gdc-sdk-node-ts 2.3.29 → 2.4.1

package/README.md

@@ -729,8 +729,14 @@ Existing-tenant recovery/reverification:
 - use `OrganizationControllerSdk.submitLegalOrganizationCredentialReissuance(...)` or
   `NodeHttpClient.submitLegalOrganizationCredentialReissuance(...)` to refresh the ICA-backed
   verification for an already registered tenant without creating a new Offer
-- GW is expected to return one new controller activation code as
-  `org.schema.IndividualProduct.serialNumber`
+- inside the terminal decoded GW Bundle, the canonical polled response keeps
+  all deduplicated ICA-issued credentials in `body.data[0].vc[]` and the
+  complete ICA payload in `body.data[0].resource.icaResponse`; SDK callers
+  receive that terminal HTTP payload as `SubmitAndPollResult.poll.body`
+- separately, GW returns the controller License activation code in
+  `body.data[0].meta.claims['org.schema.IndividualProduct.serialNumber']`
+- `Organization/_issue` is not `License/_issue`: the activation code is not a
+  VC and `License:Issued` is not the canonical response entry type for this route
 - then continue with the existing helper chain:
   `recoverOrganizationControllerWithCredentialReissuanceWithDeps(...)`
   or directly `_exchange -> _dcr`

package/dist/device-activation.js

@@ -1,9 +1,19 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
 import { resolvePollOptionsFromSeconds } from './poll-options.js';
 export async function activateEmployeeDeviceWithActivationCodeWithDeps(deps) {
+    const deviceInfo = deps.input.dcrPayload.ext_device_info;
+    const redirectUris = deps.input.dcrPayload.redirect_uris;
+    const jwks = deps.input.dcrPayload.jwks;
+    const clientInstanceId = String(deviceInfo?.device_id
+        || (deps.input.dcrPayload.software_id ? `software:${deps.input.dcrPayload.software_id}` : '')
+        || (redirectUris?.[0] ? `redirect:${redirectUris[0]}` : '')
+        || (jwks?.keys?.[0]?.kid ? `key:${jwks.keys[0].kid}` : '')).trim();
+    if (!clientInstanceId)
+        throw new Error('Device activation requires a stable device, software, redirect, or key identifier.');
     const exchangePayload = {
         thid: `exchange-${createRuntimeUuid()}`,
         subject_token: deps.input.activationCode,
+        client_instance_id: clientInstanceId,
     };
     const exchange = await deps.submitAndPollWithBearerToken(deps.input.idToken, deps.identityTokenExchangePath(deps.routeCtx), deps.identityTokenExchangePollPath(deps.routeCtx), exchangePayload, deps.input.pollOptions);
     const pollBody = exchange.poll.body || {};

package/dist/fhir-r5-subscription-runtime.d.ts

@@ -0,0 +1,26 @@
+import { type FhirR5Subscription, type FhirR5SubscriptionScope, type FhirR5SubscriptionTopic } from 'gdc-common-utils-ts/models/fhir-r5-subscription';
+import type { RouteContext } from './individual-onboarding.js';
+import type { PollOptions, SubmitAndPollResult, SubmitPayload } from './orchestration/client-port.js';
+export interface FhirR5SubscriptionBatchInput {
+    subscription: FhirR5Subscription;
+    scope: FhirR5SubscriptionScope;
+}
+type SubmitAndPoll = (submitPath: string, pollPath: string, payload: SubmitPayload, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
+type SubscriptionRuntimeDeps = {
+    createRuntimeUuid: () => string;
+    submitPath: (ctx: RouteContext, section: 'entity' | 'individual') => string;
+    pollPath: (ctx: RouteContext, section: 'entity' | 'individual') => string;
+    submitAndPoll: SubmitAndPoll;
+};
+/** Registers one active topic definition in GW CORE's neutral tenant catalog. */
+export declare function submitFhirR5SubscriptionTopicBatchWithDeps(ctx: RouteContext, topic: FhirR5SubscriptionTopic, pollOptions: PollOptions | undefined, deps: Omit<SubscriptionRuntimeDeps, 'submitPath' | 'pollPath'> & {
+    submitPath: (ctx: RouteContext) => string;
+    pollPath: (ctx: RouteContext) => string;
+}): Promise<SubmitAndPollResult>;
+/**
+ * Registers one neutral rest-hook Subscription. Individual scope maps to the
+ * individual section and retains the exact patient/subject validation owned by
+ * Common Utils and GW CORE; tenant scope maps to entity.
+ */
+export declare function submitFhirR5SubscriptionBatchWithDeps(ctx: RouteContext, input: FhirR5SubscriptionBatchInput, pollOptions: PollOptions | undefined, deps: SubscriptionRuntimeDeps): Promise<SubmitAndPollResult>;
+export {};

package/dist/fhir-r5-subscription-runtime.js

@@ -0,0 +1,28 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+import { FhirR5SubscriptionScopes, buildFhirR5SubscriptionBatch, } from 'gdc-common-utils-ts/models/fhir-r5-subscription';
+function gatewayPayload(createRuntimeUuid, body) {
+    return {
+        jti: `fhir-r5-subscription-jti-${createRuntimeUuid()}`,
+        thid: `fhir-r5-subscription-${createRuntimeUuid()}`,
+        type: 'application/fhir+json',
+        body,
+    };
+}
+/** Registers one active topic definition in GW CORE's neutral tenant catalog. */
+export function submitFhirR5SubscriptionTopicBatchWithDeps(ctx, topic, pollOptions, deps) {
+    const body = {
+        resourceType: 'Bundle', type: 'batch',
+        entry: [{ request: { method: 'POST', url: 'SubscriptionTopic' }, resource: topic }],
+    };
+    return deps.submitAndPoll(deps.submitPath(ctx), deps.pollPath(ctx), gatewayPayload(deps.createRuntimeUuid, body), pollOptions);
+}
+/**
+ * Registers one neutral rest-hook Subscription. Individual scope maps to the
+ * individual section and retains the exact patient/subject validation owned by
+ * Common Utils and GW CORE; tenant scope maps to entity.
+ */
+export function submitFhirR5SubscriptionBatchWithDeps(ctx, input, pollOptions, deps) {
+    const section = input.scope === FhirR5SubscriptionScopes.Individual ? 'individual' : 'entity';
+    const batch = buildFhirR5SubscriptionBatch(input.subscription, input.scope);
+    return deps.submitAndPoll(deps.submitPath(ctx, section), deps.pollPath(ctx, section), gatewayPayload(deps.createRuntimeUuid, batch.body), pollOptions);
+}

package/dist/index.d.ts

@@ -17,7 +17,9 @@ export * from './family-organization-registration.js';
 export * from './individual-onboarding.js';
 export * from './device-activation.js';
 export * from './organization-controller-recovery.js';
+export * from './organization-registration-authorization.js';
 export * from './smart-token.js';
+export * from './fhir-r5-subscription-runtime.js';
 export * from './order-offer-summary.js';
 export * from './organization-license-order.js';
 export * from './resource-operations.js';

package/dist/index.js

@@ -18,7 +18,9 @@ export * from './family-organization-registration.js';
 export * from './individual-onboarding.js';
 export * from './device-activation.js';
 export * from './organization-controller-recovery.js';
+export * from './organization-registration-authorization.js';
 export * from './smart-token.js';
+export * from './fhir-r5-subscription-runtime.js';
 export * from './order-offer-summary.js';
 export * from './organization-license-order.js';
 export * from './resource-operations.js';

package/dist/node-runtime-client.d.ts

@@ -15,6 +15,8 @@ import { type CommunicationIngestionInput, type BlockchainArtifactRegistrationIn
 import type { LegalOrganizationOrderInput } from './host-onboarding.js';
 import type { SmartTokenExchangeResult } from './smart-token.js';
 import type { NodeRuntimeClient, PollOptions, PollResult, SubmitAndPollResult, SubmitPayload, SubmitResponse } from './orchestration/client-port.js';
+import { type FhirR5SubscriptionBatchInput } from './fhir-r5-subscription-runtime.js';
+import type { FhirR5SubscriptionTopic } from 'gdc-common-utils-ts/models/fhir-r5-subscription';
 export type HttpRuntimeClientOptions = {
     baseUrl: string;
     bearerToken?: string;
@@ -135,6 +137,10 @@ export declare class HttpRuntimeClient implements NodeRuntimeClient {
      * Convenience wrapper that performs submit and poll in sequence.
      */
     submitAndPoll(submitPath: string, pollPath: string, payload: SubmitPayload, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
+    /** Registers one neutral FHIR R5 topic in the tenant-owned CORE catalog. */
+    submitFhirR5SubscriptionTopicBatch(ctx: RouteContext, topic: FhirR5SubscriptionTopic, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
+    /** Registers one tenant or exact-subject FHIR R5 rest-hook Subscription. */
+    submitFhirR5SubscriptionBatch(ctx: RouteContext, input: FhirR5SubscriptionBatchInput, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
     private submitAndPollWithBearerToken;
     /**
      * Starts the host-side legal-organization verification transaction that GW

package/dist/node-runtime-client.js

@@ -19,6 +19,7 @@ import { activateOrganizationInGatewayFromIcaProofWithDeps, submitLegalOrganizat
 import { buildGrantProfessionalAccessClaimsWithCid } from './runtime-consent.js';
 import { RuntimeClientPaths } from './runtime-client-paths.js';
 import { runtimeUuid, wrapBundleAsGatewayTransactionMessage } from './runtime-message.js';
+import { submitFhirR5SubscriptionBatchWithDeps, submitFhirR5SubscriptionTopicBatchWithDeps, } from './fhir-r5-subscription-runtime.js';
 const bootstrapFacade = createBootstrapFacade();
 /**
  * Runtime-oriented HTTP client for Node backends, BFFs, and workers that need
@@ -116,6 +117,24 @@ export class HttpRuntimeClient {
     async submitAndPoll(submitPath, pollPath, payload, pollOptions) {
         return submitAndPollWithMethods(this, submitPath, pollPath, payload, pollOptions);
     }
+    /** Registers one neutral FHIR R5 topic in the tenant-owned CORE catalog. */
+    submitFhirR5SubscriptionTopicBatch(ctx, topic, pollOptions) {
+        return submitFhirR5SubscriptionTopicBatchWithDeps(ctx, topic, pollOptions, {
+            createRuntimeUuid: runtimeUuid,
+            submitPath: this.paths.fhirR5SubscriptionTopicBatchPath.bind(this.paths),
+            pollPath: this.paths.fhirR5SubscriptionTopicPollPath.bind(this.paths),
+            submitAndPoll: this.submitAndPoll.bind(this),
+        });
+    }
+    /** Registers one tenant or exact-subject FHIR R5 rest-hook Subscription. */
+    submitFhirR5SubscriptionBatch(ctx, input, pollOptions) {
+        return submitFhirR5SubscriptionBatchWithDeps(ctx, input, pollOptions, {
+            createRuntimeUuid: runtimeUuid,
+            submitPath: this.paths.fhirR5SubscriptionBatchPath.bind(this.paths),
+            pollPath: this.paths.fhirR5SubscriptionPollPath.bind(this.paths),
+            submitAndPoll: this.submitAndPoll.bind(this),
+        });
+    }
     async submitAndPollWithBearerToken(bearerToken, submitPath, pollPath, payload, pollOptions) {
         const config = { ...this.transportConfig, bearerToken };
         const submitted = await postJsonWithRuntimeConfig(config, submitPath, payload, DIDCOMM_PLAINTEXT_JSON_MEDIA_TYPE);

package/dist/orchestration/client-port.d.ts

@@ -10,6 +10,8 @@ import type { HostRouteContext, HostedTenantLifecycleInput, LegalOrganizationOrd
 import type { IndividualOrganizationConfirmOrderInput, RouteContext } from '../individual-onboarding.js';
 import type { IndividualOrganizationBootstrapInput, IndividualOrganizationStartResult } from '../individual-start.js';
 import type { FamilyOrganizationSearchInput } from '../family-organization-search.js';
+import type { FhirR5SubscriptionTopic } from 'gdc-common-utils-ts/models/fhir-r5-subscription';
+import type { FhirR5SubscriptionBatchInput } from '../fhir-r5-subscription-runtime.js';
 import type { EnsureFamilyOrganizationRegistrationInput, EnsureFamilyOrganizationRegistrationResult } from '../family-organization-registration.js';
 import type { OrganizationLicenseOrderConfirmInput } from '../organization-license-order.js';
 import type { SmartTokenExchangeResult, SmartTokenRequestInput } from '../smart-token.js';
@@ -53,6 +55,10 @@ export type NodeOrganizationDidBindingInput = OrganizationDidBindingInput;
  * converge across runtimes.
  */
 export type RuntimeClient = {
+    /** Registers a neutral FHIR R5 topic in GW CORE's tenant-owned catalog. */
+    submitFhirR5SubscriptionTopicBatch?: (ctx: RouteContext, topic: FhirR5SubscriptionTopic, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
+    /** Registers a tenant-wide or exact-subject FHIR R5 rest-hook Subscription. */
+    submitFhirR5SubscriptionBatch?: (ctx: RouteContext, input: FhirR5SubscriptionBatchInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
     submitLegalOrganizationVerificationTransaction?: (hostCtx: HostRouteContext, input: NodeLegalOrganizationVerificationTransactionInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
     submitLegalOrganizationCredentialReissuance?: (hostCtx: HostRouteContext, input: NodeLegalOrganizationVerificationTransactionInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
     /** @deprecated Use `submitLegalOrganizationCredentialReissuance`. */

package/dist/organization-controller-recovery.d.ts

@@ -42,10 +42,12 @@ export declare const recoverOrganizationControllerWithIssueWithDeps: typeof reco
  * Reads the opaque activation code from a successful Organization/_issue poll result.
  *
  * Gateway deployments may retain one or more transport/job envelopes around
- * the terminal batch response. Only a response entry carrying the canonical
- * serial-number claim, or an explicitly typed `License:Issued` entry carrying
- * its public `id`, is accepted. Unrelated identifiers are never interpreted as
- * activation material.
+ * the terminal batch response. The canonical `Organization/_issue` shape
+ * carries the serial-number claim in `meta.claims`, alongside (but outside)
+ * the ICA `vc[]` array. An explicitly typed `License:Issued` entry is accepted
+ * only as a legacy `License/_issue` compatibility fallback. Unrelated
+ * identifiers and ICA credentials are never interpreted as activation
+ * material.
  */
 export declare function readLegalOrganizationCredentialReissuanceActivationCode(result: SubmitAndPollResult): string;
 /** @deprecated Use `readLegalOrganizationCredentialReissuanceActivationCode`. */

package/dist/organization-controller-recovery.js

@@ -3,8 +3,10 @@ import { activateEmployeeDeviceWithActivationCodeWithDeps } from './device-activ
 export async function recoverOrganizationControllerWithCredentialReissuanceWithDeps(deps) {
     /**
      * Existing-tenant controller recovery contract:
-     * - `Organization/_issue` is expected to reissue controller activation
-     *   material only
+     * - `Organization/_issue` reverifies/reissues organization credentials and
+     *   exposes the existing controller License activation code separately in
+     *   response claims
+     * - `Token/_exchange -> Device/_dcr` performs the device activation/rebind
      * - this flow must not depend on a new commercial Offer or Order step
      */
     const submitCredentialReissuance = deps.submitLegalOrganizationCredentialReissuance
@@ -49,10 +51,12 @@ export const recoverOrganizationControllerWithIssueWithDeps = recoverOrganizatio
  * Reads the opaque activation code from a successful Organization/_issue poll result.
  *
  * Gateway deployments may retain one or more transport/job envelopes around
- * the terminal batch response. Only a response entry carrying the canonical
- * serial-number claim, or an explicitly typed `License:Issued` entry carrying
- * its public `id`, is accepted. Unrelated identifiers are never interpreted as
- * activation material.
+ * the terminal batch response. The canonical `Organization/_issue` shape
+ * carries the serial-number claim in `meta.claims`, alongside (but outside)
+ * the ICA `vc[]` array. An explicitly typed `License:Issued` entry is accepted
+ * only as a legacy `License/_issue` compatibility fallback. Unrelated
+ * identifiers and ICA credentials are never interpreted as activation
+ * material.
  */
 export function readLegalOrganizationCredentialReissuanceActivationCode(result) {
     const pollBody = (result?.poll?.body || {});

package/dist/organization-registration-authorization.d.ts

@@ -0,0 +1,16 @@
+import type { VerifiableCredentialV2 } from 'gdc-common-utils-ts/models/verifiable-credential';
+import type { IWallet, WalletExecutionContext, WalletKeySelection } from 'gdc-sdk-core-ts';
+/** Input required to add one human-authorizer proof to the out-of-band VC. */
+export type SignOrganizationRegistrationAuthorizationInput = Readonly<{
+    credential: VerifiableCredentialV2;
+    wallet: IWallet;
+    context: WalletExecutionContext;
+    key: WalletKeySelection;
+    verificationMethod: string;
+    createdAt?: string;
+}>;
+/**
+ * Adds one detached JWS proof made by the already-unlocked professional
+ * profile. The browser never receives the private key or clear wallet seed.
+ */
+export declare function signOrganizationRegistrationAuthorizationCredential(input: SignOrganizationRegistrationAuthorizationInput): Promise<VerifiableCredentialV2>;

package/dist/organization-registration-authorization.js

@@ -0,0 +1,34 @@
+import { canonicalizeOrganizationRegistrationAuthorizationCredential, } from 'gdc-common-utils-ts/utils/organization-registration-authorization';
+/**
+ * Adds one detached JWS proof made by the already-unlocked professional
+ * profile. The browser never receives the private key or clear wallet seed.
+ */
+export async function signOrganizationRegistrationAuthorizationCredential(input) {
+    if (!input.wallet.signDetachedJws) {
+        throw new Error('Wallet does not support detached organization authorization proofs.');
+    }
+    const verificationMethod = String(input.verificationMethod || '').trim();
+    if (!verificationMethod)
+        throw new Error('Organization authorization proof requires verificationMethod.');
+    const payload = canonicalizeOrganizationRegistrationAuthorizationCredential(input.credential);
+    const jws = await input.wallet.signDetachedJws(input.context, {
+        payload,
+        header: { typ: 'application/vc+ld+json' },
+        key: input.key,
+    });
+    const existingProofs = Array.isArray(input.credential.proof)
+        ? input.credential.proof
+        : input.credential.proof
+            ? [input.credential.proof]
+            : [];
+    return {
+        ...input.credential,
+        proof: [...existingProofs, {
+                type: 'JsonWebSignature2020',
+                created: input.createdAt || new Date().toISOString(),
+                proofPurpose: 'contractAgreement',
+                verificationMethod,
+                jws,
+            }],
+    };
+}

package/dist/runtime-client-paths.d.ts

@@ -74,6 +74,14 @@ export declare class RuntimeClientPaths {
     individualCommunicationSearchPollPath(ctx: RouteContext): string;
     individualDocumentReferenceBatchPath(ctx: RouteContext): string;
     individualDocumentReferencePollPath(ctx: RouteContext): string;
+    /** Builds the tenant-owned FHIR R5 SubscriptionTopic registration path. */
+    fhirR5SubscriptionTopicBatchPath(ctx: RouteContext): string;
+    /** Builds the poll path paired with SubscriptionTopic registration. */
+    fhirR5SubscriptionTopicPollPath(ctx: RouteContext): string;
+    /** Builds one tenant or exact-subject FHIR R5 Subscription registration path. */
+    fhirR5SubscriptionBatchPath(ctx: RouteContext, section: 'entity' | 'individual'): string;
+    /** Builds the poll path paired with Subscription registration. */
+    fhirR5SubscriptionPollPath(ctx: RouteContext, section: 'entity' | 'individual'): string;
     individualBundleSearchPath(ctx: RouteContext): string;
     individualBundleSearchPollPath(ctx: RouteContext): string;
     identityTokenExchangePath(ctx: RouteContext): string;

package/dist/runtime-client-paths.js

@@ -88,6 +88,14 @@ export class RuntimeClientPaths {
     individualCommunicationSearchPollPath(ctx) { return this.v1Path(ctx, 'individual', 'org.hl7.fhir.r4', 'Communication', '_search-response'); }
     individualDocumentReferenceBatchPath(ctx) { return this.v1Path(ctx, 'individual', 'org.hl7.fhir.r4', 'DocumentReference', '_batch'); }
     individualDocumentReferencePollPath(ctx) { return this.v1Path(ctx, 'individual', 'org.hl7.fhir.r4', 'DocumentReference', '_batch-response'); }
+    /** Builds the tenant-owned FHIR R5 SubscriptionTopic registration path. */
+    fhirR5SubscriptionTopicBatchPath(ctx) { return this.v1Path(ctx, 'entity', 'org.hl7.fhir.r5', 'SubscriptionTopic', '_batch'); }
+    /** Builds the poll path paired with SubscriptionTopic registration. */
+    fhirR5SubscriptionTopicPollPath(ctx) { return this.v1Path(ctx, 'entity', 'org.hl7.fhir.r5', 'SubscriptionTopic', '_batch-response'); }
+    /** Builds one tenant or exact-subject FHIR R5 Subscription registration path. */
+    fhirR5SubscriptionBatchPath(ctx, section) { return this.v1Path(ctx, section, 'org.hl7.fhir.r5', 'Subscription', '_batch'); }
+    /** Builds the poll path paired with Subscription registration. */
+    fhirR5SubscriptionPollPath(ctx, section) { return this.v1Path(ctx, section, 'org.hl7.fhir.r5', 'Subscription', '_batch-response'); }
     individualBundleSearchPath(ctx) { return this.v1Path(ctx, 'individual', 'org.hl7.fhir.r4', 'Bundle', '_search'); }
     individualBundleSearchPollPath(ctx) { return this.v1Path(ctx, 'individual', 'org.hl7.fhir.r4', 'Bundle', '_search-response'); }
     identityTokenExchangePath(ctx) { return buildIdentityTokenExchangePath(ctx); }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-sdk-node-ts",
-  "version": "2.3.29",
+  "version": "2.4.1",
   "description": "Next-generation Node runtime package for the GDC SDK family",
   "license": "Apache-2.0",
   "author": "Antifraud Services Inc.",
@@ -37,7 +37,7 @@
     "test:e2e:live-gw:clean": "bash ./scripts/run-live-gw-clean.sh"
   },
   "dependencies": {
-    "gdc-common-utils-ts": "^2.3.29",
+    "gdc-common-utils-ts": "^2.5.1",
     "gdc-sdk-core-ts": "~2.3.18"
   },
   "devDependencies": {