gdc-sdk-node-ts 2.9.11 → 2.9.14

package/README.md

@@ -533,7 +533,7 @@ const individualControllerDid = buildIndividualMemberDidWebFromPrivateIdentifier
   roleValue: 'RESPRSN',
 });
 
-// did:web:host.example.org:health-care:organization:taxid:VATES-B00112233:individual:UUID:zG9H82pae9SCXvec3D4YKqhX8bj8F1mRgzxMEdwXXonT7BWsvsUiP2u52sWQTeESpoMee:member:zG9DrMLpQW8eoCc9Ay9AFxuMGiswgJePpbUMz9svJCZ8tKjUd4xoExgCPA5jmHc6hPATJ:RESPRSN
+// did:web:host.example.org:health-care:organization:taxid:VATES-B00112233:individual:multibase:zG9H82pae9SCXvec3D4YKqhX8bj8F1mRgzxMEdwXXonT7BWsvsUiP2u52sWQTeESpoMee:member:zG9DrMLpQW8eoCc9Ay9AFxuMGiswgJePpbUMz9svJCZ8tKjUd4xoExgCPA5jmHc6hPATJ:RESPRSN
 ```
 
 ### Use shared invitation contract from Node

package/dist/family-organization-search.d.ts

@@ -8,6 +8,20 @@ export type FamilyOrganizationSearchInput = Readonly<{
     timeoutSeconds?: number;
     intervalSeconds?: number;
 }>;
+export type OwnedFamilyOrganizationDirectoryInput = Readonly<{
+    verifiedContact: Readonly<{
+        email?: string;
+        telephone?: string;
+    }>;
+    requestThid?: string;
+    timeoutSeconds?: number;
+    intervalSeconds?: number;
+}>;
+export type OwnedFamilyOrganizationDirectoryEntry = Readonly<{
+    resourceId: string;
+    alternateName: string;
+    claims: Readonly<Record<string, unknown>>;
+}>;
 type SearchFamilyOrganizationWithDeps = {
     routeCtx: RouteContext;
     input: FamilyOrganizationSearchInput;
@@ -27,4 +41,12 @@ type SearchFamilyOrganizationWithDeps = {
  * `null`.
  */
 export declare function searchFamilyOrganizationWithDeps(deps: SearchFamilyOrganizationWithDeps): Promise<FamilyOrganizationSummary | null>;
+/**
+ * Lists the complete owner-scoped individual Organization directory.
+ *
+ * CORE requires an exact verified owner contact and deliberately performs no
+ * global or prefix scan. Callers may filter the returned alternate names only
+ * after this authenticated directory boundary.
+ */
+export declare function listOwnedFamilyOrganizationsWithDeps(routeCtx: RouteContext, input: OwnedFamilyOrganizationDirectoryInput, deps: Pick<SearchFamilyOrganizationWithDeps, 'individualFamilyOrganizationSearchPath' | 'individualFamilyOrganizationSearchPollPath' | 'submitAndPoll' | 'defaultTimeoutMs' | 'defaultIntervalMs'>): Promise<OwnedFamilyOrganizationDirectoryEntry[]>;
 export {};

package/dist/family-organization-search.js

@@ -49,6 +49,62 @@ export async function searchFamilyOrganizationWithDeps(deps) {
     }
     return readFamilyOrganizationSummaryFromResponseBody(result.poll.body);
 }
+/**
+ * Lists the complete owner-scoped individual Organization directory.
+ *
+ * CORE requires an exact verified owner contact and deliberately performs no
+ * global or prefix scan. Callers may filter the returned alternate names only
+ * after this authenticated directory boundary.
+ */
+export async function listOwnedFamilyOrganizationsWithDeps(routeCtx, input, deps) {
+    const email = String(input.verifiedContact?.email || '').trim().toLowerCase();
+    const telephone = String(input.verifiedContact?.telephone || '').trim();
+    if (!email && !telephone) {
+        throw new Error('A verified owner email or telephone is required.');
+    }
+    const claims = {
+        '@context': 'org.schema',
+        ...(email ? { [ClaimsOrganizationSchemaorg.ownerEmail]: email } : {}),
+        ...(telephone ? { [ClaimsOrganizationSchemaorg.ownerTelephone]: telephone } : {}),
+    };
+    const pollOptions = resolvePollOptionsFromSeconds(input.timeoutSeconds, input.intervalSeconds, {
+        timeoutMs: deps.defaultTimeoutMs,
+        intervalMs: deps.defaultIntervalMs,
+    });
+    const result = await deps.submitAndPoll(deps.individualFamilyOrganizationSearchPath(routeCtx), deps.individualFamilyOrganizationSearchPollPath(routeCtx), {
+        jti: `jti-${createRuntimeUuid()}`,
+        thid: input.requestThid || `owned-family-directory-${createRuntimeUuid()}`,
+        iss: routeCtx.tenantId,
+        aud: routeCtx.tenantId,
+        type: 'application/api+json',
+        body: {
+            data: [{
+                    type: 'Family-search-v1.0',
+                    resource: { meta: { claims } },
+                }],
+        },
+    }, pollOptions);
+    if (result.poll.status !== 200)
+        return [];
+    const root = result.poll.body?.body || result.poll.body;
+    const responseEntries = Array.isArray(root?.data) ? root.data : [];
+    const resources = responseEntries.flatMap((entry) => Array.isArray(entry?.resource?.entry)
+        ? entry.resource.entry.map((item) => item?.resource).filter(Boolean)
+        : []);
+    return resources.flatMap((resource) => {
+        const resourceClaims = resource?.meta?.claims;
+        if (!resource?.id || !resourceClaims || typeof resourceClaims !== 'object')
+            return [];
+        const ownerEmail = String(resourceClaims[ClaimsOrganizationSchemaorg.ownerEmail] || '').trim().toLowerCase();
+        const ownerTelephone = String(resourceClaims[ClaimsOrganizationSchemaorg.ownerTelephone] || '').trim();
+        if (!((email && ownerEmail === email) || (telephone && ownerTelephone === telephone)))
+            return [];
+        const alternateName = String(resourceClaims[ClaimsOrganizationSchemaorg.alternateName] || '').trim();
+        if (!alternateName)
+            return [];
+        return [{ resourceId: String(resource.id), alternateName, claims: resourceClaims }];
+    });
+}
 function createRuntimeUuid() {
     const fromCrypto = globalThis.crypto?.randomUUID?.();
     if (fromCrypto) {

package/dist/individual-onboarding.d.ts

@@ -29,8 +29,9 @@ export type IndividualOrganizationOrderResult = SubmitAndPollResult & Readonly<{
     activationCode: string;
     /**
      * Governed `RelatedPerson.identifier` automatically materialized by GW for
-     * the principal Organization owner/controller. Current GW values use the
-     * `urn:uuid:<UUID>` form.
+     * the principal Organization owner/controller. GW reuses the bare UUID from
+     * `Organization.owner.identifier.value`; document helpers expose it as an
+     * `urn:uuid:<UUID>` FHIR reference only when a reference is required.
      */
     controllerRelatedPersonIdentifier: string;
     /**

package/dist/individual-start.d.ts

@@ -1,10 +1,19 @@
 import { SecureIdTypesIndividual } from 'gdc-common-utils-ts';
 export { buildIndividualMemberDidWebFromPrivateIdentifiers } from 'gdc-common-utils-ts';
 import type { FamilyRegistrationStatus } from 'gdc-common-utils-ts/utils/family-organization-summary';
+import type { IndividualOnboardingDraftResult } from 'gdc-common-utils-ts/models/individual-onboarding';
 import type { PollOptions, SubmitAndPollResult } from './orchestration/client-port.js';
 import type { RouteContext } from './individual-onboarding.js';
 import type { OfferPreview } from './order-offer-summary.js';
 export type IndividualOrganizationRegistrationInput = {
+    /**
+     * Preferred high-level input produced by `createIndividualOnboardingEditor()`.
+     *
+     * The SDK converts this draft into the GW Bundle and signed-PDF attachment.
+     * Registration remains separate from Order confirmation, enrollment and
+     * opening a profile.
+     */
+    onboardingDraft?: IndividualOnboardingDraftResult;
     /**
      * Preferred route identifier for the selected personal indexing service provider.
      *
@@ -25,7 +34,7 @@ export type IndividualOrganizationRegistrationInput = {
      * This is not the technical subject identifier. It is the nearby name the
      * controller uses to refer to the person in the UI, for example `Charly`.
      */
-    alternateName: string;
+    alternateName?: string;
     /**
      * CORE-canonical controller contact channel for individual bootstrap.
      *
@@ -53,6 +62,12 @@ export type IndividualOrganizationRegistrationInput = {
      * a product gateway extension.
      */
     controllerTelephone?: string;
+    /**
+     * Stable UUID of the principal controller/RESPRSN assignment. In a self
+     * registration this may be the same UUID already assigned to the person.
+     * Omit only for a brand-new assignment so the SDK creates it once.
+     */
+    controllerIdentifier?: string;
     controllerRole?: string;
     additionalClaims?: Record<string, unknown>;
     timeoutSeconds?: number;
@@ -91,6 +106,12 @@ export type IndividualOrganizationBootstrapIdentity = {
     providerDidWeb: string;
     /** Canonical child DID built beneath the exact provider DID returned by GW. */
     subjectDid: string;
+    /**
+     * Canonical principal-controller member DID accepted by individual DCR.
+     * Optional only for compatibility with older registration receipts that did
+     * not expose the controller contact needed to derive it.
+     */
+    controllerActorDid?: string;
 };
 type RegisterIndividualOrganizationDeps = {
     input: IndividualOrganizationRegistrationInput;
@@ -122,4 +143,7 @@ export declare function startIndividualOrganizationWithDeps(deps: RegisterIndivi
  * `:organization:taxid:` DID path. `buildIndividualDidWeb(...)` only adds the
  * individual suffix and never rewrites that provider lineage.
  */
-export declare function readIndividualOrganizationBootstrapIdentity(responseBody: unknown): IndividualOrganizationBootstrapIdentity | undefined;
+export declare function readIndividualOrganizationBootstrapIdentity(responseBody: unknown, controller?: Readonly<{
+    controllerEmail?: string;
+    controllerTelephone?: string;
+}>): IndividualOrganizationBootstrapIdentity | undefined;

package/dist/individual-start.js

@@ -1,7 +1,10 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+import { randomUUID } from 'node:crypto';
 import { ClaimsOfferSchemaorg, ClaimsOrganizationSchemaorg, ClaimsPersonSchemaorg, ClaimsServiceSchemaorg, } from 'gdc-common-utils-ts/constants';
-import { buildIndividualDidWeb, buildSecureIdValueIndividual, extractPrimaryClaims, readFamilyOrganizationSummaryFromResponseBody, SecureIdTypesIndividual, } from 'gdc-common-utils-ts';
+import { HealthcareActorRoleCodes, HL7_CODING_SYSTEM_V3_ROLE_CODE, buildIndividualMemberDidWebFromPrivateIdentifiers, buildIndividualDidWeb, buildSecureIdValueIndividual, extractPrimaryClaims, normalizeUuid, readFamilyOrganizationSummaryFromResponseBody, SecureIdTypesIndividual, } from 'gdc-common-utils-ts';
 export { buildIndividualMemberDidWebFromPrivateIdentifiers } from 'gdc-common-utils-ts';
+import { DocumentReferenceClaim } from 'gdc-common-utils-ts/models/interoperable-claims/document-reference-claims';
+import { buildIndividualOrganizationRegistrationGatewayRequestFromDraft } from 'gdc-sdk-core-ts';
 import { GwCoreLifecycleRequestType } from './constants/lifecycle.js';
 import { resolvePollOptionsFromSeconds } from './poll-options.js';
 /**
@@ -22,20 +25,40 @@ export async function registerIndividualOrganizationWithDeps(deps) {
      * in the payload for compatibility, but the owner claims are the live GW
      * routing/indexing contract for this flow.
      */
+    const onboardingDraft = deps.input.onboardingDraft;
+    if (onboardingDraft && !hasSignedPdfEvidence(onboardingDraft)) {
+        const subjectAlternateName = String(onboardingDraft.formFields.subjectAlternateName
+            || onboardingDraft.claims?.[ClaimsOrganizationSchemaorg.alternateName]
+            || '').trim();
+        if (!subjectAlternateName) {
+            throw new Error('registerIndividualOrganization subjectAlternateName is required when signed PDF evidence is absent.');
+        }
+    }
     const alternateName = String(deps.input.alternateName || '').trim();
-    if (!alternateName) {
+    if (!onboardingDraft && !alternateName) {
         throw new Error('registerIndividualOrganization requires alternateName.');
     }
-    const controllerEmail = String(deps.input.controllerEmail || '').trim();
-    const controllerTelephone = String(deps.input.controllerTelephone || '').trim();
-    if (!controllerEmail && !controllerTelephone) {
+    const controllerEmail = String(deps.input.controllerEmail
+        || onboardingDraft?.formFields.controllerEmail
+        || onboardingDraft?.claims?.[ClaimsOrganizationSchemaorg.ownerEmail]
+        || '').trim();
+    const controllerTelephone = String(deps.input.controllerTelephone
+        || onboardingDraft?.formFields.controllerPhone
+        || onboardingDraft?.claims?.[ClaimsOrganizationSchemaorg.ownerTelephone]
+        || '').trim();
+    if (!onboardingDraft && !controllerEmail && !controllerTelephone) {
         throw new Error('registerIndividualOrganization requires controllerEmail, or controllerTelephone only for compatibility/extension flows.');
     }
     const controllerRole = String(deps.input.controllerRole || 'RESPRSN').trim();
+    const controllerIdentifier = canonicalControllerUuid(deps.input.controllerIdentifier
+        || deps.input.additionalClaims?.[ClaimsOrganizationSchemaorg.ownerIdentifierValue]
+        || onboardingDraft?.claims?.[ClaimsOrganizationSchemaorg.ownerIdentifierValue]
+        || randomUUID());
     const claims = {
         '@context': 'org.schema',
         ...(deps.input.additionalClaims || {}),
-        [ClaimsOrganizationSchemaorg.alternateName]: alternateName,
+        ...(alternateName ? { [ClaimsOrganizationSchemaorg.alternateName]: alternateName } : {}),
+        [ClaimsOrganizationSchemaorg.ownerIdentifierValue]: controllerIdentifier,
         [ClaimsServiceSchemaorg.category]: deps.routeCtx.sector,
         [ClaimsPersonSchemaorg.hasOccupationalRoleValue]: controllerRole,
         ...(controllerEmail
@@ -51,18 +74,24 @@ export async function registerIndividualOrganizationWithDeps(deps) {
             }
             : {}),
     };
+    const registrationBody = onboardingDraft
+        ? buildIndividualOrganizationRegistrationGatewayRequestFromDraft({
+            draft: onboardingDraft,
+            routingClaims: claims,
+        })
+        : {
+            data: [{
+                    type: GwCoreLifecycleRequestType.IndividualOrganizationRegistration,
+                    resource: { meta: { claims } },
+                }],
+        };
     const registrationPayload = {
         jti: `jti-${createRuntimeUuid()}`,
         iss: deps.routeCtx.tenantId,
         aud: deps.routeCtx.tenantId,
         type: 'application/didcomm-plain+json',
         thid: `family-org-${createRuntimeUuid()}`,
-        body: {
-            data: [{
-                    type: GwCoreLifecycleRequestType.IndividualOrganizationRegistration,
-                    resource: { meta: { claims } },
-                }],
-        },
+        body: registrationBody,
     };
     const pollOptions = resolvePollOptionsFromSeconds(deps.input.timeoutSeconds, deps.input.intervalSeconds, {
         timeoutMs: deps.defaultTimeoutMs,
@@ -90,9 +119,30 @@ export async function registerIndividualOrganizationWithDeps(deps) {
         offerPreview: deps.getOfferPreviewFromResponse(registration),
         registrationStatus: registrationSummary?.status,
         orderConfirmationRequired: registrationSummary?.status !== 'already_exists',
-        identity: readIndividualOrganizationBootstrapIdentity(registration.poll.body),
+        identity: readIndividualOrganizationBootstrapIdentity(registration.poll.body, {
+            controllerEmail,
+            controllerTelephone,
+        }),
     };
 }
+function canonicalControllerUuid(value) {
+    const hexadecimal = normalizeUuid(String(value || '').trim());
+    if (!hexadecimal) {
+        throw new TypeError('controllerIdentifier must be a UUID or urn:uuid identifier.');
+    }
+    return [
+        hexadecimal.slice(0, 8),
+        hexadecimal.slice(8, 12),
+        hexadecimal.slice(12, 16),
+        hexadecimal.slice(16, 20),
+        hexadecimal.slice(20),
+    ].join('-');
+}
+function hasSignedPdfEvidence(draft) {
+    const claims = draft.documentReference?.resource?.meta?.claims;
+    return Boolean(String(claims?.[DocumentReferenceClaim.ContentType] || '').trim()
+        && String(claims?.[DocumentReferenceClaim.ContentData] || '').trim());
+}
 /** @deprecated Use `registerIndividualOrganizationWithDeps`. */
 export async function startIndividualOrganizationWithDeps(deps) {
     return registerIndividualOrganizationWithDeps(deps);
@@ -105,7 +155,7 @@ export async function startIndividualOrganizationWithDeps(deps) {
  * `:organization:taxid:` DID path. `buildIndividualDidWeb(...)` only adds the
  * individual suffix and never rewrites that provider lineage.
  */
-export function readIndividualOrganizationBootstrapIdentity(responseBody) {
+export function readIndividualOrganizationBootstrapIdentity(responseBody, controller) {
     const root = asRecord(responseBody);
     const body = asRecord(root?.body) || root;
     const entries = Array.isArray(body?.data) ? body.data : [];
@@ -126,16 +176,33 @@ export function readIndividualOrganizationBootstrapIdentity(responseBody) {
     catch {
         return undefined;
     }
+    const subjectDid = buildIndividualDidWeb({
+        providerDidWeb,
+        secureIdTypeIndividual: SecureIdTypesIndividual.Uuid,
+        secureIdValueIndividual,
+    });
+    const controllerEmail = String(controller?.controllerEmail || claims[ClaimsOrganizationSchemaorg.ownerEmail] || '').trim();
+    const controllerTelephone = String(controller?.controllerTelephone || claims[ClaimsOrganizationSchemaorg.ownerTelephone] || '').trim();
+    const controllerActorDid = controllerEmail || controllerTelephone
+        ? buildIndividualMemberDidWebFromPrivateIdentifiers({
+            providerDidWeb,
+            secureIdTypeIndividual: SecureIdTypesIndividual.Uuid,
+            privateIdValueIndividual: resourceId,
+            secureIdTypeMember: controllerEmail
+                ? SecureIdTypesIndividual.Email
+                : SecureIdTypesIndividual.Phone,
+            privateIdValueMember: controllerEmail || controllerTelephone,
+            roleType: HL7_CODING_SYSTEM_V3_ROLE_CODE,
+            roleValue: HealthcareActorRoleCodes.Controller,
+        })
+        : undefined;
     return {
         resourceId,
         secureIdTypeIndividual: SecureIdTypesIndividual.Uuid,
         secureIdValueIndividual,
         providerDidWeb,
-        subjectDid: buildIndividualDidWeb({
-            providerDidWeb,
-            secureIdTypeIndividual: SecureIdTypesIndividual.Uuid,
-            secureIdValueIndividual,
-        }),
+        subjectDid,
+        ...(controllerActorDid ? { controllerActorDid } : {}),
     };
 }
 function asRecord(value) {

package/dist/node-runtime-client.d.ts

@@ -7,7 +7,7 @@ import type { HostedTenantDescendantKind } from './host-onboarding.js';
 import type { NodeLegalOrganizationVerificationTransactionInput, NodeOrganizationDidBindingInput, NodeOrganizationActivationInput } from './orchestration/client-port.js';
 import { type IndividualOrganizationConfirmOrderInput, type IndividualOrganizationOrderResult, type RouteContext } from './individual-onboarding.js';
 import { type EnsureFamilyOrganizationRegistrationInput } from './family-organization-registration.js';
-import { type FamilyOrganizationSearchInput } from './family-organization-search.js';
+import { type FamilyOrganizationSearchInput, type OwnedFamilyOrganizationDirectoryInput } from './family-organization-search.js';
 import { type SmartTokenRequestInput } from './smart-token.js';
 import { type EmployeeDeviceActivationRequestInput, type EmployeeDeviceActivationResult, type EmployeeDeviceOtpRecoveryInput, type EmployeeDeviceOtpRecoveryResult, type EmployeeDeviceRevocationInput } from './device-activation.js';
 import { type OrganizationLicenseOrderConfirmInput } from './organization-license-order.js';
@@ -386,6 +386,12 @@ export declare class HttpRuntimeClient implements NodeRuntimeClient {
         missingFields?: string[];
         updatedAt?: string;
     }> | null>;
+    /** Lists all individual Organizations owned by one verified account contact. */
+    listOwnedFamilyOrganizations(ctx: RouteContext, input: OwnedFamilyOrganizationDirectoryInput): Promise<Readonly<{
+        resourceId: string;
+        alternateName: string;
+        claims: Readonly<Record<string, unknown>>;
+    }>[]>;
     /**
      * Searches one existing family/individual registration and starts the
      * bootstrap flow only when the registration does not already exist.

package/dist/node-runtime-client.js

@@ -4,7 +4,7 @@ import { confirmLegalOrganizationOrderWithDeps, HostLifecycleRequestType, Hosted
 import { GwCoreLifecycleRequestType } from './constants/lifecycle.js';
 import { confirmIndividualOrganizationOrderWithDeps, } from './individual-onboarding.js';
 import { ensureFamilyOrganizationRegistrationWithDeps, } from './family-organization-registration.js';
-import { searchFamilyOrganizationWithDeps } from './family-organization-search.js';
+import { listOwnedFamilyOrganizationsWithDeps, searchFamilyOrganizationWithDeps, } from './family-organization-search.js';
 import { requestSmartTokenWithDeps } from './smart-token.js';
 import { activateEmployeeDeviceWithActivationCodeWithDeps, activateEmployeeDeviceWithActivationRequestWithDeps, recoverEmployeeDeviceWithOtpWithDeps, revokeEmployeeDeviceWithDeps, } from './device-activation.js';
 import { extractOfferIdFromResponseBody, extractOfferPreviewFromResponseBody, } from './order-offer-summary.js';
@@ -680,6 +680,16 @@ export class HttpRuntimeClient {
             submitAndPoll: this.submitAndPoll.bind(this),
         });
     }
+    /** Lists all individual Organizations owned by one verified account contact. */
+    async listOwnedFamilyOrganizations(ctx, input) {
+        return listOwnedFamilyOrganizationsWithDeps(ctx, input, {
+            defaultTimeoutMs: 20000,
+            defaultIntervalMs: 1000,
+            individualFamilyOrganizationSearchPath: this.paths.individualFamilyOrganizationSearchPath.bind(this.paths),
+            individualFamilyOrganizationSearchPollPath: this.paths.individualFamilyOrganizationSearchPollPath.bind(this.paths),
+            submitAndPoll: this.submitAndPoll.bind(this),
+        });
+    }
     /**
      * Searches one existing family/individual registration and starts the
      * bootstrap flow only when the registration does not already exist.

package/dist/orchestration/individual-controller-sdk.d.ts

@@ -9,6 +9,15 @@ import type { NodeCapability } from '../session.js';
 import type { IndividualOrganizationLifecycleInput } from 'gdc-sdk-core-ts';
 import type { BlockchainArtifactRegistrationInput, ClinicalBundleSearchInput, ClinicalSectionUpdateInput, SubjectSectionUpdateInput, ClinicalSummaryReadResult, ClinicalSummaryRequestInput, ClinicalSummaryUpdateInput, CommunicationIngestionInput, CommunicationParticipantRuntimeSearchInput, DigitalTwinGenerationInput, DigitalTwinSecondaryUseConsentInput, DigitalTwinSecondaryUseConsentResult, DigitalTwinSubjectLinkPurgeInput, DigitalTwinSubjectLinkPurgeResult, GrantProfessionalAccessInput, GrantProfessionalAccessResult, IndividualMemberLifecycleInput, IndividualMemberLicenseAddInput, IndividualMemberLicenseInvitationInput, IndividualMemberLicenseTransitionInput, IpsOrFhirImportInput, LicenseListRuntimeSearchInput, LicenseOfferRuntimeSearchInput, LicenseOrderRuntimeSearchInput, RevokeProfessionalAccessInput, RevokeProfessionalAccessResult, ProfessionalAccessRequestDecisionInput, ProfessionalAccessRequestSearchInput, RelatedPersonUpsertInput } from '../resource-operations.js';
 import type { SmartTokenExchangeResult, SmartTokenRequestInput } from '../smart-token.js';
+/** Profile-owned defaults applied to subject-section mutations after unlock. */
+export type IndividualControllerProfileDefaults = Readonly<{
+    attester: SubjectSectionUpdateInput['attester'];
+}>;
+/**
+ * High-level section input. An opened controller profile supplies its own
+ * protected RESPRSN attester; standalone facades must still provide one.
+ */
+export type IndividualControllerSubjectSectionUpdateInput = Omit<SubjectSectionUpdateInput, 'attester'> & Partial<Pick<SubjectSectionUpdateInput, 'attester'>>;
 /**
  * Individual-controller oriented facade over a `NodeRuntimeClient`.
  *
@@ -18,10 +27,11 @@ import type { SmartTokenExchangeResult, SmartTokenRequestInput } from '../smart-
 export declare class IndividualControllerSdk {
     private readonly client;
     private readonly capabilities?;
+    private readonly profileDefaults?;
     /**
      * @param client Runtime client implementation used to submit and poll GW flows.
      */
-    constructor(client: NodeRuntimeClient, capabilities?: readonly NodeCapability[] | undefined);
+    constructor(client: NodeRuntimeClient, capabilities?: readonly NodeCapability[] | undefined, profileDefaults?: IndividualControllerProfileDefaults | undefined);
     /**
      * Registers the personal organization/subject index and returns its Offer.
      * Wallet creation, activation exchange, DCR, and session opening are later
@@ -118,7 +128,7 @@ export declare class IndividualControllerSdk {
      * appointments or contracts, while preserving the indexed Composition
      * author/attester compatibility contract.
      */
-    updateSubjectSection(ctx: RouteContext, input: SubjectSectionUpdateInput): Promise<SubmitAndPollResult>;
+    updateSubjectSection(ctx: RouteContext, input: IndividualControllerSubjectSectionUpdateInput): Promise<SubmitAndPollResult>;
     /**
      * Updates the multi-section summary through a Composition-first document.
      * On a direct call, use the authenticated profile `actorDid` as `sender` and

package/dist/orchestration/individual-controller-sdk.js

@@ -18,9 +18,10 @@ export class IndividualControllerSdk {
     /**
      * @param client Runtime client implementation used to submit and poll GW flows.
      */
-    constructor(client, capabilities) {
+    constructor(client, capabilities, profileDefaults) {
         this.client = client;
         this.capabilities = capabilities;
+        this.profileDefaults = profileDefaults;
     }
     /**
      * Registers the personal organization/subject index and returns its Offer.
@@ -173,7 +174,11 @@ export class IndividualControllerSdk {
      */
     updateSubjectSection(ctx, input) {
         assertFacadeCapability(this.capabilities, ActorCapabilities.IndividualIngestCommunication, ActorKinds.IndividualController, 'updateSubjectSection');
-        return requireClientMethod(this.client, 'updateSubjectSection')(ctx, input);
+        const attester = input.attester || this.profileDefaults?.attester;
+        if (!attester) {
+            throw new Error('updateSubjectSection requires an explicit attester unless the facade comes from an opened controller profile.');
+        }
+        return requireClientMethod(this.client, 'updateSubjectSection')(ctx, { ...input, attester });
     }
     /**
      * Updates the multi-section summary through a Composition-first document.

package/dist/server-profile-session.d.ts

@@ -11,7 +11,8 @@ import { ProfessionalSdk } from './orchestration/professional-sdk.js';
 import { DigitalTwinSdk } from './orchestration/digital-twin-sdk.js';
 import type { SmartTokenExchangeResult } from './smart-token.js';
 import type { DigitalTwinSearchInput, DigitalTwinSearchResult } from './digital-twin.js';
-import type { RouteContext } from './individual-onboarding.js';
+import type { IndividualOrganizationOrderResult, RouteContext } from './individual-onboarding.js';
+import type { IndividualOrganizationRegistrationResult } from './individual-start.js';
 import type { HostRouteContext } from './host-onboarding.js';
 import type { SecureDidcommTransportAdapter } from 'gdc-sdk-core-ts';
 import { type PinProtectedProfileSecret, type ProfileProtectionOptions, type ServerProfileSealer } from './server-profile-protection.js';
@@ -145,6 +146,13 @@ export type ServerProfileEnrollmentInput = Readonly<{
     idToken: string;
     /** One-time code returned by the completed organization flow or employee `License/_issue`. */
     activationCode: string;
+    /**
+     * Principal controller identifier projected by the SDK from
+     * `Organization.owner.identifier.value` and the matching automatic
+     * `RelatedPerson.identifier`. Individual-controller callers pass this
+     * identifier; the SDK constructs protected document-attester metadata.
+     */
+    controllerRelatedPersonIdentifier?: string;
     /**
      * Optional explicit installation identity. Normally omit it so the SDK
      * derives the identity from the wallet key it creates for this profile.
@@ -292,6 +300,43 @@ export type OpenedServerIndividualController = Readonly<{
     session: ResolvedServerProfileSession;
     profile: ServerProfileRecord;
     sdk: IndividualControllerSdk;
+    /** Returns the protected RelatedPerson URI for FHIR document attestation. */
+    getAttesterUriForDocs(): string;
+}>;
+/** One-time self-controller enrollment. It never opens a working session. */
+export type ServerSelfIndividualControllerEnrollmentInput = Readonly<{
+    ownerId: string;
+    profileId: string;
+    registration: Pick<IndividualOrganizationRegistrationResult, 'identity'>;
+    order: Pick<IndividualOrganizationOrderResult, 'activationCode' | 'controllerRelatedPersonIdentifier'>;
+    routeContext: RouteContext;
+    pin: string;
+    idToken: string;
+    redirectUris: string[];
+    clientName: string;
+}>;
+/**
+ * One-time enrollment when the controller and represented subject are
+ * different identities. Demographics and alternateName belong to registration
+ * evidence and are deliberately not accepted by this operation.
+ */
+export type ServerIndividualControllerEnrollmentInput = Readonly<{
+    ownerId: string;
+    profileId: string;
+    /** Stable controller/member DID that owns the wallet and DCR client. */
+    controllerActorDid: string;
+    /**
+     * Authorized subject alias used by the product, when different from the
+     * hosted subject DID returned by registration (for example, an animal card).
+     */
+    subjectDid?: string;
+    registration: Pick<IndividualOrganizationRegistrationResult, 'identity'>;
+    order: Pick<IndividualOrganizationOrderResult, 'activationCode' | 'controllerRelatedPersonIdentifier'>;
+    routeContext: RouteContext;
+    pin: string;
+    idToken: string;
+    redirectUris: string[];
+    clientName: string;
 }>;
 /** Server-owned role evidence used to sign a fresh professional VP. */
 export type ServerProfessionalProofInput = Readonly<{
@@ -368,6 +413,12 @@ export type ServerProfileSessionManagerOptions = Readonly<{
 export declare class ServerProfileSessionManager {
     private readonly options;
     constructor(options: ServerProfileSessionManagerOptions);
+    /**
+     * Enrolls a controller for a different represented subject. The SDK consumes
+     * the automatic GW RESPRSN assignment and does not ask the caller to build an
+     * attester. This operation does not accept or update subject demographics.
+     */
+    enrollIndividualController(input: ServerIndividualControllerEnrollmentInput): Promise<ServerProfileRecord>;
     /**
      * Resolves the canonical IPS author/attester projection from one owned
      * profile without exposing its protected wallet material to the portal.
@@ -383,6 +434,13 @@ export declare class ServerProfileSessionManager {
          */
         sourceAuthor?: ClinicalSourceAuthorSelection;
     }>): Promise<ClinicalCreatorIpsExport>;
+    /**
+     * Enrolls the controller of a self-managed individual from SDK-owned
+     * registration and Order projections. The caller never parses claims or
+     * constructs FHIR attester metadata, and this operation does not open the
+     * resulting profile.
+     */
+    enrollSelfIndividualController(input: ServerSelfIndividualControllerEnrollmentInput): Promise<ServerProfileRecord>;
     enroll(input: ServerProfileEnrollmentInput): Promise<ServerProfileRecord>;
     /**
      * Rotates an employee wallet after a fresh OTP-authenticated GW recovery.

package/dist/server-profile-session.js

@@ -24,20 +24,23 @@ import { ProfilePinRejectedError, openServerProfileSecret, protectServerProfileS
  * RelatedPerson/PractitionerRole assignment returned by GW.
  */
 export function buildProfileAttester(input) {
-    const hexadecimal = normalizeUuid(String(input.assignmentIdentifier || '').trim());
-    if (!hexadecimal) {
-        throw new TypeError('Profile attester assignmentIdentifier must be a UUID returned by RelatedPerson or PractitionerRole data.');
-    }
-    const uuid = [
-        hexadecimal.slice(0, 8),
-        hexadecimal.slice(8, 12),
-        hexadecimal.slice(12, 16),
-        hexadecimal.slice(16, 20),
-        hexadecimal.slice(20),
-    ].join('-');
+    const assignmentIdentifier = String(input.assignmentIdentifier || '').trim();
+    const hexadecimal = normalizeUuid(assignmentIdentifier);
+    const reference = hexadecimal
+        ? `${UrnPrefixes.Uuid}${[
+            hexadecimal.slice(0, 8),
+            hexadecimal.slice(8, 12),
+            hexadecimal.slice(12, 16),
+            hexadecimal.slice(16, 20),
+            hexadecimal.slice(20),
+        ].join('-')}`
+        : assignmentIdentifier;
+    if (!/^(?:urn:|https?:\/\/)/i.test(reference)) {
+        throw new TypeError('Profile attester assignmentIdentifier must be a governed RelatedPerson or PractitionerRole URI.');
+    }
     return Object.freeze({
         mode: input.mode,
-        party: Object.freeze({ reference: `${UrnPrefixes.Uuid}${uuid}` }),
+        party: Object.freeze({ reference }),
     });
 }
 /**
@@ -69,6 +72,42 @@ export class ServerProfileSessionManager {
     constructor(options) {
         this.options = options;
     }
+    /**
+     * Enrolls a controller for a different represented subject. The SDK consumes
+     * the automatic GW RESPRSN assignment and does not ask the caller to build an
+     * attester. This operation does not accept or update subject demographics.
+     */
+    async enrollIndividualController(input) {
+        const identity = input.registration.identity;
+        if (!identity) {
+            throw new Error('Individual-controller enrollment requires the registered individual identity.');
+        }
+        const controllerActorDid = String(input.controllerActorDid || '').trim();
+        if (!controllerActorDid) {
+            throw new Error('Individual-controller enrollment requires controllerActorDid.');
+        }
+        const subjectDid = String(input.subjectDid || identity.subjectDid).trim();
+        if (!subjectDid) {
+            throw new Error('Individual-controller enrollment requires subjectDid.');
+        }
+        return this.enroll({
+            ownerId: input.ownerId,
+            profileId: input.profileId,
+            actorKind: ActorKinds.IndividualController,
+            actorMode: 'controller',
+            actorDid: controllerActorDid,
+            profileDid: controllerActorDid,
+            providerDid: identity.providerDidWeb,
+            routeContext: input.routeContext,
+            allowedSubjectDids: [subjectDid],
+            pin: input.pin,
+            idToken: input.idToken,
+            activationCode: input.order.activationCode,
+            controllerRelatedPersonIdentifier: input.order.controllerRelatedPersonIdentifier,
+            redirectUris: input.redirectUris,
+            clientName: input.clientName,
+        });
+    }
     /**
      * Resolves the canonical IPS author/attester projection from one owned
      * profile without exposing its protected wallet material to the portal.
@@ -76,11 +115,50 @@ export class ServerProfileSessionManager {
     async exportClinicalCreatorIps(input) {
         return exportServerProfileClinicalCreatorIps(await this.requireOwnedProfile(input.ownerId, input.profileId), { sourceAuthor: input.sourceAuthor });
     }
+    /**
+     * Enrolls the controller of a self-managed individual from SDK-owned
+     * registration and Order projections. The caller never parses claims or
+     * constructs FHIR attester metadata, and this operation does not open the
+     * resulting profile.
+     */
+    async enrollSelfIndividualController(input) {
+        const identity = input.registration.identity;
+        if (!identity) {
+            throw new Error('Self individual-controller enrollment requires the registered individual identity.');
+        }
+        const controllerActorDid = String(identity.controllerActorDid || '').trim();
+        if (!controllerActorDid) {
+            throw new Error('Self individual-controller enrollment requires the registered controller actor DID.');
+        }
+        return this.enroll({
+            ownerId: input.ownerId,
+            profileId: input.profileId,
+            actorKind: ActorKinds.IndividualController,
+            actorMode: 'self',
+            actorDid: controllerActorDid,
+            profileDid: controllerActorDid,
+            providerDid: identity.providerDidWeb,
+            routeContext: input.routeContext,
+            allowedSubjectDids: [identity.subjectDid],
+            pin: input.pin,
+            idToken: input.idToken,
+            activationCode: input.order.activationCode,
+            controllerRelatedPersonIdentifier: input.order.controllerRelatedPersonIdentifier,
+            redirectUris: input.redirectUris,
+            clientName: input.clientName,
+        });
+    }
     async enroll(input) {
         const normalizedClinicalCreatorBinding = input.clinicalCreatorBinding
             ? normalizeClinicalCreatorBinding(input.clinicalCreatorBinding)
             : undefined;
-        const attester = input.attester || (normalizedClinicalCreatorBinding
+        const controllerAttester = input.controllerRelatedPersonIdentifier
+            ? buildProfileAttester({
+                assignmentIdentifier: input.controllerRelatedPersonIdentifier,
+                mode: CompositionAttesterModes.Personal,
+            })
+            : undefined;
+        const attester = controllerAttester || input.attester || (normalizedClinicalCreatorBinding
             ? buildProfileAttester({
                 assignmentIdentifier: normalizedClinicalCreatorBinding.authorIdentifier,
                 mode: normalizedClinicalCreatorBinding.kind === FhirIpsCreatorKinds.Professional
@@ -145,8 +223,12 @@ export class ServerProfileSessionManager {
         const activation = await client.activateProfileDeviceWithActivationRequest(activationRequest);
         const dcrBody = terminalBody(activation.dcr.poll.body);
         const clientId = findText(dcrBody, ['client_id', 'clientId']);
-        if (!clientId)
-            throw new Error('GW DCR did not return client_id.');
+        if (!clientId) {
+            const diagnostics = findText(dcrBody, ['diagnostics', 'details', 'message']);
+            throw new Error(diagnostics
+                ? `GW DCR failed: ${diagnostics}`
+                : 'GW DCR did not return client_id.');
+        }
         const deviceDid = findText(dcrBody, ['device_did', 'deviceDid', 'did']) || clientId;
         const now = this.now();
         const managedVpToken = input.vpToken || (input.professionalProof
@@ -562,6 +644,10 @@ export class ServerProfileSessionManager {
             || (profile.actorMode !== 'self' && profile.actorMode !== 'controller')) {
             throw new Error('Profile is not an individual controller.');
         }
+        const profileAttester = profile.attester;
+        if (!profileAttester) {
+            throw new Error('The opened individual-controller profile has no RelatedPerson attester.');
+        }
         const client = new NodeHttpClient({
             baseUrl: this.options.gatewayBaseUrl,
             ctx: profile.routeContext,
@@ -571,7 +657,20 @@ export class ServerProfileSessionManager {
             transportProfile: TransportProfiles.DidcommEncryptedForm,
             secureTransportAdapter: session.secureTransportAdapter,
         });
-        return { session, profile, sdk: new IndividualControllerSdk(client) };
+        return {
+            session,
+            profile,
+            sdk: new IndividualControllerSdk(client, undefined, {
+                attester: profileAttester,
+            }),
+            getAttesterUriForDocs: () => {
+                const reference = String(profileAttester.party.reference || '').trim();
+                if (!reference) {
+                    throw new Error('The opened individual-controller profile has no RelatedPerson attester URI.');
+                }
+                return reference;
+            },
+        };
     }
     /**
      * Opens the high-level organization-controller API without exposing wallet,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-sdk-node-ts",
-  "version": "2.9.11",
+  "version": "2.9.14",
   "description": "Next-generation Node runtime package for the GDC SDK family",
   "license": "Apache-2.0",
   "author": "Antifraud Services Inc.",
@@ -15,7 +15,7 @@
     "prepare": "npm run build",
     "type-check": "tsc -p tsconfig.json --noEmit && tsc -p docs/snippets/tsconfig.json",
     "check:product-neutrality": "node scripts/check-product-neutrality.mjs",
-    "prepublishOnly": "npm run check:product-neutrality && npm run type-check && npm test",
+    "prepublishOnly": "npm run check:product-neutrality && npm run type-check && npm test && npm run test:e2e:live-full-cycle",
     "local:close": "PORTS=3000 bash ./scripts/local-close.sh",
     "docker:close": "PORTS=8000 bash ./scripts/local-close.sh",
     "test": "npm run build && node --test tests/*.test.mjs",
@@ -38,8 +38,8 @@
     "test:e2e:live-gw:clean": "bash ./scripts/run-live-gw-clean.sh"
   },
   "dependencies": {
-    "gdc-common-utils-ts": "2.9.10",
-    "gdc-sdk-core-ts": "2.9.8"
+    "gdc-common-utils-ts": "2.9.14",
+    "gdc-sdk-core-ts": "2.9.9"
   },
   "devDependencies": {
     "@types/node": "^20.14.10",