dataspace-client-sdk-node 0.2.0 → 0.2.2

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,353 +1,23 @@
 # dataspace-client-sdk-node
 
-Node.js SDK to consume GW/UNID async DIDComm plain endpoints.
-
-**[→ Full API Reference](docs/API.md)**
-**[→ Data Model Alignment (GW + Chat + SDK)](docs/DATA_MODEL_ALIGNMENT.md)**
-**[→ Frontend/Backend SDK Ownership Matrix](../docs/SDK_AUTH_OWNERSHIP.md)**
-**[→ Developer Use-Case Cookbook (UC5 + additional patterns)](docs/DEVELOPER_USE_CASES.md)**
-**[→ Live Local GW UC5 E2E (no mocks)](docs/E2E_LOCAL_GW_UC5.md)**
-**[→ React Web Integration Guide](docs/REACT_WEB_INTEGRATION.md)**
-**[→ Backend Node Integration Guide](docs/BACKEND_NODE_INTEGRATION.md)**
-**[→ Portal Backend Integration Handover](docs/PORTAL_BACKEND_INTEGRATION_HANDOVER.md)**
-
-## Onboarding flows (split by business case)
-
-Do not mix these two flows in the same narrative:
-
-1. Legal Organization Onboarding (B2B/tenant/controller)
-2. Personal Organization Onboarding (individual/family/subject)
-
-### 1) Legal Organization Onboarding (B2B/tenant/controller)
-
-Canonical order when ICA proof is involved:
-
-1. ICA proof/verification (`_verify`, external to this SDK).
-2. GW activation in host registry: `Organization/_activate`.
-3. Offer/Order phase for legal organization onboarding (always; if amount is 0, no payment step).
-4. Device onboarding (DCR): `identity/openid/Device/_dcr`.
-5. Post-DCR token exchange / SMART authorization for protected API calls.
-
-Node SDK helpers:
-- `activateOrganizationInGatewayFromIcaProof(...)` (UC5.2)
-- `activateEmployeeDeviceWithActivationCode(...)` (UC5.4)
-- `authenticateBackendPkceAndExchange(...)` or `authenticateBackendSmartStandard(...)`
-
-### 2) Personal Organization Onboarding (individual/family/subject)
-
-Canonical order:
-
-1. Personal/family registration: `individual/org.schema/Organization/_batch`.
-2. Offer acceptance/order confirmation: `individual/org.schema/Order/_batch`.
-3. Continue with consent + subject data workflows.
-
-Node SDK helper:
-- `bootstrapSubjectOrganizationIndex(...)` (UC5.1: registration + optional order confirmation)
-
-See:
-- `docs/DEVELOPER_USE_CASES.md` (UC5.1..UC5.7)
-- `docs/E2E_BOOTSTRAP.md` (host activation bootstrap)
-
-## Scope
-- Generic async batch client (`_batch` + `_batch-response`) and JSON POST helper.
-- Route builders that cover Swagger v1 route families:
-  - `host/registry`: `Organization _batch/_activate`, `Order`,
-  - `entity`: `Employee`,
-  - `identity`: `Device/_dcr`, `Token/_exchange`, `License/_issue`, SMART token, Firebase custom token,
-  - `individual`: `Organization`, `Order`, `Person (legacy)`, `Consent`, `Composition`, `Communication`, `RelatedPerson`, `Observation`, `Task`,
-  - `digitaltwin`: `Composition` (`org.hl7.fhir.api` and `org.hl7.fhir.r4`),
-  - debug UHC task endpoints: `_call-start`, `_logs`.
-
-## Claims Placement Contract
-- Canonical batch-entry claims location: `entry.resource.meta.claims`.
-- Legacy compatibility location: `entry.meta.claims`.
-- This SDK now emits both during migration; new consumers should read/write `resource.meta.claims`.
-
-## Install (local workspace)
-
-```bash
-cd tools/dataspace-client-sdk-node
-npm install
-npm run type-check
-npm run build
-```
-
-## Tests (mocked, no network)
-
-The SDK includes mocked tests (Python-SDK style) for:
-- route/path building,
-- async `submit + poll`,
-- multipart conversion upload.
-
-Run:
-```bash
-cd sdk/dataspace-client-sdk-node
-
-npm test
-
-```
-
-
-```ts
-import { DataspaceNodeClient, createDidcommPlainMessage } from './dist/index.js';
-const client = new DataspaceNodeClient({
-  baseUrl: 'http://localhost:3000',
-  bearerToken: 'demo-token',
-});
-
-const ctx = { tenantId: 'acme', jurisdiction: 'ES', sector: 'health-care' };
-  iss: 'adult1@example.com',
-  aud: 'did:web:api.acme.org',
-  body: {
-    data: [
-      {
-        type: 'Family-registration-form-v1.0',
-        meta: {
-          claims: {
-            '@context': 'org.schema',
-            '@type': 'template',
-            'org.schema.Organization.address.addressCountry': 'ES',
-            'org.schema.Organization.identifier.additionalType': 'UUID',
-            'org.schema.Organization.identifier.value': 'f0d4b66d-7e28-4fa2-91b7-7041e57f4f90',
-            'org.schema.Person.email': 'adult1@example.com',
-            'org.schema.Service.category': 'health-care',
-            'org.schema.Service.identifier': 'did:web:api-provider.example.com',
-            'org.schema.Service.serviceType': 'http://terminology.hl7.org/CodeSystem/v3-ActReason|SRVC',
-            'org.schema.Service.termsOfService': 'https://provider.example.com/terms',
-          },
-        },
-      },
-    ],
-  },
-});
-
-const submitPath = client.individualFamilyOrganizationBatchPath(ctx);
-const pollPath = client.individualFamilyOrganizationPollPath(ctx);
-const result = await client.submitAndPoll(submitPath, pollPath, payload);
-console.log(result.poll.status, result.poll.body);
-```
-
-## Backend auth: identity-exchange.v1 (B2B PKCE flow)
-
-For server-to-server integration (e.g. `uhc-unid-chat-node` calling the GW), the SDK implements the
-full `identity-exchange.v1` flow: DCR binding → PKCE code → token → SMART bearer exchange.
-
-This is the Node equivalent of Python's `authenticate_backend_pkce_and_exchange` in `connector-sdk-py`.
-
-**Prerequisites:**
-1. Your tenant org is activated in the GW (`registry/org.schema/Organization/_activate` with ICA VC).
-2. An API key with the required scopes has been issued by ICA (`identity/api-key/_create`).
-3. You have your service's public JWK (EC P-384 recommended).
-
-**Usage:**
-
-```ts
-import { DataspaceNodeClient } from './dist/index.js';
-
-const client = new DataspaceNodeClient({ baseUrl: 'https://gw.example.com' });
-
-const ctx = { tenantId: 'acme', jurisdiction: 'ES', sector: 'health-care' };
-
-// Run once per key pair; result is cached automatically.
-const auth = await client.authenticateBackendPkceAndExchange({
-  ctx,
-  apiKey: process.env.GW_API_KEY!,
-  controllerPublicJwk: JSON.parse(process.env.GW_PUBLIC_JWK!),
-  scopes: ['onboarding', 'family-registration', 'license-order'],
-  endpointId: 'chatbot-main', // cache key; re-auth on expiry is automatic
-});
-
-if (auth.status === 'failed') {
-  throw new Error(`Backend auth failed at step: ${auth.step}`);
-}
-
-// Use the bearer for subsequent requests:
-const authedClient = new DataspaceNodeClient({
-  baseUrl: 'https://gw.example.com',
-  bearerToken: auth.accessToken,
-});
-```
-
-**Demo / local bypass (never for production):**
-
-```ts
-// .env: SECURITY_MODE=demo  GW_AUTH_BEARER=static-demo-token
-const client = new DataspaceNodeClient({
-  baseUrl: process.env.BASE_URL!,
-  bearerToken: process.env.GW_AUTH_BEARER, // skip identity-exchange.v1 entirely
-});
-```
-
-## Backend auth: smart-backend.v1 (client_credentials + private_key_jwt)
-
-For direct OAuth2 machine-to-machine flows (bypassing the PKCE device flow), use the
-`smart-backend.v1` profile. The SDK signs the `client_assertion` JWT locally using an
-in-memory ES384 wallet.
-
-This is the Node equivalent of Python's `authenticate_backend_smart_standard` in
-`connector-sdk-py`.
-
-**Usage:**
-
-```ts
-import { DataspaceNodeClient, MemoryWalletProvider } from './dist/index.js';
-
-const wallet = new MemoryWalletProvider();
-
-// walletContext scopes the key pair. Use the service's logical identity.
-const walletContext = { tenantId: 'service-a', jurisdiction: 'ES', sector: 'health-care' };
-
-const client = new DataspaceNodeClient({
-  baseUrl: 'https://gw.example.com',
-  wallet,
-});
-
-// On first call, authenticates. On subsequent calls within token TTL, returns cached.
-const result = await client.authenticateBackendSmartStandard({
-  clientId: 'service-a',
-  scopes: ['system/*.read', 'system/*.write'],
-  walletContext,
-  // tokenUrl: optional absolute URL; defaults to `${baseUrl}/token`
-  // audience: optional; defaults to the resolved tokenUrl
-  // assertionTtlSeconds: optional; defaults to 300
-});
-
-if (result.status === 'failed') {
-  throw new Error(`smart-backend.v1 auth failed: HTTP ${result.statusCode}`);
-}
-
-const authedClient = new DataspaceNodeClient({
-  baseUrl: 'https://gw.example.com',
-  bearerToken: result.accessToken,
-});
-```
-
-**How it works internally:**
-1. `MemoryWalletProvider` generates a dedicated EC P-384 key (`use: sig`, `alg: ES384`).
-2. `signCompactJws(...)` produces the `client_assertion` JWT signed with that key.
-3. A single `client_credentials` POST to the token endpoint returns the bearer.
-4. The token is cached until 30s before expiry; subsequent calls return `status: 'cached'`.
-
-## DIDComm encrypted (nested JWS-in-JWE)
-
-For GW endpoints that require `application/didcomm-encrypted+json`, use `submitBatchEncrypted`.
-This implements the nested JOSE pattern expected by the backend: sign first (ES384 compact JWS),
-then encrypt (ML-KEM-768 + A256GCM compact JWE with `cty: JWS`).
-
-Requires a wallet provider and the recipient's ML-KEM-768 encryption JWK (from GW
-`.well-known/jwks.json`, `use: enc`). The `MemoryWalletProvider` generates ML-KEM-768 keys
-automatically — no RSA setup required.
-
-### ML-KEM-768 JWK format
-
-Encryption keys use the OKP JWK type with `crv: "ML-KEM-768"`:
-
-```json
-{
-  "kty": "OKP",
-  "crv": "ML-KEM-768",
-  "use": "enc",
-  "alg": "ML-KEM-768",
-  "x": "<base64url-encoded 1184-byte public key>",
-  "kid": "wallet:acme:ES:health-care:abc123"
-}
-```
-
-The `encrypted_key` slot in the compact JWE is the 1088-byte ML-KEM ciphertext (base64url).
-The 32-byte shared secret derived by KEM encapsulation is used directly as the AES-256-GCM CEK.
-
-```ts
-import { DataspaceNodeClient, MemoryWalletProvider } from './dist/index.js';
-
-const wallet = new MemoryWalletProvider();
-const walletContext = { tenantId: 'acme', jurisdiction: 'ES', sector: 'health-care' };
-const client = new DataspaceNodeClient({ baseUrl: 'https://gw.example.com', wallet });
-
-// Wallet's own ML-KEM enc JWK (share with backend so it can encrypt to you):
-const [, encJwk] = await wallet.getPublicJwks(walletContext);
-
-// Fetch GW encryption JWK from well-known endpoint for outbound encryption:
-// const { keys } = await (await fetch('https://gw.example.com/.well-known/jwks.json')).json();
-// const recipientEncJwk = keys.find(k => k.use === 'enc' && k.crv === 'ML-KEM-768');
-
-// For local roundtrip test, use wallet's own enc key as recipient:
-const recipientEncJwk = encJwk;
-
-const payload = { thid: 'my-thid', body: { data: [] } };
-const result = await client.submitBatchEncrypted(
-  client.individualFamilyOrganizationBatchPath(ctx),
-  payload,
-  recipientEncJwk,
-  walletContext,
-);
-```
-
-**Cache helper** — if you need the current bearer without re-running the flow:
-
-```ts
-const bearer = client.getCachedBearerToken('chatbot-main');
-// Returns undefined if not cached or expired (>30s remaining).
-```
-
-Full runnable example: `examples/backend-pkce-auth.mjs`
-
-## Swagger parity strategy
-- For any v1 route exposed in Swagger, use:
-  - `client.v1Path(ctx, section, format, resourceType, action)` for tenant routes.
-  - `client.hostRegistryPath(ctx, resourceType, action)` for host registry routes.
-- Then call one of:
-  - `submitBundle(path, didcommPayload)` for DIDComm bundle submit routes (preferred),
-  - `submitBatch(path, didcommPayload)` (legacy alias, kept for compatibility),
-  - `submitLegacyJson(path, payload)` for non-DIDComm JSON routes,
-  - `pollBatchResponse(path, { thid })` / `pollUntilComplete(...)`,
-  - `postJson(path, payload)` for non-batch JSON routes.
-
-This avoids hardcoding curl scripts per endpoint.
-
-## Notes for telephony tests
-- Keep GW/UHC unit/integration tests direct (service/router level).
-- Use this SDK for consumer-style E2E tests and external Node.js service integrations.
-- If individual onboarding moves to a separate service, telephony tests should consume that service and only use GW/UHC for reminders/calls.
-
-## DataConversion / Excel
-
-This SDK now includes conversion helpers:
-- `conversionUploadPath(ctx, softwareId, sourceFormat)`
-- `conversionUploadPollPath(ctx, softwareId, sourceFormat)`
-- `uploadConversionFile({ path, fileName, fileContent, fields })`
-
-Example:
-- `examples/conversion-upload.mjs`
-
-Run:
-```bash
-cd sdk/dataspace-client-sdk-node
-npm run build
-BASE_URL="http://localhost:3000" \
-AUTH_BEARER="demo-token" \
-TENANT_ID="acme" \
-JURISDICTION="ES" \
-SECTOR="animal-care" \
-SOFTWARE_ID="excel-adapter" \
-SOURCE_FORMAT="xlsx" \
-SOURCE_FILE="/absolute/path/to/input.xlsx" \
-node examples/conversion-upload.mjs
-```
-
-Notes:
-- Exact multipart field names may vary by DataConversion deployment.
-- If your conversion API is synchronous, polling is optional.
-- If it is async, provide/resolve `thid` and poll `.../_upload-response`.
-
-## Next planned additions
-- Typed payload builders per flow (`family`, `relatedPerson`, `observation`, `task`).
-- Claims mappers (`ClaimName` <-> SQL internal name with `_`).
-- Retry/backoff + richer error mapping.
-
-## Planning and Parity Docs
-
-- TODO / execution prompt: `TODO_PROMPT_NEXT_STEPS.md`
-- Node/Python API parity map: `SDK_PARITY_MAP.md`
-
-## Pending Compatibility TODO
-- See [SMART EHR compatibility TODO](docs/TODO_SMART_EHR_COMPAT.md).
+Node.js SDK to consume GW/UNID async DIDComm endpoints.
+
+## Documentation Index
+
+1. [Full API Reference](docs/API.md)
+2. [Data Model Alignment (GW + Chat + SDK)](docs/DATA_MODEL_ALIGNMENT.md)
+3. [Frontend/Backend SDK Ownership Matrix](../docs/SDK_AUTH_OWNERSHIP.md)
+4. [Developer Use-Case Cookbook (UC5 + additional patterns)](docs/DEVELOPER_USE_CASES.md)
+5. [Live Local GW UC5 E2E (no mocks)](docs/E2E_LOCAL_GW_UC5.md)
+6. [React Web Integration Guide](docs/REACT_WEB_INTEGRATION.md)
+7. [Backend Node Integration Guide](docs/BACKEND_NODE_INTEGRATION.md)
+8. [Controller Flow Step by Step](docs/CONTROLLER_FLOW_STEP_BY_STEP.md)
+9. [Legal Organization Flow Step by Step](docs/LEGAL_ORGANIZATION_FLOW_STEP_BY_STEP.md)
+10. [Practitioner Flow Step by Step](docs/PRACTITIONER_FLOW_STEP_BY_STEP.md)
+11. [Portal Backend Integration Handover](docs/PORTAL_BACKEND_INTEGRATION_HANDOVER.md)
+
+## TODO and Roadmap
+
+1. [Prompt Next Steps TODO](TODO_PROMPT_NEXT_STEPS.md)
+2. [SMART EHR Compatibility TODO](docs/TODO_SMART_EHR_COMPAT.md)
+3. [SDK Parity Map](../SDK_PARITY_MAP.md)