gdc-sdk-node-ts 0.12.0 → 2.0.4

package/dist/node-runtime-client.js

@@ -2,16 +2,20 @@
 // Always create JSDoc, do not use strings inline in keys nor values, use types instead, and reuse the data test examples.
 import fs from 'node:fs';
 import path from 'node:path';
-import { buildAppHeaders, createBootstrapFacade, resolveAppInfo, } from 'gdc-sdk-core-ts';
+import { DIDCOMM_DEFAULT_ACCEPT_HEADER, DIDCOMM_PLAINTEXT_JSON_MEDIA_TYPE, } from 'gdc-common-utils-ts/utils/didcomm-submit';
+import { buildLegalOrganizationVerificationGatewayRequestBundle, buildOrganizationDidBindingBundle, buildAppHeaders, createBootstrapFacade, resolveAppInfo, } from 'gdc-sdk-core-ts';
 import { buildConsentClaimsSimpleWithCid } from 'gdc-common-utils-ts/utils/consent';
+import { buildDidcommPlaintextTransportMetadata } from 'gdc-common-utils-ts/utils/activation-request';
 import { pollUntilCompleteWithMethod } from './async-polling.js';
 import { confirmLegalOrganizationOrderWithDeps, HostLifecycleRequestType, HostedTenantLifecycleRequestType, submitHostedTenantLifecycleWithDeps, } from './host-onboarding.js';
 import { confirmIndividualOrganizationOrderWithDeps, } from './individual-onboarding.js';
+import { ensureFamilyOrganizationRegistrationWithDeps, } from './family-organization-registration.js';
+import { searchFamilyOrganizationWithDeps } from './family-organization-search.js';
 import { requestSmartTokenWithDeps } from './smart-token.js';
 import { extractOfferIdFromResponseBody, extractOfferPreviewFromResponseBody, } from './order-offer-summary.js';
 import { confirmOrganizationLicenseOrderWithDeps } from './organization-license-order.js';
 import { startIndividualOrganizationWithDeps } from './individual-start.js';
-import { createOrganizationEmployeeWithDeps, disableIndividualMemberWithDeps, disableIndividualOrganizationWithDeps, disableOrganizationEmployeeWithDeps, listIndividualLicenseOffersWithDeps, listIndividualLicenseOrdersWithDeps, listIndividualLicensesWithDeps, listOrganizationLicenseOffersWithDeps, listOrganizationLicenseOrdersWithDeps, listOrganizationLicensesWithDeps, grantProfessionalAccessWithDeps, ingestCommunicationAndUpdateIndexWithDeps, purgeIndividualMemberWithDeps, purgeIndividualOrganizationWithDeps, purgeOrganizationEmployeeWithDeps, searchIndividualLicensesWithDeps, searchIndividualLicenseOffersWithDeps, searchIndividualLicenseOrdersWithDeps, searchOrganizationLicensesWithDeps, searchOrganizationLicenseOffersWithDeps, searchOrganizationLicenseOrdersWithDeps, searchOrganizationEmployeesWithDeps, searchClinicalBundleWithDeps, searchLatestIpsWithDeps, upsertRelatedPersonAndPollWithDeps, } from './resource-operations.js';
+import { createOrganizationEmployeeWithDeps, disableIndividualMemberWithDeps, disableIndividualOrganizationWithDeps, disableOrganizationEmployeeWithDeps, listIndividualLicenseOffersWithDeps, listIndividualLicenseOrdersWithDeps, listIndividualLicensesWithDeps, listOrganizationLicenseOffersWithDeps, listOrganizationLicenseOrdersWithDeps, listOrganizationLicensesWithDeps, grantProfessionalAccessWithDeps, ingestCommunicationAndUpdateIndexWithDeps, revokeProfessionalAccessWithDeps, searchCommunicationParticipantsWithDeps, purgeIndividualMemberWithDeps, purgeIndividualOrganizationWithDeps, purgeOrganizationEmployeeWithDeps, searchIndividualLicensesWithDeps, searchIndividualLicenseOffersWithDeps, searchIndividualLicenseOrdersWithDeps, searchOrganizationLicensesWithDeps, searchOrganizationLicenseOffersWithDeps, searchOrganizationLicenseOrdersWithDeps, searchOrganizationEmployeesWithDeps, searchClinicalBundleWithDeps, searchLatestIpsWithDeps, upsertRelatedPersonAndPollWithDeps, } from './resource-operations.js';
 import { submitAndPollWithMethods } from './orchestration/client-port.js';
 import { GwCoreLifecycleAction } from './constants/lifecycle.js';
 const bootstrapFacade = createBootstrapFacade();
@@ -82,7 +86,7 @@ export class HttpRuntimeClient {
      * Submits a batch payload to a gateway batch endpoint.
      */
     async submitBatch(path, payload) {
-        return this.postJson(path, payload, 'application/didcomm-plaintext+json');
+        return this.postJson(path, payload, DIDCOMM_PLAINTEXT_JSON_MEDIA_TYPE);
     }
     /**
      * Polls a batch-response endpoint until the GW reports a terminal state.
@@ -96,9 +100,67 @@ export class HttpRuntimeClient {
     async submitAndPoll(submitPath, pollPath, payload, pollOptions) {
         return submitAndPollWithMethods(this, submitPath, pollPath, payload, pollOptions);
     }
+    /**
+     * Starts the host-side legal-organization verification transaction that GW
+     * CORE forwards to ICA `_verify`.
+     *
+     * Runtime ownership:
+     * - builds the canonical shared business bundle from `sdk-core/common-utils`
+     * - keeps communication/runtime transport concerns at the outer message layer
+     * - keeps the controller business key inside the submitted bundle payload
+     *
+     * Flow separation:
+     * - `_transaction` is the new host onboarding step
+     * - this runtime does not chain `_activate` after `_transaction`
+     * - `_activate` remains available only for the older ICA `_verify` based flow
+     */
+    async submitLegalOrganizationVerificationTransaction(hostCtx, input, pollOptions) {
+        const thid = `organization-verification-transaction-${runtimeUuid()}`;
+        const jti = `organization-verification-transaction-jti-${runtimeUuid()}`;
+        const verificationBundle = buildLegalOrganizationVerificationGatewayRequestBundle(input);
+        const payload = this.wrapBundleAsGatewayTransactionMessage({
+            thid,
+            jti,
+            hostCtx,
+            bundle: verificationBundle,
+        });
+        return this.submitAndPoll(this.hostRegistryOrganizationTransactionPath(hostCtx), this.hostRegistryOrganizationTransactionPollPath(hostCtx), payload, pollOptions);
+    }
+    /**
+     * Submits one tenant-scoped DID document binding request.
+     *
+     * Binding semantics:
+     * - the tenant path identifies the existing organization
+     * - `organization.url` carries the public alias/domain list
+     * - `controller.sameAs` is optional corroborating identity material
+     * - the flow does not rotate or replace organization public keys
+     */
+    async submitOrganizationDidBinding(ctx, input, pollOptions) {
+        const thid = `organization-did-binding-${runtimeUuid()}`;
+        const jti = `organization-did-binding-jti-${runtimeUuid()}`;
+        const payload = {
+            jti,
+            thid,
+            type: 'application/api+json',
+            body: buildOrganizationDidBindingBundle(input),
+        };
+        return this.submitAndPoll(this.organizationDidBindingPath(ctx), this.organizationDidBindingPollPath(ctx), payload, pollOptions);
+    }
     /**
      * Activates a legal organization in the gateway host registry using an ICA
      * proof token already obtained by the caller.
+     *
+     * Plaintext transport note:
+     * - this Node runtime currently submits `_activate` as
+     *   `application/didcomm-plaintext+json`
+     * - because there is no real outer JWS/JWE envelope in that mode, the
+     *   runtime mirrors the technical communication metadata derived from
+     *   `controller.publicKeyJwk` / `controller.jwks` into `meta.jws.protected`
+     *   and `meta.jwe.header`
+     * - secure JOSE transports should carry those values in the real protected
+     *   headers instead of plaintext `meta`
+     * - this mirrored metadata is transport fallback only; the canonical
+     *   activation contract remains `body.vp_token` plus `body.controller.*`
      */
     async activateOrganizationInGatewayFromIcaProof(hostCtx, input, pollOptions) {
         const thid = `activate-org-${runtimeUuid()}`;
@@ -109,11 +171,16 @@ export class HttpRuntimeClient {
             additionalClaims: input.additionalClaims,
         });
         const serviceClaims = activationDraft.buildServiceClaims();
+        const transportMeta = buildDidcommPlaintextTransportMetadata({
+            controller: input.controller,
+            contentType: 'application/didcomm-plaintext+json',
+        });
         const payload = {
             thid,
             iss: String(hostCtx.controllerDid || '').trim() || undefined,
             aud: String(hostCtx.hostDid || '').trim() || undefined,
             type: 'application/api+json',
+            ...(transportMeta ? { meta: transportMeta } : {}),
             body: {
                 vp_token: input.vpToken,
                 ...(input.controller ? { controller: input.controller } : {}),
@@ -365,6 +432,38 @@ export class HttpRuntimeClient {
             getOfferPreviewFromResponse: (result) => extractOfferPreviewFromResponseBody(result.poll.body),
         });
     }
+    /**
+     * Searches one existing family/individual registration by controller phone +
+     * usualname, with optional birth-date disambiguation.
+     */
+    async searchFamilyOrganization(ctx, input) {
+        return searchFamilyOrganizationWithDeps({
+            routeCtx: ctx,
+            input,
+            defaultTimeoutMs: 20000,
+            defaultIntervalMs: 1000,
+            individualFamilyOrganizationSearchPath: this.individualFamilyOrganizationSearchPath.bind(this),
+            individualFamilyOrganizationSearchPollPath: this.individualFamilyOrganizationSearchPollPath.bind(this),
+            submitAndPoll: this.submitAndPoll.bind(this),
+        });
+    }
+    /**
+     * Searches one existing family/individual registration and starts the
+     * bootstrap flow only when the registration does not already exist.
+     */
+    async ensureFamilyOrganizationRegistration(ctx, input) {
+        return ensureFamilyOrganizationRegistrationWithDeps({
+            routeCtx: ctx,
+            input,
+            defaultTimeoutMs: 20000,
+            defaultIntervalMs: 1000,
+            individualFamilyOrganizationSearchPath: this.individualFamilyOrganizationSearchPath.bind(this),
+            individualFamilyOrganizationSearchPollPath: this.individualFamilyOrganizationSearchPollPath.bind(this),
+            individualFamilyOrganizationBatchPath: this.individualFamilyOrganizationTransactionPath.bind(this),
+            individualFamilyOrganizationPollPath: this.individualFamilyOrganizationTransactionPollPath.bind(this),
+            submitAndPoll: this.submitAndPoll.bind(this),
+        });
+    }
     /**
      * Confirms the order returned by `startIndividualOrganization(...)`.
      */
@@ -501,6 +600,17 @@ export class HttpRuntimeClient {
             submitAndPoll: this.submitAndPoll.bind(this),
         });
     }
+    /**
+     * Closes an existing professional consent by setting its period end and
+     * resubmitting the updated consent resource.
+     */
+    async revokeProfessionalAccess(ctx, input) {
+        return revokeProfessionalAccessWithDeps(ctx, input, {
+            individualConsentR4BatchPath: this.individualConsentR4BatchPath.bind(this),
+            individualConsentR4PollPath: this.individualConsentR4PollPath.bind(this),
+            submitAndPoll: this.submitAndPoll.bind(this),
+        });
+    }
     /**
      * Requests SMART/OpenID token material through the gateway.
      *
@@ -550,6 +660,17 @@ export class HttpRuntimeClient {
             submitAndPoll: this.submitAndPoll.bind(this),
         });
     }
+    /**
+     * Searches communication channel records by subject and participant
+     * identifiers through `Communication/_search`.
+     */
+    async searchCommunicationParticipants(ctx, input) {
+        return searchCommunicationParticipantsWithDeps(ctx, input, {
+            communicationSearchPath: this.individualCommunicationSearchPath.bind(this),
+            communicationSearchPollPath: this.individualCommunicationSearchPollPath.bind(this),
+            submitAndPoll: this.submitAndPoll.bind(this),
+        });
+    }
     /**
      * Alias for `ingestCommunicationAndUpdateIndex(...)`.
      *
@@ -648,7 +769,7 @@ export class HttpRuntimeClient {
         const headers = {
             ...this.defaultHeaders,
             'Content-Type': contentType,
-            Accept: 'application/json, application/didcomm-plaintext+json, */*',
+            Accept: DIDCOMM_DEFAULT_ACCEPT_HEADER,
         };
         if (this.bearerToken)
             headers.Authorization = `Bearer ${this.bearerToken}`;
@@ -723,18 +844,57 @@ export class HttpRuntimeClient {
             ? { tenantId, jurisdiction: input.jurisdiction, sector: input.sector }
             : undefined);
     }
+    /**
+     * Reuses the shared bundle business contract while keeping attachment
+     * transport fields at the DIDComm/plaintext message layer expected by GW.
+     */
+    wrapBundleAsGatewayTransactionMessage(input) {
+        const rawBundle = (input.bundle || {});
+        const attachments = Array.isArray(rawBundle.attachments) ? rawBundle.attachments : undefined;
+        const { attachments: _ignoredAttachments, ...body } = rawBundle;
+        return {
+            jti: input.jti,
+            thid: input.thid,
+            iss: String(input.hostCtx.controllerDid || '').trim() || undefined,
+            aud: String(input.hostCtx.hostDid || '').trim() || undefined,
+            type: 'application/api+json',
+            body,
+            ...(attachments && attachments.length > 0 ? { attachments } : {}),
+        };
+    }
     hostRegistryPath(ctx, resourceType, action) {
         const hostCtx = this.requireHostRouteContext(ctx);
         return `/host/cds-${encodeURIComponent(hostCtx.jurisdiction)}/v1/${encodeURIComponent(hostCtx.hostNetwork || '')}/registry/org.schema/${encodeURIComponent(resourceType)}/${encodeURIComponent(action)}`;
     }
+    /**
+     * Resolves the host route segment without forcing callers to remember whether
+     * the same raw string is named `hostNetwork` or `sector` in a given layer.
+     *
+     * Step by step:
+     * - host routes use `/host/cds-{jurisdiction}/v1/{host-network}`
+     * - tenant routes use `/{tenantId}/cds-{jurisdiction}/v1/{tenant-sector}`
+     * - older live tests and adapters sometimes passed the host segment under
+     *   `sector`, which is semantically wrong for host routes
+     * - new code should prefer `hostNetwork`
+     * - compatibility code may pass `hostNetworkOrTenantSector`
+     */
     requireHostRouteContext(ctx) {
+        const hostCtx = (ctx || {});
         const runtimeCtx = (this.ctx || {});
-        const jurisdiction = String(ctx?.jurisdiction || this.ctx?.jurisdiction || '').trim();
-        const hostNetwork = String(ctx?.hostNetwork || ctx?.sector || runtimeCtx.hostNetwork || runtimeCtx.sector || '').trim();
+        const jurisdiction = String(hostCtx.jurisdiction || this.ctx?.jurisdiction || '').trim();
+        const hostNetwork = String(hostCtx.hostNetwork
+            || hostCtx.hostNetworkOrTenantSector
+            || hostCtx.sector
+            || runtimeCtx.hostNetwork
+            || runtimeCtx.hostNetworkOrTenantSector
+            || runtimeCtx.sector
+            || '').trim();
         if (!jurisdiction || !hostNetwork)
             throw new Error('Host route context is required.');
         return { jurisdiction, hostNetwork };
     }
+    hostRegistryOrganizationTransactionPath(ctx) { return this.hostRegistryPath(ctx, 'Organization', GwCoreLifecycleAction.Transaction); }
+    hostRegistryOrganizationTransactionPollPath(ctx) { return this.hostRegistryPath(ctx, 'Organization', GwCoreLifecycleAction.TransactionResponse); }
     hostRegistryOrganizationActivatePath(ctx) { return this.hostRegistryPath(ctx, 'Organization', '_activate'); }
     hostRegistryOrganizationActivatePollPath(ctx) { return this.hostRegistryPath(ctx, 'Organization', '_activate-response'); }
     hostRegistryOrganizationDisablePath(ctx) { return this.hostRegistryPath(ctx, 'Organization', GwCoreLifecycleAction.Disable); }
@@ -749,6 +909,14 @@ export class HttpRuntimeClient {
     employeeSearchPollPath(ctx) { return this.v1Path(ctx, 'entity', 'org.schema', 'Employee', '_search-response'); }
     organizationLicenseSearchPath(ctx) { return this.v1Path(ctx, 'entity', 'org.schema', 'License', '_search'); }
     organizationLicenseSearchPollPath(ctx) { return this.v1Path(ctx, 'entity', 'org.schema', 'License', '_search-response'); }
+    organizationDidBindingPath(ctx) {
+        const resolved = this.requireRouteContext(ctx);
+        return `/${encodeURIComponent(resolved.tenantId)}/cds-${encodeURIComponent(resolved.jurisdiction)}/v1/${encodeURIComponent(resolved.sector)}/did/document/_binding`;
+    }
+    organizationDidBindingPollPath(ctx) {
+        const resolved = this.requireRouteContext(ctx);
+        return `/${encodeURIComponent(resolved.tenantId)}/cds-${encodeURIComponent(resolved.jurisdiction)}/v1/${encodeURIComponent(resolved.sector)}/did/document/_binding-response`;
+    }
     organizationLicenseOfferSearchPath(ctx) { return this.v1Path(ctx, 'entity', 'org.schema', 'Offer', '_search'); }
     organizationLicenseOfferSearchPollPath(ctx) { return this.v1Path(ctx, 'entity', 'org.schema', 'Offer', '_search-response'); }
     organizationLicenseOrderSearchPath(ctx) { return this.v1Path(ctx, 'entity', 'org.schema', 'Order', '_search'); }
@@ -757,6 +925,8 @@ export class HttpRuntimeClient {
     employeePurgePollPath(ctx) { return this.v1Path(ctx, 'entity', 'org.schema', 'Employee', `${GwCoreLifecycleAction.Purge}-response`); }
     individualFamilyOrganizationBatchPath(ctx) { return this.v1Path(ctx, 'individual', 'org.schema', 'Organization', GwCoreLifecycleAction.Batch); }
     individualFamilyOrganizationPollPath(ctx) { return this.v1Path(ctx, 'individual', 'org.schema', 'Organization', GwCoreLifecycleAction.BatchResponse); }
+    individualFamilyOrganizationSearchPath(ctx) { return this.v1Path(ctx, 'individual', 'org.schema', 'Organization', '_search'); }
+    individualFamilyOrganizationSearchPollPath(ctx) { return this.v1Path(ctx, 'individual', 'org.schema', 'Organization', '_search-response'); }
     individualFamilyOrganizationTransactionPath(ctx) { return this.v1Path(ctx, 'individual', 'org.schema', 'Organization', GwCoreLifecycleAction.Transaction); }
     individualFamilyOrganizationTransactionPollPath(ctx) { return this.v1Path(ctx, 'individual', 'org.schema', 'Organization', GwCoreLifecycleAction.TransactionResponse); }
     individualFamilyOrganizationDisablePath(ctx) { return this.v1Path(ctx, 'individual', 'org.schema', 'Organization', GwCoreLifecycleAction.Disable); }
@@ -779,6 +949,8 @@ export class HttpRuntimeClient {
     individualConsentR4PollPath(ctx) { return this.v1Path(ctx, 'individual', 'org.hl7.fhir.r4', 'Consent', '_batch-response'); }
     individualCommunicationBatchPath(ctx, format) { return this.v1Path(ctx, 'individual', format, 'Communication', '_batch'); }
     individualCommunicationPollPath(ctx, format) { return this.v1Path(ctx, 'individual', format, 'Communication', '_batch-response'); }
+    individualCommunicationSearchPath(ctx) { return this.v1Path(ctx, 'individual', 'org.hl7.fhir.r4', 'Communication', '_search'); }
+    individualCommunicationSearchPollPath(ctx) { return this.v1Path(ctx, 'individual', 'org.hl7.fhir.r4', 'Communication', '_search-response'); }
     individualBundleSearchPath(ctx) { return this.v1Path(ctx, 'individual', 'org.hl7.fhir.r4', 'Bundle', '_search'); }
     individualBundleSearchPollPath(ctx) { return this.v1Path(ctx, 'individual', 'org.hl7.fhir.r4', 'Bundle', '_search-response'); }
     identityTokenExchangePath(ctx) {

package/dist/orchestration/client-port.d.ts

@@ -1,4 +1,7 @@
 import type { ControllerBindingInput } from 'gdc-common-utils-ts/models';
+import type { FamilyOrganizationSummary } from 'gdc-common-utils-ts/utils/family-organization-summary';
+import type { LegalOrganizationVerificationTransactionInput } from 'gdc-common-utils-ts/utils/legal-organization-verification-transaction';
+import type { OrganizationDidBindingInput } from 'gdc-sdk-core-ts';
 import type { LicenseListRuntimeSearchInput, LicenseOfferRuntimeSearchInput, LicenseOrderRuntimeSearchInput } from '../resource-operations.js';
 import type { AsyncPollRequest, OrganizationActivationServiceOptions, PollOptions, PollResult, SubmitAndPollResult, SubmitPayload, SubmitResponse } from 'gdc-sdk-core-ts';
 export type { AsyncPollRequest, PollOptions, PollResult, SubmitAndPollResult, SubmitPayload, SubmitResponse, } from 'gdc-sdk-core-ts';
@@ -6,9 +9,11 @@ import type { EmployeeDeviceActivationResult, EmployeeDeviceActivationRequestInp
 import type { HostRouteContext, HostedTenantLifecycleInput, LegalOrganizationOrderInput } from '../host-onboarding.js';
 import type { IndividualOrganizationConfirmOrderInput, RouteContext } from '../individual-onboarding.js';
 import type { IndividualOrganizationBootstrapInput, IndividualOrganizationStartResult } from '../individual-start.js';
+import type { FamilyOrganizationSearchInput } from '../family-organization-search.js';
+import type { EnsureFamilyOrganizationRegistrationInput, EnsureFamilyOrganizationRegistrationResult } from '../family-organization-registration.js';
 import type { OrganizationLicenseOrderConfirmInput } from '../organization-license-order.js';
 import type { SmartTokenExchangeResult, SmartTokenRequestInput } from '../smart-token.js';
-import type { CommunicationIngestionInput, ClinicalBundleSearchInput, DigitalTwinGenerationInput, GrantProfessionalAccessInput, GrantProfessionalAccessResult, IndividualMemberLifecycleInput, IndividualOrganizationLifecycleInput, IpsOrFhirImportInput, OrganizationEmployeeCreationInput, OrganizationEmployeeLifecycleInput, OrganizationEmployeeSearchInput, RelatedPersonUpsertInput } from '../resource-operations.js';
+import type { CommunicationIngestionInput, CommunicationParticipantRuntimeSearchInput, ClinicalBundleSearchInput, DigitalTwinGenerationInput, GrantProfessionalAccessInput, GrantProfessionalAccessResult, IndividualMemberLifecycleInput, IndividualOrganizationLifecycleInput, IpsOrFhirImportInput, OrganizationEmployeeCreationInput, OrganizationEmployeeLifecycleInput, OrganizationEmployeeSearchInput, RevokeProfessionalAccessInput, RevokeProfessionalAccessResult, RelatedPersonUpsertInput } from '../resource-operations.js';
 /**
  * Shared node-runtime activation input.
  *
@@ -21,6 +26,25 @@ export type NodeOrganizationActivationInput = {
     service?: OrganizationActivationServiceOptions;
     additionalClaims?: Record<string, unknown>;
 };
+/**
+ * Shared node-runtime input for the first host-side legal-organization
+ * verification step.
+ *
+ * The business payload is owned by shared SDK/common packages:
+ * - transport/runtime communication keys stay outside this contract
+ * - controller business key binding remains in `controller.*`
+ * - GW CORE host routing/polling stays in the runtime adapter
+ */
+export type NodeLegalOrganizationVerificationTransactionInput = LegalOrganizationVerificationTransactionInput;
+/**
+ * Shared node-runtime input for the organization DID binding operation.
+ *
+ * Binding contract:
+ * - tenant identity is resolved from the route path
+ * - `organization.url` carries one or more public aliases/domains
+ * - `controller.sameAs` is optional corroborating identity evidence
+ */
+export type NodeOrganizationDidBindingInput = OrganizationDidBindingInput;
 /**
  * Runtime-neutral actor/application client contract as exposed by the Node SDK.
  *
@@ -29,6 +53,8 @@ export type NodeOrganizationActivationInput = {
  * converge across runtimes.
  */
 export type RuntimeClient = {
+    submitLegalOrganizationVerificationTransaction?: (hostCtx: HostRouteContext, input: NodeLegalOrganizationVerificationTransactionInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
+    submitOrganizationDidBinding?: (ctx: RouteContext, input: NodeOrganizationDidBindingInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
     activateOrganizationInGatewayFromIcaProof?: (hostCtx: HostRouteContext, input: NodeOrganizationActivationInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
     confirmLegalOrganizationOrder?: (hostCtx: HostRouteContext, input: LegalOrganizationOrderInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
     disableHost?: (hostCtx: HostRouteContext, input: HostedTenantLifecycleInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
@@ -51,6 +77,8 @@ export type RuntimeClient = {
     activateEmployeeDeviceWithActivationRequest?: (input: EmployeeDeviceActivationRequestInput) => Promise<EmployeeDeviceActivationResult>;
     requestSmartToken?: (input: SmartTokenRequestInput) => Promise<SmartTokenExchangeResult>;
     startIndividualOrganization?: (input: IndividualOrganizationBootstrapInput) => Promise<IndividualOrganizationStartResult>;
+    searchFamilyOrganization?: (ctx: RouteContext, input: FamilyOrganizationSearchInput) => Promise<FamilyOrganizationSummary | null>;
+    ensureFamilyOrganizationRegistration?: (ctx: RouteContext, input: EnsureFamilyOrganizationRegistrationInput) => Promise<EnsureFamilyOrganizationRegistrationResult>;
     confirmIndividualOrganizationOrder?: (input: IndividualOrganizationConfirmOrderInput) => Promise<SubmitAndPollResult>;
     disableIndividual?: (ctx: RouteContext, input: IndividualOrganizationLifecycleInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
     purgeIndividual?: (ctx: RouteContext, input: IndividualOrganizationLifecycleInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
@@ -59,7 +87,9 @@ export type RuntimeClient = {
     disableIndividualOrganization?: (ctx: RouteContext, input: IndividualOrganizationLifecycleInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
     purgeIndividualOrganization?: (ctx: RouteContext, input: IndividualOrganizationLifecycleInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
     ingestCommunicationAndUpdateIndex?: (ctx: RouteContext, input: CommunicationIngestionInput) => Promise<SubmitAndPollResult>;
+    searchCommunicationParticipants?: (ctx: RouteContext, input: CommunicationParticipantRuntimeSearchInput) => Promise<SubmitAndPollResult>;
     grantProfessionalAccess?: (ctx: RouteContext, input: GrantProfessionalAccessInput) => Promise<GrantProfessionalAccessResult>;
+    revokeProfessionalAccess?: (ctx: RouteContext, input: RevokeProfessionalAccessInput) => Promise<RevokeProfessionalAccessResult>;
     searchIndividualLicenses?: (ctx: RouteContext, input: LicenseListRuntimeSearchInput) => Promise<SubmitAndPollResult>;
     listIndividualLicenses?: (ctx: RouteContext, input?: LicenseListRuntimeSearchInput) => Promise<SubmitAndPollResult>;
     searchIndividualLicenseOffers?: (ctx: RouteContext, input: LicenseOfferRuntimeSearchInput) => Promise<SubmitAndPollResult>;

package/dist/orchestration/individual-controller-sdk.d.ts

@@ -1,8 +1,11 @@
 import { type NodeRuntimeClient, type PollOptions, type SubmitAndPollResult, type SubmitPayload } from './client-port.js';
+import type { FamilyOrganizationSummary } from 'gdc-common-utils-ts/utils/family-organization-summary';
+import type { EnsureFamilyOrganizationRegistrationInput, EnsureFamilyOrganizationRegistrationResult } from '../family-organization-registration.js';
+import type { FamilyOrganizationSearchInput } from '../family-organization-search.js';
 import type { IndividualOrganizationConfirmOrderInput, RouteContext } from '../individual-onboarding.js';
 import type { IndividualOrganizationBootstrapInput, IndividualOrganizationStartResult } from '../individual-start.js';
 import type { NodeCapability } from '../session.js';
-import type { ClinicalBundleSearchInput, CommunicationIngestionInput, DigitalTwinGenerationInput, GrantProfessionalAccessInput, GrantProfessionalAccessResult, IndividualMemberLifecycleInput, IndividualOrganizationLifecycleInput, IpsOrFhirImportInput, LicenseListRuntimeSearchInput, LicenseOfferRuntimeSearchInput, LicenseOrderRuntimeSearchInput, RelatedPersonUpsertInput } from '../resource-operations.js';
+import type { ClinicalBundleSearchInput, CommunicationIngestionInput, CommunicationParticipantRuntimeSearchInput, DigitalTwinGenerationInput, GrantProfessionalAccessInput, GrantProfessionalAccessResult, IndividualMemberLifecycleInput, IndividualOrganizationLifecycleInput, IpsOrFhirImportInput, LicenseListRuntimeSearchInput, LicenseOfferRuntimeSearchInput, LicenseOrderRuntimeSearchInput, RevokeProfessionalAccessInput, RevokeProfessionalAccessResult, RelatedPersonUpsertInput } from '../resource-operations.js';
 import type { SmartTokenExchangeResult, SmartTokenRequestInput } from '../smart-token.js';
 /**
  * Individual-controller oriented facade over a `NodeRuntimeClient`.
@@ -21,6 +24,16 @@ export declare class IndividualControllerSdk {
      * Starts the individual onboarding/bootstrap flow.
      */
     startIndividualOrganization(input: IndividualOrganizationBootstrapInput): Promise<IndividualOrganizationStartResult>;
+    /**
+     * Searches one existing family/individual registration by the phone-first
+     * business key used by channel apps.
+     */
+    searchFamilyOrganization(ctx: RouteContext, input: FamilyOrganizationSearchInput): Promise<FamilyOrganizationSummary | null>;
+    /**
+     * Searches one existing family/individual registration and starts the
+     * bootstrap flow only when the registration is still missing.
+     */
+    ensureFamilyOrganizationRegistration(ctx: RouteContext, input: EnsureFamilyOrganizationRegistrationInput): Promise<EnsureFamilyOrganizationRegistrationResult>;
     /**
      * Confirms the order returned by `startIndividualOrganization(...)`.
      */
@@ -59,6 +72,10 @@ export declare class IndividualControllerSdk {
      * Grants access to a professional through a consent flow.
      */
     grantProfessionalAccess(ctx: RouteContext, input: GrantProfessionalAccessInput): Promise<GrantProfessionalAccessResult>;
+    /**
+     * Closes an existing professional consent by setting its period end.
+     */
+    revokeProfessionalAccess(ctx: RouteContext, input: RevokeProfessionalAccessInput): Promise<RevokeProfessionalAccessResult>;
     /**
      * Imports a FHIR/IPS payload and waits until it is indexed.
      */
@@ -71,6 +88,11 @@ export declare class IndividualControllerSdk {
      * Ingests a FHIR `Communication` and waits for indexing.
      */
     ingestCommunicationAndUpdateIndex(ctx: RouteContext, input: CommunicationIngestionInput): Promise<SubmitAndPollResult>;
+    /**
+     * Searches indexed communication channel records by subject and participant
+     * identifiers.
+     */
+    searchCommunicationParticipants(ctx: RouteContext, input: CommunicationParticipantRuntimeSearchInput): Promise<SubmitAndPollResult>;
     /**
      * Generates a digital twin projection from subject data.
      */

package/dist/orchestration/individual-controller-sdk.js

@@ -23,6 +23,20 @@ export class IndividualControllerSdk {
         assertFacadeCapability(this.capabilities, ActorCapabilities.IndividualBootstrap, ActorKinds.IndividualController, 'startIndividualOrganization');
         return requireClientMethod(this.client, 'startIndividualOrganization')(input);
     }
+    /**
+     * Searches one existing family/individual registration by the phone-first
+     * business key used by channel apps.
+     */
+    searchFamilyOrganization(ctx, input) {
+        return requireClientMethod(this.client, 'searchFamilyOrganization')(ctx, input);
+    }
+    /**
+     * Searches one existing family/individual registration and starts the
+     * bootstrap flow only when the registration is still missing.
+     */
+    ensureFamilyOrganizationRegistration(ctx, input) {
+        return requireClientMethod(this.client, 'ensureFamilyOrganizationRegistration')(ctx, input);
+    }
     /**
      * Confirms the order returned by `startIndividualOrganization(...)`.
      */
@@ -85,6 +99,13 @@ export class IndividualControllerSdk {
         assertFacadeCapability(this.capabilities, ActorCapabilities.ConsentGrantProfessionalAccess, ActorKinds.IndividualController, 'grantProfessionalAccess');
         return requireClientMethod(this.client, 'grantProfessionalAccess')(ctx, input);
     }
+    /**
+     * Closes an existing professional consent by setting its period end.
+     */
+    revokeProfessionalAccess(ctx, input) {
+        assertFacadeCapability(this.capabilities, ActorCapabilities.ConsentGrantProfessionalAccess, ActorKinds.IndividualController, 'revokeProfessionalAccess');
+        return requireClientMethod(this.client, 'revokeProfessionalAccess')(ctx, input);
+    }
     /**
      * Imports a FHIR/IPS payload and waits until it is indexed.
      */
@@ -106,6 +127,13 @@ export class IndividualControllerSdk {
         assertFacadeCapability(this.capabilities, ActorCapabilities.IndividualIngestCommunication, ActorKinds.IndividualController, 'ingestCommunicationAndUpdateIndex');
         return requireClientMethod(this.client, 'ingestCommunicationAndUpdateIndex')(ctx, input);
     }
+    /**
+     * Searches indexed communication channel records by subject and participant
+     * identifiers.
+     */
+    searchCommunicationParticipants(ctx, input) {
+        return requireClientMethod(this.client, 'searchCommunicationParticipants')(ctx, input);
+    }
     /**
      * Generates a digital twin projection from subject data.
      */

package/dist/orchestration/organization-controller-sdk.d.ts

@@ -1,4 +1,4 @@
-import { type NodeRuntimeClient, type PollOptions, type SubmitAndPollResult, type SubmitPayload } from './client-port.js';
+import { type NodeOrganizationDidBindingInput, type NodeLegalOrganizationVerificationTransactionInput, type NodeRuntimeClient, type PollOptions, type SubmitAndPollResult, type SubmitPayload } from './client-port.js';
 import type { RouteContext } from '../individual-onboarding.js';
 import type { HostRouteContext, HostedTenantLifecycleInput } from '../host-onboarding.js';
 import type { EmployeeDeviceActivationResult, EmployeeDeviceActivationRequestInput } from '../device-activation.js';
@@ -19,6 +19,27 @@ export declare class OrganizationControllerSdk {
      * @param client Runtime client implementation used to submit and poll GW flows.
      */
     constructor(client: NodeRuntimeClient, capabilities?: readonly NodeCapability[] | undefined);
+    /**
+     * Starts the host-side legal-organization verification transaction that GW
+     * CORE forwards to ICA `_verify`.
+     *
+     * This is intentionally distinct from the older host `_activate` step:
+     * - `_transaction` carries signed evidence and controller business binding
+     * - `_transaction` is complete on its own for the new flow
+     * - `_activate` remains only for the legacy ICA `_verify` compatibility path
+     */
+    submitLegalOrganizationVerificationTransaction(hostCtx: HostRouteContext, input: NodeLegalOrganizationVerificationTransactionInput, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
+    /**
+     * Binds the current tenant organization DID document to one public alias
+     * view.
+     *
+     * Contract:
+     * - the tenant path identifies the organization
+     * - `organization.url`, when present, provides the public aliases/domains to
+     *   bind
+     * - `controller.sameAs` is optional corroborating identity evidence
+     */
+    submitOrganizationDidBinding(ctx: RouteContext, input: NodeOrganizationDidBindingInput, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
     /**
      * Creates an employee/professional under the current organization tenant.
      */

package/dist/orchestration/organization-controller-sdk.js

@@ -16,6 +16,31 @@ export class OrganizationControllerSdk {
         this.client = client;
         this.capabilities = capabilities;
     }
+    /**
+     * Starts the host-side legal-organization verification transaction that GW
+     * CORE forwards to ICA `_verify`.
+     *
+     * This is intentionally distinct from the older host `_activate` step:
+     * - `_transaction` carries signed evidence and controller business binding
+     * - `_transaction` is complete on its own for the new flow
+     * - `_activate` remains only for the legacy ICA `_verify` compatibility path
+     */
+    submitLegalOrganizationVerificationTransaction(hostCtx, input, pollOptions) {
+        return requireClientMethod(this.client, 'submitLegalOrganizationVerificationTransaction')(hostCtx, input, pollOptions);
+    }
+    /**
+     * Binds the current tenant organization DID document to one public alias
+     * view.
+     *
+     * Contract:
+     * - the tenant path identifies the organization
+     * - `organization.url`, when present, provides the public aliases/domains to
+     *   bind
+     * - `controller.sameAs` is optional corroborating identity evidence
+     */
+    submitOrganizationDidBinding(ctx, input, pollOptions) {
+        return requireClientMethod(this.client, 'submitOrganizationDidBinding')(ctx, input, pollOptions);
+    }
     /**
      * Creates an employee/professional under the current organization tenant.
      */

package/dist/orchestration/personal-sdk.d.ts

@@ -1,7 +1,7 @@
 import { type NodeRuntimeClient, type PollOptions, type SubmitAndPollResult, type SubmitPayload } from './client-port.js';
 import type { IndividualOrganizationBootstrapInput, IndividualOrganizationStartResult } from '../individual-start.js';
 import type { RouteContext } from '../individual-onboarding.js';
-import type { ClinicalBundleSearchInput, CommunicationIngestionInput, DigitalTwinGenerationInput, GrantProfessionalAccessInput, GrantProfessionalAccessResult, IpsOrFhirImportInput, LicenseListRuntimeSearchInput, LicenseOfferRuntimeSearchInput, LicenseOrderRuntimeSearchInput } from '../resource-operations.js';
+import type { ClinicalBundleSearchInput, CommunicationIngestionInput, CommunicationParticipantRuntimeSearchInput, DigitalTwinGenerationInput, GrantProfessionalAccessInput, GrantProfessionalAccessResult, IpsOrFhirImportInput, LicenseListRuntimeSearchInput, LicenseOfferRuntimeSearchInput, LicenseOrderRuntimeSearchInput } from '../resource-operations.js';
 import type { SmartTokenExchangeResult, SmartTokenRequestInput } from '../smart-token.js';
 export declare class PersonalSdk {
     private readonly client;
@@ -14,6 +14,8 @@ export declare class PersonalSdk {
     importIpsOrFhirAndUpdateIndex(ctx: RouteContext, input: IpsOrFhirImportInput): Promise<SubmitAndPollResult>;
     /** Ingests canonical Communication and waits for projection completion. */
     ingestCommunicationAndUpdateIndex(ctx: RouteContext, input: CommunicationIngestionInput): Promise<SubmitAndPollResult>;
+    /** Searches indexed communication channel records by subject and participant identifiers. */
+    searchCommunicationParticipants(ctx: RouteContext, input: CommunicationParticipantRuntimeSearchInput): Promise<SubmitAndPollResult>;
     /** Triggers digital twin generation from subject data. */
     generateDigitalTwinFromSubjectData(ctx: RouteContext, input: DigitalTwinGenerationInput): Promise<SubmitAndPollResult>;
     /** Searches indexed clinical bundles for the current subject/controller context. */

package/dist/orchestration/personal-sdk.js

@@ -20,6 +20,10 @@ export class PersonalSdk {
     ingestCommunicationAndUpdateIndex(ctx, input) {
         return requireClientMethod(this.client, 'ingestCommunicationAndUpdateIndex')(ctx, input);
     }
+    /** Searches indexed communication channel records by subject and participant identifiers. */
+    searchCommunicationParticipants(ctx, input) {
+        return requireClientMethod(this.client, 'searchCommunicationParticipants')(ctx, input);
+    }
     /** Triggers digital twin generation from subject data. */
     generateDigitalTwinFromSubjectData(ctx, input) {
         return requireClientMethod(this.client, 'generateDigitalTwinFromSubjectData')(ctx, input);

package/dist/orchestration/professional-sdk.d.ts

@@ -1,7 +1,7 @@
 import { type NodeRuntimeClient, type PollOptions, type SubmitAndPollResult, type SubmitPayload } from './client-port.js';
 import type { RouteContext } from '../individual-onboarding.js';
 import type { SmartTokenExchangeResult, SmartTokenRequestInput } from '../smart-token.js';
-import type { CommunicationIngestionInput, GrantProfessionalAccessInput, GrantProfessionalAccessResult } from '../resource-operations.js';
+import type { CommunicationIngestionInput, CommunicationParticipantRuntimeSearchInput, ClinicalBundleSearchInput, GrantProfessionalAccessInput, GrantProfessionalAccessResult } from '../resource-operations.js';
 /**
  * Professional-oriented facade for runtime actions that belong to the
  * professional actor itself after tenant and employee provisioning have already
@@ -29,10 +29,25 @@ export declare class ProfessionalSdk {
      * `NodeHttpClient({ ctx })` instead of being repeated on every call.
      */
     requestSmartToken(input: SmartTokenRequestInput): Promise<SmartTokenExchangeResult>;
+    /**
+     * Executes one clinical `Bundle/_search` using the professional actor
+     * session and tenant route context.
+     */
+    searchClinicalBundle(ctx: RouteContext, input: ClinicalBundleSearchInput): Promise<SubmitAndPollResult>;
+    /**
+     * Reads the latest IPS-oriented document projection available to the
+     * professional actor for one subject.
+     */
+    getLatestIps(ctx: RouteContext, input: Omit<ClinicalBundleSearchInput, 'includedTypes'>): Promise<SubmitAndPollResult>;
     /**
      * Ingests a FHIR `Communication` and waits for indexing.
      */
     ingestCommunicationAndUpdateIndex(ctx: RouteContext, input: CommunicationIngestionInput): Promise<SubmitAndPollResult>;
+    /**
+     * Searches indexed communication channel records by subject and participant
+     * identifiers.
+     */
+    searchCommunicationParticipants(ctx: RouteContext, input: CommunicationParticipantRuntimeSearchInput): Promise<SubmitAndPollResult>;
     /**
      * Grants access to a professional through a consent flow.
      */

package/dist/orchestration/professional-sdk.js

@@ -31,12 +31,33 @@ export class ProfessionalSdk {
     requestSmartToken(input) {
         return requireClientMethod(this.client, 'requestSmartToken')(input);
     }
+    /**
+     * Executes one clinical `Bundle/_search` using the professional actor
+     * session and tenant route context.
+     */
+    searchClinicalBundle(ctx, input) {
+        return requireClientMethod(this.client, 'searchClinicalBundle')(ctx, input);
+    }
+    /**
+     * Reads the latest IPS-oriented document projection available to the
+     * professional actor for one subject.
+     */
+    getLatestIps(ctx, input) {
+        return requireClientMethod(this.client, 'getLatestIps')(ctx, input);
+    }
     /**
      * Ingests a FHIR `Communication` and waits for indexing.
      */
     ingestCommunicationAndUpdateIndex(ctx, input) {
         return requireClientMethod(this.client, 'ingestCommunicationAndUpdateIndex')(ctx, input);
     }
+    /**
+     * Searches indexed communication channel records by subject and participant
+     * identifiers.
+     */
+    searchCommunicationParticipants(ctx, input) {
+        return requireClientMethod(this.client, 'searchCommunicationParticipants')(ctx, input);
+    }
     /**
      * Grants access to a professional through a consent flow.
      */