gdc-sdk-node-ts 2.9.16 → 2.9.18

package/dist/authorized-subject-directory.d.ts

@@ -20,10 +20,14 @@ export type AuthorizedIndividualSubjectDirectoryInput = Readonly<{
 /** One exact subject projection paired with its accepted grant metadata. */
 export type AuthorizedIndividualSubject = Readonly<{
     subjectDid: string;
+    /** Opaque provider resource id required for exact lifecycle operations. */
+    organizationId?: string;
     role?: string;
     /** Accepted provider grant claims; descriptive metadata, never action authority. */
     grantClaims: Readonly<Record<string, unknown>>;
     authorizationEvidenceId?: string;
+    /** Governed RelatedPerson identifier used as this subject relationship's attester. */
+    relatedPersonId?: string;
     issuerDid?: string;
     subjectClaims: Readonly<Record<string, unknown>>;
 }>;

package/dist/authorized-subject-directory.js

@@ -9,6 +9,7 @@ const CLAIM_PERSON_TELEPHONE = 'org.schema.Person.telephone';
 const CLAIM_ORGANIZATION_SAME_AS = 'org.schema.Organization.sameAs';
 const CLAIM_ORGANIZATION_OWNER_EMAIL = 'org.schema.Organization.owner.email';
 const CLAIM_ORGANIZATION_OWNER_TELEPHONE = 'org.schema.Organization.owner.telephone';
+const CLAIM_ORGANIZATION_OWNER_IDENTIFIER = 'org.schema.Organization.owner.identifier.value';
 const CLAIM_ORGANIZATION_MEMBER_ROLE = 'org.schema.Organization.member.role';
 const CLAIM_RELATED_PERSON_ROLE = 'RelatedPerson.role';
 const CLAIM_OCCUPATION_IDENTIFIER = 'org.schema.Person.hasOccupation.identifier.value';
@@ -42,7 +43,11 @@ export async function listAuthorizedIndividualSubjectsWithDeps(routeContext, inp
                 }],
         },
     }, input.pollOptions);
-    const ownedSubjects = readOwnedSubjects(ownerResult, { email, telephone });
+    const ownedSubjects = readOwnedSubjects(ownerResult, {
+        email,
+        telephone,
+        ownerRole: routeContext.sector === 'animal-care' ? 'RESPRSN' : undefined,
+    });
     const subjectsByDid = new Map(ownedSubjects.map((subject) => [subject.subjectDid, subject]));
     const licenseClaims = {
         '@context': SCHEMA_CONTEXT,
@@ -80,17 +85,19 @@ export async function listAuthorizedIndividualSubjectsWithDeps(routeContext, inp
                     }],
             },
         }, input.pollOptions);
-        const subjectClaims = readFirstClaims(organizationResult);
+        const { claims: subjectClaims, organizationId } = readFirstOrganization(organizationResult);
         if (String(subjectClaims[CLAIM_ORGANIZATION_SAME_AS] || '').trim() !== license.subjectDid) {
             return undefined;
         }
         return {
             subjectDid: license.subjectDid,
+            ...(organizationId ? { organizationId } : {}),
             ...(license.role ? { role: license.role } : {}),
             grantClaims: license.grantClaims,
             ...(license.authorizationEvidenceId
                 ? { authorizationEvidenceId: license.authorizationEvidenceId }
                 : {}),
+            ...(license.relatedPersonId ? { relatedPersonId: license.relatedPersonId } : {}),
             ...(license.issuerDid ? { issuerDid: license.issuerDid } : {}),
             subjectClaims,
         };
@@ -119,10 +126,14 @@ function readOwnedSubjects(result, verified) {
         const subjectDid = String(claims[CLAIM_ORGANIZATION_SAME_AS] || '').trim();
         if (!subjectDid)
             return [];
-        const role = String(claims[CLAIM_ORGANIZATION_MEMBER_ROLE] || '').trim();
+        const role = verified.ownerRole
+            || String(claims[CLAIM_ORGANIZATION_MEMBER_ROLE] || '').trim();
+        const relatedPersonId = String(claims[CLAIM_ORGANIZATION_OWNER_IDENTIFIER] || '').trim();
         return [{
                 subjectDid,
+                ...(String(resource?.id || '').trim() ? { organizationId: String(resource.id).trim() } : {}),
                 ...(role ? { role } : {}),
+                ...(relatedPersonId ? { relatedPersonId } : {}),
                 grantClaims: {},
                 subjectClaims: claims,
             }];
@@ -143,20 +154,28 @@ function readAcceptedLicenses(result) {
             .map((value) => value.trim().toUpperCase())
             .filter(Boolean);
         const occupation = String(claims[CLAIM_OCCUPATION_IDENTIFIER] || '').trim();
-        const role = relatedRoles.includes('CAREGIVER') ? 'CAREGIVER' : occupation;
+        const role = relatedRoles.includes('CAREGIVER')
+            ? 'CAREGIVER'
+            : relatedRoles[0] || occupation;
+        const relatedPersonId = String(meta.relatedPersonId || '').trim();
         return [{
                 subjectDid,
                 ...(role ? { role } : {}),
                 grantClaims: claims,
                 ...(meta.identifier ? { authorizationEvidenceId: String(meta.identifier) } : {}),
+                ...(relatedPersonId ? { relatedPersonId } : {}),
                 ...(meta.issuerDid ? { issuerDid: String(meta.issuerDid) } : {}),
             }];
     });
 }
-function readFirstClaims(result) {
+function readFirstOrganization(result) {
     const entry = readData(result)[0];
     const claims = entry?.resource?.meta?.claims || entry?.meta?.claims;
-    return claims && typeof claims === 'object' ? claims : {};
+    const organizationId = String(entry?.resource?.id || entry?.id || '').trim();
+    return {
+        claims: claims && typeof claims === 'object' ? claims : {},
+        ...(organizationId ? { organizationId } : {}),
+    };
 }
 function readData(result) {
     const pollBody = (result?.poll?.body || {});

package/dist/family-organization-search.d.ts

@@ -1,4 +1,4 @@
-import { type FamilyOrganizationSummary } from 'gdc-common-utils-ts/utils/family-organization-summary';
+import { type FamilyOrganizationSummary, type FamilyRegistrationStatus } from 'gdc-common-utils-ts/utils/family-organization-summary';
 import type { PollOptions, SubmitAndPollResult } from './orchestration/client-port.js';
 import type { RouteContext } from './individual-onboarding.js';
 export type FamilyOrganizationSearchInput = Readonly<{
@@ -19,7 +19,11 @@ export type OwnedFamilyOrganizationDirectoryInput = Readonly<{
 }>;
 export type OwnedFamilyOrganizationDirectoryEntry = Readonly<{
     resourceId: string;
-    alternateName: string;
+    /** Missing only for an owner-private registration draft. */
+    alternateName?: string;
+    status?: FamilyRegistrationStatus;
+    birthDate?: string;
+    missingFields?: string[];
     claims: Readonly<Record<string, unknown>>;
 }>;
 type SearchFamilyOrganizationWithDeps = {

package/dist/family-organization-search.js

@@ -1,6 +1,6 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
 import { readFamilyOrganizationSummaryFromResponseBody, } from 'gdc-common-utils-ts/utils/family-organization-summary';
-import { ClaimsOrganizationSchemaorg, ClaimsServiceSchemaorg } from 'gdc-common-utils-ts/constants';
+import { ClaimsOrganizationSchemaorg, ClaimsPersonSchemaorg, ClaimsServiceSchemaorg } from 'gdc-common-utils-ts/constants';
 import { resolvePollOptionsFromSeconds } from './poll-options.js';
 /**
  * Searches one existing family/individual organization registration by the
@@ -100,11 +100,35 @@ export async function listOwnedFamilyOrganizationsWithDeps(routeCtx, input, deps
         if (!((email && ownerEmail === email) || (telephone && ownerTelephone === telephone)))
             return [];
         const alternateName = String(resourceClaims[ClaimsOrganizationSchemaorg.alternateName] || '').trim();
-        if (!alternateName)
+        const rawStatus = String(resourceClaims['org.schema.FamilyRegistration.status'] || '').trim();
+        const status = isFamilyRegistrationStatus(rawStatus) ? rawStatus : undefined;
+        if (!alternateName && status !== 'draft_saved' && status !== 'resume_required')
             return [];
-        return [{ resourceId: String(resource.id), alternateName, claims: resourceClaims }];
+        const birthDate = String(resourceClaims[ClaimsPersonSchemaorg.birthDate]
+            || resourceClaims['org.schema.Organization.foundingDate']
+            || '').trim();
+        const missingFields = Array.isArray(resourceClaims['org.schema.FamilyRegistration.missingFields'])
+            ? resourceClaims['org.schema.FamilyRegistration.missingFields']
+                .map((value) => String(value || '').trim())
+                .filter(Boolean)
+            : [];
+        return [{
+                resourceId: String(resource.id),
+                ...(alternateName ? { alternateName } : {}),
+                ...(status ? { status } : {}),
+                ...(birthDate ? { birthDate } : {}),
+                ...(missingFields.length ? { missingFields } : {}),
+                claims: resourceClaims,
+            }];
     });
 }
+function isFamilyRegistrationStatus(value) {
+    return value === 'new_created'
+        || value === 'draft_saved'
+        || value === 'resume_required'
+        || value === 'already_exists'
+        || value === 'not_found';
+}
 function createRuntimeUuid() {
     const fromCrypto = globalThis.crypto?.randomUUID?.();
     if (fromCrypto) {

package/dist/individual-start.d.ts

@@ -6,6 +6,14 @@ import type { PollOptions, SubmitAndPollResult } from './orchestration/client-po
 import type { RouteContext } from './individual-onboarding.js';
 import type { OfferPreview } from './order-offer-summary.js';
 export type IndividualOrganizationRegistrationInput = {
+    /**
+     * Explicitly saves an owner-private, cardless registration draft.
+     *
+     * This is intended for accessible channels that captured a birth year/date
+     * but could not reliably capture the subject's name. It never authorizes an
+     * Order or public card by itself.
+     */
+    registrationIntent?: 'activate' | 'save-private-draft';
     /**
      * Preferred high-level input produced by `createIndividualOnboardingEditor()`.
      *
@@ -77,8 +85,17 @@ export type IndividualOrganizationRegistrationInput = {
 export type IndividualOrganizationBootstrapInput = IndividualOrganizationRegistrationInput;
 export type IndividualOrganizationRegistrationResult = {
     registration: SubmitAndPollResult;
-    offerId: string;
-    offerPreview: OfferPreview;
+    /**
+     * Owner-private Organization UUID returned by GW for a saved draft.
+     *
+     * It is not a public card identifier or DID and is present only when
+     * `registrationIntent` was `save-private-draft`.
+     */
+    draftId?: string;
+    /** Absent only for an explicitly requested owner-private draft. */
+    offerId?: string;
+    /** Absent only for an explicitly requested owner-private draft. */
+    offerPreview?: OfferPreview;
     /** Lifecycle state returned by GW for this registration receipt. */
     registrationStatus?: FamilyRegistrationStatus;
     /** False when the same family registration is already active. */

package/dist/individual-start.js

@@ -26,7 +26,8 @@ export async function registerIndividualOrganizationWithDeps(deps) {
      * routing/indexing contract for this flow.
      */
     const onboardingDraft = deps.input.onboardingDraft;
-    if (onboardingDraft && !hasSignedPdfEvidence(onboardingDraft)) {
+    const savesPrivateDraft = deps.input.registrationIntent === 'save-private-draft';
+    if (onboardingDraft && !hasSignedPdfEvidence(onboardingDraft) && !savesPrivateDraft) {
         const subjectAlternateName = String(onboardingDraft.formFields.subjectAlternateName
             || onboardingDraft.claims?.[ClaimsOrganizationSchemaorg.alternateName]
             || '').trim();
@@ -35,9 +36,16 @@ export async function registerIndividualOrganizationWithDeps(deps) {
         }
     }
     const alternateName = String(deps.input.alternateName || '').trim();
-    if (!onboardingDraft && !alternateName) {
+    if (!onboardingDraft && !alternateName && !savesPrivateDraft) {
         throw new Error('registerIndividualOrganization requires alternateName.');
     }
+    const draftClaims = {
+        ...(onboardingDraft?.claims || {}),
+        ...(deps.input.additionalClaims || {}),
+    };
+    if (!alternateName && savesPrivateDraft && !hasValidHumanBirthDate(draftClaims)) {
+        throw new Error('registerIndividualOrganization private draft requires a valid birth year or date.');
+    }
     const controllerEmail = String(deps.input.controllerEmail
         || onboardingDraft?.formFields.controllerEmail
         || onboardingDraft?.claims?.[ClaimsOrganizationSchemaorg.ownerEmail]
@@ -99,6 +107,23 @@ export async function registerIndividualOrganizationWithDeps(deps) {
     });
     const registration = await deps.submitAndPoll(deps.individualFamilyOrganizationBatchPath(deps.routeCtx), deps.individualFamilyOrganizationPollPath(deps.routeCtx), registrationPayload, pollOptions);
     deps.assertFirstDidcommEntrySuccess?.(registration, 'registerIndividualOrganization.registration');
+    const registrationSummary = readFamilyOrganizationSummaryFromResponseBody(registration.poll.body);
+    const registrationStatus = registrationSummary?.status;
+    if (savesPrivateDraft) {
+        if (registrationStatus !== 'draft_saved') {
+            throw new Error('registerIndividualOrganization failed: GW did not preserve the requested private draft.');
+        }
+        const draftId = String(registrationSummary?.organizationId || '').trim();
+        if (!draftId) {
+            throw new Error('registerIndividualOrganization failed: GW did not return the private draft id.');
+        }
+        return {
+            registration,
+            registrationStatus,
+            draftId,
+            orderConfirmationRequired: false,
+        };
+    }
     /**
      * Commercial contract for this SDK path:
      * - this helper targets the family/individual commercial bootstrap flow
@@ -112,12 +137,11 @@ export async function registerIndividualOrganizationWithDeps(deps) {
     if (!offerId) {
         throw new Error('registerIndividualOrganization failed: missing offerId in registration response.');
     }
-    const registrationSummary = readFamilyOrganizationSummaryFromResponseBody(registration.poll.body);
     return {
         registration,
         offerId,
         offerPreview: deps.getOfferPreviewFromResponse(registration),
-        registrationStatus: registrationSummary?.status,
+        registrationStatus,
         orderConfirmationRequired: registrationSummary?.status !== 'already_exists',
         identity: readIndividualOrganizationBootstrapIdentity(registration.poll.body, {
             controllerEmail,
@@ -125,6 +149,10 @@ export async function registerIndividualOrganizationWithDeps(deps) {
         }),
     };
 }
+function hasValidHumanBirthDate(claims) {
+    const birthDate = String(claims?.[ClaimsPersonSchemaorg.birthDate] || '').trim();
+    return /^(?:19|20)\d{2}(?:-(?:0[1-9]|1[0-2])(?:-(?:0[1-9]|[12]\d|3[01]))?)?$/.test(birthDate);
+}
 function canonicalControllerUuid(value) {
     const hexadecimal = normalizeUuid(String(value || '').trim());
     if (!hexadecimal) {

package/dist/node-runtime-client.d.ts

@@ -389,7 +389,10 @@ export declare class HttpRuntimeClient implements NodeRuntimeClient {
     /** Lists all individual Organizations owned by one verified account contact. */
     listOwnedFamilyOrganizations(ctx: RouteContext, input: OwnedFamilyOrganizationDirectoryInput): Promise<Readonly<{
         resourceId: string;
-        alternateName: string;
+        alternateName?: string;
+        status?: import("gdc-common-utils-ts").FamilyRegistrationStatus;
+        birthDate?: string;
+        missingFields?: string[];
         claims: Readonly<Record<string, unknown>>;
     }>[]>;
     /**

package/dist/server-profile-session.d.ts

@@ -7,10 +7,12 @@ import { type ClinicalCreatorBindingInput } from 'gdc-common-utils-ts/utils/fhir
 import { type AppInfo, type ConfidentialStorageProfile, type PollOptions, type SubmitAndPollResult, type ClinicalCreatorBinding, type ClinicalCreatorIpsExport, type ClinicalSourceAuthorSelection } from 'gdc-sdk-core-ts';
 import { OrganizationControllerSdk } from './orchestration/organization-controller-sdk.js';
 import { IndividualControllerSdk } from './orchestration/individual-controller-sdk.js';
+import { IndividualMemberSdk } from './orchestration/individual-member-sdk.js';
 import { ProfessionalSdk } from './orchestration/professional-sdk.js';
 import { DigitalTwinSdk } from './orchestration/digital-twin-sdk.js';
 import type { SmartTokenExchangeResult } from './smart-token.js';
 import type { DigitalTwinSearchInput, DigitalTwinSearchResult } from './digital-twin.js';
+import type { AuthorizedIndividualSubject, AuthorizedSubjectVerifiedContact } from './authorized-subject-directory.js';
 import type { IndividualOrganizationOrderResult, RouteContext } from './individual-onboarding.js';
 import type { IndividualOrganizationRegistrationResult } from './individual-start.js';
 import type { HostRouteContext } from './host-onboarding.js';
@@ -76,11 +78,21 @@ export type ServerProfileSessionRecord = Readonly<{
     sessionId: string;
     ownerId: string;
     profileId: string;
-    subjectDid: string;
+    /** Present only after the unlocked personal actor selects one authorized subject. */
+    subjectDid?: string;
     scopes: string[];
+    /** Exact directory results accepted for this unlocked actor session. */
+    authorizedSubjectDids?: string[];
+    /** Exact relationship projection returned by the encrypted directory. */
+    authorizedSubjects?: ServerAuthorizedSubjectGrant[];
+    /** Relationship used for the currently selected subject. */
+    actorMode?: ServerActorMode;
+    /** Subject-specific RelatedPerson assignment; never copied between cards. */
+    attester?: ServerProfileAttester;
     sealedUnlockedWalletSeed: string;
     sealedUnlockedVpToken?: string;
-    sealedAccessToken: string;
+    /** Present only after subject selection completes SMART authorization. */
+    sealedAccessToken?: string;
     expiresAt: string;
 }>;
 /** Persistence port; implementations must isolate environment and tenant data. */
@@ -246,6 +258,50 @@ export type ServerProfileUnlockInput = Readonly<{
     pin: string;
     idToken: string;
 }>;
+/** Unlocks one personal actor wallet before choosing any individual card. */
+export type ServerActorProfileUnlockInput = Readonly<{
+    ownerId: string;
+    profileId: string;
+    pin: string;
+}>;
+/** Refreshes the actor's exact GW directory through the unlocked DCR wallet. */
+export type ServerAuthorizedSubjectDirectoryInput = Readonly<{
+    ownerId: string;
+    sessionId: string;
+    idToken: string;
+    verifiedContact: AuthorizedSubjectVerifiedContact;
+}>;
+/** Selects one server-confirmed subject and exchanges only its SMART scopes. */
+export type ServerAuthorizedSubjectSelectionInput = Readonly<{
+    ownerId: string;
+    sessionId: string;
+    subjectDid: string;
+    scopes: string[];
+    idToken: string;
+}>;
+/** Server-owned relationship projection for one directory subject. */
+export type ServerAuthorizedSubjectGrant = Readonly<{
+    subjectDid: string;
+    actorMode: ServerActorMode;
+    attester?: ServerProfileAttester;
+}>;
+/** Wallet material available after PIN unlock but before subject selection. */
+export type ResolvedServerActorProfileSession = Readonly<{
+    sessionId: string;
+    profile: ServerProfileRecord;
+    authorizedSubjectDids: string[];
+    secureTransportAdapter: SecureDidcommTransportAdapter;
+    confidentialStorageAdapter: Readonly<{
+        protect(document: Readonly<{
+            id?: string;
+            content: unknown;
+        }>): Promise<unknown>;
+        unprotect(document: Readonly<{
+            id?: string;
+            jwe: string;
+        }>): Promise<unknown>;
+    }>;
+}>;
 /** Material available only during an authenticated, unexpired server session. */
 export type ResolvedServerProfileSession = Readonly<{
     sessionId: string;
@@ -253,6 +309,8 @@ export type ResolvedServerProfileSession = Readonly<{
     subjectDid: string;
     scopes: string[];
     accessToken: string;
+    /** Relationship authorization selected for this subject, not for the wallet. */
+    actorMode: ServerActorMode;
     /** Attester bound to this authenticated and unlocked profile. */
     attester?: ServerProfileAttester;
     secureTransportAdapter: SecureDidcommTransportAdapter;
@@ -303,6 +361,13 @@ export type OpenedServerIndividualController = Readonly<{
     /** Returns the protected RelatedPerson URI for FHIR document attestation. */
     getAttesterUriForDocs(): string;
 }>;
+/** Session-bound individual-member facade using the same personal actor wallet. */
+export type OpenedServerIndividualMember = Readonly<{
+    session: ResolvedServerProfileSession;
+    profile: ServerProfileRecord;
+    sdk: IndividualMemberSdk;
+    getAttesterUriForDocs(): string;
+}>;
 /** One-time self-controller enrollment. It never opens a working session. */
 export type ServerSelfIndividualControllerEnrollmentInput = Readonly<{
     ownerId: string;
@@ -483,6 +548,29 @@ export declare class ServerProfileSessionManager {
      */
     replaceProfilePinFromAuthorizedSecrets(input: ServerProfilePinReplacementInput): Promise<ServerProfileRecord>;
     unlock(input: ServerProfileUnlockInput): Promise<ResolvedServerProfileSession>;
+    /**
+     * Unlocks one personal actor wallet without selecting a card or requesting a
+     * subject SMART token. The returned opaque session can refresh the encrypted
+     * authorized-subject directory and then select any exact returned subject.
+     */
+    unlockActorProfile(input: ServerActorProfileUnlockInput): Promise<ResolvedServerActorProfileSession>;
+    /**
+     * Uses the already-unlocked registered wallet for the encrypted directory
+     * request, then replaces the session/profile subject list with exact GW
+     * results. The verified contact must come from the signed OpenID token.
+     */
+    refreshAuthorizedSubjects(input: ServerAuthorizedSubjectDirectoryInput): Promise<Readonly<{
+        session: ResolvedServerActorProfileSession;
+        subjects: AuthorizedIndividualSubject[];
+    }>>;
+    /**
+     * Exchanges SMART authorization for one subject returned by the encrypted
+     * directory. It reuses the same unlocked seed, profile, DCR client and
+     * opaque session; this operation deliberately accepts no PIN.
+     */
+    selectAuthorizedSubject(input: ServerAuthorizedSubjectSelectionInput): Promise<ResolvedServerProfileSession>;
+    /** Resolves an unlocked actor wallet whether or not a card is selected. */
+    resolveActorSession(ownerId: string, sessionId: string): Promise<ResolvedServerActorProfileSession>;
     /**
      * Renews the short SMART bearer while retaining the already-open server
      * wallet session. The caller must supply a fresh authenticated account
@@ -497,6 +585,8 @@ export declare class ServerProfileSessionManager {
      * browser.
      */
     openIndividualController(input: ServerIndividualControllerOpenInput): Promise<OpenedServerIndividualController>;
+    /** Opens an accepted caregiver/member relationship after exact subject selection. */
+    openIndividualMember(input: ServerIndividualControllerOpenInput): Promise<OpenedServerIndividualMember>;
     /**
      * Opens the high-level organization-controller API without exposing wallet,
      * DIDComm, DCR or HTTP-client plumbing to the integrating BFF.
@@ -520,6 +610,7 @@ export declare class ServerProfileSessionManager {
     private createClient;
     private createRegisteredProfileClient;
     private createWallet;
+    private resolveWalletState;
     /**
      * Upgrade legacy profiles deterministically after successful PIN unlock.
      * The protected seed already owns the storage pair, so migration neither

package/dist/server-profile-session.js

@@ -14,6 +14,7 @@ import { NodeManagedWallet } from './node-managed-wallet.js';
 import { NodeHttpClient } from './node-runtime-client.js';
 import { OrganizationControllerSdk } from './orchestration/organization-controller-sdk.js';
 import { IndividualControllerSdk } from './orchestration/individual-controller-sdk.js';
+import { IndividualMemberSdk } from './orchestration/individual-member-sdk.js';
 import { ProfessionalSdk } from './orchestration/professional-sdk.js';
 import { DigitalTwinSdk } from './orchestration/digital-twin-sdk.js';
 import { buildIdentityOpenIdSmartTokenPath } from './runtime-paths.js';
@@ -545,6 +546,183 @@ export class ServerProfileSessionManager {
         });
         return this.resolveSession(input.ownerId, sessionId);
     }
+    /**
+     * Unlocks one personal actor wallet without selecting a card or requesting a
+     * subject SMART token. The returned opaque session can refresh the encrypted
+     * authorized-subject directory and then select any exact returned subject.
+     */
+    async unlockActorProfile(input) {
+        let profile = await this.requireOwnedProfile(input.ownerId, input.profileId);
+        if (profile.actorKind !== ActorKinds.IndividualController) {
+            throw new Error('Actor-first unlock is restricted to personal individual profiles.');
+        }
+        const now = this.now();
+        if (profile.lockedUntil && new Date(profile.lockedUntil) > now) {
+            throw new Error('Profile is temporarily locked after failed PIN attempts.');
+        }
+        let seed;
+        let vpToken;
+        try {
+            seed = await openServerProfileSecret(profile.protectedWalletSeed, input.pin, `${profile.profileId}:wallet-seed`, this.options.sealer);
+            vpToken = profile.protectedVpToken
+                ? await openServerProfileSecret(profile.protectedVpToken, input.pin, `${profile.profileId}:vp-token`, this.options.sealer)
+                : undefined;
+        }
+        catch (reason) {
+            if (!(reason instanceof ProfilePinRejectedError))
+                throw reason;
+            const failures = profile.failedUnlocks + 1;
+            const max = this.options.maxFailedUnlocks ?? 5;
+            const lockedUntil = failures >= max
+                ? new Date(now.getTime() + (this.options.lockSeconds ?? 300) * 1000).toISOString()
+                : undefined;
+            await this.options.store.putProfile({
+                ...profile,
+                failedUnlocks: failures,
+                lockedUntil,
+                updatedAt: now.toISOString(),
+            });
+            throw new Error('Profile PIN rejected.');
+        }
+        profile = await this.ensureRequiredStorageProfile(profile, seed);
+        const sessionId = randomBytes(32).toString('base64url');
+        await this.options.store.putProfile({
+            ...profile,
+            failedUnlocks: 0,
+            lockedUntil: undefined,
+            updatedAt: now.toISOString(),
+        });
+        await this.options.store.putSession({
+            sessionId,
+            ownerId: input.ownerId,
+            profileId: profile.profileId,
+            scopes: [],
+            authorizedSubjectDids: [],
+            sealedUnlockedWalletSeed: await this.options.sealer.seal(seed, `${sessionId}:unlocked-wallet-seed`),
+            ...(vpToken ? {
+                sealedUnlockedVpToken: await this.options.sealer.seal(vpToken, `${sessionId}:unlocked-vp-token`),
+            } : {}),
+            expiresAt: new Date(now.getTime() + (this.options.sessionTtlSeconds ?? 300) * 1000).toISOString(),
+        });
+        return this.resolveActorSession(input.ownerId, sessionId);
+    }
+    /**
+     * Uses the already-unlocked registered wallet for the encrypted directory
+     * request, then replaces the session/profile subject list with exact GW
+     * results. The verified contact must come from the signed OpenID token.
+     */
+    async refreshAuthorizedSubjects(input) {
+        const actorSession = await this.resolveActorSession(input.ownerId, input.sessionId);
+        const idToken = String(input.idToken || '').trim();
+        if (!idToken)
+            throw new Error('Authorized-subject directory requires idToken.');
+        const walletState = await this.resolveWalletState(input.ownerId, input.sessionId);
+        const client = this.createRegisteredProfileClient(walletState.profile, walletState.wallet, walletState.context, idToken);
+        const subjects = await client.listAuthorizedIndividualSubjects(walletState.profile.routeContext, { verifiedContact: input.verifiedContact });
+        const authorizedSubjectDids = unique(subjects.map((subject) => subject.subjectDid));
+        const authorizedSubjects = subjects.map(toServerAuthorizedSubjectGrant);
+        const updatedProfile = {
+            ...actorSession.profile,
+            allowedSubjectDids: authorizedSubjectDids,
+            updatedAt: this.now().toISOString(),
+        };
+        await this.options.store.putProfile(updatedProfile);
+        const stored = await this.options.store.getSession(input.sessionId);
+        if (!stored || stored.ownerId !== input.ownerId)
+            throw new Error('Profile session not found.');
+        const { subjectDid: _previousSubjectDid, actorMode: _previousActorMode, attester: _previousAttester, sealedAccessToken: _previousAccessToken, ...actorOnlySession } = stored;
+        await this.options.store.putSession({
+            ...actorOnlySession,
+            authorizedSubjectDids,
+            authorizedSubjects,
+            scopes: [],
+        });
+        return {
+            session: await this.resolveActorSession(input.ownerId, input.sessionId),
+            subjects,
+        };
+    }
+    /**
+     * Exchanges SMART authorization for one subject returned by the encrypted
+     * directory. It reuses the same unlocked seed, profile, DCR client and
+     * opaque session; this operation deliberately accepts no PIN.
+     */
+    async selectAuthorizedSubject(input) {
+        const stored = await this.options.store.getSession(input.sessionId);
+        if (!stored || stored.ownerId !== input.ownerId)
+            throw new Error('Profile session not found.');
+        const subjectDid = String(input.subjectDid || '').trim();
+        if (!subjectDid || !(stored.authorizedSubjectDids || []).includes(subjectDid)) {
+            throw new Error('Subject is not authorized for this personal actor profile.');
+        }
+        const selectedGrant = stored.authorizedSubjects?.find((grant) => grant.subjectDid === subjectDid);
+        if (!selectedGrant) {
+            throw new Error('Subject relationship metadata is missing from this personal actor session.');
+        }
+        const idToken = String(input.idToken || '').trim();
+        if (!idToken)
+            throw new Error('Subject selection requires idToken.');
+        const scopes = unique(input.scopes);
+        if (!scopes.length)
+            throw new Error('Subject selection requires scopes.');
+        const walletState = await this.resolveWalletState(input.ownerId, input.sessionId);
+        const vpToken = stored.sealedUnlockedVpToken
+            ? await this.options.sealer.unseal(stored.sealedUnlockedVpToken, `${input.sessionId}:unlocked-vp-token`)
+            : undefined;
+        const smartTokenEndpoint = [
+            this.options.gatewayBaseUrl.replace(/\/+$/, ''),
+            buildIdentityOpenIdSmartTokenPath(walletState.profile.routeContext),
+        ].join('');
+        const assertion = await buildWalletClientAssertion(walletState.wallet, walletState.profile, smartTokenEndpoint, this.now());
+        const token = await this.createRegisteredProfileClient(walletState.profile, walletState.wallet, walletState.context, idToken).requestSmartToken({
+            ...walletState.profile.routeContext,
+            actorDid: walletState.profile.actorDid,
+            subjectDid,
+            clientId: walletState.profile.clientId,
+            issuer: walletState.profile.clientId,
+            audience: smartTokenEndpoint,
+            idToken,
+            vpToken,
+            vpTokenFallback: vpToken ? undefined : 'omit',
+            clientAssertion: assertion,
+            clientAssertionType: 'private_key_jwt',
+            smartTokenKind: 'openid-smart',
+            acrValues: profileSmartAcrValues(walletState.profile.actorKind),
+            scopes,
+            tokenCacheKey: `profile:${walletState.profile.profileId}:${subjectDid}:${scopes.join(',')}`,
+        });
+        if (token.status !== 'fetched' || !token.accessToken) {
+            throw new Error('SMART token exchange failed.');
+        }
+        const { attester: _previousSelectedAttester, ...sessionWithoutAttester } = stored;
+        await this.options.store.putSession({
+            ...sessionWithoutAttester,
+            subjectDid,
+            actorMode: selectedGrant.actorMode,
+            ...(selectedGrant.attester ? { attester: selectedGrant.attester } : {}),
+            scopes,
+            sealedAccessToken: await this.options.sealer.seal(token.accessToken, `${input.sessionId}:access-token`),
+        });
+        return this.resolveSession(input.ownerId, input.sessionId);
+    }
+    /** Resolves an unlocked actor wallet whether or not a card is selected. */
+    async resolveActorSession(ownerId, sessionId) {
+        const stored = await this.options.store.getSession(sessionId);
+        if (!stored || stored.ownerId !== ownerId)
+            throw new Error('Profile session not found.');
+        if (new Date(stored.expiresAt) <= this.now()) {
+            await this.options.store.deleteSession(sessionId);
+            throw new Error('Profile session expired.');
+        }
+        const state = await this.resolveWalletState(ownerId, sessionId);
+        return {
+            sessionId,
+            profile: state.profile,
+            authorizedSubjectDids: [...(stored.authorizedSubjectDids || [])],
+            secureTransportAdapter: state.secureTransportAdapter,
+            confidentialStorageAdapter: state.confidentialStorageAdapter,
+        };
+    }
     /**
      * Renews the short SMART bearer while retaining the already-open server
      * wallet session. The caller must supply a fresh authenticated account
@@ -562,6 +740,9 @@ export class ServerProfileSessionManager {
         if (!normalizedIdToken)
             throw new Error('Profile session refresh requires idToken.');
         const profile = await this.requireOwnedProfile(ownerId, session.profileId);
+        if (!session.subjectDid || !session.sealedAccessToken) {
+            throw new Error('Profile session has no selected subject.');
+        }
         this.requireSubject(profile, session.subjectDid);
         const seed = await this.options.sealer.unseal(session.sealedUnlockedWalletSeed, `${sessionId}:unlocked-wallet-seed`);
         const vpToken = session.sealedUnlockedVpToken
@@ -609,26 +790,22 @@ export class ServerProfileSessionManager {
             await this.options.store.deleteSession(sessionId);
             throw new Error('Profile session expired.');
         }
-        const profile = await this.requireOwnedProfile(ownerId, session.profileId);
-        const seed = await this.options.sealer.unseal(session.sealedUnlockedWalletSeed, `${sessionId}:unlocked-wallet-seed`);
-        const walletKeyDerivationId = profile.walletKeyDerivationId || profile.profileId;
-        const wallet = await this.createWallet(walletKeyDerivationId, seed);
-        const context = walletContext(walletKeyDerivationId);
+        if (!session.subjectDid || !session.sealedAccessToken) {
+            throw new Error('Profile session has no selected subject.');
+        }
+        const state = await this.resolveWalletState(ownerId, sessionId);
         return {
             sessionId,
-            profile,
+            profile: state.profile,
             subjectDid: session.subjectDid,
             scopes: session.scopes,
             accessToken: await this.options.sealer.unseal(session.sealedAccessToken, `${sessionId}:access-token`),
-            ...(profile.attester ? { attester: profile.attester } : {}),
-            secureTransportAdapter: {
-                pack: (message) => wallet.packForRecipientWithContext(bindTransportActor(message, profile.actorDid, profile.clientId), profile.providerDid, { context }),
-                unpack: async (jwe) => (await wallet.unpackWithContext(jwe, { context })).content,
-            },
-            confidentialStorageAdapter: {
-                protect: (document) => wallet.protectManagedConfidentialData(document, context),
-                unprotect: (document) => wallet.unprotectManagedConfidentialData(document, context),
-            },
+            actorMode: session.actorMode ?? state.profile.actorMode,
+            ...(session.attester
+                ? { attester: session.attester }
+                : (!session.authorizedSubjects && state.profile.attester ? { attester: state.profile.attester } : {})),
+            secureTransportAdapter: state.secureTransportAdapter,
+            confidentialStorageAdapter: state.confidentialStorageAdapter,
         };
     }
     /**
@@ -641,10 +818,10 @@ export class ServerProfileSessionManager {
         const session = await this.resolveSession(input.ownerId, input.sessionId);
         const profile = session.profile;
         if (profile.actorKind !== ActorKinds.IndividualController
-            || (profile.actorMode !== 'self' && profile.actorMode !== 'controller')) {
+            || (session.actorMode !== 'self' && session.actorMode !== 'controller')) {
             throw new Error('Profile is not an individual controller.');
         }
-        const profileAttester = profile.attester;
+        const profileAttester = session.attester;
         if (!profileAttester) {
             throw new Error('The opened individual-controller profile has no RelatedPerson attester.');
         }
@@ -672,6 +849,32 @@ export class ServerProfileSessionManager {
             },
         };
     }
+    /** Opens an accepted caregiver/member relationship after exact subject selection. */
+    async openIndividualMember(input) {
+        const session = await this.resolveSession(input.ownerId, input.sessionId);
+        if (session.profile.actorKind !== ActorKinds.IndividualController || session.actorMode !== 'member') {
+            throw new Error('Selected subject relationship is not an individual member.');
+        }
+        const attester = session.attester;
+        if (!attester) {
+            throw new Error('The selected individual-member relationship has no RelatedPerson attester.');
+        }
+        const client = new NodeHttpClient({
+            baseUrl: this.options.gatewayBaseUrl,
+            ctx: session.profile.routeContext,
+            bearerToken: session.accessToken,
+            fetchImpl: this.options.fetchImpl,
+            appInfo: this.options.appInfo,
+            transportProfile: TransportProfiles.DidcommEncryptedForm,
+            secureTransportAdapter: session.secureTransportAdapter,
+        });
+        return {
+            session,
+            profile: session.profile,
+            sdk: new IndividualMemberSdk(client),
+            getAttesterUriForDocs: () => attester.party.reference,
+        };
+    }
     /**
      * Opens the high-level organization-controller API without exposing wallet,
      * DIDComm, DCR or HTTP-client plumbing to the integrating BFF.
@@ -877,6 +1080,34 @@ export class ServerProfileSessionManager {
         });
         return wallet;
     }
+    async resolveWalletState(ownerId, sessionId) {
+        const session = await this.options.store.getSession(sessionId);
+        if (!session || session.ownerId !== ownerId)
+            throw new Error('Profile session not found.');
+        if (new Date(session.expiresAt) <= this.now()) {
+            await this.options.store.deleteSession(sessionId);
+            throw new Error('Profile session expired.');
+        }
+        const profile = await this.requireOwnedProfile(ownerId, session.profileId);
+        const seed = await this.options.sealer.unseal(session.sealedUnlockedWalletSeed, `${sessionId}:unlocked-wallet-seed`);
+        const walletKeyDerivationId = profile.walletKeyDerivationId || profile.profileId;
+        const wallet = await this.createWallet(walletKeyDerivationId, seed);
+        const context = walletContext(walletKeyDerivationId);
+        await requireRegisteredProfileKeys(wallet, context, profile);
+        return {
+            profile,
+            wallet,
+            context,
+            secureTransportAdapter: {
+                pack: (message) => wallet.packForRecipientWithContext(bindTransportActor(message, profile.actorDid, profile.clientId), profile.providerDid, { context }),
+                unpack: async (jwe) => (await wallet.unpackWithContext(jwe, { context })).content,
+            },
+            confidentialStorageAdapter: {
+                protect: (document) => wallet.protectManagedConfidentialData(document, context),
+                unprotect: (document) => wallet.unprotectManagedConfidentialData(document, context),
+            },
+        };
+    }
     /**
      * Upgrade legacy profiles deterministically after successful PIN unlock.
      * The protected seed already owns the storage pair, so migration neither
@@ -946,9 +1177,25 @@ async function requireRegisteredProfileKeys(wallet, context, profile) {
     if (!registeredKids.length || registeredKids.some((kid) => !derivedKids.has(kid))) {
         throw new Error('Authorized wallet seed does not match registered profile keys.');
     }
-    if (profile.clientInstanceId && !derivedKids.has(profile.clientInstanceId)) {
-        throw new Error('Authorized wallet seed does not match the registered client instance.');
-    }
+}
+function toServerAuthorizedSubjectGrant(subject) {
+    const role = String(subject.role || '').trim().toUpperCase().split(/[|/#:]/).at(-1) || '';
+    const actorMode = role === 'ONESELF'
+        ? 'self'
+        : role === 'RESPRSN'
+            ? 'controller'
+            : 'member';
+    const relatedPersonId = String(subject.relatedPersonId || '').trim();
+    return {
+        subjectDid: subject.subjectDid,
+        actorMode,
+        ...(relatedPersonId ? {
+            attester: buildProfileAttester({
+                assignmentIdentifier: relatedPersonId,
+                mode: CompositionAttesterModes.Personal,
+            }),
+        } : {}),
+    };
 }
 /** Keeps the OpenID proof class aligned with the durable actor profile. */
 function profileSmartAcrValues(actorKind) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-sdk-node-ts",
-  "version": "2.9.16",
+  "version": "2.9.18",
   "description": "Next-generation Node runtime package for the GDC SDK family",
   "license": "Apache-2.0",
   "author": "Antifraud Services Inc.",
@@ -38,7 +38,7 @@
     "test:e2e:live-gw:clean": "bash ./scripts/run-live-gw-clean.sh"
   },
   "dependencies": {
-    "gdc-common-utils-ts": "2.9.15",
+    "gdc-common-utils-ts": "2.9.16",
     "gdc-sdk-core-ts": "2.9.10"
   },
   "devDependencies": {