gdc-sdk-front-ts 2.1.2 → 2.3.0

package/README.md

@@ -7,8 +7,11 @@ profile/session runtime logic, or orchestration tests.
 Short rule:
 
 - `101` tests must stay didactic and step by step
-- reusable fixtures/types must come from `gdc-common-utils-ts` instead of
-  being repeated as frontend-local literals
+- `gdc-common-utils-ts` owns the canonical step-by-step editors/readers,
+  shared fixtures, and reusable payload examples
+- `gdc-sdk-front-ts` starts at `ProfileRuntime -> loadProfile(...) ->
+  workspace/session -> actor facade` and only then handles frontend runtime
+  orchestration
 
 Frontend runtime package for consuming the shared GDC SDK contracts in web or
 mobile apps.
@@ -39,7 +42,8 @@ If you are integrating this package for the first time, open these in order:
    Why `core`, `node`, and `front` are separate packages, what each one owns,
    and why frontend facades should mirror backend actor boundaries.
 1. [docs/101-SDK_INTEGRATION.md](./docs/101-SDK_INTEGRATION.md)
-  Real frontend/native setup, imports, `new ClientSDK(...)`,
+  Real frontend/native setup, injected runtime adapters, `loadProfile(...)`
+  into one loaded workspace/session, `new ClientSDK(...)`,
   `initializeCommunicationIdentity(...)`, `initializeSession(...)`, and the
   public actor entrypoints exposed by `ProfileManager.asXxx()`.
 2. [gdc-sdk-core-ts/docs/101-SDK_FLOWS.md](https://github.com/Global-DataCare/gdc-sdk-core-ts/blob/main/docs/101-SDK_FLOWS.md)
@@ -72,6 +76,8 @@ If you need the shortest path:
   [`ClientSDK`](src/ClientSDK.ts)
 - profile/session bootstrap:
   [`initializeSession(...)`](./docs/101-SDK_INTEGRATION.md)
+- loaded profile workspace bootstrap:
+  `new ProfileRuntime(...).loadProfile(...)`
 - first public actor entrypoints:
   `session.asHostOnboarding()`, `session.asOrganizationController()`,
   `session.asIndividualController()`, `session.asProfessional()`

package/dist/ClientSDK.d.ts

@@ -1,7 +1,7 @@
 import { ProfileManager } from './ProfileManager.js';
 import { ProfileRegistry } from './ProfileRegistry.js';
 import type { AppInfo, InitializeSessionParams, IVerifier, IVaultRepository, ProfileRegistryEntry, SdkConfig } from './types.js';
-import { type ResolvedAppInfo } from 'gdc-sdk-core-ts';
+import { type AuthorityResolution, type AuthorityResolutionInput, type AuthorityResolver, type ResolvedAppInfo } from 'gdc-sdk-core-ts';
 /**
  * Frontend-facing SDK entry point for profile/session bootstrapping, lightweight
  * provider discovery, and role-scoped session creation.
@@ -94,6 +94,16 @@ export declare class ClientSDK {
      * Clears the current in-memory session reference.
      */
     shutdownSession(): void;
+    /**
+     * Resolves one technical host/authority descriptor from business tenant
+     * context or one already-known subject/public identifier.
+     *
+     * Convenience rule:
+     * - browser/native callers should not have to handcraft `did:web`
+     * - pass a shared resolver when your app already preloaded one
+     * - without a resolver, the SDK falls back to the shared static/legacy rules
+     */
+    resolveAuthority(input: AuthorityResolutionInput, resolver?: AuthorityResolver): Promise<AuthorityResolution>;
     private resolveBaseUrl;
 }
 export type { InitializeSessionParams, ProfileRegistryEntry, };

package/dist/ClientSDK.js

@@ -1,7 +1,7 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
 import { ProfileManager } from './ProfileManager.js';
 import { ProfileRegistry } from './ProfileRegistry.js';
-import { buildAppHeaders, resolveAppInfo, } from 'gdc-sdk-core-ts';
+import { StaticAuthorityResolver, buildAppHeaders, resolveAppInfo, } from 'gdc-sdk-core-ts';
 /**
  * Frontend-facing SDK entry point for profile/session bootstrapping, lightweight
  * provider discovery, and role-scoped session creation.
@@ -154,6 +154,18 @@ export class ClientSDK {
     shutdownSession() {
         this.currentSession = null;
     }
+    /**
+     * Resolves one technical host/authority descriptor from business tenant
+     * context or one already-known subject/public identifier.
+     *
+     * Convenience rule:
+     * - browser/native callers should not have to handcraft `did:web`
+     * - pass a shared resolver when your app already preloaded one
+     * - without a resolver, the SDK falls back to the shared static/legacy rules
+     */
+    async resolveAuthority(input, resolver = new StaticAuthorityResolver()) {
+        return resolver.resolveAuthority(input);
+    }
     async resolveBaseUrl(source) {
         const raw = String(source || '').trim();
         if (!raw)

package/dist/ProfileManager.js

@@ -199,15 +199,18 @@ export class ProfileManager {
                 return this.individual.service.upsertRelatedPersonAndPoll(input.relatedPersonPayload, ctx.providerDid, ctx.requiredScope || '', ctx.idToken);
             },
             ingestCommunicationAndUpdateIndex: (ctx, input) => {
+                const communicationInput = input.communicationJob || input.communicationPayload;
+                if (!communicationInput)
+                    throw new Error('Clinical ingestion requires communicationJob.');
                 if (this.professional?.physician) {
-                    return this.professional.physician.ingestCommunicationAndUpdateIndex(input.communicationPayload, ctx.providerDid, ctx.requiredScope || '', ctx.idToken, input.pathFormatSegment);
+                    return this.professional.physician.ingestCommunicationAndUpdateIndex(communicationInput, ctx.providerDid, ctx.requiredScope || '', ctx.idToken, input.pathFormatSegment);
                 }
                 if (this.professional?.paramedic) {
-                    return this.professional.paramedic.ingestCommunicationAndUpdateIndex(input.communicationPayload, ctx.providerDid, ctx.requiredScope || '', ctx.idToken, input.pathFormatSegment);
+                    return this.professional.paramedic.ingestCommunicationAndUpdateIndex(communicationInput, ctx.providerDid, ctx.requiredScope || '', ctx.idToken, input.pathFormatSegment);
                 }
                 if (!this.individual?.service)
                     throw new Error('individual.service is not available for this profile.');
-                return this.individual.service.ingestCommunicationAndUpdateIndex(input.communicationPayload, ctx.providerDid, ctx.requiredScope || '', ctx.idToken, input.pathFormatSegment);
+                return this.individual.service.ingestCommunicationAndUpdateIndex(communicationInput, ctx.providerDid, ctx.requiredScope || '', ctx.idToken, input.pathFormatSegment);
             },
             generateDigitalTwinFromSubjectData: (ctx, input) => {
                 if (!this.individual?.service)

package/dist/front-clinical-runtime-client.d.ts

@@ -0,0 +1,69 @@
+import { type RenderedTransportRequest, type CommunicationClinicalFormatRenderers, type SecureDidcommTransportAdapter, type SubmitAndPollResult, type TransportProfile } from 'gdc-sdk-core-ts';
+import type { FrontClinicalBundleSearchInput, FrontCommunicationIngestionInput, FrontRouteContext, FrontRuntimeClient } from './orchestration/client-port.js';
+export type FrontClinicalCarrierResponse = Readonly<{
+    status: number;
+    body: unknown;
+    location?: string;
+    retryAfterMs?: number;
+}>;
+/**
+ * Carrier-neutral request. HTTP, an offline sync queue, Bluetooth or another
+ * local link receives the same already-rendered protected message.
+ */
+export type FrontClinicalCarrierRequest = Readonly<{
+    phase: 'submit' | 'poll';
+    path: string;
+    authorization: string;
+    message: RenderedTransportRequest;
+}>;
+export type FrontClinicalCarrier = Readonly<{
+    /** Deliver an already-rendered message without decrypting or rebuilding it. */
+    send(request: FrontClinicalCarrierRequest): Promise<FrontClinicalCarrierResponse>;
+}>;
+export type FrontClinicalRuntimeClientOptions = Readonly<{
+    carrier: FrontClinicalCarrier;
+    transportProfile?: TransportProfile;
+    secureTransportAdapter?: SecureDidcommTransportAdapter;
+    /** Product-supplied projections not owned by the generic frontend runtime. */
+    communicationFormatRenderers?: CommunicationClinicalFormatRenderers;
+    accessToken?: string;
+    pollIntervalMs?: number;
+    pollTimeoutMs?: number;
+}>;
+/**
+ * Direct browser/mobile implementation of the canonical Node clinical surface.
+ *
+ * The client owns message rendering, SMART bearer use, thread correlation and
+ * polling. The carrier owns delivery only. An offline-first carrier persists
+ * `request.message` byte-for-byte with its `thid`; a Bluetooth carrier relays
+ * that persisted JWE without seeing FHIR or wallet keys.
+ *
+ * A native confidential app must inject an unlocked wallet-backed
+ * `secureTransportAdapter`. It should protect that wallet with the same
+ * PIN-plus-device envelope described by the Node profile contract, replacing
+ * Cloud KMS with Keychain/Keystore rather than weakening the KDF.
+ */
+export declare class FrontClinicalRuntimeClient implements FrontRuntimeClient {
+    private readonly options;
+    private readonly profile;
+    constructor(options: FrontClinicalRuntimeClientOptions);
+    ingestCommunicationAndUpdateIndex(ctx: FrontRouteContext, input: FrontCommunicationIngestionInput): Promise<SubmitAndPollResult>;
+    searchClinicalBundle(ctx: FrontRouteContext, input: FrontClinicalBundleSearchInput): Promise<SubmitAndPollResult & {
+        thid: string;
+    }>;
+    getLatestIps(ctx: FrontRouteContext, subject: string): Promise<SubmitAndPollResult & {
+        thid: string;
+    }>;
+    private sendAndPoll;
+}
+/**
+ * Create the online HTTP carrier.
+ *
+ * Expo should inject a durable outbox carrier instead. That carrier may choose
+ * HTTP or Bluetooth at delivery time, but must preserve the rendered content
+ * type, exact form-encoded JWE and thread id.
+ */
+export declare function createFetchFrontClinicalCarrier(input: Readonly<{
+    baseUrl: string;
+    fetchImpl?: typeof fetch;
+}>): FrontClinicalCarrier;

package/dist/front-clinical-runtime-client.js

@@ -0,0 +1,214 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+import { TransportProfiles, decodeTransportResponse, renderCommunicationOutboxRequest, renderGatewayMessageRequest, renderTransportPollRequest, } from 'gdc-sdk-core-ts';
+/**
+ * Direct browser/mobile implementation of the canonical Node clinical surface.
+ *
+ * The client owns message rendering, SMART bearer use, thread correlation and
+ * polling. The carrier owns delivery only. An offline-first carrier persists
+ * `request.message` byte-for-byte with its `thid`; a Bluetooth carrier relays
+ * that persisted JWE without seeing FHIR or wallet keys.
+ *
+ * A native confidential app must inject an unlocked wallet-backed
+ * `secureTransportAdapter`. It should protect that wallet with the same
+ * PIN-plus-device envelope described by the Node profile contract, replacing
+ * Cloud KMS with Keychain/Keystore rather than weakening the KDF.
+ */
+export class FrontClinicalRuntimeClient {
+    constructor(options) {
+        this.options = options;
+        this.profile = options.transportProfile || TransportProfiles.DidcommPlainJson;
+    }
+    async ingestCommunicationAndUpdateIndex(ctx, input) {
+        if (!input.communicationJob) {
+            throw new Error('Direct clinical ingestion requires communicationJob.');
+        }
+        const route = requireDirectRoute(ctx);
+        const format = normalizeFormat(input.clinicalFormat || input.pathFormatSegment);
+        const profile = input.transportProfile || this.profile;
+        const submit = await renderCommunicationOutboxRequest(input.communicationJob, profile, this.options.secureTransportAdapter, {
+            clinicalFormat: input.clinicalFormat || input.pathFormatSegment || 'api',
+            formatRenderers: this.options.communicationFormatRenderers,
+        });
+        return this.sendAndPoll(ctx, resourcePath(route, format, 'Communication', '_batch'), resourcePath(route, format, 'Communication', '_batch-response'), submit, profile, input.pollOptions);
+    }
+    async searchClinicalBundle(ctx, input) {
+        const route = requireDirectRoute(ctx);
+        const profile = input.transportProfile || this.profile;
+        const thid = input.requestThid || `bundle-search-${runtimeUuid()}`;
+        const message = await renderGatewayMessageRequest({
+            thid,
+            body: {
+                resourceType: 'Bundle',
+                type: 'batch',
+                entry: [{ request: { method: 'GET', url: buildBundleSearchQuery(input) } }],
+            },
+        }, profile, this.options.secureTransportAdapter);
+        const result = await this.sendAndPoll(ctx, resourcePath(route, 'org.hl7.fhir.r4', 'Bundle', '_search'), resourcePath(route, 'org.hl7.fhir.r4', 'Bundle', '_search-response'), message, profile, input.pollOptions);
+        return { thid, ...result };
+    }
+    getLatestIps(ctx, subject) {
+        return this.searchClinicalBundle(ctx, {
+            subject,
+            section: 'LOINC|60591-5',
+            includedTypes: ['Composition', 'DocumentReference'],
+        });
+    }
+    async sendAndPoll(ctx, submitPath, pollPath, submitMessage, profile, pollOptions) {
+        const authorization = requireSmartBearer(ctx, this.options.accessToken);
+        const submitted = await this.options.carrier.send({
+            phase: 'submit',
+            path: submitPath,
+            authorization,
+            message: submitMessage,
+        });
+        const submit = { status: submitted.status, location: submitted.location, body: submitted.body };
+        if (submitted.status !== 202) {
+            const body = await decodeTransportResponse(submitted.body, profile, this.options.secureTransportAdapter);
+            return { submit, poll: { status: submitted.status, body, attempts: 1 } };
+        }
+        const started = Date.now();
+        const timeoutMs = pollOptions?.timeoutMs ?? this.options.pollTimeoutMs ?? 30000;
+        const intervalMs = pollOptions?.intervalMs ?? this.options.pollIntervalMs ?? 500;
+        let attempts = 0;
+        while (Date.now() - started <= timeoutMs) {
+            attempts += 1;
+            const pollMessage = await renderTransportPollRequest(submitMessage.thid, profile, this.options.secureTransportAdapter);
+            const response = await this.options.carrier.send({
+                phase: 'poll',
+                path: pollPath,
+                authorization,
+                message: pollMessage,
+            });
+            if (response.status !== 202) {
+                return {
+                    submit,
+                    poll: {
+                        status: response.status,
+                        body: await decodeTransportResponse(response.body, profile, this.options.secureTransportAdapter),
+                        attempts,
+                    },
+                };
+            }
+            await delay(response.retryAfterMs ?? intervalMs);
+        }
+        throw new Error(`Clinical transport polling timed out for thread '${submitMessage.thid}'.`);
+    }
+}
+/**
+ * Create the online HTTP carrier.
+ *
+ * Expo should inject a durable outbox carrier instead. That carrier may choose
+ * HTTP or Bluetooth at delivery time, but must preserve the rendered content
+ * type, exact form-encoded JWE and thread id.
+ */
+export function createFetchFrontClinicalCarrier(input) {
+    const baseUrl = input.baseUrl.replace(/\/$/, '');
+    const fetchImpl = input.fetchImpl || fetch;
+    return {
+        async send(request) {
+            const response = await fetchImpl(`${baseUrl}${request.path}`, {
+                method: 'POST',
+                headers: {
+                    Authorization: request.authorization,
+                    'Content-Type': request.message.contentType,
+                    Accept: request.message.accept,
+                },
+                body: typeof request.message.body === 'string'
+                    ? request.message.body
+                    : JSON.stringify(request.message.body),
+            });
+            const text = await response.text();
+            return {
+                status: response.status,
+                body: parseCarrierBody(text),
+                location: response.headers.get('location') || undefined,
+                retryAfterMs: parseRetryAfter(response.headers.get('retry-after')),
+            };
+        },
+    };
+}
+function requireDirectRoute(ctx) {
+    const tenantId = String(ctx.tenantId || '').trim();
+    const jurisdiction = String(ctx.jurisdiction || '').trim();
+    const sector = String(ctx.sector || '').trim();
+    if (!tenantId || !jurisdiction || !sector) {
+        throw new Error('Direct frontend clinical transport requires tenantId, jurisdiction and sector.');
+    }
+    return { tenantId, jurisdiction, sector };
+}
+function requireSmartBearer(ctx, fallback) {
+    const token = String(ctx.accessToken || fallback || '').trim();
+    if (!token)
+        throw new Error('Direct frontend clinical transport requires a SMART access token.');
+    return `Bearer ${token}`;
+}
+function resourcePath(route, format, resourceType, action) {
+    return `/${encodeURIComponent(route.tenantId)}/cds-${encodeURIComponent(route.jurisdiction)}/v1/${encodeURIComponent(route.sector)}/individual/${encodeURIComponent(format)}/${encodeURIComponent(resourceType)}/${encodeURIComponent(action)}`;
+}
+function normalizeFormat(value) {
+    const normalized = String(value || '').trim().toLowerCase();
+    if (!normalized || normalized === 'api' || normalized === 'org.hl7.fhir.api')
+        return 'org.hl7.fhir.api';
+    if (normalized === 'r4' || normalized === 'fhir.r4' || normalized === 'org.hl7.fhir.r4')
+        return 'org.hl7.fhir.r4';
+    if (/^org\.hl7\.fhir\.[a-z0-9.-]+$/.test(normalized))
+        return normalized;
+    throw new Error(`Unsupported Communication clinical format '${String(value || '')}'.`);
+}
+function buildBundleSearchQuery(input) {
+    const params = new URLSearchParams();
+    params.set('type', 'document');
+    params.set('subject', input.subject);
+    setCsv(params, 'composition.section', input.section);
+    setCsv(params, '_type', input.includedTypes);
+    if (input.date?.start)
+        params.set('start', input.date.start);
+    if (input.date?.end)
+        params.set('end', input.date.end);
+    setCsv(params, 'code', input.code);
+    setCsv(params, 'category', input.category);
+    setCsv(params, 'author', input.author);
+    if (input.thid)
+        params.set('thid', input.thid);
+    if (input.pthid)
+        params.set('pthid', input.pthid);
+    if (input.channelId)
+        params.set('channelId', input.channelId);
+    if (input.partOf)
+        params.set('part-of', input.partOf);
+    for (const [key, value] of Object.entries(input.extraSearchParams || {})) {
+        if (value !== undefined && value !== null && String(value).trim())
+            params.set(key, String(value));
+    }
+    return `Bundle?${params.toString()}`;
+}
+function setCsv(params, key, value) {
+    const normalized = (Array.isArray(value) ? value : value ? [value] : [])
+        .map((item) => String(item).trim())
+        .filter(Boolean)
+        .join(',');
+    if (normalized)
+        params.set(key, normalized);
+}
+function parseCarrierBody(value) {
+    if (!value)
+        return undefined;
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return value;
+    }
+}
+function parseRetryAfter(value) {
+    if (!value)
+        return undefined;
+    const seconds = Number(value);
+    return Number.isFinite(seconds) ? seconds * 1000 : undefined;
+}
+function runtimeUuid() {
+    return globalThis.crypto?.randomUUID?.() || `${Date.now()}-${Math.random().toString(16).slice(2)}`;
+}
+function delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, Math.max(0, ms)));
+}

package/dist/frontend-profile-workspace.d.ts

@@ -0,0 +1,62 @@
+import type { LoadedActorProfile, ProfileLoadRequest, SubjectIndexCompositionRequest, SubjectIndexConnectionRequest, TrustedDeviceRegistrationRequest } from 'gdc-sdk-core-ts';
+import { ProfileManager } from './ProfileManager.js';
+import type { FrontendProfileRuntimeClient, FrontendSubjectIndexCompositionResult, FrontendSubjectIndexConnectionResult, FrontendTrustedDeviceRegistrationResult } from './frontend-profile-runtime.js';
+import { HostOnboardingSdk } from './orchestration/host-onboarding-sdk.js';
+import { IndividualControllerSdk } from './orchestration/individual-controller-sdk.js';
+import { IndividualMemberSdk } from './orchestration/individual-member-sdk.js';
+import { OrganizationControllerSdk } from './orchestration/organization-controller-sdk.js';
+import { OrganizationEmployeeSdk } from './orchestration/organization-employee-sdk.js';
+import { PersonalSdk } from './orchestration/personal-sdk.js';
+import { ProfessionalSdk } from './orchestration/professional-sdk.js';
+import type { FrontRuntimeClient } from './orchestration/client-port.js';
+export type FrontendLoadedActorProfile = LoadedActorProfile & {
+    actorSession: ProfileManager;
+};
+export type LoadedProfile = FrontendLoadedActorProfile;
+/**
+ * Frontend loaded-profile workspace that keeps the login/profile bootstrap
+ * steps explicit and then exposes actor-scoped facades from that loaded
+ * profile.
+ */
+export declare class LoadedProfileWorkspace {
+    readonly profile: FrontendLoadedActorProfile;
+    readonly actorSession: ProfileManager;
+    private readonly profileRuntime;
+    private readonly facadeClient?;
+    constructor(profileRuntime: FrontendProfileRuntimeClient, loadedProfile: LoadedActorProfile, facadeClient?: FrontRuntimeClient);
+    registerTrustedDevice(input: TrustedDeviceRegistrationRequest): Promise<FrontendTrustedDeviceRegistrationResult>;
+    connectToSubjectIndex(input: SubjectIndexConnectionRequest): Promise<FrontendSubjectIndexConnectionResult>;
+    getSubjectIndexComposition(input: SubjectIndexCompositionRequest): Promise<FrontendSubjectIndexCompositionResult>;
+    asHostOnboarding(): HostOnboardingSdk;
+    asOrganizationController(): OrganizationControllerSdk;
+    asOrganizationEmployee(): OrganizationEmployeeSdk;
+    asIndividualController(): IndividualControllerSdk;
+    asIndividualMember(): IndividualMemberSdk;
+    asPersonal(): PersonalSdk;
+    asProfessional(): ProfessionalSdk;
+    private requireFacadeClient;
+}
+/**
+ * Frontend counterpart to the backend loaded-profile runtime:
+ * inject adapters once, load one protected profile, then work from the
+ * returned workspace/session facade instead of one-off helper calls.
+ */
+export declare class ProfileRuntime {
+    private readonly profileRuntime;
+    private readonly facadeClient?;
+    constructor(profileRuntime: FrontendProfileRuntimeClient, facadeClient?: FrontRuntimeClient | undefined);
+    loadProfile(input: ProfileLoadRequest): Promise<LoadedProfileWorkspace>;
+}
+export declare function createLoadedProfileWorkspace(profileRuntime: FrontendProfileRuntimeClient, loadedProfile: LoadedActorProfile, facadeClient?: FrontRuntimeClient): LoadedProfileWorkspace;
+/**
+ * @deprecated Prefer `LoadedProfileWorkspace`.
+ */
+export { LoadedProfileWorkspace as FrontendProfileWorkspace };
+/**
+ * @deprecated Prefer `ProfileRuntime`.
+ */
+export { ProfileRuntime as FrontendProfileWorkspaceRuntime };
+/**
+ * @deprecated Prefer `createLoadedProfileWorkspace`.
+ */
+export { createLoadedProfileWorkspace as createFrontendProfileWorkspace };

package/dist/frontend-profile-workspace.js

@@ -0,0 +1,129 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+import { ActorKinds, } from 'gdc-common-utils-ts/constants/actor-session';
+import { ProfileAppTypes } from 'gdc-common-utils-ts/constants';
+import { ProfileManager } from './ProfileManager.js';
+import { getFrontendSubjectIndexComposition, loadFrontendProfile, connectFrontendToSubjectIndex, registerFrontendTrustedDevice, } from './frontend-profile-runtime.js';
+import { HostOnboardingSdk } from './orchestration/host-onboarding-sdk.js';
+import { IndividualControllerSdk } from './orchestration/individual-controller-sdk.js';
+import { IndividualMemberSdk } from './orchestration/individual-member-sdk.js';
+import { OrganizationControllerSdk } from './orchestration/organization-controller-sdk.js';
+import { OrganizationEmployeeSdk } from './orchestration/organization-employee-sdk.js';
+import { PersonalSdk } from './orchestration/personal-sdk.js';
+import { ProfessionalSdk } from './orchestration/professional-sdk.js';
+function toSessionProfile(profile) {
+    const descriptor = profile.descriptor || {};
+    const id = String(descriptor.profileId
+        || descriptor.profileDid
+        || descriptor.subjectDid
+        || descriptor.providerDid
+        || 'frontend-profile').trim();
+    return {
+        id,
+        email: String(descriptor.email || '').trim(),
+        role: String(descriptor.actorRole || '').trim(),
+        providerDid: String(descriptor.providerDid || '').trim(),
+        appType: descriptor.appType || ProfileAppTypes.Family,
+        createdAt: new Date().toISOString(),
+    };
+}
+function requireActorKind(profile, actorKind) {
+    if (!profile.session.actorKinds.includes(actorKind)) {
+        throw new Error(`Loaded frontend profile does not expose actor kind '${actorKind}'.`);
+    }
+}
+function requirePersonalCapability(profile) {
+    if (profile.session.actorKinds.includes(ActorKinds.IndividualController)
+        || profile.session.actorKinds.includes(ActorKinds.IndividualMember)) {
+        return;
+    }
+    throw new Error('Loaded frontend profile does not expose one personal-capable actor kind.');
+}
+/**
+ * Frontend loaded-profile workspace that keeps the login/profile bootstrap
+ * steps explicit and then exposes actor-scoped facades from that loaded
+ * profile.
+ */
+export class LoadedProfileWorkspace {
+    constructor(profileRuntime, loadedProfile, facadeClient) {
+        this.profileRuntime = profileRuntime;
+        this.facadeClient = facadeClient;
+        this.actorSession = new ProfileManager(toSessionProfile(loadedProfile), String(loadedProfile.descriptor.providerDid || ''));
+        this.profile = {
+            ...loadedProfile,
+            actorSession: this.actorSession,
+        };
+    }
+    registerTrustedDevice(input) {
+        return registerFrontendTrustedDevice(this.profileRuntime, input);
+    }
+    connectToSubjectIndex(input) {
+        return connectFrontendToSubjectIndex(this.profileRuntime, input);
+    }
+    getSubjectIndexComposition(input) {
+        return getFrontendSubjectIndexComposition(this.profileRuntime, input);
+    }
+    asHostOnboarding() {
+        requireActorKind(this.profile, ActorKinds.HostOnboarding);
+        return new HostOnboardingSdk(this.requireFacadeClient('HostOnboardingSdk'));
+    }
+    asOrganizationController() {
+        requireActorKind(this.profile, ActorKinds.OrganizationController);
+        return new OrganizationControllerSdk(this.requireFacadeClient('OrganizationControllerSdk'));
+    }
+    asOrganizationEmployee() {
+        requireActorKind(this.profile, ActorKinds.OrganizationEmployee);
+        return new OrganizationEmployeeSdk(this.requireFacadeClient('OrganizationEmployeeSdk'));
+    }
+    asIndividualController() {
+        requireActorKind(this.profile, ActorKinds.IndividualController);
+        return new IndividualControllerSdk(this.requireFacadeClient('IndividualControllerSdk'));
+    }
+    asIndividualMember() {
+        requireActorKind(this.profile, ActorKinds.IndividualMember);
+        return new IndividualMemberSdk(this.requireFacadeClient('IndividualMemberSdk'));
+    }
+    asPersonal() {
+        requirePersonalCapability(this.profile);
+        return new PersonalSdk(this.requireFacadeClient('PersonalSdk'));
+    }
+    asProfessional() {
+        requireActorKind(this.profile, ActorKinds.Professional);
+        return new ProfessionalSdk(this.requireFacadeClient('ProfessionalSdk'));
+    }
+    requireFacadeClient(name) {
+        if (!this.facadeClient) {
+            throw new Error(`${name} requires one FrontRuntimeClient on the loaded frontend profile workspace.`);
+        }
+        return this.facadeClient;
+    }
+}
+/**
+ * Frontend counterpart to the backend loaded-profile runtime:
+ * inject adapters once, load one protected profile, then work from the
+ * returned workspace/session facade instead of one-off helper calls.
+ */
+export class ProfileRuntime {
+    constructor(profileRuntime, facadeClient) {
+        this.profileRuntime = profileRuntime;
+        this.facadeClient = facadeClient;
+    }
+    async loadProfile(input) {
+        const profile = await loadFrontendProfile(this.profileRuntime, input);
+        return new LoadedProfileWorkspace(this.profileRuntime, profile, this.facadeClient);
+    }
+}
+export function createLoadedProfileWorkspace(profileRuntime, loadedProfile, facadeClient) {
+    return new LoadedProfileWorkspace(profileRuntime, loadedProfile, facadeClient);
+}
+/**
+ * @deprecated Prefer `LoadedProfileWorkspace`.
+ */
+export { LoadedProfileWorkspace as FrontendProfileWorkspace };
+/**
+ * @deprecated Prefer `ProfileRuntime`.
+ */
+export { ProfileRuntime as FrontendProfileWorkspaceRuntime };
+/**
+ * @deprecated Prefer `createLoadedProfileWorkspace`.
+ */
+export { createLoadedProfileWorkspace as createFrontendProfileWorkspace };

package/dist/index.d.ts

@@ -13,7 +13,9 @@ export * from './ProfileRegistry.js';
 export * from './UserProfileIndexStore.js';
 export * from './ClientSDK.js';
 export * from './frontend-profile-runtime.js';
+export * from './frontend-profile-workspace.js';
 export * from './individual-controller-frontend-runtime.js';
+export * from './front-clinical-runtime-client.js';
 export * from './discovery/index.js';
 export * from './orchestration/client-port.js';
 export * from './orchestration/host-onboarding-sdk.js';

package/dist/index.js

@@ -14,7 +14,9 @@ export * from './ProfileRegistry.js';
 export * from './UserProfileIndexStore.js';
 export * from './ClientSDK.js';
 export * from './frontend-profile-runtime.js';
+export * from './frontend-profile-workspace.js';
 export * from './individual-controller-frontend-runtime.js';
+export * from './front-clinical-runtime-client.js';
 export * from './discovery/index.js';
 export * from './orchestration/client-port.js';
 export * from './orchestration/host-onboarding-sdk.js';

package/dist/individual-controller-frontend-runtime.d.ts

@@ -1,11 +1,17 @@
 import type { SubmitAndPollResult } from 'gdc-sdk-core-ts';
 import type { ProfileLoadRequest } from 'gdc-sdk-core-ts';
-import { type FrontendProfileRuntimeClient } from './frontend-profile-runtime.js';
-import { IndividualControllerSdk } from './orchestration/individual-controller-sdk.js';
+import type { ProfileManager } from './ProfileManager.js';
+import { type LoadedProfileWorkspace } from './frontend-profile-workspace.js';
+import type { FrontendProfileRuntimeClient } from './frontend-profile-runtime.js';
+import type { IndividualControllerSdk } from './orchestration/individual-controller-sdk.js';
 import type { FrontClinicalBundleSearchInput, FrontIndividualOrganizationBootstrapInput, FrontIndividualOrganizationConfirmOrderInput, FrontIndividualOrganizationStartResult, FrontRouteContext, FrontRuntimeClient } from './orchestration/client-port.js';
 import type { LoadedActorProfile } from 'gdc-sdk-core-ts';
 export type FrontendIndividualControllerProfile = {
-    profile: LoadedActorProfile;
+    profile: LoadedActorProfile & {
+        actorSession: ProfileManager;
+    };
+    workspace: LoadedProfileWorkspace;
+    actorSession: ProfileManager;
     sdk: IndividualControllerSdk;
 };
 /**

package/dist/individual-controller-frontend-runtime.js

@@ -1,7 +1,6 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
 import { ActorKinds } from 'gdc-common-utils-ts/constants/actor-session';
-import { loadFrontendProfile, } from './frontend-profile-runtime.js';
-import { IndividualControllerSdk } from './orchestration/individual-controller-sdk.js';
+import { ProfileRuntime, } from './frontend-profile-workspace.js';
 /**
  * First pragmatic frontend use-case wrapper on top of the generic v2 profile
  * runtime.
@@ -20,13 +19,15 @@ export class IndividualControllerFrontendRuntime {
      * actor capability before materializing the facade.
      */
     async loadProfile(input) {
-        const profile = await loadFrontendProfile(this.profileRuntime, input);
-        if (!profile.session.actorKinds.includes(ActorKinds.IndividualController)) {
+        const workspace = await new ProfileRuntime(this.profileRuntime, this.facadeClient).loadProfile(input);
+        if (!workspace.profile.session.actorKinds.includes(ActorKinds.IndividualController)) {
             throw new Error('Loaded frontend profile does not expose actor kind \'individual_controller\'.');
         }
         return {
-            profile,
-            sdk: new IndividualControllerSdk(this.facadeClient),
+            profile: workspace.profile,
+            workspace,
+            actorSession: workspace.actorSession,
+            sdk: workspace.asIndividualController(),
         };
     }
     /**