gdc-sdk-node-ts 2.4.2 → 2.4.4

package/dist/device-activation.d.ts

@@ -21,6 +21,21 @@ export type EmployeeDeviceActivationResult = {
     exchange: SubmitAndPollResult;
     dcr: SubmitAndPollResult;
 };
+export type EmployeeDeviceRevocationInput = {
+    licenseId: string;
+    clientId: string;
+    requestThid?: string;
+    pollOptions?: PollOptions;
+};
+export declare function revokeEmployeeDeviceWithDeps(deps: {
+    routeCtx: RouteContext;
+    input: EmployeeDeviceRevocationInput;
+    identityDeviceRevokePath: (ctx: RouteContext) => string;
+    identityDeviceRevokePollPath: (ctx: RouteContext) => string;
+    submitAndPoll: (submitPath: string, pollPath: string, payload: {
+        thid?: string;
+    } & Record<string, unknown>, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
+}): Promise<SubmitAndPollResult>;
 type ActivateEmployeeDeviceDeps = {
     routeCtx: RouteContext;
     input: EmployeeDeviceActivationInput;

package/dist/device-activation.js

@@ -1,30 +1,44 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
 import { resolvePollOptionsFromSeconds } from './poll-options.js';
+import { IdentityAuthRequestFields, IdentityAuthResponseFields, IdentityDcrMetadataFields, IdentityDeviceInfoFields, } from 'gdc-common-utils-ts/constants/identity-auth';
+import { buildEmployeeDeviceRevocationBody } from 'gdc-common-utils-ts/utils/organization-employee-lifecycle';
+export async function revokeEmployeeDeviceWithDeps(deps) {
+    const licenseId = String(deps.input.licenseId || '').trim();
+    const clientId = String(deps.input.clientId || '').trim();
+    if (!licenseId || !clientId)
+        throw new Error('revokeEmployeeDevice: licenseId and clientId are required.');
+    return deps.submitAndPoll(deps.identityDeviceRevokePath(deps.routeCtx), deps.identityDeviceRevokePollPath(deps.routeCtx), {
+        thid: deps.input.requestThid || `device-revoke-${createRuntimeUuid()}`,
+        body: buildEmployeeDeviceRevocationBody({ licenseId, clientId }),
+    }, deps.input.pollOptions);
+}
 export async function activateEmployeeDeviceWithActivationCodeWithDeps(deps) {
-    const deviceInfo = deps.input.dcrPayload.ext_device_info;
-    const redirectUris = deps.input.dcrPayload.redirect_uris;
-    const jwks = deps.input.dcrPayload.jwks;
-    const clientInstanceId = String(deviceInfo?.device_id
-        || (deps.input.dcrPayload.software_id ? `software:${deps.input.dcrPayload.software_id}` : '')
+    const deviceInfo = deps.input.dcrPayload[IdentityDcrMetadataFields.ExtendedDeviceInfo];
+    const redirectUris = deps.input.dcrPayload[IdentityDcrMetadataFields.RedirectUris];
+    const jwks = deps.input.dcrPayload[IdentityDcrMetadataFields.Jwks];
+    const clientInstanceId = String(deviceInfo?.[IdentityDeviceInfoFields.DeviceId]
+        || (deps.input.dcrPayload[IdentityDcrMetadataFields.SoftwareId] ? `software:${deps.input.dcrPayload[IdentityDcrMetadataFields.SoftwareId]}` : '')
         || (redirectUris?.[0] ? `redirect:${redirectUris[0]}` : '')
         || (jwks?.keys?.[0]?.kid ? `key:${jwks.keys[0].kid}` : '')).trim();
     if (!clientInstanceId)
         throw new Error('Device activation requires a stable device, software, redirect, or key identifier.');
     const exchangePayload = {
         thid: `exchange-${createRuntimeUuid()}`,
-        subject_token: deps.input.activationCode,
-        client_instance_id: clientInstanceId,
+        [IdentityAuthRequestFields.SubjectToken]: deps.input.activationCode,
+        [IdentityAuthRequestFields.ClientInstanceId]: clientInstanceId,
     };
     const exchange = await deps.submitAndPollWithBearerToken(deps.input.idToken, deps.identityTokenExchangePath(deps.routeCtx), deps.identityTokenExchangePollPath(deps.routeCtx), exchangePayload, deps.input.pollOptions);
     const pollBody = exchange.poll.body || {};
     const exchangeBody = (pollBody.body || pollBody);
-    const initialAccessToken = String(exchangeBody.initial_access_token || exchangeBody.access_token || '').trim();
+    const initialAccessToken = String(exchangeBody[IdentityAuthResponseFields.InitialAccessToken]
+        || exchangeBody[IdentityAuthResponseFields.AccessToken]
+        || '').trim();
     if (!initialAccessToken) {
         throw new Error('activateEmployeeDeviceWithActivationCode: missing initial_access_token in exchange response.');
     }
     const dcrPayload = {
         thid: `dcr-${createRuntimeUuid()}`,
-        code: deps.input.activationCode,
+        [IdentityAuthRequestFields.Code]: deps.input.activationCode,
         ...deps.input.dcrPayload,
     };
     const dcr = await deps.submitAndPollWithBearerToken(initialAccessToken, deps.identityDeviceDcrPath(deps.routeCtx), deps.identityDeviceDcrPollPath(deps.routeCtx), dcrPayload, deps.input.pollOptions);

package/dist/index.d.ts

@@ -17,7 +17,8 @@ export * from './family-organization-registration.js';
 export * from './individual-onboarding.js';
 export * from './device-activation.js';
 export * from './organization-controller-recovery.js';
-export * from './organization-registration-authorization.js';
+export * from './organization-test-network-credential.js';
+export * from './organization-employee-lifecycle.js';
 export * from './smart-token.js';
 export * from './fhir-r5-subscription-runtime.js';
 export * from './order-offer-summary.js';

package/dist/index.js

@@ -18,7 +18,8 @@ export * from './family-organization-registration.js';
 export * from './individual-onboarding.js';
 export * from './device-activation.js';
 export * from './organization-controller-recovery.js';
-export * from './organization-registration-authorization.js';
+export * from './organization-test-network-credential.js';
+export * from './organization-employee-lifecycle.js';
 export * from './smart-token.js';
 export * from './fhir-r5-subscription-runtime.js';
 export * from './order-offer-summary.js';

package/dist/node-runtime-client.d.ts

@@ -8,12 +8,14 @@ import { type IndividualOrganizationConfirmOrderInput, type RouteContext } from
 import { type EnsureFamilyOrganizationRegistrationInput } from './family-organization-registration.js';
 import { type FamilyOrganizationSearchInput } from './family-organization-search.js';
 import { type SmartTokenRequestInput } from './smart-token.js';
-import { type EmployeeDeviceActivationRequestInput, type EmployeeDeviceActivationResult } from './device-activation.js';
+import { type EmployeeDeviceActivationRequestInput, type EmployeeDeviceActivationResult, type EmployeeDeviceRevocationInput } from './device-activation.js';
 import { type OrganizationLicenseOrderConfirmInput } from './organization-license-order.js';
 import { type IndividualOrganizationBootstrapInput, type IndividualOrganizationStartResult } from './individual-start.js';
-import { type CommunicationIngestionInput, type BlockchainArtifactRegistrationInput, type VitalSignBatchCommunicationFromSearchResponseInput, type CommunicationParticipantRuntimeSearchInput, type ClinicalBundleSearchInput, type ClinicalSectionUpdateInput, type ClinicalSummaryReadResult, type ClinicalSummaryRequestInput, type ClinicalSummaryUpdateInput, type GrantProfessionalAccessInput, type GrantProfessionalAccessResult, type IndividualMemberLifecycleInput, type IndividualMemberLicenseAddInput, type IndividualMemberLicenseInvitationInput, type IndividualMemberLicenseTransitionInput, type LicenseListRuntimeSearchInput, type LicenseOfferRuntimeSearchInput, type LicenseOrderRuntimeSearchInput, type OrganizationEmployeeCreationInput, type OrganizationEmployeeLifecycleInput, type OrganizationEmployeeSearchInput, type ProfessionalAccessRequestInput, type ProfessionalAccessRequestResult, type RevokeProfessionalAccessInput, type RevokeProfessionalAccessResult, type RelatedPersonUpsertInput } from './resource-operations.js';
+import { type CommunicationIngestionInput, type BlockchainArtifactRegistrationInput, type VitalSignBatchCommunicationFromSearchResponseInput, type CommunicationParticipantRuntimeSearchInput, type ClinicalBundleSearchInput, type ClinicalSectionUpdateInput, type ClinicalSummaryReadResult, type ClinicalSummaryRequestInput, type ClinicalSummaryUpdateInput, type GrantProfessionalAccessInput, type GrantProfessionalAccessResult, type IndividualMemberLifecycleInput, type IndividualMemberLicenseAddInput, type IndividualMemberLicenseInvitationInput, type IndividualMemberLicenseTransitionInput, type LicenseListRuntimeSearchInput, type LicenseOfferRuntimeSearchInput, type LicenseOrderRuntimeSearchInput, type OrganizationEmployeeCreationInput, type OrganizationEmployeeLicenseInvitationInput, type OrganizationEmployeeLifecycleInput, type OrganizationEmployeeSearchInput, type ProfessionalAccessRequestInput, type ProfessionalAccessRequestResult, type RevokeProfessionalAccessInput, type RevokeProfessionalAccessResult, type RelatedPersonUpsertInput } from './resource-operations.js';
 import type { LegalOrganizationOrderInput } from './host-onboarding.js';
 import type { SmartTokenExchangeResult } from './smart-token.js';
+import { type OrganizationEmployeeProvisioningInput, type OrganizationEmployeeProvisioningResult } from './organization-employee-lifecycle.js';
+import type { OrganizationEmployeeLifecycleRecord } from 'gdc-common-utils-ts/models/organization-employee-lifecycle';
 import type { NodeRuntimeClient, PollOptions, PollResult, SubmitAndPollResult, SubmitPayload, SubmitResponse } from './orchestration/client-port.js';
 import { type FhirR5SubscriptionBatchInput } from './fhir-r5-subscription-runtime.js';
 import type { FhirR5SubscriptionTopic } from 'gdc-common-utils-ts/models/fhir-r5-subscription';
@@ -250,6 +252,12 @@ export declare class HttpRuntimeClient implements NodeRuntimeClient {
      * Creates an employee or professional entry under an existing organization tenant.
      */
     createOrganizationEmployee(ctx: RouteContext, input: OrganizationEmployeeCreationInput, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
+    /** Creates an employee and reserves its activation credential as one SDK workflow. */
+    provisionOrganizationEmployee(ctx: RouteContext, input: OrganizationEmployeeProvisioningInput): Promise<OrganizationEmployeeProvisioningResult>;
+    /** Revokes one selected employee installation without releasing its seat. */
+    revokeEmployeeDevice(ctx: RouteContext, input: EmployeeDeviceRevocationInput): Promise<SubmitAndPollResult>;
+    /** Reserves an employee seat and issues its bounded multi-device activation credential. */
+    issueOrganizationEmployeeLicense(ctx: RouteContext, input: OrganizationEmployeeLicenseInvitationInput): Promise<SubmitAndPollResult>;
     /**
      * Disables an employee using the current GW CORE contract.
      *
@@ -276,6 +284,8 @@ export declare class HttpRuntimeClient implements NodeRuntimeClient {
      * Searches employees/professionals under the selected organization tenant.
      */
     searchOrganizationEmployees(ctx: RouteContext, input: OrganizationEmployeeSearchInput): Promise<SubmitAndPollResult>;
+    /** Lists employees with their license and installation state. */
+    listOrganizationEmployeeLifecycle(ctx: RouteContext): Promise<OrganizationEmployeeLifecycleRecord[]>;
     /**
      * Searches organization-owned license seats through the canonical
      * `License/_search` route.

package/dist/node-runtime-client.js

@@ -8,11 +8,12 @@ import { confirmIndividualOrganizationOrderWithDeps, } from './individual-onboar
 import { ensureFamilyOrganizationRegistrationWithDeps, } from './family-organization-registration.js';
 import { searchFamilyOrganizationWithDeps } from './family-organization-search.js';
 import { requestSmartTokenWithDeps } from './smart-token.js';
-import { activateEmployeeDeviceWithActivationCodeWithDeps, activateEmployeeDeviceWithActivationRequestWithDeps, } from './device-activation.js';
+import { activateEmployeeDeviceWithActivationCodeWithDeps, activateEmployeeDeviceWithActivationRequestWithDeps, revokeEmployeeDeviceWithDeps, } from './device-activation.js';
 import { extractOfferIdFromResponseBody, extractOfferPreviewFromResponseBody, } from './order-offer-summary.js';
 import { confirmOrganizationLicenseOrderWithDeps } from './organization-license-order.js';
 import { startIndividualOrganizationWithDeps } from './individual-start.js';
-import { createOrganizationEmployeeWithDeps, disableIndividualMemberWithDeps, disableIndividualOrganizationWithDeps, disableOrganizationEmployeeWithDeps, listIndividualLicenseOffersWithDeps, listIndividualLicenseOrdersWithDeps, listIndividualLicensesWithDeps, addFreeIndividualMemberLicensesWithDeps, issueIndividualMemberLicenseWithDeps, transitionIndividualMemberLicenseWithDeps, listOrganizationLicenseOffersWithDeps, listOrganizationLicenseOrdersWithDeps, listOrganizationLicensesWithDeps, grantProfessionalAccessWithDeps, buildClinicalSectionUpdateIngestion, buildClinicalSummaryUpdateIngestion, ingestCommunicationAndUpdateIndexWithDeps, requestProfessionalAccessWithDeps, buildVitalSignBatchCommunicationFromSearchResponse, registerBlockchainArtifactAndUpdateIndexWithDeps, requestClinicalSummaryWithDeps, revokeProfessionalAccessWithDeps, searchCommunicationParticipantsWithDeps, purgeIndividualMemberWithDeps, purgeIndividualOrganizationWithDeps, purgeOrganizationEmployeeWithDeps, prepareEmployeeLifecycleMessageForTransport, searchIndividualLicensesWithDeps, searchIndividualLicenseOffersWithDeps, searchIndividualLicenseOrdersWithDeps, searchOrganizationLicensesWithDeps, searchOrganizationLicenseOffersWithDeps, searchOrganizationLicenseOrdersWithDeps, searchOrganizationEmployeesWithDeps, searchClinicalBundleWithDeps, searchLatestIpsWithDeps, upsertRelatedPersonAndPollWithDeps, normalizeCommunicationPathFormatSegment, } from './resource-operations.js';
+import { createOrganizationEmployeeWithDeps, issueOrganizationEmployeeLicenseWithDeps, disableIndividualMemberWithDeps, disableIndividualOrganizationWithDeps, disableOrganizationEmployeeWithDeps, listIndividualLicenseOffersWithDeps, listIndividualLicenseOrdersWithDeps, listIndividualLicensesWithDeps, addFreeIndividualMemberLicensesWithDeps, issueIndividualMemberLicenseWithDeps, transitionIndividualMemberLicenseWithDeps, listOrganizationLicenseOffersWithDeps, listOrganizationLicenseOrdersWithDeps, listOrganizationLicensesWithDeps, grantProfessionalAccessWithDeps, buildClinicalSectionUpdateIngestion, buildClinicalSummaryUpdateIngestion, ingestCommunicationAndUpdateIndexWithDeps, requestProfessionalAccessWithDeps, buildVitalSignBatchCommunicationFromSearchResponse, registerBlockchainArtifactAndUpdateIndexWithDeps, requestClinicalSummaryWithDeps, revokeProfessionalAccessWithDeps, searchCommunicationParticipantsWithDeps, purgeIndividualMemberWithDeps, purgeIndividualOrganizationWithDeps, purgeOrganizationEmployeeWithDeps, prepareEmployeeLifecycleMessageForTransport, searchIndividualLicensesWithDeps, searchIndividualLicenseOffersWithDeps, searchIndividualLicenseOrdersWithDeps, searchOrganizationLicensesWithDeps, searchOrganizationLicenseOffersWithDeps, searchOrganizationLicenseOrdersWithDeps, searchOrganizationEmployeesWithDeps, searchClinicalBundleWithDeps, searchLatestIpsWithDeps, upsertRelatedPersonAndPollWithDeps, normalizeCommunicationPathFormatSegment, } from './resource-operations.js';
+import { listOrganizationEmployeeLifecycleWithDeps, provisionOrganizationEmployeeWithDeps, } from './organization-employee-lifecycle.js';
 import { submitAndPollWithMethods } from './orchestration/client-port.js';
 import { buildRuntimeHeaders, fetchWithTimeout, parseResponseBody, pollBatchResponseWithRuntimeConfig, postJsonWithRuntimeConfig, postRenderedWithRuntimeConfig, } from './runtime-transport.js';
 import { activateOrganizationInGatewayFromIcaProofWithDeps, submitLegalOrganizationCredentialReissuanceWithDeps, submitLegalOrganizationVerificationTransactionWithDeps, submitOrganizationDidBindingWithDeps, } from './runtime-host-submission.js';
@@ -365,6 +366,35 @@ export class HttpRuntimeClient {
             submitAndPoll: (submitPath, pollPath, payload, options) => this.submitClinicalMessageAndPoll(submitPath, pollPath, prepareEmployeeLifecycleMessageForTransport(payload, this.transportProfile), this.transportProfile, options),
         });
     }
+    /** Creates an employee and reserves its activation credential as one SDK workflow. */
+    async provisionOrganizationEmployee(ctx, input) {
+        return provisionOrganizationEmployeeWithDeps(ctx, input, {
+            createEmployee: (routeContext, creation) => this.createOrganizationEmployee(routeContext, creation),
+            issueLicense: (routeContext, invitation) => this.issueOrganizationEmployeeLicense(routeContext, invitation),
+        });
+    }
+    /** Revokes one selected employee installation without releasing its seat. */
+    async revokeEmployeeDevice(ctx, input) {
+        return revokeEmployeeDeviceWithDeps({
+            routeCtx: ctx,
+            input,
+            identityDeviceRevokePath: this.paths.identityDeviceRevokePath.bind(this.paths),
+            identityDeviceRevokePollPath: this.paths.identityDeviceRevokePollPath.bind(this.paths),
+            submitAndPoll: this.transportProfile === TransportProfiles.DidcommEncryptedForm
+                ? (submitPath, pollPath, payload, pollOptions) => this.submitClinicalMessageAndPoll(submitPath, pollPath, payload, this.transportProfile, pollOptions)
+                : this.submitAndPoll.bind(this),
+        });
+    }
+    /** Reserves an employee seat and issues its bounded multi-device activation credential. */
+    async issueOrganizationEmployeeLicense(ctx, input) {
+        return issueOrganizationEmployeeLicenseWithDeps(ctx, input, {
+            identityLicenseIssuePath: this.paths.identityLicenseIssuePath.bind(this.paths),
+            identityLicenseIssuePollPath: this.paths.identityLicenseIssuePollPath.bind(this.paths),
+            submitAndPoll: this.transportProfile === TransportProfiles.DidcommEncryptedForm
+                ? (submitPath, pollPath, payload, pollOptions) => this.submitClinicalMessageAndPoll(submitPath, pollPath, payload, this.transportProfile, pollOptions)
+                : this.submitAndPoll.bind(this),
+        });
+    }
     /**
      * Disables an employee using the current GW CORE contract.
      *
@@ -413,6 +443,13 @@ export class HttpRuntimeClient {
             submitAndPoll: this.submitAndPoll.bind(this),
         });
     }
+    /** Lists employees with their license and installation state. */
+    async listOrganizationEmployeeLifecycle(ctx) {
+        return listOrganizationEmployeeLifecycleWithDeps(ctx, {
+            searchEmployees: (routeContext, input) => this.searchOrganizationEmployees(routeContext, input),
+            listLicenses: (routeContext, input) => this.listOrganizationLicenses(routeContext, input),
+        });
+    }
     /**
      * Searches organization-owned license seats through the canonical
      * `License/_search` route.

package/dist/orchestration/client-port.d.ts

@@ -5,7 +5,9 @@ import type { IndividualOrganizationLifecycleInput, OrganizationDidBindingInput
 import type { LicenseListRuntimeSearchInput, LicenseOfferRuntimeSearchInput, LicenseOrderRuntimeSearchInput } from '../resource-operations.js';
 import type { AsyncPollRequest, OrganizationActivationServiceOptions, PollOptions, PollResult, SubmitAndPollResult, SubmitPayload, SubmitResponse } from 'gdc-sdk-core-ts';
 export type { AsyncPollRequest, PollOptions, PollResult, SubmitAndPollResult, SubmitPayload, SubmitResponse, } from 'gdc-sdk-core-ts';
-import type { EmployeeDeviceActivationResult, EmployeeDeviceActivationRequestInput } from '../device-activation.js';
+import type { EmployeeDeviceActivationResult, EmployeeDeviceActivationRequestInput, EmployeeDeviceRevocationInput } from '../device-activation.js';
+import type { OrganizationEmployeeProvisioningInput, OrganizationEmployeeProvisioningResult } from '../organization-employee-lifecycle.js';
+import type { OrganizationEmployeeLifecycleRecord } from 'gdc-common-utils-ts/models/organization-employee-lifecycle';
 import type { HostRouteContext, HostedTenantLifecycleInput, LegalOrganizationOrderInput } from '../host-onboarding.js';
 import type { IndividualOrganizationConfirmOrderInput, RouteContext } from '../individual-onboarding.js';
 import type { IndividualOrganizationBootstrapInput, IndividualOrganizationStartResult } from '../individual-start.js';
@@ -15,7 +17,7 @@ import type { FhirR5SubscriptionBatchInput } from '../fhir-r5-subscription-runti
 import type { EnsureFamilyOrganizationRegistrationInput, EnsureFamilyOrganizationRegistrationResult } from '../family-organization-registration.js';
 import type { OrganizationLicenseOrderConfirmInput } from '../organization-license-order.js';
 import type { SmartTokenExchangeResult, SmartTokenRequestInput } from '../smart-token.js';
-import type { CommunicationIngestionInput, BlockchainArtifactRegistrationInput, CommunicationParticipantRuntimeSearchInput, ClinicalBundleSearchInput, ClinicalSectionUpdateInput, ClinicalSummaryReadResult, ClinicalSummaryRequestInput, ClinicalSummaryUpdateInput, VitalSignBatchCommunicationFromSearchResponseInput, DigitalTwinGenerationInput, GrantProfessionalAccessInput, GrantProfessionalAccessResult, IndividualMemberLifecycleInput, IndividualMemberLicenseAddInput, IndividualMemberLicenseInvitationInput, IndividualMemberLicenseTransitionInput, IpsOrFhirImportInput, OrganizationEmployeeCreationInput, OrganizationEmployeeLifecycleInput, OrganizationEmployeeSearchInput, ProfessionalAccessRequestInput, ProfessionalAccessRequestResult, RevokeProfessionalAccessInput, RevokeProfessionalAccessResult, RelatedPersonUpsertInput } from '../resource-operations.js';
+import type { CommunicationIngestionInput, BlockchainArtifactRegistrationInput, CommunicationParticipantRuntimeSearchInput, ClinicalBundleSearchInput, ClinicalSectionUpdateInput, ClinicalSummaryReadResult, ClinicalSummaryRequestInput, ClinicalSummaryUpdateInput, VitalSignBatchCommunicationFromSearchResponseInput, DigitalTwinGenerationInput, GrantProfessionalAccessInput, GrantProfessionalAccessResult, IndividualMemberLifecycleInput, IndividualMemberLicenseAddInput, IndividualMemberLicenseInvitationInput, IndividualMemberLicenseTransitionInput, IpsOrFhirImportInput, OrganizationEmployeeCreationInput, OrganizationEmployeeLicenseInvitationInput, OrganizationEmployeeLifecycleInput, OrganizationEmployeeSearchInput, ProfessionalAccessRequestInput, ProfessionalAccessRequestResult, RevokeProfessionalAccessInput, RevokeProfessionalAccessResult, RelatedPersonUpsertInput } from '../resource-operations.js';
 /**
  * Shared node-runtime activation input.
  *
@@ -72,7 +74,10 @@ export type RuntimeClient = {
     disableTenant?: (hostCtx: HostRouteContext, input: HostedTenantLifecycleInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
     purgeTenant?: (hostCtx: HostRouteContext, input: HostedTenantLifecycleInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
     createOrganizationEmployee?: (ctx: RouteContext, input: OrganizationEmployeeCreationInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
+    provisionOrganizationEmployee?: (ctx: RouteContext, input: OrganizationEmployeeProvisioningInput) => Promise<OrganizationEmployeeProvisioningResult>;
+    issueOrganizationEmployeeLicense?: (ctx: RouteContext, input: OrganizationEmployeeLicenseInvitationInput) => Promise<SubmitAndPollResult>;
     searchOrganizationEmployees?: (ctx: RouteContext, input: OrganizationEmployeeSearchInput) => Promise<SubmitAndPollResult>;
+    listOrganizationEmployeeLifecycle?: (ctx: RouteContext) => Promise<OrganizationEmployeeLifecycleRecord[]>;
     searchOrganizationLicenses?: (ctx: RouteContext, input: LicenseListRuntimeSearchInput) => Promise<SubmitAndPollResult>;
     listOrganizationLicenses?: (ctx: RouteContext, input?: LicenseListRuntimeSearchInput) => Promise<SubmitAndPollResult>;
     searchOrganizationLicenseOffers?: (ctx: RouteContext, input: LicenseOfferRuntimeSearchInput) => Promise<SubmitAndPollResult>;
@@ -85,6 +90,7 @@ export type RuntimeClient = {
     disableOrganizationEmployee?: (ctx: RouteContext, input: OrganizationEmployeeLifecycleInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
     purgeOrganizationEmployee?: (ctx: RouteContext, input: OrganizationEmployeeLifecycleInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
     activateEmployeeDeviceWithActivationRequest?: (input: EmployeeDeviceActivationRequestInput) => Promise<EmployeeDeviceActivationResult>;
+    revokeEmployeeDevice?: (ctx: RouteContext, input: EmployeeDeviceRevocationInput) => Promise<SubmitAndPollResult>;
     requestSmartToken?: (input: SmartTokenRequestInput) => Promise<SmartTokenExchangeResult>;
     startIndividualOrganization?: (input: IndividualOrganizationBootstrapInput) => Promise<IndividualOrganizationStartResult>;
     searchFamilyOrganization?: (ctx: RouteContext, input: FamilyOrganizationSearchInput) => Promise<FamilyOrganizationSummary | null>;

package/dist/orchestration/organization-controller-sdk.d.ts

@@ -1,11 +1,13 @@
 import { type NodeOrganizationDidBindingInput, type NodeLegalOrganizationVerificationTransactionInput, type NodeRuntimeClient, type PollOptions, type SubmitAndPollResult, type SubmitPayload } from './client-port.js';
 import type { RouteContext } from '../individual-onboarding.js';
 import type { HostRouteContext, HostedTenantLifecycleInput } from '../host-onboarding.js';
-import type { EmployeeDeviceActivationResult, EmployeeDeviceActivationRequestInput } from '../device-activation.js';
+import type { EmployeeDeviceActivationResult, EmployeeDeviceActivationRequestInput, EmployeeDeviceRevocationInput } from '../device-activation.js';
 import type { SmartTokenExchangeResult, SmartTokenRequestInput } from '../smart-token.js';
 import type { OrganizationLicenseOrderConfirmInput } from '../organization-license-order.js';
 import type { NodeCapability } from '../session.js';
-import type { LicenseListRuntimeSearchInput, LicenseOfferRuntimeSearchInput, LicenseOrderRuntimeSearchInput, OrganizationEmployeeCreationInput, OrganizationEmployeeLifecycleInput, OrganizationEmployeeSearchInput } from '../resource-operations.js';
+import type { LicenseListRuntimeSearchInput, LicenseOfferRuntimeSearchInput, LicenseOrderRuntimeSearchInput, OrganizationEmployeeCreationInput, OrganizationEmployeeLicenseInvitationInput, OrganizationEmployeeLifecycleInput, OrganizationEmployeeSearchInput } from '../resource-operations.js';
+import type { OrganizationEmployeeProvisioningInput, OrganizationEmployeeProvisioningResult } from '../organization-employee-lifecycle.js';
+import type { OrganizationEmployeeLifecycleRecord } from 'gdc-common-utils-ts/models/organization-employee-lifecycle';
 /**
  * Organization-controller oriented facade over a `NodeRuntimeClient`.
  *
@@ -55,6 +57,10 @@ export declare class OrganizationControllerSdk {
      * Creates an employee/professional under the current organization tenant.
      */
     createOrganizationEmployee(ctx: RouteContext, input: OrganizationEmployeeCreationInput, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
+    /** Creates the employee and issues its reusable multi-installation credential. */
+    provisionOrganizationEmployee(ctx: RouteContext, input: OrganizationEmployeeProvisioningInput): Promise<OrganizationEmployeeProvisioningResult>;
+    /** Reserves the employee seat and returns its bounded multi-device activation credential. */
+    issueOrganizationEmployeeLicense(ctx: RouteContext, input: OrganizationEmployeeLicenseInvitationInput): Promise<SubmitAndPollResult>;
     /**
      * Disables an employee using the current GW CORE lifecycle contract.
      */
@@ -67,6 +73,8 @@ export declare class OrganizationControllerSdk {
      * Searches employees/professionals under the current organization tenant.
      */
     searchOrganizationEmployees(ctx: RouteContext, input: OrganizationEmployeeSearchInput): Promise<SubmitAndPollResult>;
+    /** Lists employees with typed license and device lifecycle state. */
+    listOrganizationEmployeeLifecycle(ctx: RouteContext): Promise<OrganizationEmployeeLifecycleRecord[]>;
     /**
      * Searches organization-owned license seats using semantic license filters.
      */
@@ -130,6 +138,8 @@ export declare class OrganizationControllerSdk {
      * Activates the employee device from a previously issued activation request.
      */
     activateEmployeeDeviceWithActivationRequest(input: EmployeeDeviceActivationRequestInput): Promise<EmployeeDeviceActivationResult>;
+    /** Revokes one selected installation while preserving the employee and seat. */
+    revokeEmployeeDevice(ctx: RouteContext, input: EmployeeDeviceRevocationInput): Promise<SubmitAndPollResult>;
     /**
      * Requests a SMART token for the current organization-scoped actor.
      *

package/dist/orchestration/organization-controller-sdk.js

@@ -66,6 +66,15 @@ export class OrganizationControllerSdk {
         assertFacadeCapability(this.capabilities, ActorCapabilities.OrganizationCreateEmployee, ActorKinds.OrganizationController, 'createOrganizationEmployee');
         return requireClientMethod(this.client, 'createOrganizationEmployee')(ctx, input, pollOptions);
     }
+    /** Creates the employee and issues its reusable multi-installation credential. */
+    provisionOrganizationEmployee(ctx, input) {
+        assertFacadeCapability(this.capabilities, ActorCapabilities.OrganizationCreateEmployee, ActorKinds.OrganizationController, 'provisionOrganizationEmployee');
+        return requireClientMethod(this.client, 'provisionOrganizationEmployee')(ctx, input);
+    }
+    /** Reserves the employee seat and returns its bounded multi-device activation credential. */
+    issueOrganizationEmployeeLicense(ctx, input) {
+        return requireClientMethod(this.client, 'issueOrganizationEmployeeLicense')(ctx, input);
+    }
     /**
      * Disables an employee using the current GW CORE lifecycle contract.
      */
@@ -86,6 +95,10 @@ export class OrganizationControllerSdk {
     searchOrganizationEmployees(ctx, input) {
         return requireClientMethod(this.client, 'searchOrganizationEmployees')(ctx, input);
     }
+    /** Lists employees with typed license and device lifecycle state. */
+    listOrganizationEmployeeLifecycle(ctx) {
+        return requireClientMethod(this.client, 'listOrganizationEmployeeLifecycle')(ctx);
+    }
     /**
      * Searches organization-owned license seats using semantic license filters.
      */
@@ -177,6 +190,10 @@ export class OrganizationControllerSdk {
     activateEmployeeDeviceWithActivationRequest(input) {
         return requireClientMethod(this.client, 'activateEmployeeDeviceWithActivationRequest')(input);
     }
+    /** Revokes one selected installation while preserving the employee and seat. */
+    revokeEmployeeDevice(ctx, input) {
+        return requireClientMethod(this.client, 'revokeEmployeeDevice')(ctx, input);
+    }
     /**
      * Requests a SMART token for the current organization-scoped actor.
      *

package/dist/organization-employee-lifecycle.d.ts

@@ -0,0 +1,64 @@
+import { type EmployeeActivationGrant, type OrganizationEmployeeLifecycleRecord } from 'gdc-common-utils-ts';
+import type { RouteContext } from './individual-onboarding.js';
+import type { SubmitAndPollResult } from './orchestration/client-port.js';
+import type { ServerProfileEnrollmentInput, ServerProfileRecord } from './server-profile-session.js';
+import type { LicenseListRuntimeSearchInput, OrganizationEmployeeCreationInput, OrganizationEmployeeLicenseInvitationInput, OrganizationEmployeeSearchInput } from './resource-operations.js';
+/** Input for the atomic controller-facing create plus seat issuance workflow. */
+export type OrganizationEmployeeProvisioningInput = Readonly<{
+    creation: OrganizationEmployeeCreationInput;
+    invitation: OrganizationEmployeeLicenseInvitationInput;
+}>;
+/** Results required by a portal to persist routing and display the credential once. */
+export type OrganizationEmployeeProvisioningResult = Readonly<{
+    employee: SubmitAndPollResult;
+    license: SubmitAndPollResult;
+    activationCode: string;
+}>;
+/** Shared dependencies for the create plus seat issuance workflow. */
+export type OrganizationEmployeeProvisioningDeps = Readonly<{
+    createEmployee(routeContext: RouteContext, input: OrganizationEmployeeCreationInput): Promise<SubmitAndPollResult>;
+    issueLicense(routeContext: RouteContext, input: OrganizationEmployeeLicenseInvitationInput): Promise<SubmitAndPollResult>;
+}>;
+/** Creates the employee, reserves its seat and returns the exact GW credential. */
+export declare function provisionOrganizationEmployeeWithDeps(routeContext: RouteContext, input: OrganizationEmployeeProvisioningInput, deps: OrganizationEmployeeProvisioningDeps): Promise<OrganizationEmployeeProvisioningResult>;
+/** Shared dependencies for combining employee and license directory searches. */
+export type OrganizationEmployeeLifecycleQueryDeps = Readonly<{
+    searchEmployees(routeContext: RouteContext, input: OrganizationEmployeeSearchInput): Promise<SubmitAndPollResult>;
+    listLicenses(routeContext: RouteContext, input?: LicenseListRuntimeSearchInput): Promise<SubmitAndPollResult>;
+}>;
+/** Lists employees and their installation allowance through one typed projection. */
+export declare function listOrganizationEmployeeLifecycleWithDeps(routeContext: RouteContext, deps: OrganizationEmployeeLifecycleQueryDeps): Promise<OrganizationEmployeeLifecycleRecord[]>;
+/** Input used to persist routing metadata for one issued employee credential. */
+export type EmployeeActivationGrantInput = Readonly<{
+    email: string;
+    employeeDid: string;
+    employeeRoleCode: string;
+    providerDid: string;
+    routeContext: RouteContext;
+    createdAt: Date;
+    expiresAt: Date;
+}>;
+/** Builds the product-neutral routing grant stored under a credential digest. */
+export declare function createEmployeeActivationGrant(input: EmployeeActivationGrantInput): EmployeeActivationGrant;
+/** Verifies that a stored routing grant belongs to the authenticated email. */
+export declare function employeeActivationGrantMatchesEmail(grant: EmployeeActivationGrant, email: string): boolean;
+/** Stable profile id derived from account, employee and provider identities. */
+export declare function buildOrganizationEmployeeProfileId(input: Readonly<{
+    ownerId: string;
+    employeeDid: string;
+    providerDid: string;
+    clientInstanceId: string;
+}>): string;
+/** Enrolls a previously invited employee without organization discovery. */
+export declare function enrollInvitedOrganizationEmployeeWithDeps(input: Readonly<{
+    ownerId: string;
+    idToken: string;
+    activationCode: string;
+    pin: string;
+    grant: EmployeeActivationGrant;
+    dcrRedirectUris: string[];
+    dcrClientName: string;
+    clientInstanceId: string;
+}>, deps: Readonly<{
+    enroll(enrollment: ServerProfileEnrollmentInput): Promise<ServerProfileRecord>;
+}>): Promise<ServerProfileRecord>;

package/dist/organization-employee-lifecycle.js

@@ -0,0 +1,76 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+import { createHash } from 'node:crypto';
+import { ActorKinds, EmployeeActivationGrantVersions, projectOrganizationEmployeeLifecycle, readEmployeeActivationCode, } from 'gdc-common-utils-ts';
+import { buildStableActorIdentifier } from 'gdc-common-utils-ts/utils/actor-identifier';
+/** Creates the employee, reserves its seat and returns the exact GW credential. */
+export async function provisionOrganizationEmployeeWithDeps(routeContext, input, deps) {
+    const employee = await deps.createEmployee(routeContext, input.creation);
+    const license = await deps.issueLicense(routeContext, input.invitation);
+    const activationCode = readEmployeeActivationCode(license.poll.body);
+    if (!activationCode) {
+        throw new Error('provisionOrganizationEmployee: GW response did not contain an employee activation credential.');
+    }
+    return { employee, license, activationCode };
+}
+/** Lists employees and their installation allowance through one typed projection. */
+export async function listOrganizationEmployeeLifecycleWithDeps(routeContext, deps) {
+    const [employees, licenses] = await Promise.all([
+        deps.searchEmployees(routeContext, {}),
+        deps.listLicenses(routeContext),
+    ]);
+    return projectOrganizationEmployeeLifecycle({
+        employeeResponse: employees.poll.body,
+        licenseResponse: licenses.poll.body,
+    });
+}
+/** Builds the product-neutral routing grant stored under a credential digest. */
+export function createEmployeeActivationGrant(input) {
+    return {
+        version: EmployeeActivationGrantVersions.V1,
+        employeeDid: input.employeeDid,
+        employeeRoleCode: input.employeeRoleCode,
+        employeeActorIdentifier: buildStableActorIdentifier({ contactKind: 'email', contact: input.email }),
+        providerDid: input.providerDid,
+        routeContext: input.routeContext,
+        createdAt: input.createdAt.toISOString(),
+        expiresAt: input.expiresAt.toISOString(),
+    };
+}
+/** Verifies that a stored routing grant belongs to the authenticated email. */
+export function employeeActivationGrantMatchesEmail(grant, email) {
+    return grant.employeeActorIdentifier === buildStableActorIdentifier({ contactKind: 'email', contact: email });
+}
+/** Stable profile id derived from account, employee and provider identities. */
+export function buildOrganizationEmployeeProfileId(input) {
+    const digest = createHash('sha256')
+        .update([input.ownerId, input.employeeDid, input.providerDid, input.clientInstanceId].join('\u0000'))
+        .digest('base64url');
+    return `organization-employee:${digest}`;
+}
+/** Enrolls a previously invited employee without organization discovery. */
+export async function enrollInvitedOrganizationEmployeeWithDeps(input, deps) {
+    const profileId = buildOrganizationEmployeeProfileId({
+        ownerId: input.ownerId,
+        employeeDid: input.grant.employeeDid,
+        providerDid: input.grant.providerDid,
+        clientInstanceId: input.clientInstanceId,
+    });
+    return deps.enroll({
+        ownerId: input.ownerId,
+        profileId,
+        actorKind: ActorKinds.OrganizationEmployee,
+        actorMode: 'member',
+        actorDid: input.grant.employeeDid,
+        profileDid: input.grant.employeeDid,
+        providerDid: input.grant.providerDid,
+        routeContext: input.grant.routeContext,
+        allowedSubjectDids: [input.grant.employeeDid],
+        pin: input.pin,
+        idToken: input.idToken,
+        activationCode: input.activationCode,
+        clientInstanceId: input.clientInstanceId,
+        dcrRedirectUris: input.dcrRedirectUris,
+        dcrClientName: input.dcrClientName,
+        vpToken: input.idToken,
+    });
+}

package/dist/{organization-registration-authorization.d.ts → organization-test-network-credential.d.ts}

@@ -1,7 +1,7 @@
 import type { VerifiableCredentialV2 } from 'gdc-common-utils-ts/models/verifiable-credential';
 import type { IWallet, WalletExecutionContext, WalletKeySelection } from 'gdc-sdk-core-ts';
 /** Input required to add one human-authorizer proof to the out-of-band VC. */
-export type SignOrganizationRegistrationAuthorizationInput = Readonly<{
+export type SignOrganizationTestNetworkCredentialInput = Readonly<{
     credential: VerifiableCredentialV2;
     wallet: IWallet;
     context: WalletExecutionContext;
@@ -13,4 +13,9 @@ export type SignOrganizationRegistrationAuthorizationInput = Readonly<{
  * Adds one detached JWS proof made by the already-unlocked professional
  * profile. The browser never receives the private key or clear wallet seed.
  */
-export declare function signOrganizationRegistrationAuthorizationCredential(input: SignOrganizationRegistrationAuthorizationInput): Promise<VerifiableCredentialV2>;
+export declare function signOrganizationTestNetworkCredential(input: SignOrganizationTestNetworkCredentialInput): Promise<VerifiableCredentialV2>;
+/**
+ * Adds the unlocked reviewer's ML-DSA-65 assertion proof to one of the three
+ * normal domain credentials restricted to Test Network.
+ */
+export declare function signTestNetworkOrganizationCredential(input: SignOrganizationTestNetworkCredentialInput): Promise<VerifiableCredentialV2>;

package/dist/organization-test-network-credential.js

@@ -0,0 +1,62 @@
+import { canonicalizeOrganizationTestNetworkCredential, } from 'gdc-common-utils-ts/utils/organization-test-network-credential';
+import { canonicalizeTestNetworkOrganizationCredential, } from 'gdc-common-utils-ts/utils/test-network-organization-credentials';
+/**
+ * Adds one detached JWS proof made by the already-unlocked professional
+ * profile. The browser never receives the private key or clear wallet seed.
+ */
+export async function signOrganizationTestNetworkCredential(input) {
+    if (!input.wallet.signDetachedJws) {
+        throw new Error('Wallet does not support detached organization authorization proofs.');
+    }
+    const verificationMethod = String(input.verificationMethod || '').trim();
+    if (!verificationMethod)
+        throw new Error('Organization authorization proof requires verificationMethod.');
+    const payload = canonicalizeOrganizationTestNetworkCredential(input.credential);
+    const jws = await input.wallet.signDetachedJws(input.context, {
+        payload,
+        header: { typ: 'application/vc+ld+json' },
+        key: input.key,
+    });
+    const existingProofs = Array.isArray(input.credential.proof)
+        ? input.credential.proof
+        : input.credential.proof
+            ? [input.credential.proof]
+            : [];
+    return {
+        ...input.credential,
+        proof: [...existingProofs, {
+                type: 'JsonWebSignature2020',
+                created: input.createdAt || new Date().toISOString(),
+                proofPurpose: 'contractAgreement',
+                verificationMethod,
+                jws,
+            }],
+    };
+}
+/**
+ * Adds the unlocked reviewer's ML-DSA-65 assertion proof to one of the three
+ * normal domain credentials restricted to Test Network.
+ */
+export async function signTestNetworkOrganizationCredential(input) {
+    if (!input.wallet.signDetachedJws) {
+        throw new Error('Wallet does not support detached Test Network credential proofs.');
+    }
+    const verificationMethod = String(input.verificationMethod || '').trim();
+    if (!verificationMethod)
+        throw new Error('Test Network credential proof requires verificationMethod.');
+    const jws = await input.wallet.signDetachedJws(input.context, {
+        payload: canonicalizeTestNetworkOrganizationCredential(input.credential),
+        header: { typ: 'application/vc+ld+json' },
+        key: input.key,
+    });
+    return {
+        ...input.credential,
+        proof: [{
+                type: 'JsonWebSignature2020',
+                created: input.createdAt || new Date().toISOString(),
+                proofPurpose: 'assertionMethod',
+                verificationMethod,
+                jws,
+            }],
+    };
+}

package/dist/resource-operations.d.ts

@@ -1,4 +1,4 @@
-import type { DeviceAppType } from 'gdc-common-utils-ts/constants/device';
+import { type DeviceAppType } from 'gdc-common-utils-ts/constants/device';
 import { type ClinicalSectionUpdateCommunicationInput, type ClinicalUpdateCommunicationInput, type ClinicalSummaryReadResult, type ClinicalSummaryRequestInput, type PermissionRequestCommunicationInput } from 'gdc-sdk-core-ts';
 import type { LicenseOfferSearchState, LicenseOrderSearchState } from 'gdc-common-utils-ts/utils/license-commercial-search';
 import type { LicenseListSearchState } from 'gdc-common-utils-ts/utils/license-list-search';
@@ -28,6 +28,18 @@ export type OrganizationEmployeeCreationInput = {
     employeeClaims: Record<string, unknown>;
     dataType?: string;
 };
+/** Input for reserving an existing employee seat and issuing its activation credential. */
+export type OrganizationEmployeeLicenseInvitationInput = {
+    email: string;
+    role: string;
+    subjectDid: string;
+    type?: DeviceAppType;
+    requestThid?: string;
+    pollOptions?: {
+        timeoutMs?: number;
+        intervalMs?: number;
+    };
+};
 /**
  * Current GW CORE employee lifecycle locator payload.
  *
@@ -489,6 +501,21 @@ export declare function createOrganizationEmployeeWithDeps(routeCtx: RouteContex
         intervalMs?: number;
     }) => Promise<SubmitAndPollResult>;
 }): Promise<SubmitAndPollResult>;
+/**
+ * Issues the activation credential for an employee already created under the
+ * tenant. The credential belongs to that employee seat and can authorize its
+ * configured number of concurrent installations (two by default in GW CORE).
+ */
+export declare function issueOrganizationEmployeeLicenseWithDeps(routeCtx: RouteContext, input: OrganizationEmployeeLicenseInvitationInput, deps: {
+    identityLicenseIssuePath: (ctx: RouteContext) => string;
+    identityLicenseIssuePollPath: (ctx: RouteContext) => string;
+    submitAndPoll: (submitPath: string, pollPath: string, payload: {
+        thid?: string;
+    } & Record<string, unknown>, pollOptions?: {
+        timeoutMs?: number;
+        intervalMs?: number;
+    }) => Promise<SubmitAndPollResult>;
+}): Promise<SubmitAndPollResult>;
 export declare function disableOrganizationEmployeeWithDeps(routeCtx: RouteContext, input: OrganizationEmployeeLifecycleInput, options: {
     timeoutMs?: number;
     intervalMs?: number;

package/dist/resource-operations.js

@@ -5,6 +5,7 @@ import { RelatedPersonClaim } from 'gdc-common-utils-ts/models/interoperable-cla
 import { CommunicationClaim } from 'gdc-common-utils-ts/models/interoperable-claims/communication-claims';
 import { BundleEditor, buildCommunicationParticipantSearchBundle, buildBlockchainArtifactDocumentReference, BundleQuery, createInteroperableResourceOperationEditor, IndividualOrganizationLifecycleEditor, LicenseOfferSearchEditor, LicenseOrderSearchEditor, InteroperableLifecycleStatuses, LicenseListSearchEditor, buildLicenseIssueEntry, buildLicensePurchaseEntry, } from 'gdc-common-utils-ts';
 import { EmployeeBundleOperations, EmployeeResourceTypes, } from 'gdc-common-utils-ts/utils/employee';
+import { DeviceAppTypes, DeviceUserClasses } from 'gdc-common-utils-ts/constants/device';
 import { addFhirResourceToCommunication, createCommunicationResource, buildClinicalSummaryCommunicationJob, buildPermissionRequestCommunication, createClinicalSectionUpdateOutboxJob, createClinicalSummaryUpdateOutboxJob, readClinicalSummaryOperationResult, TransportProfiles, } from 'gdc-sdk-core-ts';
 import { GwCoreLifecycleRequestMethod, GwCoreLifecycleRequestType, GwCoreLifecycleTodo, } from './constants/lifecycle.js';
 import { buildEmployeeSearchBundle, ConsentClaims, } from 'gdc-sdk-core-ts';
@@ -58,6 +59,37 @@ export async function createOrganizationEmployeeWithDeps(routeCtx, input, option
     });
     return deps.submitAndPoll(deps.employeeBatchPath(routeCtx), deps.employeePollPath(routeCtx), payload, options);
 }
+/**
+ * Issues the activation credential for an employee already created under the
+ * tenant. The credential belongs to that employee seat and can authorize its
+ * configured number of concurrent installations (two by default in GW CORE).
+ */
+export async function issueOrganizationEmployeeLicenseWithDeps(routeCtx, input, deps) {
+    const email = String(input.email || '').trim().toLowerCase();
+    const role = String(input.role || '').trim();
+    const subjectDid = String(input.subjectDid || '').trim();
+    if (!email)
+        throw new Error('issueOrganizationEmployeeLicense: email is required.');
+    if (!role)
+        throw new Error('issueOrganizationEmployeeLicense: role is required.');
+    if (!subjectDid)
+        throw new Error('issueOrganizationEmployeeLicense: subjectDid is required.');
+    const entry = buildLicenseIssueEntry({
+        email,
+        role,
+        userClass: DeviceUserClasses.Employee,
+        type: input.type || DeviceAppTypes.Web,
+    });
+    entry.meta.subjectDid = subjectDid;
+    return deps.submitAndPoll(deps.identityLicenseIssuePath(routeCtx), deps.identityLicenseIssuePollPath(routeCtx), {
+        thid: input.requestThid || `employee-license-issue-${createRuntimeUuid()}`,
+        body: {
+            resourceType: EmployeeResourceTypes.bundle,
+            type: EmployeeResourceTypes.batch,
+            data: [entry],
+        },
+    }, input.pollOptions);
+}
 export async function disableOrganizationEmployeeWithDeps(routeCtx, input, options, deps) {
     // TODO(gw-core-lifecycle-target-patch-employee-disable): switch this
     // legacy DELETE-in-_batch flow to `_batch + PATCH` when GW CORE deploys it.

package/dist/runtime-client-paths.d.ts

@@ -88,6 +88,10 @@ export declare class RuntimeClientPaths {
     identityTokenExchangePollPath(ctx: RouteContext): string;
     identityDeviceDcrPath(ctx: RouteContext): string;
     identityDeviceDcrPollPath(ctx: RouteContext): string;
+    identityDeviceRevokePath(ctx: RouteContext): string;
+    identityDeviceRevokePollPath(ctx: RouteContext): string;
+    identityLicenseIssuePath(ctx: RouteContext): string;
+    identityLicenseIssuePollPath(ctx: RouteContext): string;
     identityOpenIdSmartTokenPath(ctx: RouteContext): string;
     identityOpenIdSmartTokenPollPath(ctx: RouteContext): string;
 }

package/dist/runtime-client-paths.js

@@ -1,6 +1,6 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
 import { GwCoreLifecycleAction } from './constants/lifecycle.js';
-import { buildHostRegistryPath, buildIdentityDeviceDcrPath, buildIdentityDeviceDcrPollPath, buildIdentityOpenIdSmartTokenPath, buildIdentityOpenIdSmartTokenPollPath, buildIdentityTokenExchangePath, buildIdentityTokenExchangePollPath, buildOrganizationDidBindingPath, buildOrganizationDidBindingPollPath, buildV1Path, } from './runtime-paths.js';
+import { buildHostRegistryPath, buildIdentityDeviceDcrPath, buildIdentityDeviceDcrPollPath, buildIdentityDeviceRevokePath, buildIdentityDeviceRevokePollPath, buildIdentityLicenseIssuePath, buildIdentityLicenseIssuePollPath, buildIdentityOpenIdSmartTokenPath, buildIdentityOpenIdSmartTokenPollPath, buildIdentityTokenExchangePath, buildIdentityTokenExchangePollPath, buildOrganizationDidBindingPath, buildOrganizationDidBindingPollPath, buildV1Path, } from './runtime-paths.js';
 import { requireHostRouteContext, requireRouteContext, routeCtxFromInput, } from './runtime-route-context.js';
 export class RuntimeClientPaths {
     constructor(defaultCtx) {
@@ -102,6 +102,10 @@ export class RuntimeClientPaths {
     identityTokenExchangePollPath(ctx) { return buildIdentityTokenExchangePollPath(ctx); }
     identityDeviceDcrPath(ctx) { return buildIdentityDeviceDcrPath(ctx); }
     identityDeviceDcrPollPath(ctx) { return buildIdentityDeviceDcrPollPath(ctx); }
+    identityDeviceRevokePath(ctx) { return buildIdentityDeviceRevokePath(ctx); }
+    identityDeviceRevokePollPath(ctx) { return buildIdentityDeviceRevokePollPath(ctx); }
+    identityLicenseIssuePath(ctx) { return buildIdentityLicenseIssuePath(ctx); }
+    identityLicenseIssuePollPath(ctx) { return buildIdentityLicenseIssuePollPath(ctx); }
     identityOpenIdSmartTokenPath(ctx) { return buildIdentityOpenIdSmartTokenPath(ctx); }
     identityOpenIdSmartTokenPollPath(ctx) { return buildIdentityOpenIdSmartTokenPollPath(ctx); }
 }

package/dist/runtime-paths.d.ts

@@ -8,5 +8,11 @@ export declare function buildIdentityTokenExchangePath(ctx: RouteContext): strin
 export declare function buildIdentityTokenExchangePollPath(ctx: RouteContext): string;
 export declare function buildIdentityDeviceDcrPath(ctx: RouteContext): string;
 export declare function buildIdentityDeviceDcrPollPath(ctx: RouteContext): string;
+/** Canonical controller operation that reserves an employee seat activation credential. */
+export declare function buildIdentityLicenseIssuePath(ctx: RouteContext): string;
+/** Poll endpoint paired with {@link buildIdentityLicenseIssuePath}. */
+export declare function buildIdentityLicenseIssuePollPath(ctx: RouteContext): string;
+export declare function buildIdentityDeviceRevokePath(ctx: RouteContext): string;
+export declare function buildIdentityDeviceRevokePollPath(ctx: RouteContext): string;
 export declare function buildIdentityOpenIdSmartTokenPath(ctx: RouteContext): string;
 export declare function buildIdentityOpenIdSmartTokenPollPath(ctx: RouteContext): string;

package/dist/runtime-paths.js

@@ -1,5 +1,6 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
 import { buildGwCoreTenantResourceActionPath } from 'gdc-common-utils-ts/utils/gw-core-path';
+import { IdentityAuthActions, IdentityAuthRouteSegments } from 'gdc-common-utils-ts/constants/identity-auth';
 export function buildV1Path(routeCtx, section, format, resourceType, action) {
     return buildGwCoreTenantResourceActionPath({
         tenantId: routeCtx.tenantId,
@@ -22,16 +23,33 @@ export function buildOrganizationDidBindingPollPath(routeCtx) {
     return `/${encodeURIComponent(routeCtx.tenantId)}/cds-${encodeURIComponent(routeCtx.jurisdiction)}/v1/${encodeURIComponent(routeCtx.sector)}/did/document/_binding-response`;
 }
 export function buildIdentityTokenExchangePath(ctx) {
-    return `/${encodeURIComponent('host')}/cds-${encodeURIComponent(ctx.jurisdiction)}/v1/${encodeURIComponent(ctx.sector)}/${encodeURIComponent(ctx.tenantId)}/identity/auth/_exchange`;
+    return buildIdentityAuthPath(ctx, IdentityAuthActions.Exchange);
 }
 export function buildIdentityTokenExchangePollPath(ctx) {
-    return `/${encodeURIComponent('host')}/cds-${encodeURIComponent(ctx.jurisdiction)}/v1/${encodeURIComponent(ctx.sector)}/${encodeURIComponent(ctx.tenantId)}/identity/auth/_exchange-response`;
+    return buildIdentityAuthPath(ctx, IdentityAuthActions.ExchangeResponse);
 }
 export function buildIdentityDeviceDcrPath(ctx) {
-    return `/${encodeURIComponent('host')}/cds-${encodeURIComponent(ctx.jurisdiction)}/v1/${encodeURIComponent(ctx.sector)}/${encodeURIComponent(ctx.tenantId)}/identity/auth/_dcr`;
+    return buildIdentityAuthPath(ctx, IdentityAuthActions.Dcr);
 }
 export function buildIdentityDeviceDcrPollPath(ctx) {
-    return `/${encodeURIComponent('host')}/cds-${encodeURIComponent(ctx.jurisdiction)}/v1/${encodeURIComponent(ctx.sector)}/${encodeURIComponent(ctx.tenantId)}/identity/auth/_dcr-response`;
+    return buildIdentityAuthPath(ctx, IdentityAuthActions.DcrResponse);
+}
+/** Canonical controller operation that reserves an employee seat activation credential. */
+export function buildIdentityLicenseIssuePath(ctx) {
+    return buildIdentityAuthPath(ctx, IdentityAuthActions.Issue);
+}
+/** Poll endpoint paired with {@link buildIdentityLicenseIssuePath}. */
+export function buildIdentityLicenseIssuePollPath(ctx) {
+    return buildIdentityAuthPath(ctx, IdentityAuthActions.IssueResponse);
+}
+export function buildIdentityDeviceRevokePath(ctx) {
+    return buildIdentityAuthPath(ctx, IdentityAuthActions.Revoke);
+}
+export function buildIdentityDeviceRevokePollPath(ctx) {
+    return buildIdentityAuthPath(ctx, IdentityAuthActions.RevokeResponse);
+}
+function buildIdentityAuthPath(ctx, action) {
+    return `/${encodeURIComponent(IdentityAuthRouteSegments.Host)}/cds-${encodeURIComponent(ctx.jurisdiction)}/${IdentityAuthRouteSegments.Version}/${encodeURIComponent(ctx.sector)}/${encodeURIComponent(ctx.tenantId)}/${IdentityAuthRouteSegments.Section}/${IdentityAuthRouteSegments.Format}/${encodeURIComponent(action)}`;
 }
 export function buildIdentityOpenIdSmartTokenPath(ctx) {
     return `/${encodeURIComponent(ctx.tenantId)}/cds-${encodeURIComponent(ctx.jurisdiction)}/v1/${encodeURIComponent(ctx.sector)}/identity/openid/smart/token`;

package/dist/server-profile-session.d.ts

@@ -22,6 +22,8 @@ export type ServerProfileRecord = Readonly<{
     routeContext: RouteContext;
     allowedSubjectDids: string[];
     clientId: string;
+    /** Stable non-secret id of the browser/app installation registered by DCR. */
+    clientInstanceId?: string;
     deviceDid: string;
     publicJwks: Record<string, unknown>[];
     /** Public recipient key for local confidential storage; not a DCR communication key. */
@@ -67,6 +69,8 @@ export type ServerProfileEnrollmentInput = Readonly<{
     pin: string;
     idToken: string;
     activationCode: string;
+    /** Explicit per-installation id. Older callers fall back to the first DCR key id. */
+    clientInstanceId?: string;
     vpToken: string;
     /** Registered web redirect URIs included in the OpenID DCR metadata. */
     dcrRedirectUris?: string[];

package/dist/server-profile-session.js

@@ -1,5 +1,6 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
 import { randomBytes } from 'node:crypto';
+import { IdentityDcrMetadataFields, IdentityDeviceInfoFields } from 'gdc-common-utils-ts/constants/identity-auth';
 import { TransportProfiles, } from 'gdc-sdk-core-ts';
 import { NodeManagedWallet } from './node-managed-wallet.js';
 import { NodeHttpClient } from './node-runtime-client.js';
@@ -26,6 +27,11 @@ export class ServerProfileSessionManager {
         const wallet = await this.createWallet(walletKeyDerivationId, seed);
         const context = walletContext(walletKeyDerivationId);
         const publicKeys = await wallet.getPublicJwks(context, {});
+        const clientInstanceId = String(input.clientInstanceId
+            || publicKeys.find((entry) => entry.purpose !== 'document-at-rest')?.kid
+            || '').trim();
+        if (!clientInstanceId)
+            throw new Error('Server profile enrollment requires clientInstanceId or a DCR public key id.');
         const storagePublicJwk = publicKeys.find((entry) => entry.purpose === 'document-at-rest')?.publicJwk;
         if (!storagePublicJwk)
             throw new Error('Server profile enrollment requires a document-at-rest ML-KEM key.');
@@ -35,6 +41,9 @@ export class ServerProfileSessionManager {
             activationCode: input.activationCode,
             idToken: input.idToken,
             dcrPayload: {
+                [IdentityDcrMetadataFields.ExtendedDeviceInfo]: {
+                    [IdentityDeviceInfoFields.DeviceId]: clientInstanceId,
+                },
                 application_type: 'web',
                 ...(input.dcrRedirectUris?.length ? { redirect_uris: unique(input.dcrRedirectUris) } : {}),
                 ...(input.dcrClientName ? { client_name: input.dcrClientName } : {}),
@@ -61,6 +70,7 @@ export class ServerProfileSessionManager {
             routeContext: input.routeContext,
             allowedSubjectDids: unique(input.allowedSubjectDids),
             clientId,
+            clientInstanceId,
             deviceDid,
             publicJwks: publicKeys.filter((entry) => entry.purpose !== 'document-at-rest').map((entry) => entry.publicJwk),
             storagePublicJwk: storagePublicJwk,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-sdk-node-ts",
-  "version": "2.4.2",
+  "version": "2.4.4",
   "description": "Next-generation Node runtime package for the GDC SDK family",
   "license": "Apache-2.0",
   "author": "Antifraud Services Inc.",
@@ -37,7 +37,7 @@
     "test:e2e:live-gw:clean": "bash ./scripts/run-live-gw-clean.sh"
   },
   "dependencies": {
-    "gdc-common-utils-ts": "2.5.3",
+    "gdc-common-utils-ts": "2.5.6",
     "gdc-sdk-core-ts": "~2.3.18"
   },
   "devDependencies": {

package/dist/organization-registration-authorization.js

@@ -1,34 +0,0 @@
-import { canonicalizeOrganizationRegistrationAuthorizationCredential, } from 'gdc-common-utils-ts/utils/organization-registration-authorization';
-/**
- * Adds one detached JWS proof made by the already-unlocked professional
- * profile. The browser never receives the private key or clear wallet seed.
- */
-export async function signOrganizationRegistrationAuthorizationCredential(input) {
-    if (!input.wallet.signDetachedJws) {
-        throw new Error('Wallet does not support detached organization authorization proofs.');
-    }
-    const verificationMethod = String(input.verificationMethod || '').trim();
-    if (!verificationMethod)
-        throw new Error('Organization authorization proof requires verificationMethod.');
-    const payload = canonicalizeOrganizationRegistrationAuthorizationCredential(input.credential);
-    const jws = await input.wallet.signDetachedJws(input.context, {
-        payload,
-        header: { typ: 'application/vc+ld+json' },
-        key: input.key,
-    });
-    const existingProofs = Array.isArray(input.credential.proof)
-        ? input.credential.proof
-        : input.credential.proof
-            ? [input.credential.proof]
-            : [];
-    return {
-        ...input.credential,
-        proof: [...existingProofs, {
-                type: 'JsonWebSignature2020',
-                created: input.createdAt || new Date().toISOString(),
-                proofPurpose: 'contractAgreement',
-                verificationMethod,
-                jws,
-            }],
-    };
-}