gdc-sdk-node-ts 2.6.6 → 2.7.0

package/dist/authorized-subject-directory.js

@@ -34,11 +34,11 @@ export async function listAuthorizedIndividualSubjectsWithDeps(routeContext, inp
             data: [{
                     type: 'Family-search-v1.0',
                     request: { method: 'POST' },
-                    meta: { claims: {
-                            '@context': SCHEMA_CONTEXT,
-                            ...(email ? { [CLAIM_ORGANIZATION_OWNER_EMAIL]: email } : {}),
-                            ...(telephone ? { [CLAIM_ORGANIZATION_OWNER_TELEPHONE]: telephone } : {}),
-                        } },
+                    resource: { meta: { claims: {
+                                '@context': SCHEMA_CONTEXT,
+                                ...(email ? { [CLAIM_ORGANIZATION_OWNER_EMAIL]: email } : {}),
+                                ...(telephone ? { [CLAIM_ORGANIZATION_OWNER_TELEPHONE]: telephone } : {}),
+                            } } },
                 }],
         },
     }, input.pollOptions);
@@ -58,7 +58,7 @@ export async function listAuthorizedIndividualSubjectsWithDeps(routeContext, inp
             type: 'batch',
             data: [{
                     request: { method: 'POST' },
-                    meta: { status: 'active', claims: licenseClaims },
+                    resource: { meta: { status: 'active', claims: licenseClaims } },
                 }],
         },
     }, input.pollOptions);
@@ -76,7 +76,7 @@ export async function listAuthorizedIndividualSubjectsWithDeps(routeContext, inp
                 data: [{
                         type: 'Family-search-v1.0',
                         request: { method: 'POST' },
-                        meta: { claims: organizationClaims },
+                        resource: { meta: { claims: organizationClaims } },
                     }],
             },
         }, input.pollOptions);
@@ -155,7 +155,7 @@ function readAcceptedLicenses(result) {
 }
 function readFirstClaims(result) {
     const entry = readData(result)[0];
-    const claims = entry?.meta?.claims || entry?.resource?.meta?.claims;
+    const claims = entry?.resource?.meta?.claims || entry?.meta?.claims;
     return claims && typeof claims === 'object' ? claims : {};
 }
 function readData(result) {

package/dist/device-activation.d.ts

@@ -1,3 +1,4 @@
+import type { ClinicalCreatorBinding } from 'gdc-common-utils-ts/utils/fhir-ips-creator-identity';
 import type { PollOptions, SubmitAndPollResult } from './orchestration/client-port.js';
 import type { RouteContext } from './individual-onboarding.js';
 export type EmployeeDeviceActivationInput = {
@@ -32,6 +33,7 @@ export type ProfileDeviceRegistrationInput = Readonly<{
     deviceName?: string;
     actorDid?: string;
     profileDid?: string;
+    clinicalCreatorBinding?: ClinicalCreatorBinding;
 }>;
 /** Advanced typed editor used by SDK runtimes that already own profile keys. */
 export interface ProfileDeviceActivationDraft {
@@ -43,6 +45,7 @@ export interface ProfileDeviceActivationDraft {
     setDeviceName(value: string): ProfileDeviceActivationDraft;
     setActorDid(value: string): ProfileDeviceActivationDraft;
     setProfileDid(value: string): ProfileDeviceActivationDraft;
+    setClinicalCreatorBinding(value: ClinicalCreatorBinding): ProfileDeviceActivationDraft;
     setTimeoutSeconds(value: number): ProfileDeviceActivationDraft;
     setIntervalSeconds(value: number): ProfileDeviceActivationDraft;
     build(): EmployeeDeviceActivationRequestInput & {

package/dist/device-activation.js

@@ -20,6 +20,7 @@ export function createProfileDeviceActivationRequest(input) {
     let deviceName = '';
     let actorDid = '';
     let profileDid = '';
+    let clinicalCreatorBinding;
     let timeoutSeconds;
     let intervalSeconds;
     const draft = {
@@ -31,6 +32,7 @@ export function createProfileDeviceActivationRequest(input) {
         setDeviceName(value) { deviceName = normalizedText(value); return draft; },
         setActorDid(value) { actorDid = normalizedText(value); return draft; },
         setProfileDid(value) { profileDid = normalizedText(value); return draft; },
+        setClinicalCreatorBinding(value) { clinicalCreatorBinding = stableClinicalCreatorBinding(value); return draft; },
         setTimeoutSeconds(value) { timeoutSeconds = positiveNumber(value, 'timeout seconds'); return draft; },
         setIntervalSeconds(value) { intervalSeconds = positiveNumber(value, 'interval seconds'); return draft; },
         build() {
@@ -43,6 +45,7 @@ export function createProfileDeviceActivationRequest(input) {
                 ...(deviceName ? { deviceName } : {}),
                 ...(actorDid ? { actorDid } : {}),
                 ...(profileDid ? { profileDid } : {}),
+                ...(clinicalCreatorBinding ? { clinicalCreatorBinding } : {}),
             };
             return {
                 ...input,
@@ -165,12 +168,24 @@ function resolveDcrPayload(input) {
             },
             ...(registration.actorDid ? { [IdentityDcrMetadataFields.ActorDid]: registration.actorDid } : {}),
             ...(registration.profileDid ? { [IdentityDcrMetadataFields.ProfileDid]: registration.profileDid } : {}),
+            ...(registration.clinicalCreatorBinding ? {
+                [IdentityDcrMetadataFields.ClinicalCreatorBinding]: stableClinicalCreatorBinding(registration.clinicalCreatorBinding),
+            } : {}),
         };
     }
     if (input.dcrPayload)
         return { ...input.dcrPayload };
     throw new Error('Device activation requires a device registration built by createProfileDeviceActivationRequest.');
 }
+function stableClinicalCreatorBinding(binding) {
+    return {
+        kind: binding.kind,
+        actorIdentifier: binding.actorIdentifier,
+        authorIdentifier: binding.authorIdentifier,
+        ownerIdentifier: binding.ownerIdentifier,
+        role: binding.role,
+    };
+}
 function responseBody(value) {
     if (typeof value === 'string') {
         try {

package/dist/digital-twin.js

@@ -234,12 +234,13 @@ export async function searchDigitalTwinsWithDeps(ctx, input, deps) {
         ? {
             data: [{
                     type: `${resourceType}-search-request-v1.0`,
-                    resource: { resourceType: 'Parameters', parameter: parameters },
-                    meta: {
-                        claims: Object.fromEntries([
-                            ['@context', format],
-                            ...parameters.map((parameter) => [parameter.name, parameter.valueString || parameter.valueDate || '']),
-                        ]),
+                    resource: {
+                        resourceType: 'Parameters',
+                        parameter: parameters,
+                        meta: { claims: Object.fromEntries([
+                                ['@context', format],
+                                ...parameters.map((parameter) => [parameter.name, parameter.valueString || parameter.valueDate || '']),
+                            ]) },
                     },
                 }],
         }

package/dist/family-organization-search.js

@@ -35,7 +35,6 @@ export async function searchFamilyOrganizationWithDeps(deps) {
         body: {
             data: [{
                     type: 'Family-search-v1.0',
-                    meta: { claims },
                     resource: { meta: { claims } },
                 }],
         },

package/dist/individual-onboarding.js

@@ -27,7 +27,6 @@ export async function confirmIndividualOrganizationOrderWithDeps(deps) {
         body: {
             data: [{
                     type: 'Family-order-request-v1.0',
-                    meta: { claims: orderClaims },
                     resource: { meta: { claims: orderClaims } },
                 }],
         },

package/dist/individual-start.js

@@ -54,7 +54,6 @@ export async function startIndividualOrganizationWithDeps(deps) {
         body: {
             data: [{
                     type: GwCoreLifecycleRequestType.IndividualOrganizationRegistration,
-                    meta: { claims },
                     resource: { meta: { claims } },
                 }],
         },

package/dist/organization-controller-recovery.js

@@ -68,7 +68,10 @@ export const recoverOrganizationControllerWithIssueWithDeps = recoverOrganizatio
 export function readLegalOrganizationCredentialReissuanceActivationCode(result) {
     const pollBody = (result?.poll?.body || {});
     for (const candidate of nestedObjects(pollBody)) {
-        const claims = candidate.meta?.claims;
+        const resource = candidate.resource;
+        const resourceClaims = resource?.meta?.claims;
+        const legacyClaims = candidate.meta?.claims;
+        const claims = resourceClaims || legacyClaims;
         const activationCode = String(claims?.['org.schema.IndividualProduct.serialNumber'] || '').trim();
         if (activationCode)
             return activationCode;

package/dist/organization-employee-lifecycle.js

@@ -84,8 +84,10 @@ export function readEmployeeLicenseOfferId(value) {
     for (const candidate of nestedRecords(value)) {
         if (candidate.type !== 'Employee-license-offer-v1.0')
             continue;
-        const meta = record(candidate.meta);
-        const claims = record(meta?.claims);
+        const resource = record(candidate.resource);
+        const resourceMeta = record(resource?.meta);
+        const legacyMeta = record(candidate.meta);
+        const claims = record(resourceMeta?.claims) || record(legacyMeta?.claims);
         const offerId = String(claims?.[ClaimsOfferSchemaorg.identifier] || '').trim();
         if (offerId)
             return offerId;

package/dist/organization-license-order.js

@@ -27,7 +27,6 @@ export async function confirmOrganizationLicenseOrderWithDeps(deps) {
         body: {
             data: [{
                     type: deps.input.dataType || 'Organization-order-request-v1.0',
-                    meta: { claims },
                     resource: { meta: { claims } },
                 }],
         },

package/dist/organization-registration-authorization.d.ts

@@ -0,0 +1,16 @@
+import type { VerifiableCredentialV2 } from 'gdc-common-utils-ts/models/verifiable-credential';
+import type { IWallet, WalletExecutionContext, WalletKeySelection } from 'gdc-sdk-core-ts';
+/** Input required to add one human-authorizer proof to the out-of-band VC. */
+export type SignOrganizationRegistrationAuthorizationInput = Readonly<{
+    credential: VerifiableCredentialV2;
+    wallet: IWallet;
+    context: WalletExecutionContext;
+    key: WalletKeySelection;
+    verificationMethod: string;
+    createdAt?: string;
+}>;
+/**
+ * Adds one detached JWS proof made by the already-unlocked professional
+ * profile. The browser never receives the private key or clear wallet seed.
+ */
+export declare function signOrganizationRegistrationAuthorizationCredential(input: SignOrganizationRegistrationAuthorizationInput): Promise<VerifiableCredentialV2>;

package/dist/organization-registration-authorization.js

@@ -0,0 +1,34 @@
+import { canonicalizeOrganizationRegistrationAuthorizationCredential, } from 'gdc-common-utils-ts/utils/organization-registration-authorization';
+/**
+ * Adds one detached JWS proof made by the already-unlocked professional
+ * profile. The browser never receives the private key or clear wallet seed.
+ */
+export async function signOrganizationRegistrationAuthorizationCredential(input) {
+    if (!input.wallet.signDetachedJws) {
+        throw new Error('Wallet does not support detached organization authorization proofs.');
+    }
+    const verificationMethod = String(input.verificationMethod || '').trim();
+    if (!verificationMethod)
+        throw new Error('Organization authorization proof requires verificationMethod.');
+    const payload = canonicalizeOrganizationRegistrationAuthorizationCredential(input.credential);
+    const jws = await input.wallet.signDetachedJws(input.context, {
+        payload,
+        header: { typ: 'application/vc+ld+json' },
+        key: input.key,
+    });
+    const existingProofs = Array.isArray(input.credential.proof)
+        ? input.credential.proof
+        : input.credential.proof
+            ? [input.credential.proof]
+            : [];
+    return {
+        ...input.credential,
+        proof: [...existingProofs, {
+                type: 'JsonWebSignature2020',
+                created: input.createdAt || new Date().toISOString(),
+                proofPurpose: 'contractAgreement',
+                verificationMethod,
+                jws,
+            }],
+    };
+}

package/dist/resource-operations.js

@@ -340,11 +340,11 @@ export async function transitionIndividualMemberLicenseWithDeps(routeCtx, action
                         ...(input.ownerOrganizationId ? { ownerOrganizationId: input.ownerOrganizationId } : {}),
                         ...(input.subjectId ? { subjectId: input.subjectId } : {}),
                         ...(input.verifiedActorIdentifier ? { verifiedActorIdentifier: input.verifiedActorIdentifier } : {}),
-                        claims: {
-                            '@context': 'org.schema',
-                            'org.schema.IndividualProduct.serialNumber': input.activationCode,
-                        },
                     },
+                    resource: { meta: { claims: {
+                                '@context': 'org.schema',
+                                'org.schema.IndividualProduct.serialNumber': input.activationCode,
+                            } } },
                     request: { method: 'POST' },
                 }],
         },
@@ -414,7 +414,6 @@ export async function disableIndividualMemberWithDeps(routeCtx, input, options,
             type: 'batch',
             entry: [{
                     request: { method: GwCoreLifecycleRequestMethod.Post },
-                    meta: { claims },
                     resource: {
                         ...resource,
                         ...(input.resourceId ? { id: input.resourceId } : {}),
@@ -444,7 +443,6 @@ export async function purgeIndividualMemberWithDeps(routeCtx, input, options, de
             entry: [{
                     type: input.dataType || GwCoreLifecycleRequestType.IndividualMemberPurge,
                     request: { method: GwCoreLifecycleRequestMethod.Post },
-                    meta: { claims },
                     resource: {
                         ...resource,
                         ...(input.resourceId ? { id: input.resourceId } : {}),
@@ -550,7 +548,6 @@ export async function requestProfessionalAccessWithDeps(routeCtx, input, deps) {
             type: 'batch',
             data: [{
                     type: 'CommMsgExtended',
-                    meta: { claims: communicationClaims },
                     resource: communicationResource,
                 }],
         },
@@ -701,7 +698,6 @@ export function buildBlockchainArtifactBundleFromSearchResponse(input) {
         });
         return {
             type: 'DocumentReference',
-            meta: { claims: artifact.documentReference.meta?.claims || {} },
             resource: artifact.documentReference,
             request: {
                 method: 'POST',
@@ -762,7 +758,6 @@ export async function registerBlockchainArtifactAndUpdateIndexWithDeps(routeCtx,
             type: 'batch',
             data: [{
                     type: 'DocumentReference',
-                    meta: { claims: artifact.documentReference.meta?.claims || {} },
                     resource: artifact.documentReference,
                     request: {
                         method: 'POST',
@@ -840,7 +835,6 @@ export async function grantProfessionalAccessWithDeps(routeCtx, input, deps) {
         body: {
             data: [{
                     type: input.dataType || 'Consent-grant-request-v1.0',
-                    meta: { claims: built.consentClaims },
                     resource: { resourceType: 'Consent', meta: { claims: built.consentClaims } },
                 }],
         },
@@ -983,7 +977,6 @@ export async function revokeProfessionalAccessWithDeps(routeCtx, input, deps) {
         body: {
             data: [{
                     type: input.dataType || 'Consent-grant-request-v1.0',
-                    meta: { claims: revokedClaims },
                     resource: { resourceType: 'Consent', meta: { claims: revokedClaims } },
                 }],
         },

package/dist/runtime-host-submission.js

@@ -65,13 +65,6 @@ export async function activateOrganizationInGatewayFromIcaProofWithDeps(input) {
             ...(input.activationInput.controller ? { controller: input.activationInput.controller } : {}),
             data: [{
                     type: 'Organization-activation-request-v1.0',
-                    meta: {
-                        claims: {
-                            '@context': 'org.schema',
-                            ...serviceClaims,
-                            ...(input.activationInput.additionalClaims || {}),
-                        },
-                    },
                     resource: {
                         meta: {
                             claims: {

package/dist/runtime-paths.js

@@ -1,6 +1,7 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
 import { buildGwCoreTenantResourceActionPath } from 'gdc-common-utils-ts/utils/gw-core-path';
-import { IdentityAuthActions, IdentityAuthRouteSegments } from 'gdc-common-utils-ts/constants/identity-auth';
+import { IdentityAuthActions, IdentityAuthResourceTypes, IdentityAuthRouteSegments, SmartPostDcrActions, } from 'gdc-common-utils-ts/constants/identity-auth';
+import { GatewayRouteFormats, GatewayRouteSections, } from 'gdc-common-utils-ts/constants/gateway-response';
 export function buildV1Path(routeCtx, section, format, resourceType, action) {
     return buildGwCoreTenantResourceActionPath({
         tenantId: routeCtx.tenantId,
@@ -60,8 +61,8 @@ function buildIdentityAuthPath(ctx, action) {
     return `/${encodeURIComponent(IdentityAuthRouteSegments.Host)}/cds-${encodeURIComponent(ctx.jurisdiction)}/${IdentityAuthRouteSegments.Version}/${encodeURIComponent(ctx.sector)}/${encodeURIComponent(ctx.tenantId)}/${IdentityAuthRouteSegments.Section}/${IdentityAuthRouteSegments.Format}/${encodeURIComponent(action)}`;
 }
 export function buildIdentityOpenIdSmartTokenPath(ctx) {
-    return `/${encodeURIComponent(ctx.tenantId)}/cds-${encodeURIComponent(ctx.jurisdiction)}/v1/${encodeURIComponent(ctx.sector)}/identity/openid/smart/token`;
+    return buildV1Path(ctx, GatewayRouteSections.Identity, GatewayRouteFormats.OpenId, IdentityAuthResourceTypes.Smart, SmartPostDcrActions.Token);
 }
 export function buildIdentityOpenIdSmartTokenPollPath(ctx) {
-    return `/${encodeURIComponent(ctx.tenantId)}/cds-${encodeURIComponent(ctx.jurisdiction)}/v1/${encodeURIComponent(ctx.sector)}/identity/openid/smart/_batch-response`;
+    return buildV1Path(ctx, GatewayRouteSections.Identity, GatewayRouteFormats.OpenId, IdentityAuthResourceTypes.Smart, SmartPostDcrActions.TokenResponse);
 }

package/dist/server-profile-session.d.ts

@@ -1,7 +1,7 @@
 import type { JWK } from 'gdc-common-utils-ts/models/jwk';
 import type { ActorKind } from 'gdc-common-utils-ts/models/actor-session';
 import type { LegalOrganizationVerificationTransactionInput } from 'gdc-common-utils-ts/utils/legal-organization-verification-transaction';
-import { type AppInfo, type ConfidentialStorageProfile, type PollOptions, type SubmitAndPollResult } from 'gdc-sdk-core-ts';
+import { type AppInfo, type ConfidentialStorageProfile, type PollOptions, type SubmitAndPollResult, type ClinicalCreatorBinding, type ClinicalCreatorIpsExport } from 'gdc-sdk-core-ts';
 import { OrganizationControllerSdk } from './orchestration/organization-controller-sdk.js';
 import { ProfessionalSdk } from './orchestration/professional-sdk.js';
 import { DigitalTwinSdk } from './orchestration/digital-twin-sdk.js';
@@ -29,6 +29,8 @@ export type ServerProfileRecord = Readonly<{
     clientId: string;
     /** Stable non-secret id of the browser/app installation registered by DCR. */
     clientInstanceId?: string;
+    /** Stable FHIR creator/permission identity; channel and device values are aliases only. */
+    clinicalCreatorBinding?: ClinicalCreatorBinding;
     deviceDid: string;
     publicJwks: Record<string, unknown>[];
     /** Public recipient key for local confidential storage; not a DCR communication key. */
@@ -122,6 +124,12 @@ export type ServerProfileEnrollmentInput = Readonly<{
      * derives the identity from the wallet key it creates for this profile.
      */
     clientInstanceId?: string;
+    /**
+     * Server-authorized stable creator identity imported from FHIR or generated
+     * locally. Enrollment adds the operational actor DID and registered DCR
+     * client/key aliases; it never derives UUIDs from those aliases.
+     */
+    clinicalCreatorBinding?: ClinicalCreatorBinding;
     /**
      * Signed actor/controller VP protected for later SMART operations. Required
      * for organization/professional/member actors. Individual-controller
@@ -379,6 +387,7 @@ export declare class ServerProfileSessionManager {
     openProfessional(input: ServerProfessionalOpenInput): Promise<OpenedServerProfessional>;
     lock(ownerId: string, sessionId: string): Promise<void>;
     private createClient;
+    private createRegisteredProfileClient;
     private createWallet;
     /**
      * Upgrade legacy profiles deterministically after successful PIN unlock.
@@ -391,3 +400,8 @@ export declare class ServerProfileSessionManager {
     private requireSubject;
     private now;
 }
+/**
+ * Exports the stable FHIR IPS creator attached to a server profile. Direct
+ * writes continue to use `profile.actorDid`; this function is export-only.
+ */
+export declare function exportServerProfileClinicalCreatorIps(profile: ServerProfileRecord): ClinicalCreatorIpsExport;

package/dist/server-profile-session.js

@@ -3,7 +3,7 @@ import { randomBytes } from 'node:crypto';
 import { ActorKinds } from 'gdc-common-utils-ts/constants/actor-session';
 import { readLegalOrganizationVerificationCredentialPairFromResponseBody, readServiceControllerCredentialFromResponseBody, } from 'gdc-common-utils-ts/utils/legal-organization-verification-result';
 import { addLegalRepresentativeCredential, addOrganizationCredential, addServiceControllerCredential, createVP, } from 'gdc-common-utils-ts/utils/vp-token';
-import { TransportProfiles, } from 'gdc-sdk-core-ts';
+import { TransportProfiles, resolveClinicalCreatorIpsExport, } from 'gdc-sdk-core-ts';
 import { NodeManagedWallet } from './node-managed-wallet.js';
 import { NodeHttpClient } from './node-runtime-client.js';
 import { OrganizationControllerSdk } from './orchestration/organization-controller-sdk.js';
@@ -58,7 +58,7 @@ export class ServerProfileSessionManager {
         });
         const redirectUris = input.redirectUris || input.dcrRedirectUris || [];
         const clientName = String(input.clientName || input.dcrClientName || '').trim();
-        const activationRequest = createProfileDeviceActivationRequest({
+        const activationDraft = createProfileDeviceActivationRequest({
             activationCode: input.activationCode,
             idToken,
             ...input.routeContext,
@@ -69,8 +69,11 @@ export class ServerProfileSessionManager {
             .setRedirectUris(redirectUris)
             .setPublicJwks(publicKeys.filter((entry) => entry.purpose !== 'document-at-rest').map((entry) => entry.publicJwk))
             .setActorDid(input.actorDid)
-            .setProfileDid(input.profileDid)
-            .build();
+            .setProfileDid(input.profileDid);
+        if (input.clinicalCreatorBinding) {
+            activationDraft.setClinicalCreatorBinding(input.clinicalCreatorBinding);
+        }
+        const activationRequest = activationDraft.build();
         const activation = await client.activateProfileDeviceWithActivationRequest(activationRequest);
         const dcrBody = terminalBody(activation.dcr.poll.body);
         const clientId = findText(dcrBody, ['client_id', 'clientId']);
@@ -86,6 +89,16 @@ export class ServerProfileSessionManager {
                 ...input.professionalProof,
             })
             : undefined);
+        const clinicalCreatorBinding = input.clinicalCreatorBinding
+            ? bindClinicalCreatorChannels(input.clinicalCreatorBinding, {
+                actorDid: input.actorDid,
+                clientId,
+                clientInstanceId,
+                keyIds: publicKeys
+                    .map((entry) => String(entry.publicJwk?.kid || entry.kid || '').trim())
+                    .filter(Boolean),
+            })
+            : undefined;
         const record = {
             profileId: input.profileId,
             walletKeyDerivationId,
@@ -99,6 +112,7 @@ export class ServerProfileSessionManager {
             allowedSubjectDids: unique(input.allowedSubjectDids),
             clientId,
             clientInstanceId,
+            ...(clinicalCreatorBinding ? { clinicalCreatorBinding } : {}),
             deviceDid,
             publicJwks: publicKeys.filter((entry) => entry.purpose !== 'document-at-rest').map((entry) => entry.publicJwk),
             storagePublicJwk: storagePublicJwk,
@@ -157,6 +171,14 @@ export class ServerProfileSessionManager {
                 role: replacement.employeeRole,
                 sameAs: replacement.employeeActorIdentifier,
             },
+            ...(previous.clinicalCreatorBinding ? {
+                clinicalCreatorBinding: {
+                    ...previous.clinicalCreatorBinding,
+                    actorDids: [previous.actorDid],
+                    dcrClientIds: [],
+                    keyIds: [],
+                },
+            } : {}),
         });
         await this.options.store.deleteSessionsForProfile(profile.profileId);
         return profile;
@@ -328,12 +350,13 @@ export class ServerProfileSessionManager {
         profile = await this.ensureRequiredStorageProfile(profile, seed);
         const walletKeyDerivationId = profile.walletKeyDerivationId || profile.profileId;
         const wallet = await this.createWallet(walletKeyDerivationId, seed);
+        const context = walletContext(walletKeyDerivationId);
         const smartTokenEndpoint = [
             this.options.gatewayBaseUrl.replace(/\/+$/, ''),
             buildIdentityOpenIdSmartTokenPath(profile.routeContext),
         ].join('');
         const assertion = await buildWalletClientAssertion(wallet, profile, smartTokenEndpoint, now);
-        const token = await this.createClient(profile.routeContext, input.idToken).requestSmartToken({
+        const token = await this.createRegisteredProfileClient(profile, wallet, context, input.idToken).requestSmartToken({
             ...profile.routeContext,
             actorDid: profile.actorDid,
             subjectDid: input.subjectDid,
@@ -394,13 +417,14 @@ export class ServerProfileSessionManager {
             : undefined;
         const walletKeyDerivationId = profile.walletKeyDerivationId || profile.profileId;
         const wallet = await this.createWallet(walletKeyDerivationId, seed);
+        const context = walletContext(walletKeyDerivationId);
         const now = this.now();
         const smartTokenEndpoint = [
             this.options.gatewayBaseUrl.replace(/\/+$/, ''),
             buildIdentityOpenIdSmartTokenPath(profile.routeContext),
         ].join('');
         const assertion = await buildWalletClientAssertion(wallet, profile, smartTokenEndpoint, now);
-        const token = await this.createClient(profile.routeContext, normalizedIdToken).requestSmartToken({
+        const token = await this.createRegisteredProfileClient(profile, wallet, context, normalizedIdToken).requestSmartToken({
             ...profile.routeContext,
             actorDid: profile.actorDid,
             subjectDid: session.subjectDid,
@@ -546,13 +570,11 @@ export class ServerProfileSessionManager {
             transportProfile: TransportProfiles.DidcommEncryptedForm,
             secureTransportAdapter,
         });
-        // SMART/OpenID uses its own JSON/form protocol and must not be wrapped in
-        // the encrypted resource transport selected for later business actions.
-        // Professional business operations are authored by the registered employee
-        // wallet and therefore use the encrypted DIDComm client. SMART/OpenID below
-        // remains an independent JSON/form exchange through its dedicated method.
+        // Both SMART and later business operations are post-DCR profile actions.
+        // Strict GW therefore resolves the same registered employee wallet for the
+        // encrypted request and poll transport used by both facades.
         const sdk = new ProfessionalSdk(operationalClient);
-        const smartSdk = new ProfessionalSdk(this.createClient(profile.routeContext, idToken));
+        const smartSdk = sdk;
         const digitalTwin = new DigitalTwinSdk(operationalClient, profile.actorDid);
         let digitalTwinAccessToken;
         const request = async (smart) => {
@@ -625,6 +647,20 @@ export class ServerProfileSessionManager {
             appInfo: this.options.appInfo,
         });
     }
+    createRegisteredProfileClient(profile, wallet, context, bearerToken) {
+        return new NodeHttpClient({
+            baseUrl: this.options.gatewayBaseUrl,
+            ctx: profile.routeContext,
+            bearerToken,
+            fetchImpl: this.options.fetchImpl,
+            appInfo: this.options.appInfo,
+            transportProfile: TransportProfiles.DidcommEncryptedForm,
+            secureTransportAdapter: {
+                pack: (message) => wallet.packForRecipientWithContext(bindOrganizationControllerTransport(message, profile), profile.providerDid, { context }),
+                unpack: async (jwe) => (await wallet.unpackWithContext(jwe, { context })).content,
+            },
+        });
+    }
     async createWallet(walletKeyDerivationId, seed) {
         const wallet = new NodeManagedWallet({ resolveRecipientJwk: this.options.resolveRecipientJwk });
         const context = walletContext(walletKeyDerivationId);
@@ -755,6 +791,33 @@ function requireBase64UrlSeed32(seed) {
         throw new Error('Profile enrollment walletSeed must be a 32-byte base64url value.');
     }
 }
+/**
+ * Exports the stable FHIR IPS creator attached to a server profile. Direct
+ * writes continue to use `profile.actorDid`; this function is export-only.
+ */
+export function exportServerProfileClinicalCreatorIps(profile) {
+    if (!profile.clinicalCreatorBinding) {
+        throw new Error('Server profile has no clinical creator binding.');
+    }
+    return resolveClinicalCreatorIpsExport({
+        bindings: [profile.clinicalCreatorBinding],
+        evidence: { actorDid: profile.actorDid },
+    });
+}
+function bindClinicalCreatorChannels(binding, channel) {
+    const stored = {
+        ...binding,
+        actorDids: unique([...(binding.actorDids || []), channel.actorDid]),
+        dcrClientIds: unique([
+            ...(binding.dcrClientIds || []),
+            channel.clientId,
+            channel.clientInstanceId,
+        ]),
+        keyIds: unique([...(binding.keyIds || []), ...channel.keyIds]),
+    };
+    resolveClinicalCreatorIpsExport({ bindings: [stored], evidence: { actorDid: channel.actorDid } });
+    return stored;
+}
 function requireEnrollment(input) {
     for (const [name, value] of Object.entries({
         ownerId: input.ownerId,
@@ -775,6 +838,10 @@ function requireEnrollment(input) {
     if (input.professionalProof && !String(input.professionalProof.role || '').trim()) {
         throw new Error('Profile enrollment professionalProof requires role.');
     }
+    if (input.professionalProof && input.clinicalCreatorBinding
+        && String(input.professionalProof.role).trim() !== String(input.clinicalCreatorBinding.role).trim()) {
+        throw new Error('Clinical creator binding role must equal professionalProof.role.');
+    }
     if (!input.allowedSubjectDids.length)
         throw new Error('Profile enrollment requires an allowed subject.');
 }

package/dist/smart-token.js

@@ -1,5 +1,7 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
 import { HealthcareConsentPurposes } from 'gdc-common-utils-ts/constants';
+import { IdentityAuthResourceTypes, SmartPostDcrActions, } from 'gdc-common-utils-ts/constants/identity-auth';
+import { GatewayRouteFormats, GatewayRouteSections, } from 'gdc-common-utils-ts/constants/gateway-response';
 import { buildClientAssertionJwt } from 'gdc-common-utils-ts/utils/client-assertion';
 import { resolvePollOptionsFromSeconds } from './poll-options.js';
 /**
@@ -109,16 +111,19 @@ function normalizeResolvedSmartTokenEndpoint(value) {
     if (!['http:', 'https:'].includes(endpoint.protocol)) {
         throw new Error('Resolved SMART token endpoint must use HTTP(S).');
     }
-    if (!endpoint.pathname.endsWith('/identity/openid/smart/token')) {
-        throw new Error('Resolved SMART token endpoint must target /identity/openid/smart/token.');
+    if (!endpoint.pathname.endsWith(smartTokenRouteSuffix(SmartPostDcrActions.Token))) {
+        throw new Error(`Resolved SMART token endpoint must target ${smartTokenRouteSuffix(SmartPostDcrActions.Token)}.`);
     }
     return endpoint.toString();
 }
 function smartTokenPollEndpointFromTokenEndpoint(tokenEndpoint) {
     const endpoint = new URL(tokenEndpoint);
-    endpoint.pathname = endpoint.pathname.replace(/\/identity\/openid\/smart\/token$/, '/identity/openid/smart/_batch-response');
+    endpoint.pathname = `${endpoint.pathname.slice(0, -smartTokenRouteSuffix(SmartPostDcrActions.Token).length)}${smartTokenRouteSuffix(SmartPostDcrActions.TokenResponse)}`;
     return endpoint.toString();
 }
+function smartTokenRouteSuffix(action) {
+    return `/${GatewayRouteSections.Identity}/${GatewayRouteFormats.OpenId}/${IdentityAuthResourceTypes.Smart}/${action}`;
+}
 async function resolveClientAssertion(input) {
     const explicit = String(input.clientAssertion || '').trim();
     if (explicit)
@@ -132,13 +137,17 @@ async function resolveClientAssertion(input) {
     });
 }
 function resolveTokenExchangeResult(exchange, normalizedScopes, tokenCacheKey, setTokenCache) {
-    const exchangeBody = exchange.poll.body ?? {};
+    const pollResult = exchange.poll;
+    const pollPayload = pollResult.body ?? {};
+    // Encrypted DIDComm returns the token in the authenticated message body;
+    // plain compatibility transports may still expose the token at the root.
+    const exchangeBody = pollPayload.body || pollPayload;
     const accessToken = String(exchangeBody.access_token || '').trim();
-    if (exchange.poll.status >= 400 || !accessToken) {
+    if (pollResult.status >= 400 || !accessToken) {
         return {
             status: 'failed',
-            statusCode: exchange.poll.status,
-            response: exchange.poll.body,
+            statusCode: pollResult.status,
+            response: exchangeBody,
         };
     }
     const tokenType = String(exchangeBody.token_type || 'Bearer');
@@ -156,8 +165,8 @@ function resolveTokenExchangeResult(exchange, normalizedScopes, tokenCacheKey, s
         accessToken,
         tokenType,
         scopes: resolvedScopes,
-        statusCode: exchange.poll.status,
-        response: exchange.poll.body,
+        statusCode: pollResult.status,
+        response: exchangeBody,
     };
 }
 function createRuntimeUuid() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-sdk-node-ts",
-  "version": "2.6.6",
+  "version": "2.7.0",
   "description": "Next-generation Node runtime package for the GDC SDK family",
   "license": "Apache-2.0",
   "author": "Antifraud Services Inc.",
@@ -38,8 +38,8 @@
     "test:e2e:live-gw:clean": "bash ./scripts/run-live-gw-clean.sh"
   },
   "dependencies": {
-    "gdc-common-utils-ts": "2.7.4",
-    "gdc-sdk-core-ts": "2.4.6"
+    "gdc-common-utils-ts": "2.8.1",
+    "gdc-sdk-core-ts": "2.5.1"
   },
   "devDependencies": {
     "@types/node": "^20.14.10",