gdc-sdk-node-ts 2.4.36 → 2.4.39

package/README.md

@@ -72,40 +72,43 @@ If you are integrating this package for the first time, open these in order:
 3. [docs/101-PROFESSIONAL-CONSENT-SMART.md](./docs/101-PROFESSIONAL-CONSENT-SMART.md)
    Canonical professional DID, consent, VP and SMART flow without literal
    sections or caller-built audience URLs.
-4. [docs/101-SDK_INTEGRATION.md](./docs/101-SDK_INTEGRATION.md)
+4. [docs/101-AUTHORIZED_SUBJECT_DIRECTORY.md](./docs/101-AUTHORIZED_SUBJECT_DIRECTORY.md)
+   Signed OpenID account discovery of already-authorized subjects without
+   treating the account token as VP, SMART or wallet proof.
+5. [docs/101-SDK_INTEGRATION.md](./docs/101-SDK_INTEGRATION.md)
    Real backend setup plus the public runtime entrypoints:
    `HostOnboardingSdk`, `OrganizationControllerSdk`,
    `IndividualControllerSdk`, `ProfessionalSdk`, route-context usage, and the
    canonical `ProfileRuntime -> loadProfile(...) -> workspace/session -> actor facade -> submit/poll` shape.
-5. [tests/101-live-full-cycle-bff-runtime.e2e.test.mjs](./tests/101-live-full-cycle-bff-runtime.e2e.test.mjs)
+6. [tests/101-live-full-cycle-bff-runtime.e2e.test.mjs](./tests/101-live-full-cycle-bff-runtime.e2e.test.mjs)
    Canonical live backend/BFF walkthrough on a fresh local GW lifecycle:
    host/tenant activation, employee provisioning, individual bootstrap,
    consent grant, professional SMART token, clinical read, and final cleanup.
-6. [docs/101-LIVE_GW_LOCAL.md](./docs/101-LIVE_GW_LOCAL.md)
+7. [docs/101-LIVE_GW_LOCAL.md](./docs/101-LIVE_GW_LOCAL.md)
    Exact TTY/local/Docker commands for running the SDK against a real local GW
    CORE, including tenant bootstrap and employee-seat setup.
-7. [docs/101-DISCOVERY.md](./docs/101-DISCOVERY.md)
+8. [docs/101-DISCOVERY.md](./docs/101-DISCOVERY.md)
    Node/BFF dataspace discovery, hosting-operator resolution, provider
    resolution, and the correct integration boundary for fallback and cache.
-8. [gdc-sdk-core-ts/docs/101-SDK_FLOWS.md](https://github.com/Global-DataCare/gdc-sdk-core-ts/blob/main/docs/101-SDK_FLOWS.md)
+9. [gdc-sdk-core-ts/docs/101-SDK_FLOWS.md](https://github.com/Global-DataCare/gdc-sdk-core-ts/blob/main/docs/101-SDK_FLOWS.md)
    Actor split and business-flow map across organization, individual,
    permissions, invitation, import, and SMART flows.
-9. [gwtemplate-node-ts/docs/PORTAL_API_TO_GW_CORE.md](https://github.com/Global-DataCare/gwtemplate-node-ts/blob/main/docs/PORTAL_API_TO_GW_CORE.md)
+10. [gwtemplate-node-ts/docs/PORTAL_API_TO_GW_CORE.md](https://github.com/Global-DataCare/gwtemplate-node-ts/blob/main/docs/PORTAL_API_TO_GW_CORE.md)
    Canonical portal/BFF functional map over GW CORE, including the domain
    split between `employees`, `related persons`, `members`, and `consents`.
-10. [gdc-common-utils-ts/src/examples/](https://github.com/Global-DataCare/gdc-common-utils-ts/tree/main/src/examples)
+11. [gdc-common-utils-ts/src/examples/](https://github.com/Global-DataCare/gdc-common-utils-ts/tree/main/src/examples)
    Shared payload values used by the docs and tests.
-11. [gdc-common-utils-ts/docs/101-LIFECYCLE.md](https://github.com/Global-DataCare/gdc-common-utils-ts/blob/main/docs/101-LIFECYCLE.md)
+12. [gdc-common-utils-ts/docs/101-LIFECYCLE.md](https://github.com/Global-DataCare/gdc-common-utils-ts/blob/main/docs/101-LIFECYCLE.md)
    Canonical `enable/disable/delete` semantics and copy/paste placeholders.
-12. [tests/101-backend-profile-runtime.test.mjs](./tests/101-backend-profile-runtime.test.mjs)
+13. [tests/101-backend-profile-runtime.test.mjs](./tests/101-backend-profile-runtime.test.mjs)
    Technical runtime slice for profile/device/session orchestration internals.
    Read this after the public actor SDK guides, not before them.
-13. [tests/101-individual-controller-backend-runtime.test.mjs](./tests/101-individual-controller-backend-runtime.test.mjs)
+14. [tests/101-individual-controller-backend-runtime.test.mjs](./tests/101-individual-controller-backend-runtime.test.mjs)
    Technical wrapper slice around the generic profile runtime. This is not the
    main onboarding path for new integrators.
-14. [docs/V2_INDIVIDUAL_REGISTRATION_RECONCILIATION.md](./docs/V2_INDIVIDUAL_REGISTRATION_RECONCILIATION.md)
+15. [docs/V2_INDIVIDUAL_REGISTRATION_RECONCILIATION.md](./docs/V2_INDIVIDUAL_REGISTRATION_RECONCILIATION.md)
    Historical reconciliation note for the current CORE registration baseline.
-15. [docs/NEXT_STEPS.md](./docs/NEXT_STEPS.md)
+16. [docs/NEXT_STEPS.md](./docs/NEXT_STEPS.md)
    Follow-up scope after GW CORE live validation, including the future user job
    manager boundary.
 

package/dist/authorized-subject-directory.d.ts

@@ -0,0 +1,51 @@
+import type { SubmitAndPollResult } from 'gdc-sdk-core-ts';
+import type { RouteContext } from './individual-onboarding.js';
+/** Verified contact extracted by the BFF from a signed OpenID `id_token`. */
+export type AuthorizedSubjectVerifiedContact = Readonly<{
+    email?: string;
+    telephone?: string;
+}>;
+/**
+ * High-level input for listing subject grants already accepted by an
+ * individual index. The contact locates grants; it is not role or action proof.
+ */
+export type AuthorizedIndividualSubjectDirectoryInput = Readonly<{
+    verifiedContact: AuthorizedSubjectVerifiedContact;
+    requestThid?: string;
+    pollOptions?: Readonly<{
+        timeoutMs?: number;
+        intervalMs?: number;
+    }>;
+}>;
+/** One exact subject projection paired with its accepted grant metadata. */
+export type AuthorizedIndividualSubject = Readonly<{
+    subjectDid: string;
+    role?: string;
+    /** Accepted provider grant claims; descriptive metadata, never action authority. */
+    grantClaims: Readonly<Record<string, unknown>>;
+    authorizationEvidenceId?: string;
+    issuerDid?: string;
+    subjectClaims: Readonly<Record<string, unknown>>;
+}>;
+type DirectoryDeps = Readonly<{
+    individualLicenseSearchPath: (ctx: RouteContext) => string;
+    individualLicenseSearchPollPath: (ctx: RouteContext) => string;
+    individualOrganizationSearchPath: (ctx: RouteContext) => string;
+    individualOrganizationSearchPollPath: (ctx: RouteContext) => string;
+    submitAndPoll: (submitPath: string, pollPath: string, payload: {
+        thid?: string;
+    } & Record<string, unknown>, pollOptions?: {
+        timeoutMs?: number;
+        intervalMs?: number;
+    }) => Promise<SubmitAndPollResult>;
+}>;
+/**
+ * Lists already-authorized individual subjects without exposing GW plumbing.
+ *
+ * The caller supplies a verified contact taken from a signed OpenID token.
+ * That account/contact proof is intentionally insufficient for protected
+ * actions: professional role proof remains a separate `vp_token`, and SMART
+ * access remains bound to a registered wallet/device session.
+ */
+export declare function listAuthorizedIndividualSubjectsWithDeps(routeContext: RouteContext, input: AuthorizedIndividualSubjectDirectoryInput, deps: DirectoryDeps): Promise<AuthorizedIndividualSubject[]>;
+export {};

package/dist/authorized-subject-directory.js

@@ -0,0 +1,116 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+const SCHEMA_CONTEXT = 'org.schema';
+const INDIVIDUAL_AUDIENCE_TYPE = 'Individual';
+const ACCEPTED_ITEM_CONDITION = 'https://schema.org/UsedCondition';
+const CLAIM_AUDIENCE_TYPE = 'org.schema.IndividualProduct.audience.audienceType';
+const CLAIM_ITEM_CONDITION = 'org.schema.IndividualProduct.itemCondition';
+const CLAIM_PERSON_EMAIL = 'org.schema.Person.email';
+const CLAIM_PERSON_TELEPHONE = 'org.schema.Person.telephone';
+const CLAIM_ORGANIZATION_SAME_AS = 'org.schema.Organization.sameAs';
+const CLAIM_RELATED_PERSON_ROLE = 'RelatedPerson.role';
+const CLAIM_OCCUPATION_IDENTIFIER = 'org.schema.Person.hasOccupation.identifier.value';
+/**
+ * Lists already-authorized individual subjects without exposing GW plumbing.
+ *
+ * The caller supplies a verified contact taken from a signed OpenID token.
+ * That account/contact proof is intentionally insufficient for protected
+ * actions: professional role proof remains a separate `vp_token`, and SMART
+ * access remains bound to a registered wallet/device session.
+ */
+export async function listAuthorizedIndividualSubjectsWithDeps(routeContext, input, deps) {
+    const email = String(input.verifiedContact?.email || '').trim().toLowerCase();
+    const telephone = String(input.verifiedContact?.telephone || '').trim();
+    if (!email && !telephone) {
+        throw new Error('A verified email or telephone is required to list authorized subjects.');
+    }
+    const licenseClaims = {
+        '@context': SCHEMA_CONTEXT,
+        [CLAIM_AUDIENCE_TYPE]: INDIVIDUAL_AUDIENCE_TYPE,
+        [CLAIM_ITEM_CONDITION]: ACCEPTED_ITEM_CONDITION,
+        ...(email ? { [CLAIM_PERSON_EMAIL]: email } : {}),
+        ...(telephone ? { [CLAIM_PERSON_TELEPHONE]: telephone } : {}),
+    };
+    const licenseResult = await deps.submitAndPoll(deps.individualLicenseSearchPath(routeContext), deps.individualLicenseSearchPollPath(routeContext), {
+        thid: input.requestThid || createThreadId('authorized-subject-license'),
+        body: {
+            resourceType: 'Bundle',
+            type: 'batch',
+            data: [{
+                    request: { method: 'POST' },
+                    meta: { status: 'active', claims: licenseClaims },
+                }],
+        },
+    }, input.pollOptions);
+    const licenses = readAcceptedLicenses(licenseResult);
+    const resolved = await Promise.all(licenses.map(async (license) => {
+        const organizationClaims = {
+            '@context': SCHEMA_CONTEXT,
+            [CLAIM_ORGANIZATION_SAME_AS]: license.subjectDid,
+        };
+        const organizationResult = await deps.submitAndPoll(deps.individualOrganizationSearchPath(routeContext), deps.individualOrganizationSearchPollPath(routeContext), {
+            thid: createThreadId('authorized-subject-record'),
+            body: {
+                resourceType: 'Bundle',
+                type: 'batch',
+                data: [{
+                        type: 'Family-search-v1.0',
+                        request: { method: 'POST' },
+                        meta: { claims: organizationClaims },
+                    }],
+            },
+        }, input.pollOptions);
+        const subjectClaims = readFirstClaims(organizationResult);
+        if (String(subjectClaims[CLAIM_ORGANIZATION_SAME_AS] || '').trim() !== license.subjectDid) {
+            return undefined;
+        }
+        return {
+            subjectDid: license.subjectDid,
+            ...(license.role ? { role: license.role } : {}),
+            grantClaims: license.grantClaims,
+            ...(license.authorizationEvidenceId
+                ? { authorizationEvidenceId: license.authorizationEvidenceId }
+                : {}),
+            ...(license.issuerDid ? { issuerDid: license.issuerDid } : {}),
+            subjectClaims,
+        };
+    }));
+    return resolved.filter((value) => Boolean(value));
+}
+function readAcceptedLicenses(result) {
+    const rows = readData(result)[0]?.resource?.data;
+    if (!Array.isArray(rows))
+        return [];
+    return rows.flatMap((row) => {
+        const meta = row?.meta || row?.resource?.meta || {};
+        const subjectDid = String(meta.authorizedSubjectDid || '').trim();
+        if (!subjectDid)
+            return [];
+        const claims = (meta.claims || {});
+        const relatedRoles = String(claims[CLAIM_RELATED_PERSON_ROLE] || '')
+            .split(',')
+            .map((value) => value.trim().toUpperCase())
+            .filter(Boolean);
+        const occupation = String(claims[CLAIM_OCCUPATION_IDENTIFIER] || '').trim();
+        const role = relatedRoles.includes('CAREGIVER') ? 'CAREGIVER' : occupation;
+        return [{
+                subjectDid,
+                ...(role ? { role } : {}),
+                grantClaims: claims,
+                ...(meta.identifier ? { authorizationEvidenceId: String(meta.identifier) } : {}),
+                ...(meta.issuerDid ? { issuerDid: String(meta.issuerDid) } : {}),
+            }];
+    });
+}
+function readFirstClaims(result) {
+    const entry = readData(result)[0];
+    const claims = entry?.meta?.claims || entry?.resource?.meta?.claims;
+    return claims && typeof claims === 'object' ? claims : {};
+}
+function readData(result) {
+    const pollBody = (result?.poll?.body || {});
+    const root = pollBody?.body || pollBody;
+    return Array.isArray(root?.data) ? root.data : [];
+}
+function createThreadId(prefix) {
+    return `${prefix}-${globalThis.crypto?.randomUUID?.() || `${Date.now()}-${Math.random().toString(16).slice(2)}`}`;
+}

package/dist/device-activation.d.ts

@@ -68,6 +68,28 @@ export type EmployeeDeviceActivationResult = {
     exchange: SubmitAndPollResult;
     dcr: SubmitAndPollResult;
 };
+export type EmployeeDeviceOtpRecoveryInput = Readonly<{
+    idToken: string;
+    clientInstanceId: string;
+    pollOptions?: PollOptions;
+}>;
+export type EmployeeDeviceOtpRecoveryResult = Readonly<{
+    activationCode: string;
+    licenseId: string;
+    employeeRole: string;
+    employeeActorIdentifier: string;
+    recovery: SubmitAndPollResult;
+}>;
+/** Requests a fresh replacement credential for one OTP-authenticated installation. */
+export declare function recoverEmployeeDeviceWithOtpWithDeps(deps: Readonly<{
+    routeCtx: RouteContext;
+    input: EmployeeDeviceOtpRecoveryInput;
+    identityEmployeeRecoveryPath: (ctx: RouteContext) => string;
+    identityEmployeeRecoveryPollPath: (ctx: RouteContext) => string;
+    submitAndPollWithBearerToken: (bearerToken: string | undefined, submitPath: string, pollPath: string, payload: {
+        thid?: string;
+    } & Record<string, unknown>, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
+}>): Promise<EmployeeDeviceOtpRecoveryResult>;
 export type EmployeeDeviceRevocationInput = {
     licenseId: string;
     clientId: string;

package/dist/device-activation.js

@@ -56,6 +56,26 @@ export function createProfileDeviceActivationRequest(input) {
     };
     return draft;
 }
+/** Requests a fresh replacement credential for one OTP-authenticated installation. */
+export async function recoverEmployeeDeviceWithOtpWithDeps(deps) {
+    const idToken = requiredText(deps.input.idToken, 'fresh OTP identity token');
+    const clientInstanceId = requiredText(deps.input.clientInstanceId, 'client instance id');
+    const recovery = await deps.submitAndPollWithBearerToken(idToken, deps.identityEmployeeRecoveryPath(deps.routeCtx), deps.identityEmployeeRecoveryPollPath(deps.routeCtx), { thid: `employee-recovery-${createRuntimeUuid()}`, client_instance_id: clientInstanceId }, deps.input.pollOptions);
+    const failedStatus = [recovery.submit.status, recovery.poll.status]
+        .find(status => status < 200 || status >= 300);
+    if (failedStatus !== undefined) {
+        throw new Error(`recoverEmployeeDeviceWithOtp: recovery failed (HTTP ${failedStatus}).`);
+    }
+    const terminal = responseBody(recovery.poll.body);
+    const activationCode = findResponseText(terminal, 'activation_code');
+    const licenseId = findResponseText(terminal, 'license_id');
+    const employeeRole = findResponseText(terminal, 'employee_role');
+    const employeeActorIdentifier = findResponseText(terminal, 'employee_same_as');
+    if (!activationCode || !licenseId || !employeeRole || !employeeActorIdentifier) {
+        throw new Error('recoverEmployeeDeviceWithOtp: incomplete recovery response.');
+    }
+    return { activationCode, licenseId, employeeRole, employeeActorIdentifier, recovery };
+}
 export async function revokeEmployeeDeviceWithDeps(deps) {
     const licenseId = String(deps.input.licenseId || '').trim();
     const clientId = String(deps.input.clientId || '').trim();
@@ -147,6 +167,44 @@ function resolveDcrPayload(input) {
         return { ...input.dcrPayload };
     throw new Error('Device activation requires a device registration built by createProfileDeviceActivationRequest.');
 }
+function responseBody(value) {
+    if (typeof value === 'string') {
+        try {
+            return responseBody(JSON.parse(value));
+        }
+        catch {
+            return {};
+        }
+    }
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return {};
+    const record = value;
+    return record.body && typeof record.body === 'object' && !Array.isArray(record.body)
+        ? record.body
+        : record;
+}
+function findResponseText(value, key) {
+    if (!value || typeof value !== 'object')
+        return '';
+    if (Array.isArray(value)) {
+        for (const child of value) {
+            const found = findResponseText(child, key);
+            if (found)
+                return found;
+        }
+        return '';
+    }
+    const record = value;
+    const direct = normalizedText(record[key]);
+    if (direct)
+        return direct;
+    for (const child of Object.values(record)) {
+        const found = findResponseText(child, key);
+        if (found)
+            return found;
+    }
+    return '';
+}
 function normalizedText(value) {
     return typeof value === 'string' ? value.trim() : '';
 }

package/dist/index.d.ts

@@ -24,6 +24,7 @@ export * from './fhir-r5-subscription-runtime.js';
 export * from './order-offer-summary.js';
 export * from './organization-license-order.js';
 export * from './resource-operations.js';
+export * from './authorized-subject-directory.js';
 export * from './digital-twin.js';
 export * from './operational-actor-did.js';
 export * from './profile-workspace.js';

package/dist/index.js

@@ -25,6 +25,7 @@ export * from './fhir-r5-subscription-runtime.js';
 export * from './order-offer-summary.js';
 export * from './organization-license-order.js';
 export * from './resource-operations.js';
+export * from './authorized-subject-directory.js';
 export * from './digital-twin.js';
 export * from './operational-actor-did.js';
 export * from './profile-workspace.js';

package/dist/node-runtime-client.d.ts

@@ -9,7 +9,7 @@ import { type IndividualOrganizationConfirmOrderInput, type IndividualOrganizati
 import { type EnsureFamilyOrganizationRegistrationInput } from './family-organization-registration.js';
 import { type FamilyOrganizationSearchInput } from './family-organization-search.js';
 import { type SmartTokenRequestInput } from './smart-token.js';
-import { type EmployeeDeviceActivationRequestInput, type EmployeeDeviceActivationResult, type EmployeeDeviceRevocationInput } from './device-activation.js';
+import { type EmployeeDeviceActivationRequestInput, type EmployeeDeviceActivationResult, type EmployeeDeviceOtpRecoveryInput, type EmployeeDeviceOtpRecoveryResult, type EmployeeDeviceRevocationInput } from './device-activation.js';
 import { type OrganizationLicenseOrderConfirmInput } from './organization-license-order.js';
 import { type IndividualOrganizationBootstrapInput, type IndividualOrganizationStartResult } from './individual-start.js';
 import { type CommunicationIngestionInput, type BlockchainArtifactRegistrationInput, type VitalSignBatchCommunicationFromSearchResponseInput, type CommunicationParticipantRuntimeSearchInput, type ClinicalBundleSearchInput, type ClinicalSectionUpdateInput, type ClinicalSummaryReadResult, type ClinicalSummaryRequestInput, type ClinicalSummaryUpdateInput, type GrantProfessionalAccessInput, type GrantProfessionalAccessResult, type DigitalTwinSecondaryUseConsentInput, type DigitalTwinSecondaryUseConsentResult, type DigitalTwinSubjectLinkPurgeInput, type DigitalTwinSubjectLinkPurgeResult, type IndividualMemberLifecycleInput, type IndividualMemberLicenseAddInput, type IndividualMemberLicenseInvitationInput, type IndividualMemberLicenseTransitionInput, type LicenseListRuntimeSearchInput, type LicenseOfferRuntimeSearchInput, type LicenseOrderRuntimeSearchInput, type OrganizationEmployeeCreationInput, type OrganizationEmployeeLicenseAddInput, type OrganizationEmployeeLicenseOfferInput, type OrganizationEmployeeLicenseInvitationInput, type OrganizationEmployeeLifecycleInput, type OrganizationEmployeeSearchInput, type ProfessionalAccessRequestInput, type ProfessionalAccessRequestResult, type RevokeProfessionalAccessInput, type RevokeProfessionalAccessResult, type RelatedPersonUpsertInput } from './resource-operations.js';
@@ -21,6 +21,7 @@ import type { NodeRuntimeClient, PollOptions, PollResult, SubmitAndPollResult, S
 import { type FhirR5SubscriptionBatchInput } from './fhir-r5-subscription-runtime.js';
 import type { FhirR5SubscriptionTopic } from 'gdc-common-utils-ts/models/fhir-r5-subscription';
 import { type DigitalTwinMaterializationInput, type DigitalTwinSearchInput, type DigitalTwinSelectionInput } from './digital-twin.js';
+import { type AuthorizedIndividualSubject, type AuthorizedIndividualSubjectDirectoryInput } from './authorized-subject-directory.js';
 export type HttpRuntimeClientOptions = {
     baseUrl: string;
     bearerToken?: string;
@@ -414,6 +415,12 @@ export declare class HttpRuntimeClient implements NodeRuntimeClient {
      * with optional filters.
      */
     listIndividualLicenses(ctx: RouteContext, input?: LicenseListRuntimeSearchInput): Promise<SubmitAndPollResult>;
+    /**
+     * Resolves the complete high-level directory of subjects already authorized
+     * for a verified OpenID contact. The SDK owns both GW searches and polling;
+     * the result itself grants no professional role or SMART capability.
+     */
+    listAuthorizedIndividualSubjects(ctx: RouteContext, input: AuthorizedIndividualSubjectDirectoryInput): Promise<AuthorizedIndividualSubject[]>;
     /** Adds zero-cost seats to one individual organization's member pool. */
     addFreeIndividualMemberLicenses(ctx: RouteContext, input: IndividualMemberLicenseAddInput): Promise<SubmitAndPollResult>;
     /** Reserves one individual seat for an existing FHIR v3-role contact. */
@@ -465,6 +472,8 @@ export declare class HttpRuntimeClient implements NodeRuntimeClient {
      * The implementation is actor-neutral and shares the profile-device flow.
      */
     activateEmployeeDeviceWithActivationRequest(input: EmployeeDeviceActivationRequestInput): Promise<EmployeeDeviceActivationResult>;
+    /** Obtains a replacement activation credential after fresh OTP verification. */
+    recoverEmployeeDeviceWithOtp(input: EmployeeDeviceOtpRecoveryInput & Partial<RouteContext>): Promise<EmployeeDeviceOtpRecoveryResult>;
     /**
      * Creates or updates a `RelatedPerson` for non-employee family/caregiver
      * roles such as a grandfather, guardian, or external caregiver.

package/dist/node-runtime-client.js

@@ -6,7 +6,7 @@ import { confirmIndividualOrganizationOrderWithDeps, } from './individual-onboar
 import { ensureFamilyOrganizationRegistrationWithDeps, } from './family-organization-registration.js';
 import { searchFamilyOrganizationWithDeps } from './family-organization-search.js';
 import { requestSmartTokenWithDeps } from './smart-token.js';
-import { activateEmployeeDeviceWithActivationCodeWithDeps, activateEmployeeDeviceWithActivationRequestWithDeps, revokeEmployeeDeviceWithDeps, } from './device-activation.js';
+import { activateEmployeeDeviceWithActivationCodeWithDeps, activateEmployeeDeviceWithActivationRequestWithDeps, recoverEmployeeDeviceWithOtpWithDeps, revokeEmployeeDeviceWithDeps, } from './device-activation.js';
 import { extractOfferIdFromResponseBody, extractOfferPreviewFromResponseBody, } from './order-offer-summary.js';
 import { confirmOrganizationLicenseOrderWithDeps } from './organization-license-order.js';
 import { startIndividualOrganizationWithDeps } from './individual-start.js';
@@ -19,6 +19,7 @@ import { RuntimeClientPaths } from './runtime-client-paths.js';
 import { runtimeUuid, wrapBundleAsGatewayTransactionMessage } from './runtime-message.js';
 import { submitFhirR5SubscriptionBatchWithDeps, submitFhirR5SubscriptionTopicBatchWithDeps, } from './fhir-r5-subscription-runtime.js';
 import { materializeDigitalTwinWithDeps, saveDigitalTwinSelectionWithDeps, searchDigitalTwinsWithDeps, } from './digital-twin.js';
+import { listAuthorizedIndividualSubjectsWithDeps, } from './authorized-subject-directory.js';
 const bootstrapFacade = createBootstrapFacade();
 /**
  * Runtime-oriented HTTP client for Node backends, BFFs, and workers that need
@@ -751,6 +752,20 @@ export class HttpRuntimeClient {
             submitAndPoll: this.submitAndPoll.bind(this),
         });
     }
+    /**
+     * Resolves the complete high-level directory of subjects already authorized
+     * for a verified OpenID contact. The SDK owns both GW searches and polling;
+     * the result itself grants no professional role or SMART capability.
+     */
+    async listAuthorizedIndividualSubjects(ctx, input) {
+        return listAuthorizedIndividualSubjectsWithDeps(ctx, input, {
+            individualLicenseSearchPath: this.paths.individualLicenseSearchPath.bind(this.paths),
+            individualLicenseSearchPollPath: this.paths.individualLicenseSearchPollPath.bind(this.paths),
+            individualOrganizationSearchPath: this.paths.individualFamilyOrganizationSearchPath.bind(this.paths),
+            individualOrganizationSearchPollPath: this.paths.individualFamilyOrganizationSearchPollPath.bind(this.paths),
+            submitAndPoll: this.submitAndPoll.bind(this),
+        });
+    }
     /** Adds zero-cost seats to one individual organization's member pool. */
     async addFreeIndividualMemberLicenses(ctx, input) {
         return addFreeIndividualMemberLicensesWithDeps(ctx, input, {
@@ -909,6 +924,17 @@ export class HttpRuntimeClient {
     async activateEmployeeDeviceWithActivationRequest(input) {
         return this.activateProfileDeviceWithActivationRequest(input);
     }
+    /** Obtains a replacement activation credential after fresh OTP verification. */
+    async recoverEmployeeDeviceWithOtp(input) {
+        const routeCtx = this.paths.routeCtxFromInput(input);
+        return recoverEmployeeDeviceWithOtpWithDeps({
+            routeCtx,
+            input,
+            identityEmployeeRecoveryPath: this.paths.identityEmployeeRecoveryPath.bind(this.paths),
+            identityEmployeeRecoveryPollPath: this.paths.identityEmployeeRecoveryPollPath.bind(this.paths),
+            submitAndPollWithBearerToken: this.submitAndPollWithBearerToken.bind(this),
+        });
+    }
     /**
      * Creates or updates a `RelatedPerson` for non-employee family/caregiver
      * roles such as a grandfather, guardian, or external caregiver.

package/dist/orchestration/client-port.d.ts

@@ -18,6 +18,7 @@ import type { EnsureFamilyOrganizationRegistrationInput, EnsureFamilyOrganizatio
 import type { OrganizationLicenseOrderConfirmInput } from '../organization-license-order.js';
 import type { SmartTokenExchangeResult, SmartTokenRequestInput } from '../smart-token.js';
 import type { DigitalTwinMaterializationInput, DigitalTwinSearchInput, DigitalTwinSelectionInput } from '../digital-twin.js';
+import type { AuthorizedIndividualSubject, AuthorizedIndividualSubjectDirectoryInput } from '../authorized-subject-directory.js';
 import type { CommunicationIngestionInput, BlockchainArtifactRegistrationInput, CommunicationParticipantRuntimeSearchInput, ClinicalBundleSearchInput, ClinicalSectionUpdateInput, ClinicalSummaryReadResult, ClinicalSummaryRequestInput, ClinicalSummaryUpdateInput, VitalSignBatchCommunicationFromSearchResponseInput, DigitalTwinGenerationInput, DigitalTwinSecondaryUseConsentInput, DigitalTwinSecondaryUseConsentResult, DigitalTwinSubjectLinkPurgeInput, DigitalTwinSubjectLinkPurgeResult, GrantProfessionalAccessInput, GrantProfessionalAccessResult, IndividualMemberLifecycleInput, IndividualMemberLicenseAddInput, IndividualMemberLicenseInvitationInput, IndividualMemberLicenseTransitionInput, IpsOrFhirImportInput, OrganizationEmployeeCreationInput, OrganizationEmployeeLicenseAddInput, OrganizationEmployeeLicenseOfferInput, OrganizationEmployeeLicenseInvitationInput, OrganizationEmployeeLifecycleInput, OrganizationEmployeeSearchInput, ProfessionalAccessRequestInput, ProfessionalAccessRequestResult, RevokeProfessionalAccessInput, RevokeProfessionalAccessResult, RelatedPersonUpsertInput } from '../resource-operations.js';
 /**
  * Shared node-runtime activation input.
@@ -124,6 +125,8 @@ export type RuntimeClient = {
     revokeProfessionalAccess?: (ctx: RouteContext, input: RevokeProfessionalAccessInput) => Promise<RevokeProfessionalAccessResult>;
     searchIndividualLicenses?: (ctx: RouteContext, input: LicenseListRuntimeSearchInput) => Promise<SubmitAndPollResult>;
     listIndividualLicenses?: (ctx: RouteContext, input?: LicenseListRuntimeSearchInput) => Promise<SubmitAndPollResult>;
+    /** Lists exact subjects already authorized for one verified OpenID contact. */
+    listAuthorizedIndividualSubjects?: (ctx: RouteContext, input: AuthorizedIndividualSubjectDirectoryInput) => Promise<AuthorizedIndividualSubject[]>;
     addFreeIndividualMemberLicenses?: (ctx: RouteContext, input: IndividualMemberLicenseAddInput) => Promise<SubmitAndPollResult>;
     issueIndividualMemberLicense?: (ctx: RouteContext, input: IndividualMemberLicenseInvitationInput) => Promise<SubmitAndPollResult>;
     transitionIndividualMemberLicense?: (ctx: RouteContext, action: '_accept' | '_deactivate' | '_release', input: IndividualMemberLicenseTransitionInput) => Promise<SubmitAndPollResult>;

package/dist/runtime-client-paths.d.ts

@@ -109,6 +109,8 @@ export declare class RuntimeClientPaths {
     digitalTwinCommunicationPollPath(ctx: RouteContext, format: string): string;
     identityTokenExchangePath(ctx: RouteContext): string;
     identityTokenExchangePollPath(ctx: RouteContext): string;
+    identityEmployeeRecoveryPath(ctx: RouteContext): string;
+    identityEmployeeRecoveryPollPath(ctx: RouteContext): string;
     identityDeviceDcrPath(ctx: RouteContext): string;
     identityDeviceDcrPollPath(ctx: RouteContext): string;
     identityDeviceRevokePath(ctx: RouteContext): string;

package/dist/runtime-client-paths.js

@@ -1,6 +1,6 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
 import { GwCoreLifecycleAction } from './constants/lifecycle.js';
-import { buildHostRegistryPath, buildIdentityDeviceDcrPath, buildIdentityDeviceDcrPollPath, buildIdentityDeviceRevokePath, buildIdentityDeviceRevokePollPath, buildIdentityLicenseIssuePath, buildIdentityLicenseIssuePollPath, buildIdentityOpenIdSmartTokenPath, buildIdentityOpenIdSmartTokenPollPath, buildIdentityTokenExchangePath, buildIdentityTokenExchangePollPath, buildOrganizationDidBindingPath, buildOrganizationDidBindingPollPath, buildV1Path, } from './runtime-paths.js';
+import { buildHostRegistryPath, buildIdentityDeviceDcrPath, buildIdentityDeviceDcrPollPath, buildIdentityDeviceRevokePath, buildIdentityDeviceRevokePollPath, buildIdentityEmployeeRecoveryPath, buildIdentityEmployeeRecoveryPollPath, buildIdentityLicenseIssuePath, buildIdentityLicenseIssuePollPath, buildIdentityOpenIdSmartTokenPath, buildIdentityOpenIdSmartTokenPollPath, buildIdentityTokenExchangePath, buildIdentityTokenExchangePollPath, buildOrganizationDidBindingPath, buildOrganizationDidBindingPollPath, buildV1Path, } from './runtime-paths.js';
 import { requireHostRouteContext, requireRouteContext, routeCtxFromInput, } from './runtime-route-context.js';
 export class RuntimeClientPaths {
     constructor(defaultCtx) {
@@ -123,6 +123,8 @@ export class RuntimeClientPaths {
     digitalTwinCommunicationPollPath(ctx, format) { return this.v1Path(ctx, 'digitaltwin', format, 'Communication', '_batch-response'); }
     identityTokenExchangePath(ctx) { return buildIdentityTokenExchangePath(ctx); }
     identityTokenExchangePollPath(ctx) { return buildIdentityTokenExchangePollPath(ctx); }
+    identityEmployeeRecoveryPath(ctx) { return buildIdentityEmployeeRecoveryPath(ctx); }
+    identityEmployeeRecoveryPollPath(ctx) { return buildIdentityEmployeeRecoveryPollPath(ctx); }
     identityDeviceDcrPath(ctx) { return buildIdentityDeviceDcrPath(ctx); }
     identityDeviceDcrPollPath(ctx) { return buildIdentityDeviceDcrPollPath(ctx); }
     identityDeviceRevokePath(ctx) { return buildIdentityDeviceRevokePath(ctx); }

package/dist/runtime-paths.d.ts

@@ -6,6 +6,10 @@ export declare function buildOrganizationDidBindingPath(routeCtx: RouteContext):
 export declare function buildOrganizationDidBindingPollPath(routeCtx: RouteContext): string;
 export declare function buildIdentityTokenExchangePath(ctx: RouteContext): string;
 export declare function buildIdentityTokenExchangePollPath(ctx: RouteContext): string;
+/** Fresh OTP-assisted replacement credential for one existing installation. */
+export declare function buildIdentityEmployeeRecoveryPath(ctx: RouteContext): string;
+/** Poll endpoint paired with employee wallet recovery. */
+export declare function buildIdentityEmployeeRecoveryPollPath(ctx: RouteContext): string;
 export declare function buildIdentityDeviceDcrPath(ctx: RouteContext): string;
 export declare function buildIdentityDeviceDcrPollPath(ctx: RouteContext): string;
 /** Canonical controller operation that reserves an employee seat activation credential. */

package/dist/runtime-paths.js

@@ -28,6 +28,14 @@ export function buildIdentityTokenExchangePath(ctx) {
 export function buildIdentityTokenExchangePollPath(ctx) {
     return buildIdentityAuthPath(ctx, IdentityAuthActions.ExchangeResponse);
 }
+/** Fresh OTP-assisted replacement credential for one existing installation. */
+export function buildIdentityEmployeeRecoveryPath(ctx) {
+    return buildIdentityAuthPath(ctx, '_recover');
+}
+/** Poll endpoint paired with employee wallet recovery. */
+export function buildIdentityEmployeeRecoveryPollPath(ctx) {
+    return buildIdentityAuthPath(ctx, '_recover-response');
+}
 export function buildIdentityDeviceDcrPath(ctx) {
     return buildIdentityAuthPath(ctx, IdentityAuthActions.Dcr);
 }

package/dist/server-profile-session.d.ts

@@ -45,6 +45,7 @@ export type ServerProfileSessionRecord = Readonly<{
     subjectDid: string;
     scopes: string[];
     sealedUnlockedWalletSeed: string;
+    sealedUnlockedVpToken?: string;
     sealedAccessToken: string;
     expiresAt: string;
 }>;
@@ -56,7 +57,18 @@ export type ServerProfileStore = Readonly<{
     getSession(sessionId: string): Promise<ServerProfileSessionRecord | undefined>;
     putSession(session: ServerProfileSessionRecord): Promise<void>;
     deleteSession(sessionId: string): Promise<void>;
+    /** Required by key rotation so no session can retain the superseded seed. */
+    deleteSessionsForProfile?(profileId: string): Promise<void>;
 }>;
+export type ServerEmployeeProfileOtpRotationInput = Readonly<{
+    ownerId: string;
+    profileId: string;
+    idToken: string;
+    newPin: string;
+    redirectUris: string[];
+    clientName: string;
+}>;
+export type ServerEmployeeProfileOtpRotationResult = ServerProfileRecord;
 export type ServerProfileEnrollmentInput = Readonly<{
     /** Stable confidential id of the authenticated portal account that owns and lists this profile. */
     ownerId: string;
@@ -221,6 +233,13 @@ export declare class ServerProfileSessionManager {
     private readonly options;
     constructor(options: ServerProfileSessionManagerOptions);
     enroll(input: ServerProfileEnrollmentInput): Promise<ServerProfileRecord>;
+    /**
+     * Rotates an employee wallet after a fresh OTP-authenticated GW recovery.
+     * The old PIN and seed are never opened: DCR replaces the installation with
+     * newly generated keys, all old BFF sessions are removed, and the new wallet
+     * is opened once with the new PIN.
+     */
+    rotateEmployeeProfileWithOtp(input: ServerEmployeeProfileOtpRotationInput): Promise<ServerEmployeeProfileOtpRotationResult>;
     /**
      * Derives only the public enrollment descriptors for a server-governed
      * recovery seed. This is intended for pre-DCR controller binding requests;
@@ -249,6 +268,12 @@ export declare class ServerProfileSessionManager {
     submitLegalOrganizationIssueWithBootstrapWallet(input: ServerProfileOrganizationIssueInput): Promise<SubmitAndPollResult>;
     listProfiles(ownerId: string): Promise<ServerProfileRecord[]>;
     unlock(input: ServerProfileUnlockInput): Promise<ResolvedServerProfileSession>;
+    /**
+     * Renews the short SMART bearer while retaining the already-open server
+     * wallet session. The caller must supply a fresh authenticated account
+     * token; neither the PIN nor wallet keys return to the browser.
+     */
+    refreshSession(ownerId: string, sessionId: string, idToken: string): Promise<ResolvedServerProfileSession>;
     resolveSession(ownerId: string, sessionId: string): Promise<ResolvedServerProfileSession>;
     lock(ownerId: string, sessionId: string): Promise<void>;
     private createClient;

package/dist/server-profile-session.js

@@ -100,6 +100,53 @@ export class ServerProfileSessionManager {
         await this.options.store.putProfile(record);
         return record;
     }
+    /**
+     * Rotates an employee wallet after a fresh OTP-authenticated GW recovery.
+     * The old PIN and seed are never opened: DCR replaces the installation with
+     * newly generated keys, all old BFF sessions are removed, and the new wallet
+     * is opened once with the new PIN.
+     */
+    async rotateEmployeeProfileWithOtp(input) {
+        const previous = await this.requireOwnedProfile(input.ownerId, input.profileId);
+        if (previous.actorKind !== ActorKinds.OrganizationEmployee || previous.actorMode !== 'member') {
+            throw new Error('OTP wallet rotation is restricted to organization employee profiles.');
+        }
+        const clientInstanceId = String(previous.clientInstanceId || '').trim();
+        if (!clientInstanceId)
+            throw new Error('Employee profile has no registered installation id.');
+        if (!this.options.store.deleteSessionsForProfile) {
+            throw new Error('Employee wallet rotation requires profile-session invalidation support.');
+        }
+        const client = this.createClient(previous.routeContext, input.idToken);
+        const replacement = await client.recoverEmployeeDeviceWithOtp({
+            ...previous.routeContext,
+            idToken: input.idToken,
+            clientInstanceId,
+        });
+        const profile = await this.enroll({
+            ownerId: previous.ownerId,
+            profileId: previous.profileId,
+            actorKind: previous.actorKind,
+            actorMode: previous.actorMode,
+            actorDid: previous.actorDid,
+            profileDid: previous.profileDid,
+            providerDid: previous.providerDid,
+            routeContext: previous.routeContext,
+            allowedSubjectDids: previous.allowedSubjectDids,
+            pin: input.newPin,
+            idToken: input.idToken,
+            activationCode: replacement.activationCode,
+            clientInstanceId,
+            redirectUris: input.redirectUris,
+            clientName: input.clientName,
+            professionalProof: {
+                role: replacement.employeeRole,
+                sameAs: replacement.employeeActorIdentifier,
+            },
+        });
+        await this.options.store.deleteSessionsForProfile(profile.profileId);
+        return profile;
+    }
     /**
      * Derives only the public enrollment descriptors for a server-governed
      * recovery seed. This is intended for pre-DCR controller binding requests;
@@ -269,11 +316,69 @@ export class ServerProfileSessionManager {
             subjectDid: input.subjectDid,
             scopes: unique(input.scopes),
             sealedUnlockedWalletSeed: await this.options.sealer.seal(seed, `${sessionId}:unlocked-wallet-seed`),
+            ...(vpToken ? {
+                sealedUnlockedVpToken: await this.options.sealer.seal(vpToken, `${sessionId}:unlocked-vp-token`),
+            } : {}),
             sealedAccessToken: await this.options.sealer.seal(token.accessToken, `${sessionId}:access-token`),
             expiresAt: expiresAt.toISOString(),
         });
         return this.resolveSession(input.ownerId, sessionId);
     }
+    /**
+     * Renews the short SMART bearer while retaining the already-open server
+     * wallet session. The caller must supply a fresh authenticated account
+     * token; neither the PIN nor wallet keys return to the browser.
+     */
+    async refreshSession(ownerId, sessionId, idToken) {
+        const session = await this.options.store.getSession(sessionId);
+        if (!session || session.ownerId !== ownerId)
+            throw new Error('Profile session not found.');
+        if (new Date(session.expiresAt) <= this.now()) {
+            await this.options.store.deleteSession(sessionId);
+            throw new Error('Profile session expired.');
+        }
+        const normalizedIdToken = String(idToken || '').trim();
+        if (!normalizedIdToken)
+            throw new Error('Profile session refresh requires idToken.');
+        const profile = await this.requireOwnedProfile(ownerId, session.profileId);
+        this.requireSubject(profile, session.subjectDid);
+        const seed = await this.options.sealer.unseal(session.sealedUnlockedWalletSeed, `${sessionId}:unlocked-wallet-seed`);
+        const vpToken = session.sealedUnlockedVpToken
+            ? await this.options.sealer.unseal(session.sealedUnlockedVpToken, `${sessionId}:unlocked-vp-token`)
+            : undefined;
+        const walletKeyDerivationId = profile.walletKeyDerivationId || profile.profileId;
+        const wallet = await this.createWallet(walletKeyDerivationId, seed);
+        const now = this.now();
+        const smartTokenEndpoint = [
+            this.options.gatewayBaseUrl.replace(/\/+$/, ''),
+            buildIdentityOpenIdSmartTokenPath(profile.routeContext),
+        ].join('');
+        const assertion = await buildWalletClientAssertion(wallet, profile, smartTokenEndpoint, now);
+        const token = await this.createClient(profile.routeContext, normalizedIdToken).requestSmartToken({
+            ...profile.routeContext,
+            actorDid: profile.actorDid,
+            subjectDid: session.subjectDid,
+            clientId: profile.clientId,
+            issuer: profile.clientId,
+            audience: smartTokenEndpoint,
+            idToken: normalizedIdToken,
+            vpToken,
+            vpTokenFallback: vpToken ? undefined : 'omit',
+            clientAssertion: assertion,
+            clientAssertionType: 'private_key_jwt',
+            smartTokenKind: 'openid-smart',
+            acrValues: profileSmartAcrValues(profile.actorKind),
+            scopes: unique(session.scopes),
+            tokenCacheKey: `profile-refresh:${sessionId}:${now.getTime()}`,
+        });
+        if (token.status !== 'fetched' || !token.accessToken)
+            throw new Error('SMART token refresh failed.');
+        await this.options.store.putSession({
+            ...session,
+            sealedAccessToken: await this.options.sealer.seal(token.accessToken, `${sessionId}:access-token`),
+        });
+        return this.resolveSession(ownerId, sessionId);
+    }
     async resolveSession(ownerId, sessionId) {
         const session = await this.options.store.getSession(sessionId);
         if (!session || session.ownerId !== ownerId)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-sdk-node-ts",
-  "version": "2.4.36",
+  "version": "2.4.39",
   "description": "Next-generation Node runtime package for the GDC SDK family",
   "license": "Apache-2.0",
   "author": "Antifraud Services Inc.",