gdc-sdk-node-ts 2.4.41 → 2.4.44

package/README.md

@@ -650,13 +650,13 @@ modules below.
   - types: `SmartTokenRequestInput`, `SmartTokenExchangeResult`
   - function: `requestSmartTokenWithDeps(...)`
 - [`src/resource-operations.ts`](src/resource-operations.ts)
-  - types: `OrganizationEmployeeCreationInput`, `IpsOrFhirImportInput`, `RelatedPersonUpsertInput`, `CommunicationIngestionInput`, `ClinicalDateRange`, `ClinicalBundleSearchInput`, `ConsentActorTargetInput`, `GrantProfessionalAccessInput`, `GrantProfessionalAccessResult`, `DigitalTwinSecondaryUseConsentInput`, `DigitalTwinSubjectLinkPurgeInput`
-  - functions: `createOrganizationEmployeeWithDeps(...)`, `importIpsOrFhirAndUpdateIndexWithDeps(...)`, `upsertRelatedPersonAndPollWithDeps(...)`, `ingestCommunicationAndUpdateIndexWithDeps(...)`, `searchClinicalBundleWithDeps(...)`, `searchLatestIpsWithDeps(...)`, `grantProfessionalAccessWithDeps(...)`, `setDigitalTwinSecondaryUseConsentWithDeps(...)`, `purgeDigitalTwinSubjectLinkWithDeps(...)`
+  - types: `OrganizationEmployeeCreationInput`, `IpsOrFhirImportInput`, `RelatedPersonUpsertInput`, `CommunicationIngestionInput`, `ClinicalDateRange`, `ClinicalBundleSearchInput`, `ConsentActorTargetInput`, `GrantProfessionalAccessInput`, `GrantProfessionalAccessResult`, `DigitalTwinSecondaryUseConsentInput`, `DigitalTwinSubjectLinkPurgeInput`, `SubjectConsentSearchInput`
+  - functions: `createOrganizationEmployeeWithDeps(...)`, `importIpsOrFhirAndUpdateIndexWithDeps(...)`, `upsertRelatedPersonAndPollWithDeps(...)`, `ingestCommunicationAndUpdateIndexWithDeps(...)`, `searchClinicalBundleWithDeps(...)`, `searchSubjectConsentsWithDeps(...)`, `searchLatestIpsWithDeps(...)`, `grantProfessionalAccessWithDeps(...)`, `setDigitalTwinSecondaryUseConsentWithDeps(...)`, `purgeDigitalTwinSubjectLinkWithDeps(...)`
 - [`src/digital-twin.ts`](src/digital-twin.ts)
   - types: `DigitalTwinSearchInput`, `DigitalTwinSelectionInput`, `DigitalTwinResearchTag`, `DigitalTwinMaterializationInput`
   - functions: `searchDigitalTwinsWithDeps(...)`, `saveDigitalTwinSelectionWithDeps(...)`, `materializeDigitalTwinWithDeps(...)`
 - [`src/orchestration/digital-twin-sdk.ts`](src/orchestration/digital-twin-sdk.ts)
-  - class: `DigitalTwinSdk` (`requestSmartToken`, `search`, `saveSelection`, `materialize`)
+  - class: `DigitalTwinSdk` (`requestSmartToken`, `search`, `saveSelection`, `searchSelections`, `materialize`); both searches expose `ResearchSubject` through FHIR Parameters, with its canonical internal Composition available as `composition`
 - [`src/session.ts`](src/session.ts)
   - types: `NodeCapability`, `NodeActorSessionContext`, `ActorSessionContext`
   - classes: `ActorSession`, `NodeActorSession`

package/dist/digital-twin.d.ts

@@ -7,7 +7,7 @@ export type DigitalTwinFhirFormat = 'org.hl7.fhir.r4' | 'org.hl7.fhir.api';
 export declare function isDigitalTwinSubjectId(value: unknown): value is string;
 /** Rejects operational DIDs and malformed or caller-invented subject shapes. */
 export declare function assertDigitalTwinSubjectId(value: unknown): asserts value is string;
-/** Search parameters added by the digital-twin Composition profile. */
+/** Search parameters evaluated against a ResearchSubject's canonical Composition index. */
 export declare const DigitalTwinSearchParameter: Readonly<{
     Section: "section";
     DateFrom: "date-from";
@@ -20,7 +20,8 @@ export type DigitalTwinSearchInput = {
     accessToken?: string;
     thid?: string;
     format?: DigitalTwinFhirFormat;
-    resourceType?: string;
+    /** Public twin search resource; exposed for low-level request inspection only. */
+    resourceType?: 'ResearchSubject';
     /** One or more IPS section tokens. Basic search uses OR across sections. */
     sections?: readonly string[];
     /** Inclusive clinical-event lower bound as ISO date or dateTime. */
@@ -33,11 +34,19 @@ export type DigitalTwinSearchInput = {
     filters?: Readonly<Record<string, string | readonly string[] | undefined>>;
     pollOptions?: PollOptions;
 };
-/** One pseudonymous Composition returned by a digital-twin search. */
+/**
+ * One public ResearchSubject digital twin returned by search.
+ *
+ * `composition` is the canonical Composition GW uses as the aggregate's
+ * internal index document. It joins the ResearchSubject to the projected
+ * clinical resources later returned by `ResearchSubject/$summary`.
+ */
 export type DigitalTwinSearchMatch = Record<string, unknown> & {
+    resourceType?: 'ResearchSubject';
     id?: string;
     [CompositionClaim.Subject]: string;
     [CompositionClaim.Section]?: string;
+    composition?: Record<string, unknown>;
     meta?: {
         tag?: DigitalTwinResearchTag[];
     };
@@ -120,11 +129,15 @@ export type DigitalTwinRuntimeDeps = {
         body: Record<string, unknown>;
     }, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
 };
-/** Opens the GW async response and exposes the matched Compositions directly. */
+/** Opens the GW async response and exposes the matched ResearchSubjects directly. */
 export declare function readDigitalTwinSearchResult(operation: SubmitAndPollResult): DigitalTwinSearchResult;
 /** Persists one tagged researcher working copy through `digitaltwin/Composition/_batch`. */
 export declare function saveDigitalTwinSelectionWithDeps(ctx: RouteContext, input: DigitalTwinSelectionInput, deps: DigitalTwinRuntimeDeps): Promise<SubmitAndPollResult>;
-/** Searches the tenant digital-twin index through its public asynchronous route. */
+/**
+ * Searches ResearchSubject digital twins through the public asynchronous route.
+ * GW filters their canonical Composition index documents internally; callers
+ * never switch to a separate public Composition search surface.
+ */
 export declare function searchDigitalTwinsWithDeps(ctx: RouteContext, input: DigitalTwinSearchInput, deps: DigitalTwinRuntimeDeps): Promise<SubmitAndPollResult>;
 /** Materializes one selected pseudonymous twin as a research summary Bundle. */
 export declare function materializeDigitalTwinWithDeps(ctx: RouteContext, input: DigitalTwinMaterializationInput, deps: DigitalTwinRuntimeDeps): Promise<SubmitAndPollResult>;

package/dist/digital-twin.js

@@ -13,7 +13,7 @@ export function assertDigitalTwinSubjectId(value) {
         throw new Error('Digital twin subject must be a valid urn:uuid identifier.');
     }
 }
-/** Search parameters added by the digital-twin Composition profile. */
+/** Search parameters evaluated against a ResearchSubject's canonical Composition index. */
 export const DigitalTwinSearchParameter = Object.freeze({
     Section: 'section',
     DateFrom: 'date-from',
@@ -59,7 +59,7 @@ function normalizeResearchTags(tags) {
     }
     return normalized;
 }
-/** Opens the GW async response and exposes the matched Compositions directly. */
+/** Opens the GW async response and exposes the matched ResearchSubjects directly. */
 export function readDigitalTwinSearchResult(operation) {
     const body = operation?.poll?.body;
     const responseEntries = Array.isArray(body?.data)
@@ -129,10 +129,14 @@ export async function saveDigitalTwinSelectionWithDeps(ctx, input, deps) {
             : { resourceType: 'Bundle', type: 'batch', entry: [entry] },
     }, input.pollOptions);
 }
-/** Searches the tenant digital-twin index through its public asynchronous route. */
+/**
+ * Searches ResearchSubject digital twins through the public asynchronous route.
+ * GW filters their canonical Composition index documents internally; callers
+ * never switch to a separate public Composition search surface.
+ */
 export async function searchDigitalTwinsWithDeps(ctx, input, deps) {
     const format = input.format || 'org.hl7.fhir.r4';
-    const resourceType = String(input.resourceType || 'Composition').trim();
+    const resourceType = String(input.resourceType || 'ResearchSubject').trim();
     if (!resourceType)
         throw new Error('Digital twin resourceType is required.');
     const usesBasicSearch = Boolean(input.sections || input.dateFrom || input.dateTo || input.text);

package/dist/gateway-active-consent-provider.js

@@ -1,5 +1,4 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
-import { ResourceTypesFhirR4 } from 'gdc-common-utils-ts/constants/fhir-resource-types';
 import { ClaimConsent } from 'gdc-common-utils-ts/models/consent-rule';
 import { isConsentRuleActive } from 'gdc-common-utils-ts/utils/consent';
 import { requireClientMethod } from './orchestration/client-port.js';
@@ -20,10 +19,7 @@ export class GatewayActiveConsentProvider {
         if (!normalizedSubject.startsWith('did:')) {
             throw new Error('Active Consent lookup requires a subject DID.');
         }
-        const result = await requireClientMethod(this.client, 'searchClinicalBundle')(this.routeContext, {
-            subject: normalizedSubject,
-            includedTypes: [ResourceTypesFhirR4.Consent],
-        });
+        const result = await requireClientMethod(this.client, 'searchSubjectConsents')(this.routeContext, { subject: normalizedSubject });
         return extractConsentRules(result.poll.body)
             .filter((rule) => isConsentRuleActive(rule, { subject: normalizedSubject }));
     }

package/dist/index.d.ts

@@ -4,6 +4,7 @@ export * from './identity-bootstrap.js';
 export * from './async-polling.js';
 export * from './backend-profile-runtime.js';
 export * from './server-profile-session.js';
+export * from './profile-recovery-envelope.js';
 export * from './server-profile-protection.js';
 export * from './backend-profile-workspace.js';
 export * from './individual-controller-backend-runtime.js';

package/dist/index.js

@@ -5,6 +5,7 @@ export * from './identity-bootstrap.js';
 export * from './async-polling.js';
 export * from './backend-profile-runtime.js';
 export * from './server-profile-session.js';
+export * from './profile-recovery-envelope.js';
 export * from './server-profile-protection.js';
 export * from './backend-profile-workspace.js';
 export * from './individual-controller-backend-runtime.js';

package/dist/node-runtime-client.d.ts

@@ -12,7 +12,7 @@ import { type SmartTokenRequestInput } from './smart-token.js';
 import { type EmployeeDeviceActivationRequestInput, type EmployeeDeviceActivationResult, type EmployeeDeviceOtpRecoveryInput, type EmployeeDeviceOtpRecoveryResult, type EmployeeDeviceRevocationInput } from './device-activation.js';
 import { type OrganizationLicenseOrderConfirmInput } from './organization-license-order.js';
 import { type IndividualOrganizationBootstrapInput, type IndividualOrganizationStartResult } from './individual-start.js';
-import { type CommunicationIngestionInput, type BlockchainArtifactRegistrationInput, type VitalSignBatchCommunicationFromSearchResponseInput, type CommunicationParticipantRuntimeSearchInput, type ClinicalBundleSearchInput, type ClinicalSectionUpdateInput, type ClinicalSummaryReadResult, type ClinicalSummaryRequestInput, type ClinicalSummaryUpdateInput, type GrantProfessionalAccessInput, type GrantProfessionalAccessResult, type DigitalTwinSecondaryUseConsentInput, type DigitalTwinSecondaryUseConsentResult, type DigitalTwinSubjectLinkPurgeInput, type DigitalTwinSubjectLinkPurgeResult, type IndividualMemberLifecycleInput, type IndividualMemberLicenseAddInput, type IndividualMemberLicenseInvitationInput, type IndividualMemberLicenseTransitionInput, type LicenseListRuntimeSearchInput, type LicenseOfferRuntimeSearchInput, type LicenseOrderRuntimeSearchInput, type OrganizationEmployeeCreationInput, type OrganizationEmployeeLicenseAddInput, type OrganizationEmployeeLicenseOfferInput, type OrganizationEmployeeLicenseInvitationInput, type OrganizationEmployeeLifecycleInput, type OrganizationEmployeeSearchInput, type ProfessionalAccessRequestInput, type ProfessionalAccessRequestResult, type RevokeProfessionalAccessInput, type RevokeProfessionalAccessResult, type RelatedPersonUpsertInput } from './resource-operations.js';
+import { type CommunicationIngestionInput, type BlockchainArtifactRegistrationInput, type VitalSignBatchCommunicationFromSearchResponseInput, type CommunicationParticipantRuntimeSearchInput, type ClinicalBundleSearchInput, type ClinicalSectionUpdateInput, type ClinicalSummaryReadResult, type ClinicalSummaryRequestInput, type ClinicalSummaryUpdateInput, type GrantProfessionalAccessInput, type GrantProfessionalAccessResult, type DigitalTwinSecondaryUseConsentInput, type DigitalTwinSecondaryUseConsentResult, type DigitalTwinSubjectLinkPurgeInput, type DigitalTwinSubjectLinkPurgeResult, type SubjectConsentSearchInput, type IndividualMemberLifecycleInput, type IndividualMemberLicenseAddInput, type IndividualMemberLicenseInvitationInput, type IndividualMemberLicenseTransitionInput, type LicenseListRuntimeSearchInput, type LicenseOfferRuntimeSearchInput, type LicenseOrderRuntimeSearchInput, type OrganizationEmployeeCreationInput, type OrganizationEmployeeLicenseAddInput, type OrganizationEmployeeLicenseOfferInput, type OrganizationEmployeeLicenseInvitationInput, type OrganizationEmployeeLifecycleInput, type OrganizationEmployeeSearchInput, type ProfessionalAccessRequestInput, type ProfessionalAccessRequestResult, type RevokeProfessionalAccessInput, type RevokeProfessionalAccessResult, type RelatedPersonUpsertInput } from './resource-operations.js';
 import type { LegalOrganizationOrderInput } from './host-onboarding.js';
 import type { SmartTokenExchangeResult } from './smart-token.js';
 import { type OrganizationEmployeeProvisioningInput, type OrganizationEmployeeProvisioningResult } from './organization-employee-lifecycle.js';
@@ -447,6 +447,8 @@ export declare class HttpRuntimeClient implements NodeRuntimeClient {
     setDigitalTwinSecondaryUseConsent(ctx: RouteContext, input: DigitalTwinSecondaryUseConsentInput): Promise<DigitalTwinSecondaryUseConsentResult>;
     /** Offboards the subject from this index provider without deleting the anonymous twin. */
     purgeDigitalTwinSubjectLink(ctx: RouteContext, input: DigitalTwinSubjectLinkPurgeInput): Promise<DigitalTwinSubjectLinkPurgeResult>;
+    /** Reads the subject-owned Consent records through Communication -> Subject/_search. */
+    searchSubjectConsents(ctx: RouteContext, input: SubjectConsentSearchInput): Promise<SubmitAndPollResult>;
     /**
      * Closes an existing professional consent by setting its period end and
      * resubmitting the updated consent resource.

package/dist/node-runtime-client.js

@@ -10,7 +10,7 @@ import { activateEmployeeDeviceWithActivationCodeWithDeps, activateEmployeeDevic
 import { extractOfferIdFromResponseBody, extractOfferPreviewFromResponseBody, } from './order-offer-summary.js';
 import { confirmOrganizationLicenseOrderWithDeps } from './organization-license-order.js';
 import { startIndividualOrganizationWithDeps } from './individual-start.js';
-import { createOrganizationEmployeeWithDeps, issueOrganizationEmployeeLicenseWithDeps, disableIndividualMemberWithDeps, disableIndividualOrganizationWithDeps, disableOrganizationEmployeeWithDeps, listIndividualLicenseOffersWithDeps, listIndividualLicenseOrdersWithDeps, listIndividualLicensesWithDeps, addFreeIndividualMemberLicensesWithDeps, issueIndividualMemberLicenseWithDeps, transitionIndividualMemberLicenseWithDeps, listOrganizationLicenseOffersWithDeps, listOrganizationLicenseOrdersWithDeps, listOrganizationLicensesWithDeps, grantProfessionalAccessWithDeps, setDigitalTwinSecondaryUseConsentWithDeps, purgeDigitalTwinSubjectLinkWithDeps, buildClinicalSectionUpdateIngestion, buildClinicalSummaryUpdateIngestion, ingestCommunicationAndUpdateIndexWithDeps, requestProfessionalAccessWithDeps, buildVitalSignBatchCommunicationFromSearchResponse, registerBlockchainArtifactAndUpdateIndexWithDeps, requestClinicalSummaryWithDeps, revokeProfessionalAccessWithDeps, searchCommunicationParticipantsWithDeps, purgeIndividualMemberWithDeps, purgeIndividualOrganizationWithDeps, purgeOrganizationEmployeeWithDeps, prepareEmployeeLifecycleMessageForTransport, searchIndividualLicensesWithDeps, searchIndividualLicenseOffersWithDeps, searchIndividualLicenseOrdersWithDeps, searchOrganizationLicensesWithDeps, searchOrganizationLicenseOffersWithDeps, searchOrganizationLicenseOrdersWithDeps, searchOrganizationEmployeesWithDeps, searchClinicalBundleWithDeps, searchLatestIpsWithDeps, upsertRelatedPersonAndPollWithDeps, normalizeCommunicationPathFormatSegment, addFreeOrganizationEmployeeLicensesWithDeps, requestOrganizationEmployeeLicenseOfferWithDeps, } from './resource-operations.js';
+import { createOrganizationEmployeeWithDeps, issueOrganizationEmployeeLicenseWithDeps, disableIndividualMemberWithDeps, disableIndividualOrganizationWithDeps, disableOrganizationEmployeeWithDeps, listIndividualLicenseOffersWithDeps, listIndividualLicenseOrdersWithDeps, listIndividualLicensesWithDeps, addFreeIndividualMemberLicensesWithDeps, issueIndividualMemberLicenseWithDeps, transitionIndividualMemberLicenseWithDeps, listOrganizationLicenseOffersWithDeps, listOrganizationLicenseOrdersWithDeps, listOrganizationLicensesWithDeps, grantProfessionalAccessWithDeps, setDigitalTwinSecondaryUseConsentWithDeps, purgeDigitalTwinSubjectLinkWithDeps, searchSubjectConsentsWithDeps, buildClinicalSectionUpdateIngestion, buildClinicalSummaryUpdateIngestion, ingestCommunicationAndUpdateIndexWithDeps, requestProfessionalAccessWithDeps, buildVitalSignBatchCommunicationFromSearchResponse, registerBlockchainArtifactAndUpdateIndexWithDeps, requestClinicalSummaryWithDeps, revokeProfessionalAccessWithDeps, searchCommunicationParticipantsWithDeps, purgeIndividualMemberWithDeps, purgeIndividualOrganizationWithDeps, purgeOrganizationEmployeeWithDeps, prepareEmployeeLifecycleMessageForTransport, searchIndividualLicensesWithDeps, searchIndividualLicenseOffersWithDeps, searchIndividualLicenseOrdersWithDeps, searchOrganizationLicensesWithDeps, searchOrganizationLicenseOffersWithDeps, searchOrganizationLicenseOrdersWithDeps, searchOrganizationEmployeesWithDeps, searchClinicalBundleWithDeps, searchLatestIpsWithDeps, upsertRelatedPersonAndPollWithDeps, normalizeCommunicationPathFormatSegment, addFreeOrganizationEmployeeLicensesWithDeps, requestOrganizationEmployeeLicenseOfferWithDeps, } from './resource-operations.js';
 import { listOrganizationEmployeeLifecycleWithDeps, provisionOrganizationEmployeeWithDeps, } from './organization-employee-lifecycle.js';
 import { buildRuntimeHeaders, fetchWithTimeout, parseResponseBody, postRenderedWithRuntimeConfig, } from './runtime-transport.js';
 import { activateOrganizationInGatewayFromIcaProofWithDeps, submitLegalOrganizationCredentialReissuanceWithDeps, submitLegalOrganizationVerificationTransactionWithDeps, submitOrganizationDidBindingWithDeps, } from './runtime-host-submission.js';
@@ -860,6 +860,14 @@ export class HttpRuntimeClient {
             submitAndPoll: this.submitAndPoll.bind(this),
         });
     }
+    /** Reads the subject-owned Consent records through Communication -> Subject/_search. */
+    async searchSubjectConsents(ctx, input) {
+        return searchSubjectConsentsWithDeps(ctx, input, {
+            individualCommunicationBatchPath: this.paths.individualCommunicationBatchPath.bind(this.paths),
+            individualCommunicationPollPath: this.paths.individualCommunicationPollPath.bind(this.paths),
+            submitAndPoll: this.submitAndPoll.bind(this),
+        });
+    }
     /**
      * Closes an existing professional consent by setting its period end and
      * resubmitting the updated consent resource.

package/dist/orchestration/client-port.d.ts

@@ -19,7 +19,7 @@ import type { OrganizationLicenseOrderConfirmInput } from '../organization-licen
 import type { SmartTokenExchangeResult, SmartTokenRequestInput } from '../smart-token.js';
 import type { DigitalTwinMaterializationInput, DigitalTwinSearchInput, DigitalTwinSelectionInput } from '../digital-twin.js';
 import type { AuthorizedIndividualSubject, AuthorizedIndividualSubjectDirectoryInput } from '../authorized-subject-directory.js';
-import type { CommunicationIngestionInput, BlockchainArtifactRegistrationInput, CommunicationParticipantRuntimeSearchInput, ClinicalBundleSearchInput, ClinicalSectionUpdateInput, ClinicalSummaryReadResult, ClinicalSummaryRequestInput, ClinicalSummaryUpdateInput, VitalSignBatchCommunicationFromSearchResponseInput, DigitalTwinGenerationInput, DigitalTwinSecondaryUseConsentInput, DigitalTwinSecondaryUseConsentResult, DigitalTwinSubjectLinkPurgeInput, DigitalTwinSubjectLinkPurgeResult, GrantProfessionalAccessInput, GrantProfessionalAccessResult, IndividualMemberLifecycleInput, IndividualMemberLicenseAddInput, IndividualMemberLicenseInvitationInput, IndividualMemberLicenseTransitionInput, IpsOrFhirImportInput, OrganizationEmployeeCreationInput, OrganizationEmployeeLicenseAddInput, OrganizationEmployeeLicenseOfferInput, OrganizationEmployeeLicenseInvitationInput, OrganizationEmployeeLifecycleInput, OrganizationEmployeeSearchInput, ProfessionalAccessRequestInput, ProfessionalAccessRequestResult, RevokeProfessionalAccessInput, RevokeProfessionalAccessResult, RelatedPersonUpsertInput } from '../resource-operations.js';
+import type { CommunicationIngestionInput, BlockchainArtifactRegistrationInput, CommunicationParticipantRuntimeSearchInput, ClinicalBundleSearchInput, ClinicalSectionUpdateInput, ClinicalSummaryReadResult, ClinicalSummaryRequestInput, ClinicalSummaryUpdateInput, VitalSignBatchCommunicationFromSearchResponseInput, DigitalTwinGenerationInput, DigitalTwinSecondaryUseConsentInput, DigitalTwinSecondaryUseConsentResult, DigitalTwinSubjectLinkPurgeInput, DigitalTwinSubjectLinkPurgeResult, GrantProfessionalAccessInput, GrantProfessionalAccessResult, IndividualMemberLifecycleInput, IndividualMemberLicenseAddInput, IndividualMemberLicenseInvitationInput, IndividualMemberLicenseTransitionInput, IpsOrFhirImportInput, OrganizationEmployeeCreationInput, OrganizationEmployeeLicenseAddInput, OrganizationEmployeeLicenseOfferInput, OrganizationEmployeeLicenseInvitationInput, OrganizationEmployeeLifecycleInput, OrganizationEmployeeSearchInput, ProfessionalAccessRequestInput, ProfessionalAccessRequestResult, RevokeProfessionalAccessInput, RevokeProfessionalAccessResult, RelatedPersonUpsertInput, SubjectConsentSearchInput } from '../resource-operations.js';
 /**
  * Shared node-runtime activation input.
  *
@@ -140,6 +140,7 @@ export type RuntimeClient = {
     generateDigitalTwinFromSubjectData?: (ctx: RouteContext, input: DigitalTwinGenerationInput) => Promise<SubmitAndPollResult>;
     setDigitalTwinSecondaryUseConsent?: (ctx: RouteContext, input: DigitalTwinSecondaryUseConsentInput) => Promise<DigitalTwinSecondaryUseConsentResult>;
     purgeDigitalTwinSubjectLink?: (ctx: RouteContext, input: DigitalTwinSubjectLinkPurgeInput) => Promise<DigitalTwinSubjectLinkPurgeResult>;
+    searchSubjectConsents?: (ctx: RouteContext, input: SubjectConsentSearchInput) => Promise<SubmitAndPollResult>;
     searchClinicalBundle?: (ctx: RouteContext, input: ClinicalBundleSearchInput) => Promise<SubmitAndPollResult>;
     searchDigitalTwins?: (ctx: RouteContext, input: DigitalTwinSearchInput) => Promise<SubmitAndPollResult>;
     saveDigitalTwinSelection?: (ctx: RouteContext, input: DigitalTwinSelectionInput) => Promise<SubmitAndPollResult>;

package/dist/orchestration/digital-twin-sdk.d.ts

@@ -11,7 +11,9 @@ export declare class DigitalTwinSdk {
     /** Requests the SMART token used by subsequent digital-twin operations. */
     requestSmartToken(input: SmartTokenRequestInput): Promise<SmartTokenExchangeResult>;
     /**
-     * Searches pseudonymous records and exposes matched Compositions directly.
+     * Searches the public `ResearchSubject/_search` aggregate with FHIR
+     * Parameters. Each match includes the canonical Composition GW uses
+     * internally to index that ResearchSubject and connect its resources.
      *
      * MVP basic search supplies `sections`, `dateFrom`, optional `dateTo`, and
      * `text`. GW resolves an omitted `dateTo` to its current time, applies OR
@@ -24,7 +26,11 @@ export declare class DigitalTwinSdk {
      * The canonical clinical twin is never modified.
      */
     saveSelection(ctx: RouteContext, input: DigitalTwinSelectionInput): Promise<SubmitAndPollResult>;
-    /** Reopens only this employee's saved selections for one exact custom tag. */
+    /**
+     * Reopens this employee's saved ResearchSubjects through the same public
+     * route. The tag is combined with an author filter bound to the actor DID;
+     * GW verifies that author against the authenticated SMART `sub`.
+     */
     searchSelections(ctx: RouteContext, input: Omit<DigitalTwinSearchInput, 'filters'> & {
         section: string;
         tag: Readonly<{

package/dist/orchestration/digital-twin-sdk.js

@@ -16,11 +16,18 @@ export class DigitalTwinSdk {
             throw new Error('DigitalTwinSdk actorDid must match the actor session.');
         }
         const actorDid = this.researcherDid || requestedActorDid;
+        const requestedScopes = input.scopes?.length
+            ? input.scopes
+            : [ServiceCapability.DigitalTwinReader];
         const result = await requireClientMethod(this.client, 'requestSmartToken')({
             ...input,
             actorDid,
             purpose: input.purpose || HealthcareConsentPurposes.Research,
-            scopes: input.scopes?.length ? input.scopes : [ServiceCapability.DigitalTwinReader],
+            // GW root scopes are explicit queries. Complete the common bare SDK
+            // capability so callers do not have to know the SMART wire syntax.
+            scopes: requestedScopes.map((scope) => scope === ServiceCapability.DigitalTwinReader
+                ? `${scope}?subject=*`
+                : scope),
         });
         if (result.accessToken)
             this.smartAccessToken = result.accessToken;
@@ -29,7 +36,9 @@ export class DigitalTwinSdk {
         return result;
     }
     /**
-     * Searches pseudonymous records and exposes matched Compositions directly.
+     * Searches the public `ResearchSubject/_search` aggregate with FHIR
+     * Parameters. Each match includes the canonical Composition GW uses
+     * internally to index that ResearchSubject and connect its resources.
      *
      * MVP basic search supplies `sections`, `dateFrom`, optional `dateTo`, and
      * `text`. GW resolves an omitted `dateTo` to its current time, applies OR
@@ -59,6 +68,7 @@ export class DigitalTwinSdk {
         }
         const operation = await requireClientMethod(this.client, 'searchDigitalTwins')(ctx, {
             ...input,
+            resourceType: 'ResearchSubject',
             filters,
             accessToken: input.accessToken || this.smartAccessToken,
         });
@@ -80,7 +90,11 @@ export class DigitalTwinSdk {
             accessToken: input.accessToken || this.smartAccessToken,
         });
     }
-    /** Reopens only this employee's saved selections for one exact custom tag. */
+    /**
+     * Reopens this employee's saved ResearchSubjects through the same public
+     * route. The tag is combined with an author filter bound to the actor DID;
+     * GW verifies that author against the authenticated SMART `sub`.
+     */
     searchSelections(ctx, input) {
         const section = String(input.section || '').trim();
         const system = String(input.tag?.system || '').trim();

package/dist/orchestration/individual-controller-sdk.d.ts

@@ -138,7 +138,11 @@ export declare class IndividualControllerSdk {
      * data already shared for research.
      */
     purgeDigitalTwinSubjectLink(ctx: RouteContext, input: DigitalTwinSubjectLinkPurgeInput): Promise<DigitalTwinSubjectLinkPurgeResult>;
-    /** Returns the current decision for one portal, software or research study. */
+    /**
+     * Returns the current decision for one portal, software or research study.
+     * Consent is read through Communication -> individual `Subject/_search`;
+     * this does not query a clinical Bundle or the twin ResearchSubject index.
+     */
     getDigitalTwinSecondaryUseConsentStatus(ctx: RouteContext, input: Readonly<{
         subjectDid: string;
         indexProviderOrganizationDid: string;

package/dist/orchestration/individual-controller-sdk.js

@@ -208,7 +208,11 @@ export class IndividualControllerSdk {
         assertFacadeCapability(this.capabilities, ActorCapabilities.IndividualGenerateDigitalTwin, ActorKinds.IndividualController, 'purgeDigitalTwinSubjectLink');
         return requireClientMethod(this.client, 'purgeDigitalTwinSubjectLink')(ctx, input);
     }
-    /** Returns the current decision for one portal, software or research study. */
+    /**
+     * Returns the current decision for one portal, software or research study.
+     * Consent is read through Communication -> individual `Subject/_search`;
+     * this does not query a clinical Bundle or the twin ResearchSubject index.
+     */
     async getDigitalTwinSecondaryUseConsentStatus(ctx, input) {
         assertFacadeCapability(this.capabilities, ActorCapabilities.IndividualGenerateDigitalTwin, ActorKinds.IndividualController, 'getDigitalTwinSecondaryUseConsentStatus');
         const consents = await new GatewayActiveConsentProvider(this.client, ctx)

package/dist/organization-registration-authorization.d.ts

@@ -0,0 +1,16 @@
+import type { VerifiableCredentialV2 } from 'gdc-common-utils-ts/models/verifiable-credential';
+import type { IWallet, WalletExecutionContext, WalletKeySelection } from 'gdc-sdk-core-ts';
+/** Input required to add one human-authorizer proof to the out-of-band VC. */
+export type SignOrganizationRegistrationAuthorizationInput = Readonly<{
+    credential: VerifiableCredentialV2;
+    wallet: IWallet;
+    context: WalletExecutionContext;
+    key: WalletKeySelection;
+    verificationMethod: string;
+    createdAt?: string;
+}>;
+/**
+ * Adds one detached JWS proof made by the already-unlocked professional
+ * profile. The browser never receives the private key or clear wallet seed.
+ */
+export declare function signOrganizationRegistrationAuthorizationCredential(input: SignOrganizationRegistrationAuthorizationInput): Promise<VerifiableCredentialV2>;

package/dist/organization-registration-authorization.js

@@ -0,0 +1,34 @@
+import { canonicalizeOrganizationRegistrationAuthorizationCredential, } from 'gdc-common-utils-ts/utils/organization-registration-authorization';
+/**
+ * Adds one detached JWS proof made by the already-unlocked professional
+ * profile. The browser never receives the private key or clear wallet seed.
+ */
+export async function signOrganizationRegistrationAuthorizationCredential(input) {
+    if (!input.wallet.signDetachedJws) {
+        throw new Error('Wallet does not support detached organization authorization proofs.');
+    }
+    const verificationMethod = String(input.verificationMethod || '').trim();
+    if (!verificationMethod)
+        throw new Error('Organization authorization proof requires verificationMethod.');
+    const payload = canonicalizeOrganizationRegistrationAuthorizationCredential(input.credential);
+    const jws = await input.wallet.signDetachedJws(input.context, {
+        payload,
+        header: { typ: 'application/vc+ld+json' },
+        key: input.key,
+    });
+    const existingProofs = Array.isArray(input.credential.proof)
+        ? input.credential.proof
+        : input.credential.proof
+            ? [input.credential.proof]
+            : [];
+    return {
+        ...input.credential,
+        proof: [...existingProofs, {
+                type: 'JsonWebSignature2020',
+                created: input.createdAt || new Date().toISOString(),
+                proofPurpose: 'contractAgreement',
+                verificationMethod,
+                jws,
+            }],
+    };
+}

package/dist/profile-recovery-envelope.d.ts

@@ -0,0 +1,37 @@
+export type PortableProfileRecoveryEnvelope = Readonly<{
+    version: 'gdc-portable-profile-recovery-v1';
+    profileId: string;
+    walletKeyDerivationId: string;
+    kdf: Readonly<{
+        name: 'scrypt';
+        saltBase64Url: string;
+        cost: number;
+        blockSize: number;
+        parallelization: number;
+        keyLength: 32;
+    }>;
+    cipher: 'A256GCM';
+    ivBase64Url: string;
+    ciphertextBase64Url: string;
+    tagBase64Url: string;
+}>;
+export type PortableProfileRecoveryProtection = Readonly<{
+    cost?: number;
+    blockSize?: number;
+    parallelization?: number;
+}>;
+export declare function createPortableProfileRecoveryEnvelope(input: Readonly<{
+    profileId: string;
+    walletSeed: string;
+    walletKeyDerivationId: string;
+    recoverySecret: string;
+    protection?: PortableProfileRecoveryProtection;
+}>): PortableProfileRecoveryEnvelope;
+export declare function openPortableProfileRecoveryEnvelope(input: Readonly<{
+    envelope: PortableProfileRecoveryEnvelope;
+    recoverySecret: string;
+}>): Readonly<{
+    profileId: string;
+    walletSeed: string;
+    walletKeyDerivationId: string;
+}>;

package/dist/profile-recovery-envelope.js

@@ -0,0 +1,113 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from 'node:crypto';
+export function createPortableProfileRecoveryEnvelope(input) {
+    const profileId = requiredText(input.profileId, 'profileId');
+    const walletKeyDerivationId = requiredText(input.walletKeyDerivationId, 'walletKeyDerivationId');
+    requireSeed(input.walletSeed);
+    requireRecoverySecret(input.recoverySecret);
+    const kdf = {
+        name: 'scrypt',
+        saltBase64Url: randomBytes(16).toString('base64url'),
+        cost: input.protection?.cost ?? 65536,
+        blockSize: input.protection?.blockSize ?? 8,
+        parallelization: input.protection?.parallelization ?? 1,
+        keyLength: 32,
+    };
+    const key = deriveKey(input.recoverySecret, kdf);
+    const iv = randomBytes(12);
+    const aad = envelopeAad(profileId, walletKeyDerivationId);
+    try {
+        const cipher = createCipheriv('aes-256-gcm', key, iv);
+        cipher.setAAD(aad);
+        const ciphertext = Buffer.concat([
+            cipher.update(JSON.stringify({ walletSeed: input.walletSeed }), 'utf8'),
+            cipher.final(),
+        ]);
+        return {
+            version: 'gdc-portable-profile-recovery-v1',
+            profileId,
+            walletKeyDerivationId,
+            kdf,
+            cipher: 'A256GCM',
+            ivBase64Url: iv.toString('base64url'),
+            ciphertextBase64Url: ciphertext.toString('base64url'),
+            tagBase64Url: cipher.getAuthTag().toString('base64url'),
+        };
+    }
+    finally {
+        key.fill(0);
+    }
+}
+export function openPortableProfileRecoveryEnvelope(input) {
+    const envelope = input.envelope;
+    try {
+        validateEnvelope(envelope);
+        requireRecoverySecret(input.recoverySecret);
+        const key = deriveKey(input.recoverySecret, envelope.kdf);
+        try {
+            const decipher = createDecipheriv('aes-256-gcm', key, Buffer.from(envelope.ivBase64Url, 'base64url'));
+            decipher.setAAD(envelopeAad(envelope.profileId, envelope.walletKeyDerivationId));
+            decipher.setAuthTag(Buffer.from(envelope.tagBase64Url, 'base64url'));
+            const cleartext = Buffer.concat([
+                decipher.update(Buffer.from(envelope.ciphertextBase64Url, 'base64url')),
+                decipher.final(),
+            ]).toString('utf8');
+            const payload = JSON.parse(cleartext);
+            const walletSeed = String(payload.walletSeed || '');
+            requireSeed(walletSeed);
+            return {
+                profileId: envelope.profileId,
+                walletSeed,
+                walletKeyDerivationId: envelope.walletKeyDerivationId,
+            };
+        }
+        finally {
+            key.fill(0);
+        }
+    }
+    catch {
+        throw new Error('Portable profile recovery envelope could not be opened.');
+    }
+}
+function deriveKey(secret, kdf) {
+    return scryptSync(secret, Buffer.from(kdf.saltBase64Url, 'base64url'), kdf.keyLength, {
+        N: kdf.cost,
+        r: kdf.blockSize,
+        p: kdf.parallelization,
+        maxmem: Math.max(128 * 1024 * 1024, 256 * kdf.cost * kdf.blockSize),
+    });
+}
+function envelopeAad(profileId, walletKeyDerivationId) {
+    return Buffer.from(JSON.stringify({
+        version: 'gdc-portable-profile-recovery-v1',
+        profileId,
+        walletKeyDerivationId,
+    }));
+}
+function requireRecoverySecret(value) {
+    const secret = String(value || '');
+    if (secret.length < 16 || /^\d+$/.test(secret)) {
+        throw new Error('Portable recovery requires a high-entropy recovery secret, not a short PIN.');
+    }
+}
+function requireSeed(value) {
+    if (!/^[A-Za-z0-9_-]{43}$/.test(value) || Buffer.from(value, 'base64url').byteLength !== 32) {
+        throw new Error('Portable recovery requires a 32-byte base64url wallet seed.');
+    }
+}
+function requiredText(value, name) {
+    const normalized = String(value || '').trim();
+    if (!normalized)
+        throw new Error(`Portable recovery requires ${name}.`);
+    return normalized;
+}
+function validateEnvelope(value) {
+    if (value?.version !== 'gdc-portable-profile-recovery-v1'
+        || value.cipher !== 'A256GCM'
+        || value.kdf?.name !== 'scrypt'
+        || value.kdf.keyLength !== 32
+        || !value.profileId
+        || !value.walletKeyDerivationId) {
+        throw new Error('Unsupported portable profile recovery envelope.');
+    }
+}

package/dist/resource-operations.d.ts

@@ -532,6 +532,14 @@ export type DigitalTwinSubjectLinkPurgeInput = {
 };
 /** Async GW result for a subject/twin binding purge. */
 export type DigitalTwinSubjectLinkPurgeResult = SubmitAndPollResult;
+/** Input for reading the subject-owned Consent records through its individual aggregate. */
+export type SubjectConsentSearchInput = Readonly<{
+    subject: string;
+    pollOptions?: {
+        timeoutMs?: number;
+        intervalMs?: number;
+    };
+}>;
 export declare function createOrganizationEmployeeWithDeps(routeCtx: RouteContext, input: OrganizationEmployeeCreationInput, options: {
     timeoutMs?: number;
     intervalMs?: number;
@@ -953,6 +961,22 @@ export declare function purgeDigitalTwinSubjectLinkWithDeps(routeCtx: RouteConte
         intervalMs?: number;
     }) => Promise<SubmitAndPollResult>;
 }): Promise<DigitalTwinSubjectLinkPurgeResult>;
+/**
+ * Reads Consent through the individual `Subject/_search` aggregate carried by
+ * an auditable Communication. `Subject` is the individual aggregate; it is
+ * intentionally separate from the public digital-twin `ResearchSubject`
+ * aggregate, whose canonical index document is a Composition.
+ */
+export declare function searchSubjectConsentsWithDeps(routeCtx: RouteContext, input: SubjectConsentSearchInput, deps: {
+    individualCommunicationBatchPath: (ctx: RouteContext, pathFormatSegment: string) => string;
+    individualCommunicationPollPath: (ctx: RouteContext, pathFormatSegment: string) => string;
+    submitAndPoll: (submitPath: string, pollPath: string, payload: {
+        thid?: string;
+    } & Record<string, unknown>, pollOptions?: {
+        timeoutMs?: number;
+        intervalMs?: number;
+    }) => Promise<SubmitAndPollResult>;
+}): Promise<SubmitAndPollResult>;
 export declare function revokeProfessionalAccessWithDeps(routeCtx: RouteContext, input: RevokeProfessionalAccessInput, deps: {
     individualConsentR4BatchPath: (ctx: RouteContext) => string;
     individualConsentR4PollPath: (ctx: RouteContext) => string;

package/dist/resource-operations.js

@@ -865,6 +865,50 @@ export async function purgeDigitalTwinSubjectLinkWithDeps(routeCtx, input, deps)
         },
     }, input.pollOptions);
 }
+/**
+ * Reads Consent through the individual `Subject/_search` aggregate carried by
+ * an auditable Communication. `Subject` is the individual aggregate; it is
+ * intentionally separate from the public digital-twin `ResearchSubject`
+ * aggregate, whose canonical index document is a Composition.
+ */
+export async function searchSubjectConsentsWithDeps(routeCtx, input, deps) {
+    const subject = String(input.subject || '').trim();
+    if (!subject.startsWith('did:')) {
+        throw new Error('Consent search requires a subject DID.');
+    }
+    const format = 'org.hl7.fhir.r4';
+    const parameters = {
+        resourceType: 'Parameters',
+        parameter: [{ name: 'subject', valueString: subject }],
+    };
+    const thid = `subject-consent-search-${createRuntimeUuid()}`;
+    const communication = {
+        resourceType: 'Communication',
+        status: 'completed',
+        subject: { reference: subject },
+        payload: [{
+                contentReference: {
+                    reference: 'individual/org.hl7.fhir.api/Subject/_search',
+                },
+                contentAttachment: {
+                    contentType: 'application/fhir+json',
+                    title: 'subject-consent-search-parameters.json',
+                    data: Buffer.from(JSON.stringify(parameters), 'utf8').toString('base64'),
+                },
+            }],
+    };
+    return deps.submitAndPoll(deps.individualCommunicationBatchPath(routeCtx, format), deps.individualCommunicationPollPath(routeCtx, format), {
+        thid,
+        body: {
+            resourceType: 'Bundle',
+            type: 'batch',
+            entry: [{
+                    request: { method: 'POST', url: 'Communication' },
+                    resource: communication,
+                }],
+        },
+    }, input.pollOptions);
+}
 export async function revokeProfessionalAccessWithDeps(routeCtx, input, deps) {
     const revokedClaims = ConsentClaims
         .fromClaims(input.consentClaims)

package/dist/server-profile-session.d.ts

@@ -3,6 +3,10 @@ import type { ActorKind } from 'gdc-common-utils-ts/models/actor-session';
 import type { LegalOrganizationVerificationTransactionInput } from 'gdc-common-utils-ts/utils/legal-organization-verification-transaction';
 import { type AppInfo, type ConfidentialStorageProfile, type PollOptions, type SubmitAndPollResult } from 'gdc-sdk-core-ts';
 import { OrganizationControllerSdk } from './orchestration/organization-controller-sdk.js';
+import { ProfessionalSdk } from './orchestration/professional-sdk.js';
+import { DigitalTwinSdk } from './orchestration/digital-twin-sdk.js';
+import type { SmartTokenExchangeResult } from './smart-token.js';
+import type { DigitalTwinSearchInput, DigitalTwinSearchResult } from './digital-twin.js';
 import type { RouteContext } from './individual-onboarding.js';
 import type { HostRouteContext } from './host-onboarding.js';
 import type { SecureDidcommTransportAdapter } from 'gdc-sdk-core-ts';
@@ -70,6 +74,15 @@ export type ServerEmployeeProfileOtpRotationInput = Readonly<{
     clientName: string;
 }>;
 export type ServerEmployeeProfileOtpRotationResult = ServerProfileRecord;
+export type ServerProfilePinReplacementInput = Readonly<{
+    ownerId: string;
+    profileId: string;
+    /** Server-authorized seed obtained from a passkey, active wallet session or recovery envelope. */
+    authorizedWalletSeed: string;
+    /** Required when the durable profile still carries a separately protected legacy VP. */
+    authorizedVpToken?: string;
+    newPin: string;
+}>;
 export type ServerProfileEnrollmentInput = Readonly<{
     /** Stable confidential id of the authenticated portal account that owns and lists this profile. */
     ownerId: string;
@@ -228,6 +241,47 @@ export type OpenedServerOrganizationController = Readonly<{
     profile: ServerProfileRecord;
     sdk: OrganizationControllerSdk;
 }>;
+/** Server-owned role evidence used to sign a fresh professional VP. */
+export type ServerProfessionalProofInput = Readonly<{
+    role: string;
+    email?: string;
+    sameAs?: string | readonly string[];
+    telephone?: string;
+    credentialMaterial?: string;
+}>;
+/** Reopens one enrolled employee/professional profile behind the BFF boundary. */
+export type ServerProfessionalOpenInput = Readonly<{
+    ownerId: string;
+    profileId: string;
+    /** Fresh signed OIDC id_token proving the authenticated account/email. */
+    idToken: string;
+    /** Role evidence signed by the managed DCR wallet, independently of idToken. */
+    professionalProof: ServerProfessionalProofInput;
+    /** Manager-owned PIN path; mutually exclusive with authorizedWalletSeed. */
+    pin?: string;
+    /** Server-only seed already authorized by a product passkey/session policy. */
+    authorizedWalletSeed?: string;
+}>;
+/** Business authorization requested from SMART; OpenID/JWT fields stay SDK-owned. */
+export type ServerProfessionalSmartTokenInput = Readonly<{
+    subjectDid?: string;
+    purpose?: string;
+    scopes: string[];
+    acrValues?: string;
+    requestBodyClaims?: Record<string, unknown>;
+    tokenCacheKey?: string;
+    timeoutSeconds?: number;
+    intervalSeconds?: number;
+}>;
+/** Role-scoped professional facades with managed SMART proof methods. */
+export type OpenedServerProfessional = Readonly<{
+    profile: ServerProfileRecord;
+    sdk: ProfessionalSdk;
+    digitalTwin: DigitalTwinSdk;
+    requestSmartToken(input: ServerProfessionalSmartTokenInput): Promise<SmartTokenExchangeResult>;
+    requestDigitalTwinSmartToken(input: ServerProfessionalSmartTokenInput): Promise<SmartTokenExchangeResult>;
+    searchDigitalTwins(input: Omit<DigitalTwinSearchInput, 'accessToken'>): Promise<DigitalTwinSearchResult>;
+}>;
 export type ServerProfileSessionManagerOptions = Readonly<{
     store: ServerProfileStore;
     sealer: ServerProfileSealer;
@@ -290,6 +344,12 @@ export declare class ServerProfileSessionManager {
     /** @deprecated Use `submitLegalOrganizationCredentialReissuanceWithBootstrapWallet`. */
     submitLegalOrganizationIssueWithBootstrapWallet(input: ServerProfileOrganizationIssueInput): Promise<SubmitAndPollResult>;
     listProfiles(ownerId: string): Promise<ServerProfileRecord[]>;
+    /**
+     * Rewraps the exact registered wallet under a new PIN after a separate
+     * server-authorized recovery factor has released its secrets. No GW call or
+     * DCR occurs because proof-of-possession and every public key remain intact.
+     */
+    replaceProfilePinFromAuthorizedSecrets(input: ServerProfilePinReplacementInput): Promise<ServerProfileRecord>;
     unlock(input: ServerProfileUnlockInput): Promise<ResolvedServerProfileSession>;
     /**
      * Renews the short SMART bearer while retaining the already-open server
@@ -307,6 +367,16 @@ export declare class ServerProfileSessionManager {
      * registered for that profile before any gateway request can be sent.
      */
     openOrganizationController(input: ServerOrganizationControllerOpenInput): Promise<OpenedServerOrganizationController>;
+    /**
+     * Opens one registered organization employee/professional without exposing
+     * wallet reconstruction, private_key_jwt, VP or transport plumbing.
+     *
+     * The product authorizes the PIN/passkey/session and supplies business role
+     * evidence. The SDK revalidates the registered key set, signs a fresh role
+     * VP independently from the OIDC account proof, derives the SMART endpoint
+     * from the durable profile route and owns the client assertion.
+     */
+    openProfessional(input: ServerProfessionalOpenInput): Promise<OpenedServerProfessional>;
     lock(ownerId: string, sessionId: string): Promise<void>;
     private createClient;
     private createWallet;

package/dist/server-profile-session.js

@@ -7,6 +7,8 @@ import { TransportProfiles, } from 'gdc-sdk-core-ts';
 import { NodeManagedWallet } from './node-managed-wallet.js';
 import { NodeHttpClient } from './node-runtime-client.js';
 import { OrganizationControllerSdk } from './orchestration/organization-controller-sdk.js';
+import { ProfessionalSdk } from './orchestration/professional-sdk.js';
+import { DigitalTwinSdk } from './orchestration/digital-twin-sdk.js';
 import { buildIdentityOpenIdSmartTokenPath } from './runtime-paths.js';
 import { createProfileDeviceActivationRequest } from './device-activation.js';
 import { ProfilePinRejectedError, openServerProfileSecret, protectServerProfileSecret, } from './server-profile-protection.js';
@@ -254,6 +256,38 @@ export class ServerProfileSessionManager {
     listProfiles(ownerId) {
         return this.options.store.listProfiles(ownerId);
     }
+    /**
+     * Rewraps the exact registered wallet under a new PIN after a separate
+     * server-authorized recovery factor has released its secrets. No GW call or
+     * DCR occurs because proof-of-possession and every public key remain intact.
+     */
+    async replaceProfilePinFromAuthorizedSecrets(input) {
+        const profile = await this.requireOwnedProfile(input.ownerId, input.profileId);
+        const seed = String(input.authorizedWalletSeed || '').trim();
+        requireBase64UrlSeed32(seed);
+        if (!this.options.store.deleteSessionsForProfile) {
+            throw new Error('Profile PIN replacement requires profile-session invalidation support.');
+        }
+        if (profile.protectedVpToken && !String(input.authorizedVpToken || '').trim()) {
+            throw new Error('Profile PIN replacement requires the authorized VP token.');
+        }
+        const walletKeyDerivationId = normalizedWalletKeyDerivationId(profile.walletKeyDerivationId, profile.profileId);
+        const wallet = await this.createWallet(walletKeyDerivationId, seed);
+        await requireRegisteredProfileKeys(wallet, walletContext(walletKeyDerivationId), profile);
+        const updated = {
+            ...profile,
+            protectedWalletSeed: await protectServerProfileSecret(seed, input.newPin, `${profile.profileId}:wallet-seed`, this.options.sealer, this.options.profileProtection),
+            ...(profile.protectedVpToken ? {
+                protectedVpToken: await protectServerProfileSecret(String(input.authorizedVpToken), input.newPin, `${profile.profileId}:vp-token`, this.options.sealer, this.options.profileProtection),
+            } : {}),
+            failedUnlocks: 0,
+            lockedUntil: undefined,
+            updatedAt: this.now().toISOString(),
+        };
+        await this.options.store.putProfile(updated);
+        await this.options.store.deleteSessionsForProfile(profile.profileId);
+        return updated;
+    }
     async unlock(input) {
         let profile = await this.requireOwnedProfile(input.ownerId, input.profileId);
         this.requireSubject(profile, input.subjectDid);
@@ -453,6 +487,115 @@ export class ServerProfileSessionManager {
         });
         return { profile, sdk: new OrganizationControllerSdk(client) };
     }
+    /**
+     * Opens one registered organization employee/professional without exposing
+     * wallet reconstruction, private_key_jwt, VP or transport plumbing.
+     *
+     * The product authorizes the PIN/passkey/session and supplies business role
+     * evidence. The SDK revalidates the registered key set, signs a fresh role
+     * VP independently from the OIDC account proof, derives the SMART endpoint
+     * from the durable profile route and owns the client assertion.
+     */
+    async openProfessional(input) {
+        const profile = await this.requireOwnedProfile(input.ownerId, input.profileId);
+        const isProfessional = profile.actorKind === ActorKinds.OrganizationEmployee
+            || profile.actorKind === ActorKinds.Professional;
+        if (!isProfessional || profile.actorMode !== 'member') {
+            throw new Error('Profile is not an organization employee or professional.');
+        }
+        const idToken = String(input.idToken || '').trim();
+        const role = String(input.professionalProof?.role || '').trim();
+        if (!idToken)
+            throw new Error('Opening a professional requires a signed OIDC idToken.');
+        if (!role)
+            throw new Error('Opening a professional requires role proof.');
+        const hasPin = Boolean(String(input.pin || '').trim());
+        const hasAuthorizedSeed = Boolean(String(input.authorizedWalletSeed || '').trim());
+        if (hasPin === hasAuthorizedSeed) {
+            throw new Error('Opening a professional requires exactly one of pin or authorizedWalletSeed.');
+        }
+        const seed = hasAuthorizedSeed
+            ? String(input.authorizedWalletSeed)
+            : await openServerProfileSecret(profile.protectedWalletSeed, String(input.pin), `${profile.profileId}:wallet-seed`, this.options.sealer);
+        requireBase64UrlSeed32(seed);
+        const walletKeyDerivationId = normalizedWalletKeyDerivationId(profile.walletKeyDerivationId, profile.profileId);
+        const wallet = await this.createWallet(walletKeyDerivationId, seed);
+        const context = walletContext(walletKeyDerivationId);
+        await requireRegisteredProfileKeys(wallet, context, profile);
+        const secureTransportAdapter = {
+            pack: (message) => wallet.packForRecipientWithContext(bindOrganizationControllerTransport(message, profile), profile.providerDid, { context }),
+            unpack: async (jwe) => (await wallet.unpackWithContext(jwe, { context })).content,
+        };
+        const operationalClient = new NodeHttpClient({
+            baseUrl: this.options.gatewayBaseUrl,
+            ctx: profile.routeContext,
+            bearerToken: idToken,
+            fetchImpl: this.options.fetchImpl,
+            appInfo: this.options.appInfo,
+            transportProfile: TransportProfiles.DidcommEncryptedForm,
+            secureTransportAdapter,
+        });
+        // SMART/OpenID uses its own JSON/form protocol and must not be wrapped in
+        // the encrypted resource transport selected for later business actions.
+        const sdk = new ProfessionalSdk(this.createClient(profile.routeContext, idToken));
+        const digitalTwin = new DigitalTwinSdk(operationalClient, profile.actorDid);
+        let digitalTwinAccessToken;
+        const request = async (smart) => {
+            if (!smart.scopes?.length)
+                throw new Error('Professional SMART request requires scopes.');
+            const now = this.now();
+            const audience = [
+                this.options.gatewayBaseUrl.replace(/\/+$/, ''),
+                buildIdentityOpenIdSmartTokenPath(profile.routeContext),
+            ].join('');
+            const clientAssertion = await buildWalletClientAssertion(wallet, profile, audience, now);
+            const vpToken = await buildManagedProfessionalVp(wallet, context, {
+                clientId: profile.clientId,
+                actorDid: profile.actorDid,
+                profileDid: profile.profileDid,
+                ...input.professionalProof,
+                role,
+            });
+            return sdk.requestSmartToken({
+                ...profile.routeContext,
+                actorDid: profile.actorDid,
+                subjectDid: String(smart.subjectDid || '').trim() || undefined,
+                clientId: profile.clientId,
+                issuer: profile.clientId,
+                audience,
+                idToken,
+                vpToken,
+                vpTokenFallback: 'omit',
+                clientAssertion,
+                clientAssertionType: 'private_key_jwt',
+                smartTokenKind: 'openid-smart',
+                acrValues: smart.acrValues || profileSmartAcrValues(profile.actorKind),
+                purpose: smart.purpose,
+                scopes: unique(smart.scopes),
+                requestBodyClaims: smart.requestBodyClaims,
+                tokenCacheKey: smart.tokenCacheKey,
+                timeoutSeconds: smart.timeoutSeconds,
+                intervalSeconds: smart.intervalSeconds,
+            });
+        };
+        return {
+            profile,
+            sdk,
+            digitalTwin,
+            requestSmartToken: request,
+            requestDigitalTwinSmartToken: async (smart) => {
+                const result = await request(smart);
+                if (result.accessToken)
+                    digitalTwinAccessToken = result.accessToken;
+                return result;
+            },
+            searchDigitalTwins: (search) => {
+                if (!digitalTwinAccessToken)
+                    throw new Error('Digital twin SMART token has not been granted.');
+                return digitalTwin.search(profile.routeContext, { ...search, accessToken: digitalTwinAccessToken });
+            },
+        };
+    }
     async lock(ownerId, sessionId) {
         const session = await this.options.store.getSession(sessionId);
         if (session?.ownerId === ownerId)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-sdk-node-ts",
-  "version": "2.4.41",
+  "version": "2.4.44",
   "description": "Next-generation Node runtime package for the GDC SDK family",
   "license": "Apache-2.0",
   "author": "Antifraud Services Inc.",