gdc-sdk-node-ts 2.4.35 → 2.4.37

package/dist/device-activation.d.ts

@@ -68,6 +68,28 @@ export type EmployeeDeviceActivationResult = {
     exchange: SubmitAndPollResult;
     dcr: SubmitAndPollResult;
 };
+export type EmployeeDeviceOtpRecoveryInput = Readonly<{
+    idToken: string;
+    clientInstanceId: string;
+    pollOptions?: PollOptions;
+}>;
+export type EmployeeDeviceOtpRecoveryResult = Readonly<{
+    activationCode: string;
+    licenseId: string;
+    employeeRole: string;
+    employeeActorIdentifier: string;
+    recovery: SubmitAndPollResult;
+}>;
+/** Requests a fresh replacement credential for one OTP-authenticated installation. */
+export declare function recoverEmployeeDeviceWithOtpWithDeps(deps: Readonly<{
+    routeCtx: RouteContext;
+    input: EmployeeDeviceOtpRecoveryInput;
+    identityEmployeeRecoveryPath: (ctx: RouteContext) => string;
+    identityEmployeeRecoveryPollPath: (ctx: RouteContext) => string;
+    submitAndPollWithBearerToken: (bearerToken: string | undefined, submitPath: string, pollPath: string, payload: {
+        thid?: string;
+    } & Record<string, unknown>, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
+}>): Promise<EmployeeDeviceOtpRecoveryResult>;
 export type EmployeeDeviceRevocationInput = {
     licenseId: string;
     clientId: string;

package/dist/device-activation.js

@@ -56,6 +56,26 @@ export function createProfileDeviceActivationRequest(input) {
     };
     return draft;
 }
+/** Requests a fresh replacement credential for one OTP-authenticated installation. */
+export async function recoverEmployeeDeviceWithOtpWithDeps(deps) {
+    const idToken = requiredText(deps.input.idToken, 'fresh OTP identity token');
+    const clientInstanceId = requiredText(deps.input.clientInstanceId, 'client instance id');
+    const recovery = await deps.submitAndPollWithBearerToken(idToken, deps.identityEmployeeRecoveryPath(deps.routeCtx), deps.identityEmployeeRecoveryPollPath(deps.routeCtx), { thid: `employee-recovery-${createRuntimeUuid()}`, client_instance_id: clientInstanceId }, deps.input.pollOptions);
+    const failedStatus = [recovery.submit.status, recovery.poll.status]
+        .find(status => status < 200 || status >= 300);
+    if (failedStatus !== undefined) {
+        throw new Error(`recoverEmployeeDeviceWithOtp: recovery failed (HTTP ${failedStatus}).`);
+    }
+    const terminal = responseBody(recovery.poll.body);
+    const activationCode = findResponseText(terminal, 'activation_code');
+    const licenseId = findResponseText(terminal, 'license_id');
+    const employeeRole = findResponseText(terminal, 'employee_role');
+    const employeeActorIdentifier = findResponseText(terminal, 'employee_same_as');
+    if (!activationCode || !licenseId || !employeeRole || !employeeActorIdentifier) {
+        throw new Error('recoverEmployeeDeviceWithOtp: incomplete recovery response.');
+    }
+    return { activationCode, licenseId, employeeRole, employeeActorIdentifier, recovery };
+}
 export async function revokeEmployeeDeviceWithDeps(deps) {
     const licenseId = String(deps.input.licenseId || '').trim();
     const clientId = String(deps.input.clientId || '').trim();
@@ -147,6 +167,44 @@ function resolveDcrPayload(input) {
         return { ...input.dcrPayload };
     throw new Error('Device activation requires a device registration built by createProfileDeviceActivationRequest.');
 }
+function responseBody(value) {
+    if (typeof value === 'string') {
+        try {
+            return responseBody(JSON.parse(value));
+        }
+        catch {
+            return {};
+        }
+    }
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return {};
+    const record = value;
+    return record.body && typeof record.body === 'object' && !Array.isArray(record.body)
+        ? record.body
+        : record;
+}
+function findResponseText(value, key) {
+    if (!value || typeof value !== 'object')
+        return '';
+    if (Array.isArray(value)) {
+        for (const child of value) {
+            const found = findResponseText(child, key);
+            if (found)
+                return found;
+        }
+        return '';
+    }
+    const record = value;
+    const direct = normalizedText(record[key]);
+    if (direct)
+        return direct;
+    for (const child of Object.values(record)) {
+        const found = findResponseText(child, key);
+        if (found)
+            return found;
+    }
+    return '';
+}
 function normalizedText(value) {
     return typeof value === 'string' ? value.trim() : '';
 }

package/dist/digital-twin.d.ts

@@ -10,6 +10,9 @@ export declare function assertDigitalTwinSubjectId(value: unknown): asserts valu
 /** Search parameters added by the digital-twin Composition profile. */
 export declare const DigitalTwinSearchParameter: Readonly<{
     Section: "section";
+    DateFrom: "date-from";
+    DateTo: "date-to";
+    Text: "text";
     MetaTag: "Composition.meta-tag";
 }>;
 export type DigitalTwinSearchInput = {
@@ -18,6 +21,15 @@ export type DigitalTwinSearchInput = {
     thid?: string;
     format?: DigitalTwinFhirFormat;
     resourceType?: string;
+    /** One or more IPS section tokens. Basic search uses OR across sections. */
+    sections?: readonly string[];
+    /** Inclusive clinical-event lower bound as ISO date or dateTime. */
+    dateFrom?: string;
+    /** Inclusive upper bound. When omitted, GW resolves its current time. */
+    dateTo?: string;
+    /** Case- and accent-insensitive text matched against GW's private derived index. */
+    text?: string;
+    /** Advanced/compatibility filters. Do not combine with basic-search fields. */
     filters?: Readonly<Record<string, string | readonly string[] | undefined>>;
     pollOptions?: PollOptions;
 };

package/dist/digital-twin.js

@@ -16,6 +16,9 @@ export function assertDigitalTwinSubjectId(value) {
 /** Search parameters added by the digital-twin Composition profile. */
 export const DigitalTwinSearchParameter = Object.freeze({
     Section: 'section',
+    DateFrom: 'date-from',
+    DateTo: 'date-to',
+    Text: 'text',
     MetaTag: 'Composition.meta-tag',
 });
 /**
@@ -132,10 +135,42 @@ export async function searchDigitalTwinsWithDeps(ctx, input, deps) {
     const resourceType = String(input.resourceType || 'Composition').trim();
     if (!resourceType)
         throw new Error('Digital twin resourceType is required.');
-    const parameters = Object.entries(input.filters || {}).flatMap(([name, value]) => {
+    const usesBasicSearch = Boolean(input.sections || input.dateFrom || input.dateTo || input.text);
+    if (usesBasicSearch && Object.keys(input.filters || {}).length > 0) {
+        throw new Error('Digital twin basic search cannot be combined with advanced filters.');
+    }
+    const sections = (input.sections || []).map((value) => String(value || '').trim()).filter(Boolean);
+    const dateFrom = String(input.dateFrom || '').trim();
+    const dateTo = String(input.dateTo || '').trim();
+    const searchText = String(input.text || '').trim();
+    if (usesBasicSearch) {
+        if (sections.length === 0)
+            throw new Error('Digital twin basic search requires at least one section.');
+        if (!dateFrom)
+            throw new Error('Digital twin basic search requires dateFrom.');
+        if (!searchText)
+            throw new Error('Digital twin basic search requires text.');
+        const fromMs = Date.parse(dateFrom);
+        const toMs = dateTo ? Date.parse(dateTo) : undefined;
+        if (Number.isNaN(fromMs))
+            throw new Error('Digital twin basic search dateFrom must be an ISO date or dateTime.');
+        if (dateTo && Number.isNaN(toMs))
+            throw new Error('Digital twin basic search dateTo must be an ISO date or dateTime.');
+        if (toMs !== undefined && toMs < fromMs)
+            throw new Error('Digital twin basic search dateTo must be on or after dateFrom.');
+    }
+    const advancedParameters = Object.entries(input.filters || {}).flatMap(([name, value]) => {
         const values = Array.isArray(value) ? value : value === undefined ? [] : [value];
         return values.map((item) => ({ name, valueString: String(item) }));
     });
+    const parameters = usesBasicSearch
+        ? [
+            ...sections.map((section) => ({ name: DigitalTwinSearchParameter.Section, valueString: section })),
+            { name: DigitalTwinSearchParameter.DateFrom, valueDate: dateFrom },
+            ...(dateTo ? [{ name: DigitalTwinSearchParameter.DateTo, valueDate: dateTo }] : []),
+            { name: DigitalTwinSearchParameter.Text, valueString: searchText },
+        ]
+        : advancedParameters;
     const thid = String(input.thid || randomUUID());
     const body = format === 'org.hl7.fhir.api'
         ? {
@@ -145,7 +180,7 @@ export async function searchDigitalTwinsWithDeps(ctx, input, deps) {
                     meta: {
                         claims: Object.fromEntries([
                             ['@context', format],
-                            ...parameters.map((parameter) => [parameter.name, parameter.valueString]),
+                            ...parameters.map((parameter) => [parameter.name, parameter.valueString || parameter.valueDate || '']),
                         ]),
                     },
                 }],

package/dist/individual-controller-backend-runtime.d.ts

@@ -1,6 +1,6 @@
 import type { SubmitAndPollResult } from 'gdc-sdk-core-ts';
 import type { FamilyOrganizationSummary } from 'gdc-common-utils-ts/utils/family-organization-summary';
-import type { IndividualOrganizationConfirmOrderInput, RouteContext } from './individual-onboarding.js';
+import type { IndividualOrganizationConfirmOrderInput, IndividualOrganizationOrderResult, RouteContext } from './individual-onboarding.js';
 import type { IndividualOrganizationBootstrapInput, IndividualOrganizationStartResult } from './individual-start.js';
 import type { EnsureFamilyOrganizationRegistrationInput, EnsureFamilyOrganizationRegistrationResult } from './family-organization-registration.js';
 import type { FamilyOrganizationSearchInput } from './family-organization-search.js';
@@ -45,7 +45,7 @@ export declare class IndividualControllerBackendRuntime {
     /**
      * Confirms the order returned by the individual bootstrap flow.
      */
-    confirmIndividualOrganizationOrder(profile: BackendIndividualControllerProfile, input: IndividualOrganizationConfirmOrderInput): Promise<SubmitAndPollResult>;
+    confirmIndividualOrganizationOrder(profile: BackendIndividualControllerProfile, input: IndividualOrganizationConfirmOrderInput): Promise<IndividualOrganizationOrderResult>;
     /**
      * Reads the authoritative subject document through the canonical
      * `Communication -> Subject/$summary -> FHIR Parameters` lifecycle.

package/dist/individual-onboarding.d.ts

@@ -21,6 +21,13 @@ export type IndividualOrganizationConfirmOrderInput = {
     timeoutSeconds?: number;
     intervalSeconds?: number;
 };
+/**
+ * Terminal individual Order result with the opaque code required by the
+ * subsequent managed-wallet activation and DCR flow.
+ */
+export type IndividualOrganizationOrderResult = SubmitAndPollResult & Readonly<{
+    activationCode: string;
+}>;
 type ConfirmIndividualOrganizationOrderDeps = {
     input: IndividualOrganizationConfirmOrderInput;
     routeCtx: RouteContext;
@@ -32,5 +39,11 @@ type ConfirmIndividualOrganizationOrderDeps = {
         thid?: string;
     } & Record<string, unknown>, options?: PollOptions) => Promise<SubmitAndPollResult>;
 };
-export declare function confirmIndividualOrganizationOrderWithDeps(deps: ConfirmIndividualOrganizationOrderDeps): Promise<SubmitAndPollResult>;
+export declare function confirmIndividualOrganizationOrderWithDeps(deps: ConfirmIndividualOrganizationOrderDeps): Promise<IndividualOrganizationOrderResult>;
+/**
+ * Reads the opaque controller activation code from a completed individual
+ * Order. Integrators should consume `result.activationCode` instead of calling
+ * this reader directly; it remains public for response-adapter compatibility.
+ */
+export declare function readIndividualOrganizationActivationCode(responseBody: unknown): string | undefined;
 export {};

package/dist/individual-onboarding.js

@@ -1,4 +1,5 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+import { extractPrimaryClaims } from 'gdc-common-utils-ts';
 import { resolvePollOptionsFromSeconds } from './poll-options.js';
 export async function confirmIndividualOrganizationOrderWithDeps(deps) {
     /**
@@ -35,7 +36,21 @@ export async function confirmIndividualOrganizationOrderWithDeps(deps) {
         timeoutMs: deps.defaultTimeoutMs,
         intervalMs: deps.defaultIntervalMs,
     });
-    return deps.submitAndPoll(deps.individualFamilyOrderBatchPath(deps.routeCtx), deps.individualFamilyOrderPollPath(deps.routeCtx), payload, pollOptions);
+    const order = await deps.submitAndPoll(deps.individualFamilyOrderBatchPath(deps.routeCtx), deps.individualFamilyOrderPollPath(deps.routeCtx), payload, pollOptions);
+    const activationCode = readIndividualOrganizationActivationCode(order.poll.body);
+    if (!activationCode) {
+        throw new Error('confirmIndividualOrganizationOrder failed: missing controller activation code in GW Order response.');
+    }
+    return { ...order, activationCode };
+}
+/**
+ * Reads the opaque controller activation code from a completed individual
+ * Order. Integrators should consume `result.activationCode` instead of calling
+ * this reader directly; it remains public for response-adapter compatibility.
+ */
+export function readIndividualOrganizationActivationCode(responseBody) {
+    const claims = extractPrimaryClaims(responseBody);
+    return String(claims['org.schema.IndividualProduct.serialNumber'] || '').trim() || undefined;
 }
 function createRuntimeUuid() {
     const fromCrypto = globalThis.crypto?.randomUUID?.();

package/dist/node-runtime-client.d.ts

@@ -5,11 +5,11 @@ import { type ResolvedAppInfo, type CommunicationClinicalFormatRenderers, type S
 import { type HostRouteContext, type HostedTenantLifecycleInput } from './host-onboarding.js';
 import type { HostedTenantDescendantKind } from './host-onboarding.js';
 import type { NodeLegalOrganizationVerificationTransactionInput, NodeOrganizationDidBindingInput, NodeOrganizationActivationInput } from './orchestration/client-port.js';
-import { type IndividualOrganizationConfirmOrderInput, type RouteContext } from './individual-onboarding.js';
+import { type IndividualOrganizationConfirmOrderInput, type IndividualOrganizationOrderResult, type RouteContext } from './individual-onboarding.js';
 import { type EnsureFamilyOrganizationRegistrationInput } from './family-organization-registration.js';
 import { type FamilyOrganizationSearchInput } from './family-organization-search.js';
 import { type SmartTokenRequestInput } from './smart-token.js';
-import { type EmployeeDeviceActivationRequestInput, type EmployeeDeviceActivationResult, type EmployeeDeviceRevocationInput } from './device-activation.js';
+import { type EmployeeDeviceActivationRequestInput, type EmployeeDeviceActivationResult, type EmployeeDeviceOtpRecoveryInput, type EmployeeDeviceOtpRecoveryResult, type EmployeeDeviceRevocationInput } from './device-activation.js';
 import { type OrganizationLicenseOrderConfirmInput } from './organization-license-order.js';
 import { type IndividualOrganizationBootstrapInput, type IndividualOrganizationStartResult } from './individual-start.js';
 import { type CommunicationIngestionInput, type BlockchainArtifactRegistrationInput, type VitalSignBatchCommunicationFromSearchResponseInput, type CommunicationParticipantRuntimeSearchInput, type ClinicalBundleSearchInput, type ClinicalSectionUpdateInput, type ClinicalSummaryReadResult, type ClinicalSummaryRequestInput, type ClinicalSummaryUpdateInput, type GrantProfessionalAccessInput, type GrantProfessionalAccessResult, type DigitalTwinSecondaryUseConsentInput, type DigitalTwinSecondaryUseConsentResult, type DigitalTwinSubjectLinkPurgeInput, type DigitalTwinSubjectLinkPurgeResult, type IndividualMemberLifecycleInput, type IndividualMemberLicenseAddInput, type IndividualMemberLicenseInvitationInput, type IndividualMemberLicenseTransitionInput, type LicenseListRuntimeSearchInput, type LicenseOfferRuntimeSearchInput, type LicenseOrderRuntimeSearchInput, type OrganizationEmployeeCreationInput, type OrganizationEmployeeLicenseAddInput, type OrganizationEmployeeLicenseOfferInput, type OrganizationEmployeeLicenseInvitationInput, type OrganizationEmployeeLifecycleInput, type OrganizationEmployeeSearchInput, type ProfessionalAccessRequestInput, type ProfessionalAccessRequestResult, type RevokeProfessionalAccessInput, type RevokeProfessionalAccessResult, type RelatedPersonUpsertInput } from './resource-operations.js';
@@ -376,7 +376,7 @@ export declare class HttpRuntimeClient implements NodeRuntimeClient {
     /**
      * Confirms the order returned by `startIndividualOrganization(...)`.
      */
-    confirmIndividualOrganizationOrder(input: IndividualOrganizationConfirmOrderInput): Promise<SubmitAndPollResult>;
+    confirmIndividualOrganizationOrder(input: IndividualOrganizationConfirmOrderInput): Promise<IndividualOrganizationOrderResult>;
     /**
      * Disables a hosted individual/family organization without releasing licenses.
      *
@@ -465,6 +465,8 @@ export declare class HttpRuntimeClient implements NodeRuntimeClient {
      * The implementation is actor-neutral and shares the profile-device flow.
      */
     activateEmployeeDeviceWithActivationRequest(input: EmployeeDeviceActivationRequestInput): Promise<EmployeeDeviceActivationResult>;
+    /** Obtains a replacement activation credential after fresh OTP verification. */
+    recoverEmployeeDeviceWithOtp(input: EmployeeDeviceOtpRecoveryInput & Partial<RouteContext>): Promise<EmployeeDeviceOtpRecoveryResult>;
     /**
      * Creates or updates a `RelatedPerson` for non-employee family/caregiver
      * roles such as a grandfather, guardian, or external caregiver.

package/dist/node-runtime-client.js

@@ -6,7 +6,7 @@ import { confirmIndividualOrganizationOrderWithDeps, } from './individual-onboar
 import { ensureFamilyOrganizationRegistrationWithDeps, } from './family-organization-registration.js';
 import { searchFamilyOrganizationWithDeps } from './family-organization-search.js';
 import { requestSmartTokenWithDeps } from './smart-token.js';
-import { activateEmployeeDeviceWithActivationCodeWithDeps, activateEmployeeDeviceWithActivationRequestWithDeps, revokeEmployeeDeviceWithDeps, } from './device-activation.js';
+import { activateEmployeeDeviceWithActivationCodeWithDeps, activateEmployeeDeviceWithActivationRequestWithDeps, recoverEmployeeDeviceWithOtpWithDeps, revokeEmployeeDeviceWithDeps, } from './device-activation.js';
 import { extractOfferIdFromResponseBody, extractOfferPreviewFromResponseBody, } from './order-offer-summary.js';
 import { confirmOrganizationLicenseOrderWithDeps } from './organization-license-order.js';
 import { startIndividualOrganizationWithDeps } from './individual-start.js';
@@ -909,6 +909,17 @@ export class HttpRuntimeClient {
     async activateEmployeeDeviceWithActivationRequest(input) {
         return this.activateProfileDeviceWithActivationRequest(input);
     }
+    /** Obtains a replacement activation credential after fresh OTP verification. */
+    async recoverEmployeeDeviceWithOtp(input) {
+        const routeCtx = this.paths.routeCtxFromInput(input);
+        return recoverEmployeeDeviceWithOtpWithDeps({
+            routeCtx,
+            input,
+            identityEmployeeRecoveryPath: this.paths.identityEmployeeRecoveryPath.bind(this.paths),
+            identityEmployeeRecoveryPollPath: this.paths.identityEmployeeRecoveryPollPath.bind(this.paths),
+            submitAndPollWithBearerToken: this.submitAndPollWithBearerToken.bind(this),
+        });
+    }
     /**
      * Creates or updates a `RelatedPerson` for non-employee family/caregiver
      * roles such as a grandfather, guardian, or external caregiver.

package/dist/orchestration/client-port.d.ts

@@ -9,7 +9,7 @@ import type { EmployeeDeviceActivationResult, EmployeeDeviceActivationRequestInp
 import type { OrganizationEmployeeProvisioningInput, OrganizationEmployeeProvisioningResult } from '../organization-employee-lifecycle.js';
 import type { OrganizationEmployeeLifecycleRecord } from 'gdc-common-utils-ts/models/organization-employee-lifecycle';
 import type { HostRouteContext, HostedTenantLifecycleInput, LegalOrganizationOrderInput } from '../host-onboarding.js';
-import type { IndividualOrganizationConfirmOrderInput, RouteContext } from '../individual-onboarding.js';
+import type { IndividualOrganizationConfirmOrderInput, IndividualOrganizationOrderResult, RouteContext } from '../individual-onboarding.js';
 import type { IndividualOrganizationBootstrapInput, IndividualOrganizationStartResult } from '../individual-start.js';
 import type { FamilyOrganizationSearchInput } from '../family-organization-search.js';
 import type { FhirR5SubscriptionTopic } from 'gdc-common-utils-ts/models/fhir-r5-subscription';
@@ -106,7 +106,7 @@ export type RuntimeClient = {
     startIndividualOrganization?: (input: IndividualOrganizationBootstrapInput) => Promise<IndividualOrganizationStartResult>;
     searchFamilyOrganization?: (ctx: RouteContext, input: FamilyOrganizationSearchInput) => Promise<FamilyOrganizationSummary | null>;
     ensureFamilyOrganizationRegistration?: (ctx: RouteContext, input: EnsureFamilyOrganizationRegistrationInput) => Promise<EnsureFamilyOrganizationRegistrationResult>;
-    confirmIndividualOrganizationOrder?: (input: IndividualOrganizationConfirmOrderInput) => Promise<SubmitAndPollResult>;
+    confirmIndividualOrganizationOrder?: (input: IndividualOrganizationConfirmOrderInput) => Promise<IndividualOrganizationOrderResult>;
     disableIndividual?: (ctx: RouteContext, input: IndividualOrganizationLifecycleInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
     purgeIndividual?: (ctx: RouteContext, input: IndividualOrganizationLifecycleInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
     disableIndividualMember?: (ctx: RouteContext, input: IndividualMemberLifecycleInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;

package/dist/orchestration/digital-twin-sdk.d.ts

@@ -10,7 +10,14 @@ export declare class DigitalTwinSdk {
     constructor(client: NodeRuntimeClient, actorDid?: string);
     /** Requests the SMART token used by subsequent digital-twin operations. */
     requestSmartToken(input: SmartTokenRequestInput): Promise<SmartTokenExchangeResult>;
-    /** Searches pseudonymous records and exposes matched Compositions directly. */
+    /**
+     * Searches pseudonymous records and exposes matched Compositions directly.
+     *
+     * MVP basic search supplies `sections`, `dateFrom`, optional `dateTo`, and
+     * `text`. GW resolves an omitted `dateTo` to its current time, applies OR
+     * across sections and requires text/date to match the same clinical record.
+     * Organization/tenant scope comes from the authenticated SMART token.
+     */
     search(ctx: RouteContext, input: DigitalTwinSearchInput): Promise<DigitalTwinSearchResult>;
     /**
      * Saves a tagged researcher-owned working selection for one matching twin.

package/dist/orchestration/digital-twin-sdk.js

@@ -28,7 +28,14 @@ export class DigitalTwinSdk {
             this.researcherDid = actorDid;
         return result;
     }
-    /** Searches pseudonymous records and exposes matched Compositions directly. */
+    /**
+     * Searches pseudonymous records and exposes matched Compositions directly.
+     *
+     * MVP basic search supplies `sections`, `dateFrom`, optional `dateTo`, and
+     * `text`. GW resolves an omitted `dateTo` to its current time, applies OR
+     * across sections and requires text/date to match the same clinical record.
+     * Organization/tenant scope comes from the authenticated SMART token.
+     */
     async search(ctx, input) {
         const filters = { ...(input.filters || {}) };
         const isPrivateSelectionSearch = Object.keys(filters).some((name) => {

package/dist/orchestration/individual-controller-sdk.d.ts

@@ -3,7 +3,7 @@ import { type NodeRuntimeClient, type PollOptions, type SubmitAndPollResult, typ
 import type { FamilyOrganizationSummary } from 'gdc-common-utils-ts/utils/family-organization-summary';
 import type { EnsureFamilyOrganizationRegistrationInput, EnsureFamilyOrganizationRegistrationResult } from '../family-organization-registration.js';
 import type { FamilyOrganizationSearchInput } from '../family-organization-search.js';
-import type { IndividualOrganizationConfirmOrderInput, RouteContext } from '../individual-onboarding.js';
+import type { IndividualOrganizationConfirmOrderInput, IndividualOrganizationOrderResult, RouteContext } from '../individual-onboarding.js';
 import type { IndividualOrganizationBootstrapInput, IndividualOrganizationStartResult } from '../individual-start.js';
 import type { NodeCapability } from '../session.js';
 import type { IndividualOrganizationLifecycleInput } from 'gdc-sdk-core-ts';
@@ -39,7 +39,7 @@ export declare class IndividualControllerSdk {
     /**
      * Confirms the order returned by `startIndividualOrganization(...)`.
      */
-    confirmIndividualOrganizationOrder(input: IndividualOrganizationConfirmOrderInput): Promise<SubmitAndPollResult>;
+    confirmIndividualOrganizationOrder(input: IndividualOrganizationConfirmOrderInput): Promise<IndividualOrganizationOrderResult>;
     /**
      * Disables the hosted individual/family organization without freeing licenses.
      */

package/dist/runtime-client-paths.d.ts

@@ -109,6 +109,8 @@ export declare class RuntimeClientPaths {
     digitalTwinCommunicationPollPath(ctx: RouteContext, format: string): string;
     identityTokenExchangePath(ctx: RouteContext): string;
     identityTokenExchangePollPath(ctx: RouteContext): string;
+    identityEmployeeRecoveryPath(ctx: RouteContext): string;
+    identityEmployeeRecoveryPollPath(ctx: RouteContext): string;
     identityDeviceDcrPath(ctx: RouteContext): string;
     identityDeviceDcrPollPath(ctx: RouteContext): string;
     identityDeviceRevokePath(ctx: RouteContext): string;

package/dist/runtime-client-paths.js

@@ -1,6 +1,6 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
 import { GwCoreLifecycleAction } from './constants/lifecycle.js';
-import { buildHostRegistryPath, buildIdentityDeviceDcrPath, buildIdentityDeviceDcrPollPath, buildIdentityDeviceRevokePath, buildIdentityDeviceRevokePollPath, buildIdentityLicenseIssuePath, buildIdentityLicenseIssuePollPath, buildIdentityOpenIdSmartTokenPath, buildIdentityOpenIdSmartTokenPollPath, buildIdentityTokenExchangePath, buildIdentityTokenExchangePollPath, buildOrganizationDidBindingPath, buildOrganizationDidBindingPollPath, buildV1Path, } from './runtime-paths.js';
+import { buildHostRegistryPath, buildIdentityDeviceDcrPath, buildIdentityDeviceDcrPollPath, buildIdentityDeviceRevokePath, buildIdentityDeviceRevokePollPath, buildIdentityEmployeeRecoveryPath, buildIdentityEmployeeRecoveryPollPath, buildIdentityLicenseIssuePath, buildIdentityLicenseIssuePollPath, buildIdentityOpenIdSmartTokenPath, buildIdentityOpenIdSmartTokenPollPath, buildIdentityTokenExchangePath, buildIdentityTokenExchangePollPath, buildOrganizationDidBindingPath, buildOrganizationDidBindingPollPath, buildV1Path, } from './runtime-paths.js';
 import { requireHostRouteContext, requireRouteContext, routeCtxFromInput, } from './runtime-route-context.js';
 export class RuntimeClientPaths {
     constructor(defaultCtx) {
@@ -123,6 +123,8 @@ export class RuntimeClientPaths {
     digitalTwinCommunicationPollPath(ctx, format) { return this.v1Path(ctx, 'digitaltwin', format, 'Communication', '_batch-response'); }
     identityTokenExchangePath(ctx) { return buildIdentityTokenExchangePath(ctx); }
     identityTokenExchangePollPath(ctx) { return buildIdentityTokenExchangePollPath(ctx); }
+    identityEmployeeRecoveryPath(ctx) { return buildIdentityEmployeeRecoveryPath(ctx); }
+    identityEmployeeRecoveryPollPath(ctx) { return buildIdentityEmployeeRecoveryPollPath(ctx); }
     identityDeviceDcrPath(ctx) { return buildIdentityDeviceDcrPath(ctx); }
     identityDeviceDcrPollPath(ctx) { return buildIdentityDeviceDcrPollPath(ctx); }
     identityDeviceRevokePath(ctx) { return buildIdentityDeviceRevokePath(ctx); }

package/dist/runtime-paths.d.ts

@@ -6,6 +6,10 @@ export declare function buildOrganizationDidBindingPath(routeCtx: RouteContext):
 export declare function buildOrganizationDidBindingPollPath(routeCtx: RouteContext): string;
 export declare function buildIdentityTokenExchangePath(ctx: RouteContext): string;
 export declare function buildIdentityTokenExchangePollPath(ctx: RouteContext): string;
+/** Fresh OTP-assisted replacement credential for one existing installation. */
+export declare function buildIdentityEmployeeRecoveryPath(ctx: RouteContext): string;
+/** Poll endpoint paired with employee wallet recovery. */
+export declare function buildIdentityEmployeeRecoveryPollPath(ctx: RouteContext): string;
 export declare function buildIdentityDeviceDcrPath(ctx: RouteContext): string;
 export declare function buildIdentityDeviceDcrPollPath(ctx: RouteContext): string;
 /** Canonical controller operation that reserves an employee seat activation credential. */

package/dist/runtime-paths.js

@@ -28,6 +28,14 @@ export function buildIdentityTokenExchangePath(ctx) {
 export function buildIdentityTokenExchangePollPath(ctx) {
     return buildIdentityAuthPath(ctx, IdentityAuthActions.ExchangeResponse);
 }
+/** Fresh OTP-assisted replacement credential for one existing installation. */
+export function buildIdentityEmployeeRecoveryPath(ctx) {
+    return buildIdentityAuthPath(ctx, '_recover');
+}
+/** Poll endpoint paired with employee wallet recovery. */
+export function buildIdentityEmployeeRecoveryPollPath(ctx) {
+    return buildIdentityAuthPath(ctx, '_recover-response');
+}
 export function buildIdentityDeviceDcrPath(ctx) {
     return buildIdentityAuthPath(ctx, IdentityAuthActions.Dcr);
 }

package/dist/server-profile-session.d.ts

@@ -45,6 +45,7 @@ export type ServerProfileSessionRecord = Readonly<{
     subjectDid: string;
     scopes: string[];
     sealedUnlockedWalletSeed: string;
+    sealedUnlockedVpToken?: string;
     sealedAccessToken: string;
     expiresAt: string;
 }>;
@@ -56,7 +57,18 @@ export type ServerProfileStore = Readonly<{
     getSession(sessionId: string): Promise<ServerProfileSessionRecord | undefined>;
     putSession(session: ServerProfileSessionRecord): Promise<void>;
     deleteSession(sessionId: string): Promise<void>;
+    /** Required by key rotation so no session can retain the superseded seed. */
+    deleteSessionsForProfile?(profileId: string): Promise<void>;
 }>;
+export type ServerEmployeeProfileOtpRotationInput = Readonly<{
+    ownerId: string;
+    profileId: string;
+    idToken: string;
+    newPin: string;
+    redirectUris: string[];
+    clientName: string;
+}>;
+export type ServerEmployeeProfileOtpRotationResult = ServerProfileRecord;
 export type ServerProfileEnrollmentInput = Readonly<{
     /** Stable confidential id of the authenticated portal account that owns and lists this profile. */
     ownerId: string;
@@ -221,6 +233,13 @@ export declare class ServerProfileSessionManager {
     private readonly options;
     constructor(options: ServerProfileSessionManagerOptions);
     enroll(input: ServerProfileEnrollmentInput): Promise<ServerProfileRecord>;
+    /**
+     * Rotates an employee wallet after a fresh OTP-authenticated GW recovery.
+     * The old PIN and seed are never opened: DCR replaces the installation with
+     * newly generated keys, all old BFF sessions are removed, and the new wallet
+     * is opened once with the new PIN.
+     */
+    rotateEmployeeProfileWithOtp(input: ServerEmployeeProfileOtpRotationInput): Promise<ServerEmployeeProfileOtpRotationResult>;
     /**
      * Derives only the public enrollment descriptors for a server-governed
      * recovery seed. This is intended for pre-DCR controller binding requests;
@@ -249,6 +268,12 @@ export declare class ServerProfileSessionManager {
     submitLegalOrganizationIssueWithBootstrapWallet(input: ServerProfileOrganizationIssueInput): Promise<SubmitAndPollResult>;
     listProfiles(ownerId: string): Promise<ServerProfileRecord[]>;
     unlock(input: ServerProfileUnlockInput): Promise<ResolvedServerProfileSession>;
+    /**
+     * Renews the short SMART bearer while retaining the already-open server
+     * wallet session. The caller must supply a fresh authenticated account
+     * token; neither the PIN nor wallet keys return to the browser.
+     */
+    refreshSession(ownerId: string, sessionId: string, idToken: string): Promise<ResolvedServerProfileSession>;
     resolveSession(ownerId: string, sessionId: string): Promise<ResolvedServerProfileSession>;
     lock(ownerId: string, sessionId: string): Promise<void>;
     private createClient;

package/dist/server-profile-session.js

@@ -100,6 +100,53 @@ export class ServerProfileSessionManager {
         await this.options.store.putProfile(record);
         return record;
     }
+    /**
+     * Rotates an employee wallet after a fresh OTP-authenticated GW recovery.
+     * The old PIN and seed are never opened: DCR replaces the installation with
+     * newly generated keys, all old BFF sessions are removed, and the new wallet
+     * is opened once with the new PIN.
+     */
+    async rotateEmployeeProfileWithOtp(input) {
+        const previous = await this.requireOwnedProfile(input.ownerId, input.profileId);
+        if (previous.actorKind !== ActorKinds.OrganizationEmployee || previous.actorMode !== 'member') {
+            throw new Error('OTP wallet rotation is restricted to organization employee profiles.');
+        }
+        const clientInstanceId = String(previous.clientInstanceId || '').trim();
+        if (!clientInstanceId)
+            throw new Error('Employee profile has no registered installation id.');
+        if (!this.options.store.deleteSessionsForProfile) {
+            throw new Error('Employee wallet rotation requires profile-session invalidation support.');
+        }
+        const client = this.createClient(previous.routeContext, input.idToken);
+        const replacement = await client.recoverEmployeeDeviceWithOtp({
+            ...previous.routeContext,
+            idToken: input.idToken,
+            clientInstanceId,
+        });
+        const profile = await this.enroll({
+            ownerId: previous.ownerId,
+            profileId: previous.profileId,
+            actorKind: previous.actorKind,
+            actorMode: previous.actorMode,
+            actorDid: previous.actorDid,
+            profileDid: previous.profileDid,
+            providerDid: previous.providerDid,
+            routeContext: previous.routeContext,
+            allowedSubjectDids: previous.allowedSubjectDids,
+            pin: input.newPin,
+            idToken: input.idToken,
+            activationCode: replacement.activationCode,
+            clientInstanceId,
+            redirectUris: input.redirectUris,
+            clientName: input.clientName,
+            professionalProof: {
+                role: replacement.employeeRole,
+                sameAs: replacement.employeeActorIdentifier,
+            },
+        });
+        await this.options.store.deleteSessionsForProfile(profile.profileId);
+        return profile;
+    }
     /**
      * Derives only the public enrollment descriptors for a server-governed
      * recovery seed. This is intended for pre-DCR controller binding requests;
@@ -269,11 +316,69 @@ export class ServerProfileSessionManager {
             subjectDid: input.subjectDid,
             scopes: unique(input.scopes),
             sealedUnlockedWalletSeed: await this.options.sealer.seal(seed, `${sessionId}:unlocked-wallet-seed`),
+            ...(vpToken ? {
+                sealedUnlockedVpToken: await this.options.sealer.seal(vpToken, `${sessionId}:unlocked-vp-token`),
+            } : {}),
             sealedAccessToken: await this.options.sealer.seal(token.accessToken, `${sessionId}:access-token`),
             expiresAt: expiresAt.toISOString(),
         });
         return this.resolveSession(input.ownerId, sessionId);
     }
+    /**
+     * Renews the short SMART bearer while retaining the already-open server
+     * wallet session. The caller must supply a fresh authenticated account
+     * token; neither the PIN nor wallet keys return to the browser.
+     */
+    async refreshSession(ownerId, sessionId, idToken) {
+        const session = await this.options.store.getSession(sessionId);
+        if (!session || session.ownerId !== ownerId)
+            throw new Error('Profile session not found.');
+        if (new Date(session.expiresAt) <= this.now()) {
+            await this.options.store.deleteSession(sessionId);
+            throw new Error('Profile session expired.');
+        }
+        const normalizedIdToken = String(idToken || '').trim();
+        if (!normalizedIdToken)
+            throw new Error('Profile session refresh requires idToken.');
+        const profile = await this.requireOwnedProfile(ownerId, session.profileId);
+        this.requireSubject(profile, session.subjectDid);
+        const seed = await this.options.sealer.unseal(session.sealedUnlockedWalletSeed, `${sessionId}:unlocked-wallet-seed`);
+        const vpToken = session.sealedUnlockedVpToken
+            ? await this.options.sealer.unseal(session.sealedUnlockedVpToken, `${sessionId}:unlocked-vp-token`)
+            : undefined;
+        const walletKeyDerivationId = profile.walletKeyDerivationId || profile.profileId;
+        const wallet = await this.createWallet(walletKeyDerivationId, seed);
+        const now = this.now();
+        const smartTokenEndpoint = [
+            this.options.gatewayBaseUrl.replace(/\/+$/, ''),
+            buildIdentityOpenIdSmartTokenPath(profile.routeContext),
+        ].join('');
+        const assertion = await buildWalletClientAssertion(wallet, profile, smartTokenEndpoint, now);
+        const token = await this.createClient(profile.routeContext, normalizedIdToken).requestSmartToken({
+            ...profile.routeContext,
+            actorDid: profile.actorDid,
+            subjectDid: session.subjectDid,
+            clientId: profile.clientId,
+            issuer: profile.clientId,
+            audience: smartTokenEndpoint,
+            idToken: normalizedIdToken,
+            vpToken,
+            vpTokenFallback: vpToken ? undefined : 'omit',
+            clientAssertion: assertion,
+            clientAssertionType: 'private_key_jwt',
+            smartTokenKind: 'openid-smart',
+            acrValues: profileSmartAcrValues(profile.actorKind),
+            scopes: unique(session.scopes),
+            tokenCacheKey: `profile-refresh:${sessionId}:${now.getTime()}`,
+        });
+        if (token.status !== 'fetched' || !token.accessToken)
+            throw new Error('SMART token refresh failed.');
+        await this.options.store.putSession({
+            ...session,
+            sealedAccessToken: await this.options.sealer.seal(token.accessToken, `${sessionId}:access-token`),
+        });
+        return this.resolveSession(ownerId, sessionId);
+    }
     async resolveSession(ownerId, sessionId) {
         const session = await this.options.store.getSession(sessionId);
         if (!session || session.ownerId !== ownerId)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-sdk-node-ts",
-  "version": "2.4.35",
+  "version": "2.4.37",
   "description": "Next-generation Node runtime package for the GDC SDK family",
   "license": "Apache-2.0",
   "author": "Antifraud Services Inc.",
@@ -38,7 +38,7 @@
     "test:e2e:live-gw:clean": "bash ./scripts/run-live-gw-clean.sh"
   },
   "dependencies": {
-    "gdc-common-utils-ts": "2.5.15",
+    "gdc-common-utils-ts": "2.5.20",
     "gdc-sdk-core-ts": "~2.3.18"
   },
   "devDependencies": {

package/dist/organization-registration-authorization.d.ts

@@ -1,16 +0,0 @@
-import type { VerifiableCredentialV2 } from 'gdc-common-utils-ts/models/verifiable-credential';
-import type { IWallet, WalletExecutionContext, WalletKeySelection } from 'gdc-sdk-core-ts';
-/** Input required to add one human-authorizer proof to the out-of-band VC. */
-export type SignOrganizationRegistrationAuthorizationInput = Readonly<{
-    credential: VerifiableCredentialV2;
-    wallet: IWallet;
-    context: WalletExecutionContext;
-    key: WalletKeySelection;
-    verificationMethod: string;
-    createdAt?: string;
-}>;
-/**
- * Adds one detached JWS proof made by the already-unlocked professional
- * profile. The browser never receives the private key or clear wallet seed.
- */
-export declare function signOrganizationRegistrationAuthorizationCredential(input: SignOrganizationRegistrationAuthorizationInput): Promise<VerifiableCredentialV2>;

package/dist/organization-registration-authorization.js

@@ -1,34 +0,0 @@
-import { canonicalizeOrganizationRegistrationAuthorizationCredential, } from 'gdc-common-utils-ts/utils/organization-registration-authorization';
-/**
- * Adds one detached JWS proof made by the already-unlocked professional
- * profile. The browser never receives the private key or clear wallet seed.
- */
-export async function signOrganizationRegistrationAuthorizationCredential(input) {
-    if (!input.wallet.signDetachedJws) {
-        throw new Error('Wallet does not support detached organization authorization proofs.');
-    }
-    const verificationMethod = String(input.verificationMethod || '').trim();
-    if (!verificationMethod)
-        throw new Error('Organization authorization proof requires verificationMethod.');
-    const payload = canonicalizeOrganizationRegistrationAuthorizationCredential(input.credential);
-    const jws = await input.wallet.signDetachedJws(input.context, {
-        payload,
-        header: { typ: 'application/vc+ld+json' },
-        key: input.key,
-    });
-    const existingProofs = Array.isArray(input.credential.proof)
-        ? input.credential.proof
-        : input.credential.proof
-            ? [input.credential.proof]
-            : [];
-    return {
-        ...input.credential,
-        proof: [...existingProofs, {
-                type: 'JsonWebSignature2020',
-                created: input.createdAt || new Date().toISOString(),
-                proofPurpose: 'contractAgreement',
-                verificationMethod,
-                jws,
-            }],
-    };
-}