationParticipantRuntimeSearchInput, DigitalTwinGenerationInput, GrantProfessionalAccessInput, GrantProfessionalAccessResult, IndividualMemberLifecycleInput, IndividualMemberLicenseAddInput, IndividualMemberLicenseInvitationInput, IndividualMemberLicenseTransitionInput, IpsOrFhirImportInput, LicenseListRuntimeSearchInput, LicenseOfferRuntimeSearchInput, LicenseOrderRuntimeSearchInput, RevokeProfessionalAccessInput, RevokeProfessionalAccessResult, RelatedPersonUpsertInput } from '../resource-operations.js';
 import type { SmartTokenExchangeResult, SmartTokenRequestInput } from '../smart-token.js';
 /**
  * Individual-controller oriented facade over a `NodeRuntimeClient`.
@@ -79,13 +79,25 @@ export declare class IndividualControllerSdk {
      */
     importIpsOrFhirAndUpdateIndex(ctx: RouteContext, input: IpsOrFhirImportInput): Promise<SubmitAndPollResult>;
     /**
-     * Creates or updates a `RelatedPerson` for non-employee caregivers or family members.
+     * Compatibility adapter for the older direct `RelatedPerson` route.
+     *
+     * @deprecated Author one or more typed RelatedPerson entries in a Bundle,
+     * attach that completed Bundle to a Communication outbox job, and call
+     * `ingestCommunicationAndUpdateIndex(...)`.
      */
     upsertRelatedPersonAndPoll(ctx: RouteContext, input: RelatedPersonUpsertInput): Promise<SubmitAndPollResult>;
     /**
      * Ingests a FHIR `Communication` and waits for indexing.
      */
     ingestCommunicationAndUpdateIndex(ctx: RouteContext, input: CommunicationIngestionInput): Promise<SubmitAndPollResult>;
+    /**
+     * Reads the subject's available clinical document through
+     * `Communication -> Subject/$summary -> FHIR Parameters`.
+     *
+     * The returned `BundleReader` navigates the authoritative GW document by
+     * section. This method never ingests resources or updates the index.
+     */
+    requestClinicalSummary(ctx: RouteContext, input: ClinicalSummaryRequestInput): Promise<ClinicalSummaryReadResult>;
     /**
      * Registers one FHIR resource or raw artifact on blockchain before it is
      * attached to a subject communication.

package/dist/orchestration/individual-controller-sdk.js

@@ -111,7 +111,11 @@ export class IndividualControllerSdk {
         return requireClientMethod(this.client, 'importIpsOrFhirAndUpdateIndex')(ctx, input);
     }
     /**
-     * Creates or updates a `RelatedPerson` for non-employee caregivers or family members.
+     * Compatibility adapter for the older direct `RelatedPerson` route.
+     *
+     * @deprecated Author one or more typed RelatedPerson entries in a Bundle,
+     * attach that completed Bundle to a Communication outbox job, and call
+     * `ingestCommunicationAndUpdateIndex(...)`.
      */
     upsertRelatedPersonAndPoll(ctx, input) {
         assertFacadeCapability(this.capabilities, ActorCapabilities.IndividualUpsertRelatedPerson, ActorKinds.IndividualController, 'upsertRelatedPersonAndPoll');
@@ -124,6 +128,17 @@ export class IndividualControllerSdk {
         assertFacadeCapability(this.capabilities, ActorCapabilities.IndividualIngestCommunication, ActorKinds.IndividualController, 'ingestCommunicationAndUpdateIndex');
         return requireClientMethod(this.client, 'ingestCommunicationAndUpdateIndex')(ctx, input);
     }
+    /**
+     * Reads the subject's available clinical document through
+     * `Communication -> Subject/$summary -> FHIR Parameters`.
+     *
+     * The returned `BundleReader` navigates the authoritative GW document by
+     * section. This method never ingests resources or updates the index.
+     */
+    requestClinicalSummary(ctx, input) {
+        assertFacadeCapability(this.capabilities, ActorCapabilities.IndividualReadClinicalSummary, ActorKinds.IndividualController, 'requestClinicalSummary');
+        return requireClientMethod(this.client, 'requestClinicalSummary')(ctx, input);
+    }
     /**
      * Registers one FHIR resource or raw artifact on blockchain before it is
      * attached to a subject communication.

package/dist/orchestration/individual-member-sdk.d.ts

@@ -2,12 +2,15 @@ import { type IndividualMemberCredentialInput, type IndividualMemberVpPayloadInp
 import { type NodeRuntimeClient } from './client-port.js';
 import type { SmartTokenExchangeResult, SmartTokenRequestInput } from '../smart-token.js';
 import type { RouteContext } from '../individual-onboarding.js';
-import type { ClinicalBundleSearchInput, CommunicationIngestionInput, RelatedPersonUpsertInput } from '../resource-operations.js';
+import type { ClinicalBundleSearchInput, ClinicalSummaryReadResult, ClinicalSummaryRequestInput, CommunicationIngestionInput, RelatedPersonUpsertInput } from '../resource-operations.js';
 export declare class IndividualMemberSdk {
     private readonly client;
     constructor(client: NodeRuntimeClient);
     /**
-     * Creates or updates the member/caregiver `RelatedPerson` relationship to the subject.
+     * Compatibility adapter for the older direct `RelatedPerson` route.
+     *
+     * @deprecated Author a typed RelatedPerson Bundle, attach it to a
+     * Communication outbox job, and call `ingestCommunicationAndUpdateIndex(...)`.
      */
     upsertRelatedPersonAndPoll(ctx: RouteContext, input: RelatedPersonUpsertInput): Promise<import("gdc-sdk-core-ts/polling-model.js").SubmitAndPollResult>;
     /**
@@ -20,6 +23,8 @@ export declare class IndividualMemberSdk {
      * SMART token and accepted RelatedPerson/Consent relationship.
      */
     ingestCommunicationAndUpdateIndex(ctx: RouteContext, input: CommunicationIngestionInput): Promise<import("gdc-sdk-core-ts/polling-model.js").SubmitAndPollResult>;
+    /** Reads the member-authorized `$summary` document without mutating the subject index. */
+    requestClinicalSummary(ctx: RouteContext, input: ClinicalSummaryRequestInput): Promise<ClinicalSummaryReadResult>;
     /** Reads subject-scoped clinical documents permitted to this member. */
     searchClinicalBundle(ctx: RouteContext, input: ClinicalBundleSearchInput): Promise<import("gdc-sdk-core-ts/polling-model.js").SubmitAndPollResult>;
     /** Reads the latest permitted IPS document for the selected subject. */

package/dist/orchestration/individual-member-sdk.js

@@ -6,7 +6,10 @@ export class IndividualMemberSdk {
         this.client = client;
     }
     /**
-     * Creates or updates the member/caregiver `RelatedPerson` relationship to the subject.
+     * Compatibility adapter for the older direct `RelatedPerson` route.
+     *
+     * @deprecated Author a typed RelatedPerson Bundle, attach it to a
+     * Communication outbox job, and call `ingestCommunicationAndUpdateIndex(...)`.
      */
     upsertRelatedPersonAndPoll(ctx, input) {
         return requireClientMethod(this.client, 'upsertRelatedPersonAndPoll')(ctx, input);
@@ -25,6 +28,10 @@ export class IndividualMemberSdk {
     ingestCommunicationAndUpdateIndex(ctx, input) {
         return requireClientMethod(this.client, 'ingestCommunicationAndUpdateIndex')(ctx, input);
     }
+    /** Reads the member-authorized `$summary` document without mutating the subject index. */
+    requestClinicalSummary(ctx, input) {
+        return requireClientMethod(this.client, 'requestClinicalSummary')(ctx, input);
+    }
     /** Reads subject-scoped clinical documents permitted to this member. */
     searchClinicalBundle(ctx, input) {
         return requireClientMethod(this.client, 'searchClinicalBundle')(ctx, input);

package/dist/orchestration/personal-sdk.d.ts

@@ -1,7 +1,7 @@
 import { type NodeRuntimeClient, type PollOptions, type SubmitAndPollResult, type SubmitPayload } from './client-port.js';
 import type { IndividualOrganizationBootstrapInput, IndividualOrganizationStartResult } from '../individual-start.js';
 import type { RouteContext } from '../individual-onboarding.js';
-import type { BlockchainArtifactRegistrationInput, ClinicalBundleSearchInput, CommunicationIngestionInput, CommunicationParticipantRuntimeSearchInput, DigitalTwinGenerationInput, GrantProfessionalAccessInput, GrantProfessionalAccessResult, IpsOrFhirImportInput, LicenseListRuntimeSearchInput, LicenseOfferRuntimeSearchInput, LicenseOrderRuntimeSearchInput } from '../resource-operations.js';
+import type { BlockchainArtifactRegistrationInput, ClinicalBundleSearchInput, ClinicalSummaryReadResult, ClinicalSummaryRequestInput, CommunicationIngestionInput, CommunicationParticipantRuntimeSearchInput, DigitalTwinGenerationInput, GrantProfessionalAccessInput, GrantProfessionalAccessResult, IpsOrFhirImportInput, LicenseListRuntimeSearchInput, LicenseOfferRuntimeSearchInput, LicenseOrderRuntimeSearchInput } from '../resource-operations.js';
 import type { SmartTokenExchangeResult, SmartTokenRequestInput } from '../smart-token.js';
 export declare class PersonalSdk {
     private readonly client;
@@ -14,6 +14,8 @@ export declare class PersonalSdk {
     importIpsOrFhirAndUpdateIndex(ctx: RouteContext, input: IpsOrFhirImportInput): Promise<SubmitAndPollResult>;
     /** Ingests canonical Communication and waits for projection completion. */
     ingestCommunicationAndUpdateIndex(ctx: RouteContext, input: CommunicationIngestionInput): Promise<SubmitAndPollResult>;
+    /** Reads the current subject through Communication `$summary`; it performs no ingestion. */
+    requestClinicalSummary(ctx: RouteContext, input: ClinicalSummaryRequestInput): Promise<ClinicalSummaryReadResult>;
     /** Registers one FHIR resource or raw artifact on blockchain before communication. */
     registerBlockchainArtifactAndUpdateIndex(ctx: RouteContext, input: BlockchainArtifactRegistrationInput): Promise<SubmitAndPollResult>;
     /** Searches indexed communication channel records by subject and participant identifiers. */

package/dist/orchestration/personal-sdk.js

@@ -20,6 +20,10 @@ export class PersonalSdk {
     ingestCommunicationAndUpdateIndex(ctx, input) {
         return requireClientMethod(this.client, 'ingestCommunicationAndUpdateIndex')(ctx, input);
     }
+    /** Reads the current subject through Communication `$summary`; it performs no ingestion. */
+    requestClinicalSummary(ctx, input) {
+        return requireClientMethod(this.client, 'requestClinicalSummary')(ctx, input);
+    }
     /** Registers one FHIR resource or raw artifact on blockchain before communication. */
     registerBlockchainArtifactAndUpdateIndex(ctx, input) {
         return requireClientMethod(this.client, 'registerBlockchainArtifactAndUpdateIndex')(ctx, input);

package/dist/orchestration/professional-sdk.d.ts

@@ -2,7 +2,7 @@ import { type ProfessionalEmployeeCredentialInput, type ProfessionalSmartVpPaylo
 import { type NodeRuntimeClient, type PollOptions, type SubmitAndPollResult, type SubmitPayload } from './client-port.js';
 import type { RouteContext } from '../individual-onboarding.js';
 import type { SmartTokenExchangeResult, SmartTokenRequestInput } from '../smart-token.js';
-import type { BlockchainArtifactRegistrationInput, CommunicationIngestionInput, CommunicationParticipantRuntimeSearchInput, ClinicalBundleSearchInput, GrantProfessionalAccessInput, GrantProfessionalAccessResult, VitalSignBatchCommunicationFromSearchResponseInput } from '../resource-operations.js';
+import type { BlockchainArtifactRegistrationInput, CommunicationIngestionInput, CommunicationParticipantRuntimeSearchInput, ClinicalBundleSearchInput, ClinicalSummaryReadResult, ClinicalSummaryRequestInput, GrantProfessionalAccessInput, GrantProfessionalAccessResult, VitalSignBatchCommunicationFromSearchResponseInput } from '../resource-operations.js';
 /**
  * Professional-oriented facade for runtime actions that belong to the
  * professional actor itself after tenant and employee provisioning have already
@@ -59,6 +59,8 @@ export declare class ProfessionalSdk {
      * session and tenant route context.
      */
     searchClinicalBundle(ctx: RouteContext, input: ClinicalBundleSearchInput): Promise<SubmitAndPollResult>;
+    /** Reads the consent-authorized clinical `$summary` document without ingestion. */
+    requestClinicalSummary(ctx: RouteContext, input: ClinicalSummaryRequestInput): Promise<ClinicalSummaryReadResult>;
     /**
      * Reads the latest IPS-oriented document projection available to the
      * professional actor for one subject.

package/dist/orchestration/professional-sdk.js

@@ -67,6 +67,10 @@ export class ProfessionalSdk {
     searchClinicalBundle(ctx, input) {
         return requireClientMethod(this.client, 'searchClinicalBundle')(ctx, input);
     }
+    /** Reads the consent-authorized clinical `$summary` document without ingestion. */
+    requestClinicalSummary(ctx, input) {
+        return requireClientMethod(this.client, 'requestClinicalSummary')(ctx, input);
+    }
     /**
      * Reads the latest IPS-oriented document projection available to the
      * professional actor for one subject.

package/dist/resource-operations.d.ts

@@ -1,10 +1,12 @@
 import type { DeviceAppType } from 'gdc-common-utils-ts/constants/device';
+import { type ClinicalSummaryReadResult, type ClinicalSummaryRequestInput } from 'gdc-sdk-core-ts';
 import type { LicenseOfferSearchState, LicenseOrderSearchState } from 'gdc-common-utils-ts/utils/license-commercial-search';
 import type { LicenseListSearchState } from 'gdc-common-utils-ts/utils/license-list-search';
 import type { BundleSearchQuery, CommMsgExtendedCommunicationOutboxJob, CommunicationOutboxJob, CommunicationInput, DateRange, EmployeeSearchValue, IndividualOrganizationLifecycleInput, TransportProfile } from 'gdc-sdk-core-ts';
 import type { BundleEntry, BundleJsonApi } from 'gdc-common-utils-ts/models/bundle';
 import type { SubmitAndPollResult } from './orchestration/client-port.js';
 import type { RouteContext } from './individual-onboarding.js';
+export type { ClinicalSummaryReadResult, ClinicalSummaryRequestInput, } from 'gdc-sdk-core-ts';
 export type OrganizationEmployeeCreationInput = {
     /**
      * Canonical employee/person claims sent to CORE GW.
@@ -675,6 +677,19 @@ export declare function searchCommunicationParticipantsWithDeps(routeCtx: RouteC
         intervalMs?: number;
     }) => Promise<SubmitAndPollResult>;
 }): Promise<SubmitAndPollResult>;
+/**
+ * Requests the subject's available clinical document through the canonical
+ * auditable read lifecycle:
+ *
+ * `Communication -> Subject/$summary -> FHIR Parameters -> Bundle document`.
+ *
+ * The dependency name intentionally says `submit`, not `ingest`: GW receives a
+ * Communication transport record, but the business operation is a read and
+ * must not be exposed to applications as index ingestion.
+ */
+export declare function requestClinicalSummaryWithDeps(routeCtx: RouteContext, input: ClinicalSummaryRequestInput, deps: {
+    submitSummaryCommunication: (ctx: RouteContext, input: CommunicationIngestionInput) => Promise<SubmitAndPollResult>;
+}): Promise<ClinicalSummaryReadResult>;
 export declare function searchClinicalBundleWithDeps(routeCtx: RouteContext, input: ClinicalBundleSearchInput, deps: {
     bundleSearchPath: (ctx: RouteContext) => string;
     bundleSearchPollPath: (ctx: RouteContext) => string;
@@ -757,4 +772,3 @@ export declare function generateDigitalTwinFromSubjectDataWithDeps(routeCtx: Rou
     }) => Promise<SubmitAndPollResult>;
 }): Promise<SubmitAndPollResult>;
 export declare function normalizeCommunicationPathFormatSegment(raw?: string): string;
-export {};

package/dist/resource-operations.js

@@ -3,7 +3,7 @@ import { HealthcareBasicSections, ResourceTypesFhirR4 } from 'gdc-common-utils-t
 import { Format } from 'gdc-common-utils-ts/constants/Schemas';
 import { RelatedPersonClaim } from 'gdc-common-utils-ts/models/interoperable-claims/related-person-claims';
 import { buildCommunicationParticipantSearchBundle, buildBlockchainArtifactDocumentReference, BundleQuery, createInteroperableResourceOperationEditor, IndividualOrganizationLifecycleEditor, LicenseOfferSearchEditor, LicenseOrderSearchEditor, InteroperableLifecycleStatuses, LicenseListSearchEditor, buildLicenseIssueEntry, buildLicensePurchaseEntry, } from 'gdc-common-utils-ts';
-import { addFhirResourceToCommunication, createCommunicationResource, } from 'gdc-sdk-core-ts';
+import { addFhirResourceToCommunication, createCommunicationResource, buildClinicalSummaryCommunicationJob, readClinicalSummaryOperationResult, } from 'gdc-sdk-core-ts';
 import { GwCoreLifecycleRequestMethod, GwCoreLifecycleRequestType, GwCoreLifecycleTodo, } from './constants/lifecycle.js';
 import { buildEmployeeBatchEntry, buildEmployeeSearchBundle, ConsentClaims, } from 'gdc-sdk-core-ts';
 export async function createOrganizationEmployeeWithDeps(routeCtx, input, options, deps) {
@@ -390,6 +390,26 @@ export async function searchCommunicationParticipantsWithDeps(routeCtx, input, d
     };
     return deps.submitAndPoll(deps.communicationSearchPath(routeCtx), deps.communicationSearchPollPath(routeCtx), payload, input.pollOptions);
 }
+/**
+ * Requests the subject's available clinical document through the canonical
+ * auditable read lifecycle:
+ *
+ * `Communication -> Subject/$summary -> FHIR Parameters -> Bundle document`.
+ *
+ * The dependency name intentionally says `submit`, not `ingest`: GW receives a
+ * Communication transport record, but the business operation is a read and
+ * must not be exposed to applications as index ingestion.
+ */
+export async function requestClinicalSummaryWithDeps(routeCtx, input, deps) {
+    const communicationJob = buildClinicalSummaryCommunicationJob(input);
+    const operation = await deps.submitSummaryCommunication(routeCtx, {
+        communicationJob,
+        clinicalFormat: input.clinicalFormat || 'api',
+        transportProfile: input.transportProfile,
+        pollOptions: input.pollOptions,
+    });
+    return readClinicalSummaryOperationResult(operation);
+}
 export async function searchClinicalBundleWithDeps(routeCtx, input, deps) {
     const query = buildBundleSearchQuery(input);
     const payload = {

package/dist/server-profile-session.d.ts

@@ -1,5 +1,6 @@
 import type { JWK } from 'gdc-common-utils-ts/models/jwk';
 import type { ActorKind } from 'gdc-common-utils-ts/models/actor-session';
+import type { ConfidentialStorageProfile } from 'gdc-sdk-core-ts';
 import type { RouteContext } from './individual-onboarding.js';
 import type { SecureDidcommTransportAdapter } from 'gdc-sdk-core-ts';
 import { type PinProtectedProfileSecret, type ProfileProtectionOptions, type ServerProfileSealer } from './server-profile-protection.js';
@@ -19,6 +20,10 @@ export type ServerProfileRecord = Readonly<{
     clientId: string;
     deviceDid: string;
     publicJwks: Record<string, unknown>[];
+    /** Public recipient key for local confidential storage; not a DCR communication key. */
+    storagePublicJwk?: Record<string, unknown>;
+    /** Server-owned policy; browser input is never authoritative for this value. */
+    confidentialStorageProfile?: ConfidentialStorageProfile;
     protectedWalletSeed: PinProtectedProfileSecret;
     protectedVpToken: PinProtectedProfileSecret;
     failedUnlocks: number;
@@ -77,18 +82,30 @@ export type ResolvedServerProfileSession = Readonly<{
     scopes: string[];
     accessToken: string;
     secureTransportAdapter: SecureDidcommTransportAdapter;
+    /** Storage adapter available only while the PIN-unlocked session is alive. */
+    confidentialStorageAdapter: Readonly<{
+        protect(document: Readonly<{
+            id?: string;
+            content: unknown;
+        }>): Promise<unknown>;
+        unprotect(document: Readonly<{
+            id?: string;
+            jwe: string;
+        }>): Promise<unknown>;
+    }>;
 }>;
 export type ServerProfileSessionManagerOptions = Readonly<{
     store: ServerProfileStore;
     sealer: ServerProfileSealer;
     gatewayBaseUrl: string;
-    recipientDid: string;
     resolveRecipientJwk: (recipientDid: string) => Promise<JWK>;
     fetchImpl?: typeof fetch;
     sessionTtlSeconds?: number;
     maxFailedUnlocks?: number;
     lockSeconds?: number;
     profileProtection?: ProfileProtectionOptions;
+    /** Product/tenant policy applied to enrollment and upgraded on next PIN unlock. */
+    requiredConfidentialStorageProfile?: ConfidentialStorageProfile;
     now?: () => Date;
 }>;
 /**
@@ -109,6 +126,13 @@ export declare class ServerProfileSessionManager {
     lock(ownerId: string, sessionId: string): Promise<void>;
     private createClient;
     private createWallet;
+    /**
+     * Upgrade legacy profiles deterministically after successful PIN unlock.
+     * The protected seed already owns the storage pair, so migration neither
+     * exports a private key nor calls KMS/GW. Only its public JWK and policy label
+     * are added to the durable profile record.
+     */
+    private ensureRequiredStorageProfile;
     private requireOwnedProfile;
     private requireSubject;
     private now;

package/dist/server-profile-session.js

@@ -21,6 +21,9 @@ export class ServerProfileSessionManager {
         const wallet = await this.createWallet(input.profileId, seed);
         const context = walletContext(input.profileId);
         const publicKeys = await wallet.getPublicJwks(context, {});
+        const storagePublicJwk = publicKeys.find((entry) => entry.purpose === 'document-at-rest')?.publicJwk;
+        if (!storagePublicJwk)
+            throw new Error('Server profile enrollment requires a document-at-rest ML-KEM key.');
         const client = this.createClient(input.routeContext, input.idToken);
         const activation = await client.activateProfileDeviceWithActivationRequest({
             ...input.routeContext,
@@ -30,7 +33,7 @@ export class ServerProfileSessionManager {
                 application_type: 'web',
                 actor_did: input.actorDid,
                 profile_did: input.profileDid,
-                jwks: { keys: publicKeys.map((entry) => entry.publicJwk) },
+                jwks: { keys: publicKeys.filter((entry) => entry.purpose !== 'document-at-rest').map((entry) => entry.publicJwk) },
             },
         });
         const dcrBody = terminalBody(activation.dcr.poll.body);
@@ -51,7 +54,9 @@ export class ServerProfileSessionManager {
             allowedSubjectDids: unique(input.allowedSubjectDids),
             clientId,
             deviceDid,
-            publicJwks: publicKeys.map((entry) => entry.publicJwk),
+            publicJwks: publicKeys.filter((entry) => entry.purpose !== 'document-at-rest').map((entry) => entry.publicJwk),
+            storagePublicJwk: storagePublicJwk,
+            confidentialStorageProfile: this.options.requiredConfidentialStorageProfile ?? 'confidential-basic-v1',
             protectedWalletSeed: await protectServerProfileSecret(seed, input.pin, `${input.profileId}:wallet-seed`, this.options.sealer, this.options.profileProtection),
             protectedVpToken: await protectServerProfileSecret(input.vpToken, input.pin, `${input.profileId}:vp-token`, this.options.sealer, this.options.profileProtection),
             failedUnlocks: 0,
@@ -65,7 +70,7 @@ export class ServerProfileSessionManager {
         return this.options.store.listProfiles(ownerId);
     }
     async unlock(input) {
-        const profile = await this.requireOwnedProfile(input.ownerId, input.profileId);
+        let profile = await this.requireOwnedProfile(input.ownerId, input.profileId);
         this.requireSubject(profile, input.subjectDid);
         const now = this.now();
         if (profile.lockedUntil && new Date(profile.lockedUntil) > now) {
@@ -88,6 +93,7 @@ export class ServerProfileSessionManager {
             await this.options.store.putProfile({ ...profile, failedUnlocks: failures, lockedUntil, updatedAt: now.toISOString() });
             throw new Error('Profile PIN rejected.');
         }
+        profile = await this.ensureRequiredStorageProfile(profile, seed);
         const wallet = await this.createWallet(profile.profileId, seed);
         const assertion = await buildWalletClientAssertion(wallet, profile, this.options.gatewayBaseUrl, now);
         const token = await this.createClient(profile.routeContext, input.idToken).requestSmartToken({
@@ -141,9 +147,13 @@ export class ServerProfileSessionManager {
             scopes: session.scopes,
             accessToken: await this.options.sealer.unseal(session.sealedAccessToken, `${sessionId}:access-token`),
             secureTransportAdapter: {
-                pack: (message) => wallet.packForRecipientWithContext(message, this.options.recipientDid, { context }),
+                pack: (message) => wallet.packForRecipientWithContext(message, profile.providerDid, { context }),
                 unpack: async (jwe) => (await wallet.unpackWithContext(jwe, { context })).content,
             },
+            confidentialStorageAdapter: {
+                protect: (document) => wallet.protectManagedConfidentialData(document, context),
+                unprotect: (document) => wallet.unprotectManagedConfidentialData(document, context),
+            },
         };
     }
     async lock(ownerId, sessionId) {
@@ -164,7 +174,7 @@ export class ServerProfileSessionManager {
         const context = walletContext(profileId);
         await wallet.provisionManagedKeys(context, {
             ownerScope: 'profile',
-            purposes: ['actor-signing'],
+            purposes: ['actor-signing', 'document-at-rest'],
             mode: 'deterministic',
             seedMaterial: seed,
         });
@@ -176,6 +186,35 @@ export class ServerProfileSessionManager {
         });
         return wallet;
     }
+    /**
+     * Upgrade legacy profiles deterministically after successful PIN unlock.
+     * The protected seed already owns the storage pair, so migration neither
+     * exports a private key nor calls KMS/GW. Only its public JWK and policy label
+     * are added to the durable profile record.
+     */
+    async ensureRequiredStorageProfile(profile, seed) {
+        const required = this.options.requiredConfidentialStorageProfile ?? profile.confidentialStorageProfile ?? 'confidential-basic-v1';
+        if (required !== 'confidential-pqc-v1')
+            return profile;
+        const wallet = await this.createWallet(profile.profileId, seed);
+        const storageKeys = await wallet.getPublicJwks(walletContext(profile.profileId), {
+            ownerScope: 'profile', purpose: 'document-at-rest', alg: 'ML-KEM-768',
+        });
+        const storagePublicJwk = storageKeys[0]?.publicJwk;
+        if (!storagePublicJwk)
+            throw new Error('Required ML-KEM storage key could not be provisioned.');
+        const hasKey = profile.storagePublicJwk?.kid === storagePublicJwk.kid;
+        if (profile.confidentialStorageProfile === required && hasKey)
+            return profile;
+        const upgraded = {
+            ...profile,
+            confidentialStorageProfile: required,
+            storagePublicJwk,
+            updatedAt: this.now().toISOString(),
+        };
+        await this.options.store.putProfile(upgraded);
+        return upgraded;
+    }
     async requireOwnedProfile(ownerId, profileId) {
         const profile = await this.options.store.getProfile(profileId);
         if (!profile || profile.ownerId !== ownerId)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-sdk-node-ts",
-  "version": "2.3.1",
+  "version": "2.3.3",
   "description": "Next-generation Node runtime package for the GDC SDK family",
   "license": "Apache-2.0",
   "author": "Antifraud Services Inc.",
@@ -13,6 +13,7 @@
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "type-check": "tsc -p tsconfig.json --noEmit",
+    "prepublishOnly": "npm run type-check && npm test",
     "local:close": "PORTS=3000 bash ./scripts/local-close.sh",
     "docker:close": "PORTS=8000 bash ./scripts/local-close.sh",
     "test": "npm run build && node --test tests/*.test.mjs",
@@ -35,8 +36,8 @@
     "test:e2e:live-gw:clean": "bash ./scripts/run-live-gw-clean.sh"
   },
   "dependencies": {
-    "gdc-common-utils-ts": "^2.3.1",
-    "gdc-sdk-core-ts": "~2.3.1"
+    "gdc-common-utils-ts": "^2.3.2",
+    "gdc-sdk-core-ts": "~2.3.2"
   },
   "devDependencies": {
     "@types/node": "^20.14.10",