gdc-sdk-node-ts 2.4.34 → 2.4.36

package/dist/digital-twin.d.ts

@@ -10,6 +10,9 @@ export declare function assertDigitalTwinSubjectId(value: unknown): asserts valu
 /** Search parameters added by the digital-twin Composition profile. */
 export declare const DigitalTwinSearchParameter: Readonly<{
     Section: "section";
+    DateFrom: "date-from";
+    DateTo: "date-to";
+    Text: "text";
     MetaTag: "Composition.meta-tag";
 }>;
 export type DigitalTwinSearchInput = {
@@ -18,6 +21,15 @@ export type DigitalTwinSearchInput = {
     thid?: string;
     format?: DigitalTwinFhirFormat;
     resourceType?: string;
+    /** One or more IPS section tokens. Basic search uses OR across sections. */
+    sections?: readonly string[];
+    /** Inclusive clinical-event lower bound as ISO date or dateTime. */
+    dateFrom?: string;
+    /** Inclusive upper bound. When omitted, GW resolves its current time. */
+    dateTo?: string;
+    /** Case- and accent-insensitive text matched against GW's private derived index. */
+    text?: string;
+    /** Advanced/compatibility filters. Do not combine with basic-search fields. */
     filters?: Readonly<Record<string, string | readonly string[] | undefined>>;
     pollOptions?: PollOptions;
 };

package/dist/digital-twin.js

@@ -16,6 +16,9 @@ export function assertDigitalTwinSubjectId(value) {
 /** Search parameters added by the digital-twin Composition profile. */
 export const DigitalTwinSearchParameter = Object.freeze({
     Section: 'section',
+    DateFrom: 'date-from',
+    DateTo: 'date-to',
+    Text: 'text',
     MetaTag: 'Composition.meta-tag',
 });
 /**
@@ -132,10 +135,42 @@ export async function searchDigitalTwinsWithDeps(ctx, input, deps) {
     const resourceType = String(input.resourceType || 'Composition').trim();
     if (!resourceType)
         throw new Error('Digital twin resourceType is required.');
-    const parameters = Object.entries(input.filters || {}).flatMap(([name, value]) => {
+    const usesBasicSearch = Boolean(input.sections || input.dateFrom || input.dateTo || input.text);
+    if (usesBasicSearch && Object.keys(input.filters || {}).length > 0) {
+        throw new Error('Digital twin basic search cannot be combined with advanced filters.');
+    }
+    const sections = (input.sections || []).map((value) => String(value || '').trim()).filter(Boolean);
+    const dateFrom = String(input.dateFrom || '').trim();
+    const dateTo = String(input.dateTo || '').trim();
+    const searchText = String(input.text || '').trim();
+    if (usesBasicSearch) {
+        if (sections.length === 0)
+            throw new Error('Digital twin basic search requires at least one section.');
+        if (!dateFrom)
+            throw new Error('Digital twin basic search requires dateFrom.');
+        if (!searchText)
+            throw new Error('Digital twin basic search requires text.');
+        const fromMs = Date.parse(dateFrom);
+        const toMs = dateTo ? Date.parse(dateTo) : undefined;
+        if (Number.isNaN(fromMs))
+            throw new Error('Digital twin basic search dateFrom must be an ISO date or dateTime.');
+        if (dateTo && Number.isNaN(toMs))
+            throw new Error('Digital twin basic search dateTo must be an ISO date or dateTime.');
+        if (toMs !== undefined && toMs < fromMs)
+            throw new Error('Digital twin basic search dateTo must be on or after dateFrom.');
+    }
+    const advancedParameters = Object.entries(input.filters || {}).flatMap(([name, value]) => {
         const values = Array.isArray(value) ? value : value === undefined ? [] : [value];
         return values.map((item) => ({ name, valueString: String(item) }));
     });
+    const parameters = usesBasicSearch
+        ? [
+            ...sections.map((section) => ({ name: DigitalTwinSearchParameter.Section, valueString: section })),
+            { name: DigitalTwinSearchParameter.DateFrom, valueDate: dateFrom },
+            ...(dateTo ? [{ name: DigitalTwinSearchParameter.DateTo, valueDate: dateTo }] : []),
+            { name: DigitalTwinSearchParameter.Text, valueString: searchText },
+        ]
+        : advancedParameters;
     const thid = String(input.thid || randomUUID());
     const body = format === 'org.hl7.fhir.api'
         ? {
@@ -145,7 +180,7 @@ export async function searchDigitalTwinsWithDeps(ctx, input, deps) {
                     meta: {
                         claims: Object.fromEntries([
                             ['@context', format],
-                            ...parameters.map((parameter) => [parameter.name, parameter.valueString]),
+                            ...parameters.map((parameter) => [parameter.name, parameter.valueString || parameter.valueDate || '']),
                         ]),
                     },
                 }],

package/dist/individual-controller-backend-runtime.d.ts

@@ -1,6 +1,6 @@
 import type { SubmitAndPollResult } from 'gdc-sdk-core-ts';
 import type { FamilyOrganizationSummary } from 'gdc-common-utils-ts/utils/family-organization-summary';
-import type { IndividualOrganizationConfirmOrderInput, RouteContext } from './individual-onboarding.js';
+import type { IndividualOrganizationConfirmOrderInput, IndividualOrganizationOrderResult, RouteContext } from './individual-onboarding.js';
 import type { IndividualOrganizationBootstrapInput, IndividualOrganizationStartResult } from './individual-start.js';
 import type { EnsureFamilyOrganizationRegistrationInput, EnsureFamilyOrganizationRegistrationResult } from './family-organization-registration.js';
 import type { FamilyOrganizationSearchInput } from './family-organization-search.js';
@@ -45,7 +45,7 @@ export declare class IndividualControllerBackendRuntime {
     /**
      * Confirms the order returned by the individual bootstrap flow.
      */
-    confirmIndividualOrganizationOrder(profile: BackendIndividualControllerProfile, input: IndividualOrganizationConfirmOrderInput): Promise<SubmitAndPollResult>;
+    confirmIndividualOrganizationOrder(profile: BackendIndividualControllerProfile, input: IndividualOrganizationConfirmOrderInput): Promise<IndividualOrganizationOrderResult>;
     /**
      * Reads the authoritative subject document through the canonical
      * `Communication -> Subject/$summary -> FHIR Parameters` lifecycle.

package/dist/individual-onboarding.d.ts

@@ -21,6 +21,13 @@ export type IndividualOrganizationConfirmOrderInput = {
     timeoutSeconds?: number;
     intervalSeconds?: number;
 };
+/**
+ * Terminal individual Order result with the opaque code required by the
+ * subsequent managed-wallet activation and DCR flow.
+ */
+export type IndividualOrganizationOrderResult = SubmitAndPollResult & Readonly<{
+    activationCode: string;
+}>;
 type ConfirmIndividualOrganizationOrderDeps = {
     input: IndividualOrganizationConfirmOrderInput;
     routeCtx: RouteContext;
@@ -32,5 +39,11 @@ type ConfirmIndividualOrganizationOrderDeps = {
         thid?: string;
     } & Record<string, unknown>, options?: PollOptions) => Promise<SubmitAndPollResult>;
 };
-export declare function confirmIndividualOrganizationOrderWithDeps(deps: ConfirmIndividualOrganizationOrderDeps): Promise<SubmitAndPollResult>;
+export declare function confirmIndividualOrganizationOrderWithDeps(deps: ConfirmIndividualOrganizationOrderDeps): Promise<IndividualOrganizationOrderResult>;
+/**
+ * Reads the opaque controller activation code from a completed individual
+ * Order. Integrators should consume `result.activationCode` instead of calling
+ * this reader directly; it remains public for response-adapter compatibility.
+ */
+export declare function readIndividualOrganizationActivationCode(responseBody: unknown): string | undefined;
 export {};

package/dist/individual-onboarding.js

@@ -1,4 +1,5 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+import { extractPrimaryClaims } from 'gdc-common-utils-ts';
 import { resolvePollOptionsFromSeconds } from './poll-options.js';
 export async function confirmIndividualOrganizationOrderWithDeps(deps) {
     /**
@@ -35,7 +36,21 @@ export async function confirmIndividualOrganizationOrderWithDeps(deps) {
         timeoutMs: deps.defaultTimeoutMs,
         intervalMs: deps.defaultIntervalMs,
     });
-    return deps.submitAndPoll(deps.individualFamilyOrderBatchPath(deps.routeCtx), deps.individualFamilyOrderPollPath(deps.routeCtx), payload, pollOptions);
+    const order = await deps.submitAndPoll(deps.individualFamilyOrderBatchPath(deps.routeCtx), deps.individualFamilyOrderPollPath(deps.routeCtx), payload, pollOptions);
+    const activationCode = readIndividualOrganizationActivationCode(order.poll.body);
+    if (!activationCode) {
+        throw new Error('confirmIndividualOrganizationOrder failed: missing controller activation code in GW Order response.');
+    }
+    return { ...order, activationCode };
+}
+/**
+ * Reads the opaque controller activation code from a completed individual
+ * Order. Integrators should consume `result.activationCode` instead of calling
+ * this reader directly; it remains public for response-adapter compatibility.
+ */
+export function readIndividualOrganizationActivationCode(responseBody) {
+    const claims = extractPrimaryClaims(responseBody);
+    return String(claims['org.schema.IndividualProduct.serialNumber'] || '').trim() || undefined;
 }
 function createRuntimeUuid() {
     const fromCrypto = globalThis.crypto?.randomUUID?.();

package/dist/node-managed-wallet.d.ts

@@ -11,6 +11,16 @@ export type NodeManagedWalletOptions = {
     resolveRecipientJwk?: (recipientDid: string) => Promise<JWK>;
     policy?: Partial<NodeManagedWalletPolicy>;
 };
+export type NodeProfessionalIdentityVpInput = Readonly<{
+    clientId: string;
+    actorDid: string;
+    profileDid?: string;
+    role: string;
+    email?: string;
+    sameAs?: string | readonly string[];
+    telephone?: string;
+    credentialMaterial?: string;
+}>;
 export type NodeCommunicationWalletInitialization = {
     /**
      * Stable secret used to reconstruct the same communication keys after a
@@ -67,26 +77,29 @@ export declare class NodeManagedWallet implements IWallet {
      */
     getPublicJwks(context?: WalletExecutionContext, filter?: WalletKeySelection): Promise<WalletKeyDescriptor[]>;
     /**
-     * Initializes the runtime communication wallet and returns exactly the
-     * public signing/encryption JWKS accepted as `controller.publicKeys` by the
-     * legacy organization activation builder.
+     * Initializes one user/profile device communication wallet and returns only
+     * its public signing/encryption JWKS. The wallet is actor-role neutral: the
+     * same custody contract can back a controller, employee/professional or
+     * individual-controller profile.
      *
-     * This does not replace the professional-role signing key supplied as
-     * `controller.publicSignKey`. The role key identifies the historical legal
-     * representative; these runtime keys protect DIDComm communications.
+     * These communication keys do not replace the actor's person/professional-
+     * role signing key. In the historical legal-representative flow, for example,
+     * this returned set is accepted as `controller.publicKeys`, while the
+     * independent role key is supplied as `controller.publicSignKey`.
      *
      * The caller owns durable wallet custody. When deterministic provisioning is
      * used, protect `seedMaterial` in the portal wallet store (for example with
      * its KMS/KEK and optionally a user PIN) and persist the same non-secret
      * `context.runtime.runtimeId`. A fresh `NodeManagedWallet` reconstructs the
      * same private keys from that seed and context after restart, so private JWKs
-     * do not need separate persistence. ICA and GW receive only this returned
-     * public JWKS.
+     * do not need separate persistence. Only the returned public JWKS may be
+     * submitted when the selected high-level onboarding flow requires it.
      */
     initializeCommunicationJsonWebKeySet(context: WalletExecutionContext, options?: NodeCommunicationWalletInitialization): Promise<JwkSet>;
     /**
      * Returns only the public DIDComm signing/encryption keys for a previously
-     * initialized runtime wallet. Private material never leaves the wallet.
+     * initialized user/profile device runtime wallet. Private material never
+     * leaves the wallet, and the returned keys do not convey an actor role.
      */
     getCommunicationJsonWebKeySet(context: WalletExecutionContext): Promise<JwkSet>;
     /**
@@ -139,6 +152,12 @@ export declare class NodeManagedWallet implements IWallet {
      * Builds one compact JWS using one managed signing key.
      */
     signCompactJws(context: WalletExecutionContext, request: WalletCompactJwsRequest): Promise<string>;
+    /**
+     * Builds and signs the canonical employee/professional VP with the managed
+     * `vp-token-signing` key. Callers provide identity facts only; they do not
+     * assemble JOSE headers, choose a JWK or handle private key material.
+     */
+    signProfessionalIdentityVp(context: WalletExecutionContext, input: NodeProfessionalIdentityVpInput): Promise<string>;
     /**
      * Builds one detached compact JWS using one managed signing key.
      */

package/dist/node-managed-wallet.js

@@ -4,6 +4,7 @@ import { CryptographyService } from 'gdc-common-utils-ts/CryptographyService';
 import { Content } from 'gdc-common-utils-ts/utils/content';
 import { createJwtSigner } from 'gdc-common-utils-ts/utils/jwt-signer';
 import { buildJwtCompact, prepareJwtForSignature } from 'gdc-common-utils-ts/utils/jwt';
+import { buildProfessionalIdentityVpPayload } from 'gdc-common-utils-ts/utils/professional-smart';
 import { NodeCryptoHelper } from './node-crypto-helper.js';
 const DEFAULT_POLICY = {
     defaults: {
@@ -134,21 +135,23 @@ export class NodeManagedWallet {
         return descriptors;
     }
     /**
-     * Initializes the runtime communication wallet and returns exactly the
-     * public signing/encryption JWKS accepted as `controller.publicKeys` by the
-     * legacy organization activation builder.
+     * Initializes one user/profile device communication wallet and returns only
+     * its public signing/encryption JWKS. The wallet is actor-role neutral: the
+     * same custody contract can back a controller, employee/professional or
+     * individual-controller profile.
      *
-     * This does not replace the professional-role signing key supplied as
-     * `controller.publicSignKey`. The role key identifies the historical legal
-     * representative; these runtime keys protect DIDComm communications.
+     * These communication keys do not replace the actor's person/professional-
+     * role signing key. In the historical legal-representative flow, for example,
+     * this returned set is accepted as `controller.publicKeys`, while the
+     * independent role key is supplied as `controller.publicSignKey`.
      *
      * The caller owns durable wallet custody. When deterministic provisioning is
      * used, protect `seedMaterial` in the portal wallet store (for example with
      * its KMS/KEK and optionally a user PIN) and persist the same non-secret
      * `context.runtime.runtimeId`. A fresh `NodeManagedWallet` reconstructs the
      * same private keys from that seed and context after restart, so private JWKs
-     * do not need separate persistence. ICA and GW receive only this returned
-     * public JWKS.
+     * do not need separate persistence. Only the returned public JWKS may be
+     * submitted when the selected high-level onboarding flow requires it.
      */
     async initializeCommunicationJsonWebKeySet(context, options = {}) {
         if (!context.runtime?.runtimeId) {
@@ -164,7 +167,8 @@ export class NodeManagedWallet {
     }
     /**
      * Returns only the public DIDComm signing/encryption keys for a previously
-     * initialized runtime wallet. Private material never leaves the wallet.
+     * initialized user/profile device runtime wallet. Private material never
+     * leaves the wallet, and the returned keys do not convey an actor role.
      */
     async getCommunicationJsonWebKeySet(context) {
         if (!context.runtime?.runtimeId) {
@@ -335,6 +339,37 @@ export class NodeManagedWallet {
         const signature = await this.sign(prepared.signingInput, context, request.key);
         return buildJwtCompact(prepared.encodedHeader, prepared.encodedPayload, signature);
     }
+    /**
+     * Builds and signs the canonical employee/professional VP with the managed
+     * `vp-token-signing` key. Callers provide identity facts only; they do not
+     * assemble JOSE headers, choose a JWK or handle private key material.
+     */
+    async signProfessionalIdentityVp(context, input) {
+        const [vpSigningKey] = await this.getPublicJwks(context, {
+            ownerScope: 'runtime',
+            purpose: 'vp-token-signing',
+        });
+        if (!vpSigningKey)
+            throw new Error('Managed VP signing key is not available.');
+        const payload = buildProfessionalIdentityVpPayload({
+            clientId: input.clientId,
+            actorDid: input.actorDid,
+            role: input.role,
+            ...(input.email ? { email: input.email } : {}),
+            ...(input.sameAs ? { sameAs: input.sameAs } : {}),
+            ...(input.telephone ? { telephone: input.telephone } : {}),
+            ...(input.credentialMaterial ? { credentialMaterial: input.credentialMaterial } : {}),
+        });
+        return this.signCompactJws(context, {
+            header: { typ: 'JWT', jwk: vpSigningKey.publicJwk },
+            claims: {
+                iss: vpSigningKey.kid,
+                sub: input.profileDid || input.actorDid,
+                ...payload,
+            },
+            key: { ownerScope: 'runtime', purpose: 'vp-token-signing' },
+        });
+    }
     /**
      * Builds one detached compact JWS using one managed signing key.
      */

package/dist/node-runtime-client.d.ts

@@ -5,7 +5,7 @@ import { type ResolvedAppInfo, type CommunicationClinicalFormatRenderers, type S
 import { type HostRouteContext, type HostedTenantLifecycleInput } from './host-onboarding.js';
 import type { HostedTenantDescendantKind } from './host-onboarding.js';
 import type { NodeLegalOrganizationVerificationTransactionInput, NodeOrganizationDidBindingInput, NodeOrganizationActivationInput } from './orchestration/client-port.js';
-import { type IndividualOrganizationConfirmOrderInput, type RouteContext } from './individual-onboarding.js';
+import { type IndividualOrganizationConfirmOrderInput, type IndividualOrganizationOrderResult, type RouteContext } from './individual-onboarding.js';
 import { type EnsureFamilyOrganizationRegistrationInput } from './family-organization-registration.js';
 import { type FamilyOrganizationSearchInput } from './family-organization-search.js';
 import { type SmartTokenRequestInput } from './smart-token.js';
@@ -376,7 +376,7 @@ export declare class HttpRuntimeClient implements NodeRuntimeClient {
     /**
      * Confirms the order returned by `startIndividualOrganization(...)`.
      */
-    confirmIndividualOrganizationOrder(input: IndividualOrganizationConfirmOrderInput): Promise<SubmitAndPollResult>;
+    confirmIndividualOrganizationOrder(input: IndividualOrganizationConfirmOrderInput): Promise<IndividualOrganizationOrderResult>;
     /**
      * Disables a hosted individual/family organization without releasing licenses.
      *

package/dist/orchestration/client-port.d.ts

@@ -9,7 +9,7 @@ import type { EmployeeDeviceActivationResult, EmployeeDeviceActivationRequestInp
 import type { OrganizationEmployeeProvisioningInput, OrganizationEmployeeProvisioningResult } from '../organization-employee-lifecycle.js';
 import type { OrganizationEmployeeLifecycleRecord } from 'gdc-common-utils-ts/models/organization-employee-lifecycle';
 import type { HostRouteContext, HostedTenantLifecycleInput, LegalOrganizationOrderInput } from '../host-onboarding.js';
-import type { IndividualOrganizationConfirmOrderInput, RouteContext } from '../individual-onboarding.js';
+import type { IndividualOrganizationConfirmOrderInput, IndividualOrganizationOrderResult, RouteContext } from '../individual-onboarding.js';
 import type { IndividualOrganizationBootstrapInput, IndividualOrganizationStartResult } from '../individual-start.js';
 import type { FamilyOrganizationSearchInput } from '../family-organization-search.js';
 import type { FhirR5SubscriptionTopic } from 'gdc-common-utils-ts/models/fhir-r5-subscription';
@@ -106,7 +106,7 @@ export type RuntimeClient = {
     startIndividualOrganization?: (input: IndividualOrganizationBootstrapInput) => Promise<IndividualOrganizationStartResult>;
     searchFamilyOrganization?: (ctx: RouteContext, input: FamilyOrganizationSearchInput) => Promise<FamilyOrganizationSummary | null>;
     ensureFamilyOrganizationRegistration?: (ctx: RouteContext, input: EnsureFamilyOrganizationRegistrationInput) => Promise<EnsureFamilyOrganizationRegistrationResult>;
-    confirmIndividualOrganizationOrder?: (input: IndividualOrganizationConfirmOrderInput) => Promise<SubmitAndPollResult>;
+    confirmIndividualOrganizationOrder?: (input: IndividualOrganizationConfirmOrderInput) => Promise<IndividualOrganizationOrderResult>;
     disableIndividual?: (ctx: RouteContext, input: IndividualOrganizationLifecycleInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
     purgeIndividual?: (ctx: RouteContext, input: IndividualOrganizationLifecycleInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
     disableIndividualMember?: (ctx: RouteContext, input: IndividualMemberLifecycleInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;

package/dist/orchestration/digital-twin-sdk.d.ts

@@ -10,7 +10,14 @@ export declare class DigitalTwinSdk {
     constructor(client: NodeRuntimeClient, actorDid?: string);
     /** Requests the SMART token used by subsequent digital-twin operations. */
     requestSmartToken(input: SmartTokenRequestInput): Promise<SmartTokenExchangeResult>;
-    /** Searches pseudonymous records and exposes matched Compositions directly. */
+    /**
+     * Searches pseudonymous records and exposes matched Compositions directly.
+     *
+     * MVP basic search supplies `sections`, `dateFrom`, optional `dateTo`, and
+     * `text`. GW resolves an omitted `dateTo` to its current time, applies OR
+     * across sections and requires text/date to match the same clinical record.
+     * Organization/tenant scope comes from the authenticated SMART token.
+     */
     search(ctx: RouteContext, input: DigitalTwinSearchInput): Promise<DigitalTwinSearchResult>;
     /**
      * Saves a tagged researcher-owned working selection for one matching twin.

package/dist/orchestration/digital-twin-sdk.js

@@ -28,7 +28,14 @@ export class DigitalTwinSdk {
             this.researcherDid = actorDid;
         return result;
     }
-    /** Searches pseudonymous records and exposes matched Compositions directly. */
+    /**
+     * Searches pseudonymous records and exposes matched Compositions directly.
+     *
+     * MVP basic search supplies `sections`, `dateFrom`, optional `dateTo`, and
+     * `text`. GW resolves an omitted `dateTo` to its current time, applies OR
+     * across sections and requires text/date to match the same clinical record.
+     * Organization/tenant scope comes from the authenticated SMART token.
+     */
     async search(ctx, input) {
         const filters = { ...(input.filters || {}) };
         const isPrivateSelectionSearch = Object.keys(filters).some((name) => {

package/dist/orchestration/individual-controller-sdk.d.ts

@@ -3,7 +3,7 @@ import { type NodeRuntimeClient, type PollOptions, type SubmitAndPollResult, typ
 import type { FamilyOrganizationSummary } from 'gdc-common-utils-ts/utils/family-organization-summary';
 import type { EnsureFamilyOrganizationRegistrationInput, EnsureFamilyOrganizationRegistrationResult } from '../family-organization-registration.js';
 import type { FamilyOrganizationSearchInput } from '../family-organization-search.js';
-import type { IndividualOrganizationConfirmOrderInput, RouteContext } from '../individual-onboarding.js';
+import type { IndividualOrganizationConfirmOrderInput, IndividualOrganizationOrderResult, RouteContext } from '../individual-onboarding.js';
 import type { IndividualOrganizationBootstrapInput, IndividualOrganizationStartResult } from '../individual-start.js';
 import type { NodeCapability } from '../session.js';
 import type { IndividualOrganizationLifecycleInput } from 'gdc-sdk-core-ts';
@@ -39,7 +39,7 @@ export declare class IndividualControllerSdk {
     /**
      * Confirms the order returned by `startIndividualOrganization(...)`.
      */
-    confirmIndividualOrganizationOrder(input: IndividualOrganizationConfirmOrderInput): Promise<SubmitAndPollResult>;
+    confirmIndividualOrganizationOrder(input: IndividualOrganizationConfirmOrderInput): Promise<IndividualOrganizationOrderResult>;
     /**
      * Disables the hosted individual/family organization without freeing licenses.
      */

package/dist/organization-employee-lifecycle.js

@@ -218,6 +218,12 @@ export async function enrollInvitedOrganizationEmployeeWithDeps(input, deps) {
         clientInstanceId: input.clientInstanceId,
         dcrRedirectUris: input.dcrRedirectUris,
         dcrClientName: input.dcrClientName,
-        vpToken: input.idToken,
+        // The grant contains the server-verified stable actor alias and role. The
+        // profile runtime signs the VP with its managed DCR wallet after GW has
+        // returned the real client_id; idToken remains only the OIDC account proof.
+        professionalProof: {
+            role: input.grant.employeeRoleCode,
+            sameAs: input.grant.employeeActorIdentifier,
+        },
     });
 }

package/dist/server-profile-session.d.ts

@@ -1,7 +1,7 @@
 import type { JWK } from 'gdc-common-utils-ts/models/jwk';
 import type { ActorKind } from 'gdc-common-utils-ts/models/actor-session';
 import type { LegalOrganizationVerificationTransactionInput } from 'gdc-common-utils-ts/utils/legal-organization-verification-transaction';
-import { type ConfidentialStorageProfile, type PollOptions, type SubmitAndPollResult } from 'gdc-sdk-core-ts';
+import { type AppInfo, type ConfidentialStorageProfile, type PollOptions, type SubmitAndPollResult } from 'gdc-sdk-core-ts';
 import type { RouteContext } from './individual-onboarding.js';
 import type { HostRouteContext } from './host-onboarding.js';
 import type { SecureDidcommTransportAdapter } from 'gdc-sdk-core-ts';
@@ -31,7 +31,8 @@ export type ServerProfileRecord = Readonly<{
     /** Server-owned policy; browser input is never authoritative for this value. */
     confidentialStorageProfile?: ConfidentialStorageProfile;
     protectedWalletSeed: PinProtectedProfileSecret;
-    protectedVpToken: PinProtectedProfileSecret;
+    /** Present only when this actor kind requires an independent signed role/relationship VP. */
+    protectedVpToken?: PinProtectedProfileSecret;
     failedUnlocks: number;
     lockedUntil?: string;
     createdAt: string;
@@ -95,8 +96,25 @@ export type ServerProfileEnrollmentInput = Readonly<{
      * derives the identity from the wallet key it creates for this profile.
      */
     clientInstanceId?: string;
-    /** Signed actor/controller VP protected with the profile for later proof and session operations. */
-    vpToken: string;
+    /**
+     * Signed actor/controller VP protected for later SMART operations. Required
+     * for organization/professional/member actors. Individual-controller
+     * profiles omit it: their account `id_token`, DCR device binding and
+     * provider-side relationship policy are evaluated independently.
+     */
+    vpToken?: string;
+    /**
+     * High-level employee/professional proof source. When supplied, the SDK
+     * builds and signs the VP with the managed DCR wallet after registration;
+     * callers do not compose JWT/JWK material.
+     */
+    professionalProof?: Readonly<{
+        role: string;
+        email?: string;
+        sameAs?: string | readonly string[];
+        telephone?: string;
+        credentialMaterial?: string;
+    }>;
     /** Redirect URIs owned by this portal/app installation. */
     redirectUris?: string[];
     /** Human-readable portal/app name. */
@@ -132,6 +150,20 @@ export type ServerProfileOrganizationIssueInput = Readonly<{
     verificationInput: LegalOrganizationVerificationTransactionInput;
     pollOptions?: PollOptions;
 }>;
+export type ServerOrganizationControllerVpInput = Readonly<{
+    /** Same protected seed that committed the controller public key to ICA. */
+    walletSeed: string;
+    /** Stable application-owned derivation id reused after every restart. */
+    walletKeyDerivationId: string;
+    /** Terminal ICA/GW verification body containing the issued organization, representative and controller VCs. */
+    verificationResponseBody: unknown;
+    /** Exact organization tenant identifier represented by the controller proof. */
+    tenantId: string;
+    /** Exact audience required by the receiving GW/host policy. */
+    audience: string;
+    /** Optional stable sameAs selector when the response contains several controller credentials. */
+    controllerSameAs?: string;
+}>;
 /** One explicit unlock request; scopes and subject remain session-bound. */
 export type ServerProfileUnlockInput = Readonly<{
     ownerId: string;
@@ -166,6 +198,8 @@ export type ServerProfileSessionManagerOptions = Readonly<{
     sealer: ServerProfileSealer;
     gatewayBaseUrl: string;
     resolveRecipientJwk: (recipientDid: string) => Promise<JWK>;
+    /** Stable identity of the portal/application, shared by all of its user wallets. */
+    appInfo?: AppInfo;
     fetchImpl?: typeof fetch;
     sessionTtlSeconds?: number;
     maxFailedUnlocks?: number;
@@ -196,6 +230,15 @@ export declare class ServerProfileSessionManager {
         walletSeed: string;
         walletKeyDerivationId: string;
     }>): Promise<ServerProfileEnrollmentPublicKey[]>;
+    /**
+     * Builds and signs the canonical controller VP directly from ICA-issued
+     * credentials. The caller never assembles a VP/JWS or exports a private key.
+     *
+     * This proof is independent from the signed OIDC id_token: the VP proves
+     * organization/controller authority, while id_token proves control of the
+     * verified login identifier used by Token/_exchange and DCR.
+     */
+    buildOrganizationControllerVpFromIcaProof(input: ServerOrganizationControllerVpInput): Promise<string>;
     /**
      * Reissues an existing organization controller activation through protected
      * DIDComm transport before a durable profile exists. The deterministic seed

package/dist/server-profile-session.js

@@ -1,6 +1,8 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
 import { randomBytes } from 'node:crypto';
 import { ActorKinds } from 'gdc-common-utils-ts/constants/actor-session';
+import { readLegalOrganizationVerificationCredentialPairFromResponseBody, readServiceControllerCredentialFromResponseBody, } from 'gdc-common-utils-ts/utils/legal-organization-verification-result';
+import { addLegalRepresentativeCredential, addOrganizationCredential, addServiceControllerCredential, createVP, } from 'gdc-common-utils-ts/utils/vp-token';
 import { TransportProfiles, } from 'gdc-sdk-core-ts';
 import { NodeManagedWallet } from './node-managed-wallet.js';
 import { NodeHttpClient } from './node-runtime-client.js';
@@ -62,6 +64,14 @@ export class ServerProfileSessionManager {
             throw new Error('GW DCR did not return client_id.');
         const deviceDid = findText(dcrBody, ['device_did', 'deviceDid', 'did']) || clientId;
         const now = this.now();
+        const managedVpToken = input.vpToken || (input.professionalProof
+            ? await buildManagedProfessionalVp(wallet, context, {
+                clientId,
+                actorDid: input.actorDid,
+                profileDid: input.profileDid,
+                ...input.professionalProof,
+            })
+            : undefined);
         const record = {
             profileId: input.profileId,
             walletKeyDerivationId,
@@ -80,7 +90,9 @@ export class ServerProfileSessionManager {
             storagePublicJwk: storagePublicJwk,
             confidentialStorageProfile: this.options.requiredConfidentialStorageProfile ?? 'confidential-basic-v1',
             protectedWalletSeed: await protectServerProfileSecret(seed, input.pin, `${input.profileId}:wallet-seed`, this.options.sealer, this.options.profileProtection),
-            protectedVpToken: await protectServerProfileSecret(input.vpToken, input.pin, `${input.profileId}:vp-token`, this.options.sealer, this.options.profileProtection),
+            ...(managedVpToken ? {
+                protectedVpToken: await protectServerProfileSecret(managedVpToken, input.pin, `${input.profileId}:vp-token`, this.options.sealer, this.options.profileProtection),
+            } : {}),
             failedUnlocks: 0,
             createdAt: now.toISOString(),
             updatedAt: now.toISOString(),
@@ -109,6 +121,57 @@ export class ServerProfileSessionManager {
             publicJwk: entry.publicJwk,
         }));
     }
+    /**
+     * Builds and signs the canonical controller VP directly from ICA-issued
+     * credentials. The caller never assembles a VP/JWS or exports a private key.
+     *
+     * This proof is independent from the signed OIDC id_token: the VP proves
+     * organization/controller authority, while id_token proves control of the
+     * verified login identifier used by Token/_exchange and DCR.
+     */
+    async buildOrganizationControllerVpFromIcaProof(input) {
+        requireBase64UrlSeed32(input.walletSeed);
+        const walletKeyDerivationId = normalizedWalletKeyDerivationId(input.walletKeyDerivationId, '');
+        if (!walletKeyDerivationId) {
+            throw new Error('buildOrganizationControllerVpFromIcaProof requires walletKeyDerivationId.');
+        }
+        const tenantId = String(input.tenantId || '').trim();
+        const audience = String(input.audience || '').trim();
+        if (!tenantId)
+            throw new Error('buildOrganizationControllerVpFromIcaProof requires tenantId.');
+        if (!audience)
+            throw new Error('buildOrganizationControllerVpFromIcaProof requires audience.');
+        const { organizationCredential, legalRepresentativeCredential } = readLegalOrganizationVerificationCredentialPairFromResponseBody(input.verificationResponseBody);
+        const controllerCredential = readServiceControllerCredentialFromResponseBody(input.verificationResponseBody, input.controllerSameAs);
+        if (!controllerCredential) {
+            throw new Error('ICA verification response does not contain a ServiceControllerCredential.');
+        }
+        const wallet = await this.createWallet(walletKeyDerivationId, input.walletSeed);
+        const context = walletContext(walletKeyDerivationId);
+        const [actorSigningKey] = await wallet.getPublicJwks(context, {
+            ownerScope: 'profile',
+            purpose: 'actor-signing',
+        });
+        if (!actorSigningKey)
+            throw new Error('Controller actor-signing key is not available.');
+        const vp = createVP({
+            iss: actorSigningKey.kid,
+            sub: tenantId,
+            aud: audience,
+            vp: { holder: actorSigningKey.kid, verifiableCredential: [] },
+        });
+        addOrganizationCredential(vp, organizationCredential);
+        addLegalRepresentativeCredential(vp, legalRepresentativeCredential);
+        addServiceControllerCredential(vp, controllerCredential);
+        return wallet.signCompactJws(context, {
+            header: {
+                typ: 'JWT',
+                jwk: actorSigningKey.publicJwk,
+            },
+            claims: vp,
+            key: { ownerScope: 'profile', purpose: 'actor-signing' },
+        });
+    }
     /**
      * Reissues an existing organization controller activation through protected
      * DIDComm transport before a durable profile exists. The deterministic seed
@@ -126,6 +189,7 @@ export class ServerProfileSessionManager {
             baseUrl: this.options.gatewayBaseUrl,
             ctx: input.routeContext,
             bearerToken: input.bearerToken,
+            appInfo: this.options.appInfo,
             fetchImpl: this.options.fetchImpl,
             transportProfile: TransportProfiles.DidcommEncryptedForm,
             secureTransportAdapter: {
@@ -153,7 +217,9 @@ export class ServerProfileSessionManager {
         let vpToken;
         try {
             seed = await openServerProfileSecret(profile.protectedWalletSeed, input.pin, `${profile.profileId}:wallet-seed`, this.options.sealer);
-            vpToken = await openServerProfileSecret(profile.protectedVpToken, input.pin, `${profile.profileId}:vp-token`, this.options.sealer);
+            vpToken = profile.protectedVpToken
+                ? await openServerProfileSecret(profile.protectedVpToken, input.pin, `${profile.profileId}:vp-token`, this.options.sealer)
+                : undefined;
         }
         catch (reason) {
             if (!(reason instanceof ProfilePinRejectedError))
@@ -183,6 +249,7 @@ export class ServerProfileSessionManager {
             audience: smartTokenEndpoint,
             idToken: input.idToken,
             vpToken,
+            vpTokenFallback: vpToken ? undefined : 'omit',
             clientAssertion: assertion,
             clientAssertionType: 'private_key_jwt',
             smartTokenKind: 'openid-smart',
@@ -247,6 +314,7 @@ export class ServerProfileSessionManager {
             ctx,
             bearerToken,
             fetchImpl: this.options.fetchImpl,
+            appInfo: this.options.appInfo,
         });
     }
     async createWallet(walletKeyDerivationId, seed) {
@@ -323,6 +391,10 @@ function profileSmartAcrValues(actorKind) {
         ? 'urn:antifraud:acr:openid4vp:individual'
         : 'urn:antifraud:acr:openid4vp:employee';
 }
+/** Creates the role VP after DCR has returned the wallet's actual client_id. */
+async function buildManagedProfessionalVp(wallet, context, input) {
+    return wallet.signProfessionalIdentityVp(context, input);
+}
 async function buildWalletClientAssertion(wallet, profile, audience, now) {
     const seconds = Math.floor(now.getTime() / 1000);
     return wallet.signCompactJws(walletContext(profile.walletKeyDerivationId || profile.profileId), {
@@ -361,10 +433,17 @@ function requireEnrollment(input) {
         providerDid: input.providerDid,
         activationCode: input.activationCode,
         idToken: input.idToken,
-        vpToken: input.vpToken,
     }))
         if (!String(value || '').trim())
             throw new Error(`Profile enrollment requires ${name}.`);
+    if (input.actorKind !== ActorKinds.IndividualController
+        && !String(input.vpToken || '').trim()
+        && !input.professionalProof) {
+        throw new Error('Profile enrollment requires vpToken for this actor kind.');
+    }
+    if (input.professionalProof && !String(input.professionalProof.role || '').trim()) {
+        throw new Error('Profile enrollment professionalProof requires role.');
+    }
     if (!input.allowedSubjectDids.length)
         throw new Error('Profile enrollment requires an allowed subject.');
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-sdk-node-ts",
-  "version": "2.4.34",
+  "version": "2.4.36",
   "description": "Next-generation Node runtime package for the GDC SDK family",
   "license": "Apache-2.0",
   "author": "Antifraud Services Inc.",
@@ -38,7 +38,7 @@
     "test:e2e:live-gw:clean": "bash ./scripts/run-live-gw-clean.sh"
   },
   "dependencies": {
-    "gdc-common-utils-ts": "2.5.15",
+    "gdc-common-utils-ts": "2.5.20",
     "gdc-sdk-core-ts": "~2.3.18"
   },
   "devDependencies": {

package/dist/organization-registration-authorization.d.ts

@@ -1,16 +0,0 @@
-import type { VerifiableCredentialV2 } from 'gdc-common-utils-ts/models/verifiable-credential';
-import type { IWallet, WalletExecutionContext, WalletKeySelection } from 'gdc-sdk-core-ts';
-/** Input required to add one human-authorizer proof to the out-of-band VC. */
-export type SignOrganizationRegistrationAuthorizationInput = Readonly<{
-    credential: VerifiableCredentialV2;
-    wallet: IWallet;
-    context: WalletExecutionContext;
-    key: WalletKeySelection;
-    verificationMethod: string;
-    createdAt?: string;
-}>;
-/**
- * Adds one detached JWS proof made by the already-unlocked professional
- * profile. The browser never receives the private key or clear wallet seed.
- */
-export declare function signOrganizationRegistrationAuthorizationCredential(input: SignOrganizationRegistrationAuthorizationInput): Promise<VerifiableCredentialV2>;

package/dist/organization-registration-authorization.js

@@ -1,34 +0,0 @@
-import { canonicalizeOrganizationRegistrationAuthorizationCredential, } from 'gdc-common-utils-ts/utils/organization-registration-authorization';
-/**
- * Adds one detached JWS proof made by the already-unlocked professional
- * profile. The browser never receives the private key or clear wallet seed.
- */
-export async function signOrganizationRegistrationAuthorizationCredential(input) {
-    if (!input.wallet.signDetachedJws) {
-        throw new Error('Wallet does not support detached organization authorization proofs.');
-    }
-    const verificationMethod = String(input.verificationMethod || '').trim();
-    if (!verificationMethod)
-        throw new Error('Organization authorization proof requires verificationMethod.');
-    const payload = canonicalizeOrganizationRegistrationAuthorizationCredential(input.credential);
-    const jws = await input.wallet.signDetachedJws(input.context, {
-        payload,
-        header: { typ: 'application/vc+ld+json' },
-        key: input.key,
-    });
-    const existingProofs = Array.isArray(input.credential.proof)
-        ? input.credential.proof
-        : input.credential.proof
-            ? [input.credential.proof]
-            : [];
-    return {
-        ...input.credential,
-        proof: [...existingProofs, {
-                type: 'JsonWebSignature2020',
-                created: input.createdAt || new Date().toISOString(),
-                proofPurpose: 'contractAgreement',
-                verificationMethod,
-                jws,
-            }],
-    };
-}