gdc-sdk-node-ts 2.9.12 → 2.9.14

package/README.md

@@ -533,7 +533,7 @@ const individualControllerDid = buildIndividualMemberDidWebFromPrivateIdentifier
   roleValue: 'RESPRSN',
 });
 
-// did:web:host.example.org:health-care:organization:taxid:VATES-B00112233:individual:UUID:zG9H82pae9SCXvec3D4YKqhX8bj8F1mRgzxMEdwXXonT7BWsvsUiP2u52sWQTeESpoMee:member:zG9DrMLpQW8eoCc9Ay9AFxuMGiswgJePpbUMz9svJCZ8tKjUd4xoExgCPA5jmHc6hPATJ:RESPRSN
+// did:web:host.example.org:health-care:organization:taxid:VATES-B00112233:individual:multibase:zG9H82pae9SCXvec3D4YKqhX8bj8F1mRgzxMEdwXXonT7BWsvsUiP2u52sWQTeESpoMee:member:zG9DrMLpQW8eoCc9Ay9AFxuMGiswgJePpbUMz9svJCZ8tKjUd4xoExgCPA5jmHc6hPATJ:RESPRSN
 ```
 
 ### Use shared invitation contract from Node

package/dist/family-organization-search.d.ts

@@ -8,6 +8,20 @@ export type FamilyOrganizationSearchInput = Readonly<{
     timeoutSeconds?: number;
     intervalSeconds?: number;
 }>;
+export type OwnedFamilyOrganizationDirectoryInput = Readonly<{
+    verifiedContact: Readonly<{
+        email?: string;
+        telephone?: string;
+    }>;
+    requestThid?: string;
+    timeoutSeconds?: number;
+    intervalSeconds?: number;
+}>;
+export type OwnedFamilyOrganizationDirectoryEntry = Readonly<{
+    resourceId: string;
+    alternateName: string;
+    claims: Readonly<Record<string, unknown>>;
+}>;
 type SearchFamilyOrganizationWithDeps = {
     routeCtx: RouteContext;
     input: FamilyOrganizationSearchInput;
@@ -27,4 +41,12 @@ type SearchFamilyOrganizationWithDeps = {
  * `null`.
  */
 export declare function searchFamilyOrganizationWithDeps(deps: SearchFamilyOrganizationWithDeps): Promise<FamilyOrganizationSummary | null>;
+/**
+ * Lists the complete owner-scoped individual Organization directory.
+ *
+ * CORE requires an exact verified owner contact and deliberately performs no
+ * global or prefix scan. Callers may filter the returned alternate names only
+ * after this authenticated directory boundary.
+ */
+export declare function listOwnedFamilyOrganizationsWithDeps(routeCtx: RouteContext, input: OwnedFamilyOrganizationDirectoryInput, deps: Pick<SearchFamilyOrganizationWithDeps, 'individualFamilyOrganizationSearchPath' | 'individualFamilyOrganizationSearchPollPath' | 'submitAndPoll' | 'defaultTimeoutMs' | 'defaultIntervalMs'>): Promise<OwnedFamilyOrganizationDirectoryEntry[]>;
 export {};

package/dist/family-organization-search.js

@@ -49,6 +49,62 @@ export async function searchFamilyOrganizationWithDeps(deps) {
     }
     return readFamilyOrganizationSummaryFromResponseBody(result.poll.body);
 }
+/**
+ * Lists the complete owner-scoped individual Organization directory.
+ *
+ * CORE requires an exact verified owner contact and deliberately performs no
+ * global or prefix scan. Callers may filter the returned alternate names only
+ * after this authenticated directory boundary.
+ */
+export async function listOwnedFamilyOrganizationsWithDeps(routeCtx, input, deps) {
+    const email = String(input.verifiedContact?.email || '').trim().toLowerCase();
+    const telephone = String(input.verifiedContact?.telephone || '').trim();
+    if (!email && !telephone) {
+        throw new Error('A verified owner email or telephone is required.');
+    }
+    const claims = {
+        '@context': 'org.schema',
+        ...(email ? { [ClaimsOrganizationSchemaorg.ownerEmail]: email } : {}),
+        ...(telephone ? { [ClaimsOrganizationSchemaorg.ownerTelephone]: telephone } : {}),
+    };
+    const pollOptions = resolvePollOptionsFromSeconds(input.timeoutSeconds, input.intervalSeconds, {
+        timeoutMs: deps.defaultTimeoutMs,
+        intervalMs: deps.defaultIntervalMs,
+    });
+    const result = await deps.submitAndPoll(deps.individualFamilyOrganizationSearchPath(routeCtx), deps.individualFamilyOrganizationSearchPollPath(routeCtx), {
+        jti: `jti-${createRuntimeUuid()}`,
+        thid: input.requestThid || `owned-family-directory-${createRuntimeUuid()}`,
+        iss: routeCtx.tenantId,
+        aud: routeCtx.tenantId,
+        type: 'application/api+json',
+        body: {
+            data: [{
+                    type: 'Family-search-v1.0',
+                    resource: { meta: { claims } },
+                }],
+        },
+    }, pollOptions);
+    if (result.poll.status !== 200)
+        return [];
+    const root = result.poll.body?.body || result.poll.body;
+    const responseEntries = Array.isArray(root?.data) ? root.data : [];
+    const resources = responseEntries.flatMap((entry) => Array.isArray(entry?.resource?.entry)
+        ? entry.resource.entry.map((item) => item?.resource).filter(Boolean)
+        : []);
+    return resources.flatMap((resource) => {
+        const resourceClaims = resource?.meta?.claims;
+        if (!resource?.id || !resourceClaims || typeof resourceClaims !== 'object')
+            return [];
+        const ownerEmail = String(resourceClaims[ClaimsOrganizationSchemaorg.ownerEmail] || '').trim().toLowerCase();
+        const ownerTelephone = String(resourceClaims[ClaimsOrganizationSchemaorg.ownerTelephone] || '').trim();
+        if (!((email && ownerEmail === email) || (telephone && ownerTelephone === telephone)))
+            return [];
+        const alternateName = String(resourceClaims[ClaimsOrganizationSchemaorg.alternateName] || '').trim();
+        if (!alternateName)
+            return [];
+        return [{ resourceId: String(resource.id), alternateName, claims: resourceClaims }];
+    });
+}
 function createRuntimeUuid() {
     const fromCrypto = globalThis.crypto?.randomUUID?.();
     if (fromCrypto) {

package/dist/individual-start.d.ts

@@ -1,10 +1,19 @@
 import { SecureIdTypesIndividual } from 'gdc-common-utils-ts';
 export { buildIndividualMemberDidWebFromPrivateIdentifiers } from 'gdc-common-utils-ts';
 import type { FamilyRegistrationStatus } from 'gdc-common-utils-ts/utils/family-organization-summary';
+import type { IndividualOnboardingDraftResult } from 'gdc-common-utils-ts/models/individual-onboarding';
 import type { PollOptions, SubmitAndPollResult } from './orchestration/client-port.js';
 import type { RouteContext } from './individual-onboarding.js';
 import type { OfferPreview } from './order-offer-summary.js';
 export type IndividualOrganizationRegistrationInput = {
+    /**
+     * Preferred high-level input produced by `createIndividualOnboardingEditor()`.
+     *
+     * The SDK converts this draft into the GW Bundle and signed-PDF attachment.
+     * Registration remains separate from Order confirmation, enrollment and
+     * opening a profile.
+     */
+    onboardingDraft?: IndividualOnboardingDraftResult;
     /**
      * Preferred route identifier for the selected personal indexing service provider.
      *
@@ -25,7 +34,7 @@ export type IndividualOrganizationRegistrationInput = {
      * This is not the technical subject identifier. It is the nearby name the
      * controller uses to refer to the person in the UI, for example `Charly`.
      */
-    alternateName: string;
+    alternateName?: string;
     /**
      * CORE-canonical controller contact channel for individual bootstrap.
      *
@@ -97,6 +106,12 @@ export type IndividualOrganizationBootstrapIdentity = {
     providerDidWeb: string;
     /** Canonical child DID built beneath the exact provider DID returned by GW. */
     subjectDid: string;
+    /**
+     * Canonical principal-controller member DID accepted by individual DCR.
+     * Optional only for compatibility with older registration receipts that did
+     * not expose the controller contact needed to derive it.
+     */
+    controllerActorDid?: string;
 };
 type RegisterIndividualOrganizationDeps = {
     input: IndividualOrganizationRegistrationInput;
@@ -128,4 +143,7 @@ export declare function startIndividualOrganizationWithDeps(deps: RegisterIndivi
  * `:organization:taxid:` DID path. `buildIndividualDidWeb(...)` only adds the
  * individual suffix and never rewrites that provider lineage.
  */
-export declare function readIndividualOrganizationBootstrapIdentity(responseBody: unknown): IndividualOrganizationBootstrapIdentity | undefined;
+export declare function readIndividualOrganizationBootstrapIdentity(responseBody: unknown, controller?: Readonly<{
+    controllerEmail?: string;
+    controllerTelephone?: string;
+}>): IndividualOrganizationBootstrapIdentity | undefined;

package/dist/individual-start.js

@@ -1,8 +1,10 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
 import { randomUUID } from 'node:crypto';
 import { ClaimsOfferSchemaorg, ClaimsOrganizationSchemaorg, ClaimsPersonSchemaorg, ClaimsServiceSchemaorg, } from 'gdc-common-utils-ts/constants';
-import { buildIndividualDidWeb, buildSecureIdValueIndividual, extractPrimaryClaims, normalizeUuid, readFamilyOrganizationSummaryFromResponseBody, SecureIdTypesIndividual, } from 'gdc-common-utils-ts';
+import { HealthcareActorRoleCodes, HL7_CODING_SYSTEM_V3_ROLE_CODE, buildIndividualMemberDidWebFromPrivateIdentifiers, buildIndividualDidWeb, buildSecureIdValueIndividual, extractPrimaryClaims, normalizeUuid, readFamilyOrganizationSummaryFromResponseBody, SecureIdTypesIndividual, } from 'gdc-common-utils-ts';
 export { buildIndividualMemberDidWebFromPrivateIdentifiers } from 'gdc-common-utils-ts';
+import { DocumentReferenceClaim } from 'gdc-common-utils-ts/models/interoperable-claims/document-reference-claims';
+import { buildIndividualOrganizationRegistrationGatewayRequestFromDraft } from 'gdc-sdk-core-ts';
 import { GwCoreLifecycleRequestType } from './constants/lifecycle.js';
 import { resolvePollOptionsFromSeconds } from './poll-options.js';
 /**
@@ -23,23 +25,39 @@ export async function registerIndividualOrganizationWithDeps(deps) {
      * in the payload for compatibility, but the owner claims are the live GW
      * routing/indexing contract for this flow.
      */
+    const onboardingDraft = deps.input.onboardingDraft;
+    if (onboardingDraft && !hasSignedPdfEvidence(onboardingDraft)) {
+        const subjectAlternateName = String(onboardingDraft.formFields.subjectAlternateName
+            || onboardingDraft.claims?.[ClaimsOrganizationSchemaorg.alternateName]
+            || '').trim();
+        if (!subjectAlternateName) {
+            throw new Error('registerIndividualOrganization subjectAlternateName is required when signed PDF evidence is absent.');
+        }
+    }
     const alternateName = String(deps.input.alternateName || '').trim();
-    if (!alternateName) {
+    if (!onboardingDraft && !alternateName) {
         throw new Error('registerIndividualOrganization requires alternateName.');
     }
-    const controllerEmail = String(deps.input.controllerEmail || '').trim();
-    const controllerTelephone = String(deps.input.controllerTelephone || '').trim();
-    if (!controllerEmail && !controllerTelephone) {
+    const controllerEmail = String(deps.input.controllerEmail
+        || onboardingDraft?.formFields.controllerEmail
+        || onboardingDraft?.claims?.[ClaimsOrganizationSchemaorg.ownerEmail]
+        || '').trim();
+    const controllerTelephone = String(deps.input.controllerTelephone
+        || onboardingDraft?.formFields.controllerPhone
+        || onboardingDraft?.claims?.[ClaimsOrganizationSchemaorg.ownerTelephone]
+        || '').trim();
+    if (!onboardingDraft && !controllerEmail && !controllerTelephone) {
         throw new Error('registerIndividualOrganization requires controllerEmail, or controllerTelephone only for compatibility/extension flows.');
     }
     const controllerRole = String(deps.input.controllerRole || 'RESPRSN').trim();
     const controllerIdentifier = canonicalControllerUuid(deps.input.controllerIdentifier
         || deps.input.additionalClaims?.[ClaimsOrganizationSchemaorg.ownerIdentifierValue]
+        || onboardingDraft?.claims?.[ClaimsOrganizationSchemaorg.ownerIdentifierValue]
         || randomUUID());
     const claims = {
         '@context': 'org.schema',
         ...(deps.input.additionalClaims || {}),
-        [ClaimsOrganizationSchemaorg.alternateName]: alternateName,
+        ...(alternateName ? { [ClaimsOrganizationSchemaorg.alternateName]: alternateName } : {}),
         [ClaimsOrganizationSchemaorg.ownerIdentifierValue]: controllerIdentifier,
         [ClaimsServiceSchemaorg.category]: deps.routeCtx.sector,
         [ClaimsPersonSchemaorg.hasOccupationalRoleValue]: controllerRole,
@@ -56,18 +74,24 @@ export async function registerIndividualOrganizationWithDeps(deps) {
             }
             : {}),
     };
+    const registrationBody = onboardingDraft
+        ? buildIndividualOrganizationRegistrationGatewayRequestFromDraft({
+            draft: onboardingDraft,
+            routingClaims: claims,
+        })
+        : {
+            data: [{
+                    type: GwCoreLifecycleRequestType.IndividualOrganizationRegistration,
+                    resource: { meta: { claims } },
+                }],
+        };
     const registrationPayload = {
         jti: `jti-${createRuntimeUuid()}`,
         iss: deps.routeCtx.tenantId,
         aud: deps.routeCtx.tenantId,
         type: 'application/didcomm-plain+json',
         thid: `family-org-${createRuntimeUuid()}`,
-        body: {
-            data: [{
-                    type: GwCoreLifecycleRequestType.IndividualOrganizationRegistration,
-                    resource: { meta: { claims } },
-                }],
-        },
+        body: registrationBody,
     };
     const pollOptions = resolvePollOptionsFromSeconds(deps.input.timeoutSeconds, deps.input.intervalSeconds, {
         timeoutMs: deps.defaultTimeoutMs,
@@ -95,7 +119,10 @@ export async function registerIndividualOrganizationWithDeps(deps) {
         offerPreview: deps.getOfferPreviewFromResponse(registration),
         registrationStatus: registrationSummary?.status,
         orderConfirmationRequired: registrationSummary?.status !== 'already_exists',
-        identity: readIndividualOrganizationBootstrapIdentity(registration.poll.body),
+        identity: readIndividualOrganizationBootstrapIdentity(registration.poll.body, {
+            controllerEmail,
+            controllerTelephone,
+        }),
     };
 }
 function canonicalControllerUuid(value) {
@@ -111,6 +138,11 @@ function canonicalControllerUuid(value) {
         hexadecimal.slice(20),
     ].join('-');
 }
+function hasSignedPdfEvidence(draft) {
+    const claims = draft.documentReference?.resource?.meta?.claims;
+    return Boolean(String(claims?.[DocumentReferenceClaim.ContentType] || '').trim()
+        && String(claims?.[DocumentReferenceClaim.ContentData] || '').trim());
+}
 /** @deprecated Use `registerIndividualOrganizationWithDeps`. */
 export async function startIndividualOrganizationWithDeps(deps) {
     return registerIndividualOrganizationWithDeps(deps);
@@ -123,7 +155,7 @@ export async function startIndividualOrganizationWithDeps(deps) {
  * `:organization:taxid:` DID path. `buildIndividualDidWeb(...)` only adds the
  * individual suffix and never rewrites that provider lineage.
  */
-export function readIndividualOrganizationBootstrapIdentity(responseBody) {
+export function readIndividualOrganizationBootstrapIdentity(responseBody, controller) {
     const root = asRecord(responseBody);
     const body = asRecord(root?.body) || root;
     const entries = Array.isArray(body?.data) ? body.data : [];
@@ -144,16 +176,33 @@ export function readIndividualOrganizationBootstrapIdentity(responseBody) {
     catch {
         return undefined;
     }
+    const subjectDid = buildIndividualDidWeb({
+        providerDidWeb,
+        secureIdTypeIndividual: SecureIdTypesIndividual.Uuid,
+        secureIdValueIndividual,
+    });
+    const controllerEmail = String(controller?.controllerEmail || claims[ClaimsOrganizationSchemaorg.ownerEmail] || '').trim();
+    const controllerTelephone = String(controller?.controllerTelephone || claims[ClaimsOrganizationSchemaorg.ownerTelephone] || '').trim();
+    const controllerActorDid = controllerEmail || controllerTelephone
+        ? buildIndividualMemberDidWebFromPrivateIdentifiers({
+            providerDidWeb,
+            secureIdTypeIndividual: SecureIdTypesIndividual.Uuid,
+            privateIdValueIndividual: resourceId,
+            secureIdTypeMember: controllerEmail
+                ? SecureIdTypesIndividual.Email
+                : SecureIdTypesIndividual.Phone,
+            privateIdValueMember: controllerEmail || controllerTelephone,
+            roleType: HL7_CODING_SYSTEM_V3_ROLE_CODE,
+            roleValue: HealthcareActorRoleCodes.Controller,
+        })
+        : undefined;
     return {
         resourceId,
         secureIdTypeIndividual: SecureIdTypesIndividual.Uuid,
         secureIdValueIndividual,
         providerDidWeb,
-        subjectDid: buildIndividualDidWeb({
-            providerDidWeb,
-            secureIdTypeIndividual: SecureIdTypesIndividual.Uuid,
-            secureIdValueIndividual,
-        }),
+        subjectDid,
+        ...(controllerActorDid ? { controllerActorDid } : {}),
     };
 }
 function asRecord(value) {

package/dist/node-runtime-client.d.ts

@@ -7,7 +7,7 @@ import type { HostedTenantDescendantKind } from './host-onboarding.js';
 import type { NodeLegalOrganizationVerificationTransactionInput, NodeOrganizationDidBindingInput, NodeOrganizationActivationInput } from './orchestration/client-port.js';
 import { type IndividualOrganizationConfirmOrderInput, type IndividualOrganizationOrderResult, type RouteContext } from './individual-onboarding.js';
 import { type EnsureFamilyOrganizationRegistrationInput } from './family-organization-registration.js';
-import { type FamilyOrganizationSearchInput } from './family-organization-search.js';
+import { type FamilyOrganizationSearchInput, type OwnedFamilyOrganizationDirectoryInput } from './family-organization-search.js';
 import { type SmartTokenRequestInput } from './smart-token.js';
 import { type EmployeeDeviceActivationRequestInput, type EmployeeDeviceActivationResult, type EmployeeDeviceOtpRecoveryInput, type EmployeeDeviceOtpRecoveryResult, type EmployeeDeviceRevocationInput } from './device-activation.js';
 import { type OrganizationLicenseOrderConfirmInput } from './organization-license-order.js';
@@ -386,6 +386,12 @@ export declare class HttpRuntimeClient implements NodeRuntimeClient {
         missingFields?: string[];
         updatedAt?: string;
     }> | null>;
+    /** Lists all individual Organizations owned by one verified account contact. */
+    listOwnedFamilyOrganizations(ctx: RouteContext, input: OwnedFamilyOrganizationDirectoryInput): Promise<Readonly<{
+        resourceId: string;
+        alternateName: string;
+        claims: Readonly<Record<string, unknown>>;
+    }>[]>;
     /**
      * Searches one existing family/individual registration and starts the
      * bootstrap flow only when the registration does not already exist.

package/dist/node-runtime-client.js

@@ -4,7 +4,7 @@ import { confirmLegalOrganizationOrderWithDeps, HostLifecycleRequestType, Hosted
 import { GwCoreLifecycleRequestType } from './constants/lifecycle.js';
 import { confirmIndividualOrganizationOrderWithDeps, } from './individual-onboarding.js';
 import { ensureFamilyOrganizationRegistrationWithDeps, } from './family-organization-registration.js';
-import { searchFamilyOrganizationWithDeps } from './family-organization-search.js';
+import { listOwnedFamilyOrganizationsWithDeps, searchFamilyOrganizationWithDeps, } from './family-organization-search.js';
 import { requestSmartTokenWithDeps } from './smart-token.js';
 import { activateEmployeeDeviceWithActivationCodeWithDeps, activateEmployeeDeviceWithActivationRequestWithDeps, recoverEmployeeDeviceWithOtpWithDeps, revokeEmployeeDeviceWithDeps, } from './device-activation.js';
 import { extractOfferIdFromResponseBody, extractOfferPreviewFromResponseBody, } from './order-offer-summary.js';
@@ -680,6 +680,16 @@ export class HttpRuntimeClient {
             submitAndPoll: this.submitAndPoll.bind(this),
         });
     }
+    /** Lists all individual Organizations owned by one verified account contact. */
+    async listOwnedFamilyOrganizations(ctx, input) {
+        return listOwnedFamilyOrganizationsWithDeps(ctx, input, {
+            defaultTimeoutMs: 20000,
+            defaultIntervalMs: 1000,
+            individualFamilyOrganizationSearchPath: this.paths.individualFamilyOrganizationSearchPath.bind(this.paths),
+            individualFamilyOrganizationSearchPollPath: this.paths.individualFamilyOrganizationSearchPollPath.bind(this.paths),
+            submitAndPoll: this.submitAndPoll.bind(this),
+        });
+    }
     /**
      * Searches one existing family/individual registration and starts the
      * bootstrap flow only when the registration does not already exist.

package/dist/server-profile-session.d.ts

@@ -315,6 +315,29 @@ export type ServerSelfIndividualControllerEnrollmentInput = Readonly<{
     redirectUris: string[];
     clientName: string;
 }>;
+/**
+ * One-time enrollment when the controller and represented subject are
+ * different identities. Demographics and alternateName belong to registration
+ * evidence and are deliberately not accepted by this operation.
+ */
+export type ServerIndividualControllerEnrollmentInput = Readonly<{
+    ownerId: string;
+    profileId: string;
+    /** Stable controller/member DID that owns the wallet and DCR client. */
+    controllerActorDid: string;
+    /**
+     * Authorized subject alias used by the product, when different from the
+     * hosted subject DID returned by registration (for example, an animal card).
+     */
+    subjectDid?: string;
+    registration: Pick<IndividualOrganizationRegistrationResult, 'identity'>;
+    order: Pick<IndividualOrganizationOrderResult, 'activationCode' | 'controllerRelatedPersonIdentifier'>;
+    routeContext: RouteContext;
+    pin: string;
+    idToken: string;
+    redirectUris: string[];
+    clientName: string;
+}>;
 /** Server-owned role evidence used to sign a fresh professional VP. */
 export type ServerProfessionalProofInput = Readonly<{
     role: string;
@@ -390,6 +413,12 @@ export type ServerProfileSessionManagerOptions = Readonly<{
 export declare class ServerProfileSessionManager {
     private readonly options;
     constructor(options: ServerProfileSessionManagerOptions);
+    /**
+     * Enrolls a controller for a different represented subject. The SDK consumes
+     * the automatic GW RESPRSN assignment and does not ask the caller to build an
+     * attester. This operation does not accept or update subject demographics.
+     */
+    enrollIndividualController(input: ServerIndividualControllerEnrollmentInput): Promise<ServerProfileRecord>;
     /**
      * Resolves the canonical IPS author/attester projection from one owned
      * profile without exposing its protected wallet material to the portal.

package/dist/server-profile-session.js

@@ -72,6 +72,42 @@ export class ServerProfileSessionManager {
     constructor(options) {
         this.options = options;
     }
+    /**
+     * Enrolls a controller for a different represented subject. The SDK consumes
+     * the automatic GW RESPRSN assignment and does not ask the caller to build an
+     * attester. This operation does not accept or update subject demographics.
+     */
+    async enrollIndividualController(input) {
+        const identity = input.registration.identity;
+        if (!identity) {
+            throw new Error('Individual-controller enrollment requires the registered individual identity.');
+        }
+        const controllerActorDid = String(input.controllerActorDid || '').trim();
+        if (!controllerActorDid) {
+            throw new Error('Individual-controller enrollment requires controllerActorDid.');
+        }
+        const subjectDid = String(input.subjectDid || identity.subjectDid).trim();
+        if (!subjectDid) {
+            throw new Error('Individual-controller enrollment requires subjectDid.');
+        }
+        return this.enroll({
+            ownerId: input.ownerId,
+            profileId: input.profileId,
+            actorKind: ActorKinds.IndividualController,
+            actorMode: 'controller',
+            actorDid: controllerActorDid,
+            profileDid: controllerActorDid,
+            providerDid: identity.providerDidWeb,
+            routeContext: input.routeContext,
+            allowedSubjectDids: [subjectDid],
+            pin: input.pin,
+            idToken: input.idToken,
+            activationCode: input.order.activationCode,
+            controllerRelatedPersonIdentifier: input.order.controllerRelatedPersonIdentifier,
+            redirectUris: input.redirectUris,
+            clientName: input.clientName,
+        });
+    }
     /**
      * Resolves the canonical IPS author/attester projection from one owned
      * profile without exposing its protected wallet material to the portal.
@@ -90,13 +126,17 @@ export class ServerProfileSessionManager {
         if (!identity) {
             throw new Error('Self individual-controller enrollment requires the registered individual identity.');
         }
+        const controllerActorDid = String(identity.controllerActorDid || '').trim();
+        if (!controllerActorDid) {
+            throw new Error('Self individual-controller enrollment requires the registered controller actor DID.');
+        }
         return this.enroll({
             ownerId: input.ownerId,
             profileId: input.profileId,
             actorKind: ActorKinds.IndividualController,
             actorMode: 'self',
-            actorDid: identity.subjectDid,
-            profileDid: identity.subjectDid,
+            actorDid: controllerActorDid,
+            profileDid: controllerActorDid,
             providerDid: identity.providerDidWeb,
             routeContext: input.routeContext,
             allowedSubjectDids: [identity.subjectDid],
@@ -183,8 +223,12 @@ export class ServerProfileSessionManager {
         const activation = await client.activateProfileDeviceWithActivationRequest(activationRequest);
         const dcrBody = terminalBody(activation.dcr.poll.body);
         const clientId = findText(dcrBody, ['client_id', 'clientId']);
-        if (!clientId)
-            throw new Error('GW DCR did not return client_id.');
+        if (!clientId) {
+            const diagnostics = findText(dcrBody, ['diagnostics', 'details', 'message']);
+            throw new Error(diagnostics
+                ? `GW DCR failed: ${diagnostics}`
+                : 'GW DCR did not return client_id.');
+        }
         const deviceDid = findText(dcrBody, ['device_did', 'deviceDid', 'did']) || clientId;
         const now = this.now();
         const managedVpToken = input.vpToken || (input.professionalProof

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-sdk-node-ts",
-  "version": "2.9.12",
+  "version": "2.9.14",
   "description": "Next-generation Node runtime package for the GDC SDK family",
   "license": "Apache-2.0",
   "author": "Antifraud Services Inc.",
@@ -15,7 +15,7 @@
     "prepare": "npm run build",
     "type-check": "tsc -p tsconfig.json --noEmit && tsc -p docs/snippets/tsconfig.json",
     "check:product-neutrality": "node scripts/check-product-neutrality.mjs",
-    "prepublishOnly": "npm run check:product-neutrality && npm run type-check && npm test",
+    "prepublishOnly": "npm run check:product-neutrality && npm run type-check && npm test && npm run test:e2e:live-full-cycle",
     "local:close": "PORTS=3000 bash ./scripts/local-close.sh",
     "docker:close": "PORTS=8000 bash ./scripts/local-close.sh",
     "test": "npm run build && node --test tests/*.test.mjs",
@@ -38,8 +38,8 @@
     "test:e2e:live-gw:clean": "bash ./scripts/run-live-gw-clean.sh"
   },
   "dependencies": {
-    "gdc-common-utils-ts": "2.9.10",
-    "gdc-sdk-core-ts": "2.9.8"
+    "gdc-common-utils-ts": "2.9.14",
+    "gdc-sdk-core-ts": "2.9.9"
   },
   "devDependencies": {
     "@types/node": "^20.14.10",