gdc-sdk-node-ts 2.4.23 → 2.4.30

package/dist/orchestration/individual-controller-sdk.d.ts

@@ -1,3 +1,4 @@
+import { type ConsentRule } from 'gdc-common-utils-ts/models/consent-rule';
 import { type IndividualControllerCredentialInput, type IndividualControllerVpPayloadInput, type IndividualSubjectCredentialInput } from 'gdc-common-utils-ts';
 import { type NodeRuntimeClient, type PollOptions, type SubmitAndPollResult, type SubmitPayload } from './client-port.js';
 import type { FamilyOrganizationSummary } from 'gdc-common-utils-ts/utils/family-organization-summary';
@@ -7,7 +8,7 @@ import type { IndividualOrganizationConfirmOrderInput, RouteContext } from '../i
 import type { IndividualOrganizationBootstrapInput, IndividualOrganizationStartResult } from '../individual-start.js';
 import type { NodeCapability } from '../session.js';
 import type { IndividualOrganizationLifecycleInput } from 'gdc-sdk-core-ts';
-import type { BlockchainArtifactRegistrationInput, ClinicalBundleSearchInput, ClinicalSectionUpdateInput, ClinicalSummaryReadResult, ClinicalSummaryRequestInput, ClinicalSummaryUpdateInput, CommunicationIngestionInput, CommunicationParticipantRuntimeSearchInput, DigitalTwinGenerationInput, GrantProfessionalAccessInput, GrantProfessionalAccessResult, IndividualMemberLifecycleInput, IndividualMemberLicenseAddInput, IndividualMemberLicenseInvitationInput, IndividualMemberLicenseTransitionInput, IpsOrFhirImportInput, LicenseListRuntimeSearchInput, LicenseOfferRuntimeSearchInput, LicenseOrderRuntimeSearchInput, RevokeProfessionalAccessInput, RevokeProfessionalAccessResult, ProfessionalAccessRequestDecisionInput, ProfessionalAccessRequestSearchInput, RelatedPersonUpsertInput } from '../resource-operations.js';
+import type { BlockchainArtifactRegistrationInput, ClinicalBundleSearchInput, ClinicalSectionUpdateInput, ClinicalSummaryReadResult, ClinicalSummaryRequestInput, ClinicalSummaryUpdateInput, CommunicationIngestionInput, CommunicationParticipantRuntimeSearchInput, DigitalTwinGenerationInput, DigitalTwinSecondaryUseConsentInput, DigitalTwinSecondaryUseConsentResult, DigitalTwinSubjectLinkPurgeInput, DigitalTwinSubjectLinkPurgeResult, GrantProfessionalAccessInput, GrantProfessionalAccessResult, IndividualMemberLifecycleInput, IndividualMemberLicenseAddInput, IndividualMemberLicenseInvitationInput, IndividualMemberLicenseTransitionInput, IpsOrFhirImportInput, LicenseListRuntimeSearchInput, LicenseOfferRuntimeSearchInput, LicenseOrderRuntimeSearchInput, RevokeProfessionalAccessInput, RevokeProfessionalAccessResult, ProfessionalAccessRequestDecisionInput, ProfessionalAccessRequestSearchInput, RelatedPersonUpsertInput } from '../resource-operations.js';
 import type { SmartTokenExchangeResult, SmartTokenRequestInput } from '../smart-token.js';
 /**
  * Individual-controller oriented facade over a `NodeRuntimeClient`.
@@ -117,10 +118,35 @@ export declare class IndividualControllerSdk {
      */
     searchCommunicationParticipants(ctx: RouteContext, input: CommunicationParticipantRuntimeSearchInput): Promise<SubmitAndPollResult>;
     /**
-     * Explicitly packages subject data for a study/transfer flow.
-     * Normal clinical ingestion is projected into the tenant research index by GW.
+     * Legacy direct Composition transfer hook.
+     *
+     * @deprecated Canonical twins are created only by GW from current subject
+     * data after `setDigitalTwinSecondaryUseConsent(..., { decision: 'permit' })`.
+     * The Node runtime intentionally does not publish canonical Compositions.
      */
     generateDigitalTwinFromSubjectData(ctx: RouteContext, input: DigitalTwinGenerationInput): Promise<SubmitAndPollResult>;
+    /**
+     * Enables or disables the subject's secondary-use digital-twin projection.
+     * This is the canonical patient-side operation; application code must not
+     * publish a canonical Composition directly into the research index.
+     */
+    setDigitalTwinSecondaryUseConsent(ctx: RouteContext, input: DigitalTwinSecondaryUseConsentInput): Promise<DigitalTwinSecondaryUseConsentResult>;
+    /**
+     * Offboards the subject from the current index provider. This removes only
+     * the private subject/twin correspondence; it never deletes anonymous twin
+     * data already shared for research.
+     */
+    purgeDigitalTwinSubjectLink(ctx: RouteContext, input: DigitalTwinSubjectLinkPurgeInput): Promise<DigitalTwinSubjectLinkPurgeResult>;
+    /** Returns whether the subject currently permits projection by its index provider. */
+    getDigitalTwinSecondaryUseConsentStatus(ctx: RouteContext, input: Readonly<{
+        subjectDid: string;
+        indexProviderOrganizationDid: string;
+        consentIdentifier: string;
+    }>): Promise<Readonly<{
+        exists: boolean;
+        enabled: boolean;
+        consent?: ConsentRule;
+    }>>;
     /**
      * Searches indexed clinical bundles for the current subject/controller context.
      */

package/dist/orchestration/individual-controller-sdk.js

@@ -1,8 +1,11 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
 import { ActorCapabilities, ActorKinds } from 'gdc-common-utils-ts/constants/actor-session';
+import { HealthcareConsentPurposes, ServiceCapability } from 'gdc-common-utils-ts/constants';
+import { ClaimConsent } from 'gdc-common-utils-ts/models/consent-rule';
 import { buildIndividualControllerIdentityVpPayload, buildUnsignedIndividualControllerIdentityVpJwt, getIndividualControllerIdentitySameAs, getIndividualControllerIdentityVC, getIndividualSubjectVC, } from 'gdc-common-utils-ts';
 import { requireClientMethod, submitAndPollWithClient, } from './client-port.js';
 import { assertFacadeCapability } from './capability-guard.js';
+import { GatewayActiveConsentProvider } from '../gateway-active-consent-provider.js';
 import { buildProfessionalAccessRequestDecisionGrant } from '../resource-operations.js';
 import { buildProfessionalAccessRequestSearchInput } from '../resource-operations.js';
 /**
@@ -175,13 +178,56 @@ export class IndividualControllerSdk {
         return requireClientMethod(this.client, 'searchCommunicationParticipants')(ctx, input);
     }
     /**
-     * Explicitly packages subject data for a study/transfer flow.
-     * Normal clinical ingestion is projected into the tenant research index by GW.
+     * Legacy direct Composition transfer hook.
+     *
+     * @deprecated Canonical twins are created only by GW from current subject
+     * data after `setDigitalTwinSecondaryUseConsent(..., { decision: 'permit' })`.
+     * The Node runtime intentionally does not publish canonical Compositions.
      */
     generateDigitalTwinFromSubjectData(ctx, input) {
         assertFacadeCapability(this.capabilities, ActorCapabilities.IndividualGenerateDigitalTwin, ActorKinds.IndividualController, 'generateDigitalTwinFromSubjectData');
         return requireClientMethod(this.client, 'generateDigitalTwinFromSubjectData')(ctx, input);
     }
+    /**
+     * Enables or disables the subject's secondary-use digital-twin projection.
+     * This is the canonical patient-side operation; application code must not
+     * publish a canonical Composition directly into the research index.
+     */
+    setDigitalTwinSecondaryUseConsent(ctx, input) {
+        assertFacadeCapability(this.capabilities, ActorCapabilities.IndividualGenerateDigitalTwin, ActorKinds.IndividualController, 'setDigitalTwinSecondaryUseConsent');
+        return requireClientMethod(this.client, 'setDigitalTwinSecondaryUseConsent')(ctx, input);
+    }
+    /**
+     * Offboards the subject from the current index provider. This removes only
+     * the private subject/twin correspondence; it never deletes anonymous twin
+     * data already shared for research.
+     */
+    purgeDigitalTwinSubjectLink(ctx, input) {
+        assertFacadeCapability(this.capabilities, ActorCapabilities.IndividualGenerateDigitalTwin, ActorKinds.IndividualController, 'purgeDigitalTwinSubjectLink');
+        return requireClientMethod(this.client, 'purgeDigitalTwinSubjectLink')(ctx, input);
+    }
+    /** Returns whether the subject currently permits projection by its index provider. */
+    async getDigitalTwinSecondaryUseConsentStatus(ctx, input) {
+        assertFacadeCapability(this.capabilities, ActorCapabilities.IndividualGenerateDigitalTwin, ActorKinds.IndividualController, 'getDigitalTwinSecondaryUseConsentStatus');
+        const activeConsents = await new GatewayActiveConsentProvider(this.client, ctx)
+            .getActiveConsentsForSubject(input.subjectDid);
+        const consentIdentifier = String(input.consentIdentifier || '').trim();
+        if (!consentIdentifier)
+            throw new Error('consentIdentifier is required to distinguish the portal rule from study consents.');
+        const indexProviderOrganizationDid = String(input.indexProviderOrganizationDid || '').trim();
+        if (!indexProviderOrganizationDid)
+            throw new Error('indexProviderOrganizationDid is required.');
+        const consent = activeConsents.find((rule) => {
+            const actions = String(rule[ClaimConsent.action] || '').split(',').map((value) => value.trim());
+            return String(rule[ClaimConsent.identifier] || '').trim() === consentIdentifier
+                && String(rule[ClaimConsent.actorIdentifier] || '').trim() === indexProviderOrganizationDid
+                && String(rule[ClaimConsent.purpose] || '').trim().toUpperCase() === String(HealthcareConsentPurposes.Research).toUpperCase()
+                && actions.includes(ServiceCapability.DigitalTwinReader);
+        });
+        return consent
+            ? { exists: true, enabled: String(consent[ClaimConsent.decision] || '').trim().toLowerCase() === 'permit', consent }
+            : { exists: false, enabled: false };
+    }
     /**
      * Searches indexed clinical bundles for the current subject/controller context.
      */

package/dist/orchestration/organization-controller-sdk.d.ts

@@ -107,17 +107,18 @@ export declare class OrganizationControllerSdk {
     listLicenseOrders(ctx: RouteContext, input?: LicenseOrderRuntimeSearchInput): Promise<SubmitAndPollResult>;
     /**
      * Confirms an already paid organization-side license order so GW CORE can
-     * activate additional tenant seats once the public route exists.
+     * activate additional tenant seats.
      *
      * The commercial/payment step happens outside GW CORE. This method models
      * the follow-up confirmation that should materialize new seats from the
      * accepted order.
      *
-     * Current runtime note:
-     * - search/list of organization license offers and orders already exists
-     * - the public/write post-payment seat-activation route is not converged yet
-     * - current runtime clients therefore throw an explicit unsupported-flow
-     *   error instead of fabricating an unstable payload contract
+     * Security/routing contract:
+     * - the request is routed through the host `Order/_batch` endpoint
+     * - the signed `iss` is still the exact controller DID registered by DCR for
+     *   `ctx.tenantId`; its `kid`/`skid` keys belong to that tenant, not the host
+     * - the configured runtime transport profile applies unchanged, including
+     *   DIDComm encryption in protected staging/production runtimes
      */
     confirmOrganizationLicenseOrder(ctx: RouteContext, input: OrganizationLicenseOrderConfirmInput, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
     /**
@@ -133,11 +134,23 @@ export declare class OrganizationControllerSdk {
      * employees or individual/member descendants remain.
      */
     disableTenant(hostCtx: HostRouteContext, input: HostedTenantLifecycleInput, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
+    /** Re-enables the same suspended tenant and immutable legal identifier. */
+    enableTenant(hostCtx: HostRouteContext, input: HostedTenantLifecycleInput, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
     /**
      * Purges the hosted tenant through the host registry after tenant disable and
      * descendant purges have both completed.
      */
     purgeTenant(hostCtx: HostRouteContext, input: HostedTenantLifecycleInput, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
+    /** Returns host-confirmed tenant state and descendant counters. */
+    getTenantLifecycleStatus(hostCtx: HostRouteContext, input: HostedTenantLifecycleInput, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
+    /** Explicitly disables individuals before tenant disable. Employees use their dedicated lifecycle. */
+    disableTenantDescendants(hostCtx: HostRouteContext, input: HostedTenantLifecycleInput & {
+        descendantKind: 'individuals';
+    }, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
+    /** Explicitly purges individuals before tenant purge. Employees use their dedicated lifecycle. */
+    purgeTenantDescendants(hostCtx: HostRouteContext, input: HostedTenantLifecycleInput & {
+        descendantKind: 'individuals';
+    }, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
     /**
      * Activates the employee device from a previously issued activation request.
      */

package/dist/orchestration/organization-controller-sdk.js

@@ -147,17 +147,18 @@ export class OrganizationControllerSdk {
     }
     /**
      * Confirms an already paid organization-side license order so GW CORE can
-     * activate additional tenant seats once the public route exists.
+     * activate additional tenant seats.
      *
      * The commercial/payment step happens outside GW CORE. This method models
      * the follow-up confirmation that should materialize new seats from the
      * accepted order.
      *
-     * Current runtime note:
-     * - search/list of organization license offers and orders already exists
-     * - the public/write post-payment seat-activation route is not converged yet
-     * - current runtime clients therefore throw an explicit unsupported-flow
-     *   error instead of fabricating an unstable payload contract
+     * Security/routing contract:
+     * - the request is routed through the host `Order/_batch` endpoint
+     * - the signed `iss` is still the exact controller DID registered by DCR for
+     *   `ctx.tenantId`; its `kid`/`skid` keys belong to that tenant, not the host
+     * - the configured runtime transport profile applies unchanged, including
+     *   DIDComm encryption in protected staging/production runtimes
      */
     confirmOrganizationLicenseOrder(ctx, input, pollOptions) {
         return requireClientMethod(this.client, 'confirmOrganizationLicenseOrder')(ctx, input, pollOptions);
@@ -184,6 +185,11 @@ export class OrganizationControllerSdk {
         assertFacadeCapability(this.capabilities, ActorCapabilities.OrganizationDisableTenant, ActorKinds.OrganizationController, 'disableTenant');
         return requireClientMethod(this.client, 'disableTenant')(hostCtx, input, pollOptions);
     }
+    /** Re-enables the same suspended tenant and immutable legal identifier. */
+    enableTenant(hostCtx, input, pollOptions) {
+        assertFacadeCapability(this.capabilities, ActorCapabilities.OrganizationDisableTenant, ActorKinds.OrganizationController, 'enableTenant');
+        return requireClientMethod(this.client, 'enableTenant')(hostCtx, input, pollOptions);
+    }
     /**
      * Purges the hosted tenant through the host registry after tenant disable and
      * descendant purges have both completed.
@@ -192,6 +198,21 @@ export class OrganizationControllerSdk {
         assertFacadeCapability(this.capabilities, ActorCapabilities.OrganizationPurgeTenant, ActorKinds.OrganizationController, 'purgeTenant');
         return requireClientMethod(this.client, 'purgeTenant')(hostCtx, input, pollOptions);
     }
+    /** Returns host-confirmed tenant state and descendant counters. */
+    getTenantLifecycleStatus(hostCtx, input, pollOptions) {
+        assertFacadeCapability(this.capabilities, ActorCapabilities.OrganizationDisableTenant, ActorKinds.OrganizationController, 'getTenantLifecycleStatus');
+        return requireClientMethod(this.client, 'getTenantLifecycleStatus')(hostCtx, input, pollOptions);
+    }
+    /** Explicitly disables individuals before tenant disable. Employees use their dedicated lifecycle. */
+    disableTenantDescendants(hostCtx, input, pollOptions) {
+        assertFacadeCapability(this.capabilities, ActorCapabilities.OrganizationDisableTenant, ActorKinds.OrganizationController, 'disableTenantDescendants');
+        return requireClientMethod(this.client, 'disableTenantDescendants')(hostCtx, input, pollOptions);
+    }
+    /** Explicitly purges individuals before tenant purge. Employees use their dedicated lifecycle. */
+    purgeTenantDescendants(hostCtx, input, pollOptions) {
+        assertFacadeCapability(this.capabilities, ActorCapabilities.OrganizationPurgeTenant, ActorKinds.OrganizationController, 'purgeTenantDescendants');
+        return requireClientMethod(this.client, 'purgeTenantDescendants')(hostCtx, input, pollOptions);
+    }
     /**
      * Activates the employee device from a previously issued activation request.
      */

package/dist/organization-controller-recovery.d.ts

@@ -1,13 +1,15 @@
 import type { NodeLegalOrganizationVerificationTransactionInput, PollOptions, SubmitAndPollResult } from './orchestration/client-port.js';
 import type { HostRouteContext } from './host-onboarding.js';
 import type { RouteContext } from './individual-onboarding.js';
-import type { EmployeeDeviceActivationResult } from './device-activation.js';
+import type { EmployeeDeviceActivationResult, ProfileDeviceRegistrationInput } from './device-activation.js';
 export type OrganizationControllerRecoveryInput = {
     credentialReissuanceInput?: NodeLegalOrganizationVerificationTransactionInput;
     /** @deprecated Use `credentialReissuanceInput`. */
     issueInput?: NodeLegalOrganizationVerificationTransactionInput;
     controllerIdToken: string;
-    dcrPayload: Record<string, unknown>;
+    deviceRegistration?: ProfileDeviceRegistrationInput;
+    /** @deprecated Use a profile-device draft and pass its `deviceRegistration`. */
+    dcrPayload?: Record<string, unknown>;
     credentialReissuancePollOptions?: PollOptions;
     /** @deprecated Use `credentialReissuancePollOptions`. */
     issuePollOptions?: PollOptions;

package/dist/organization-controller-recovery.js

@@ -1,5 +1,5 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
-import { activateEmployeeDeviceWithActivationCodeWithDeps } from './device-activation.js';
+import { activateEmployeeDeviceWithActivationCodeWithDeps, activateEmployeeDeviceWithActivationRequestWithDeps, } from './device-activation.js';
 export async function recoverOrganizationControllerWithCredentialReissuanceWithDeps(deps) {
     /**
      * Existing-tenant controller recovery contract:
@@ -24,19 +24,25 @@ export async function recoverOrganizationControllerWithCredentialReissuanceWithD
     if (!activationCode) {
         throw new Error('recoverOrganizationControllerWithCredentialReissuance: missing org.schema.IndividualProduct.serialNumber in Organization/_issue response.');
     }
-    const activation = await activateEmployeeDeviceWithActivationCodeWithDeps({
+    const activation = await activateEmployeeDeviceWithActivationRequestWithDeps({
         routeCtx: deps.tenantCtx,
         input: {
             activationCode,
             idToken: deps.input.controllerIdToken,
+            deviceRegistration: deps.input.deviceRegistration,
             dcrPayload: deps.input.dcrPayload,
-            pollOptions: deps.input.activationPollOptions,
         },
-        identityTokenExchangePath: deps.identityTokenExchangePath,
-        identityTokenExchangePollPath: deps.identityTokenExchangePollPath,
-        identityDeviceDcrPath: deps.identityDeviceDcrPath,
-        identityDeviceDcrPollPath: deps.identityDeviceDcrPollPath,
-        submitAndPollWithBearerToken: deps.submitAndPollWithBearerToken,
+        defaultTimeoutMs: deps.input.activationPollOptions?.timeoutMs,
+        defaultIntervalMs: deps.input.activationPollOptions?.intervalMs,
+        activateEmployeeDeviceWithActivationCode: (routeCtx, input) => activateEmployeeDeviceWithActivationCodeWithDeps({
+            routeCtx,
+            input,
+            identityTokenExchangePath: deps.identityTokenExchangePath,
+            identityTokenExchangePollPath: deps.identityTokenExchangePollPath,
+            identityDeviceDcrPath: deps.identityDeviceDcrPath,
+            identityDeviceDcrPollPath: deps.identityDeviceDcrPollPath,
+            submitAndPollWithBearerToken: deps.submitAndPollWithBearerToken,
+        }),
     });
     return {
         credentialReissuance,

package/dist/organization-employee-lifecycle.d.ts

@@ -21,6 +21,8 @@ export type OrganizationEmployeeProvisioningResult = Readonly<{
     license: SubmitAndPollResult;
     licenseOrder?: SubmitAndPollResult;
     activationCode: string;
+    /** Effective installation allowance returned by the reserved GW seat. */
+    maxDevices?: number;
 }>;
 /** Shared dependencies for the create plus seat issuance workflow. */
 export type OrganizationEmployeeProvisioningDeps = Readonly<{
@@ -34,6 +36,8 @@ export type OrganizationEmployeeProvisioningDeps = Readonly<{
  * returns the exact GW activation credential.
  */
 export declare function provisionOrganizationEmployeeWithDeps(routeContext: RouteContext, input: OrganizationEmployeeProvisioningInput, deps: OrganizationEmployeeProvisioningDeps): Promise<OrganizationEmployeeProvisioningResult>;
+/** Reads the effective positive installation allowance returned by `License/_issue`. */
+export declare function readEmployeeLicenseMaxDevices(value: unknown): number | undefined;
 /**
  * Reads the pending seat Offer from an employee-create response.
  *

package/dist/organization-employee-lifecycle.js

@@ -35,7 +35,23 @@ export async function provisionOrganizationEmployeeWithDeps(routeContext, input,
     if (!activationCode) {
         throw new Error('provisionOrganizationEmployee: GW response did not contain an employee activation credential.');
     }
-    return { employee, license, licenseOrder, activationCode };
+    const maxDevices = readEmployeeLicenseMaxDevices(license.poll.body);
+    return {
+        employee,
+        license,
+        licenseOrder,
+        activationCode,
+        ...(maxDevices ? { maxDevices } : {}),
+    };
+}
+/** Reads the effective positive installation allowance returned by `License/_issue`. */
+export function readEmployeeLicenseMaxDevices(value) {
+    for (const candidate of nestedRecords(value)) {
+        const configured = Number(record(candidate.meta)?.maxDevices ?? candidate.maxDevices);
+        if (Number.isInteger(configured) && configured > 0)
+            return configured;
+    }
+    return undefined;
 }
 /**
  * Reads the pending seat Offer from an employee-create response.

package/dist/organization-license-order.d.ts

@@ -14,11 +14,16 @@ import type { RouteContext } from './individual-onboarding.js';
  * Transport note:
  * - current GW CORE exposes this confirmation step through the host
  *   `registry/org.schema/Order/_batch` route
- * - the organization controller still reasons in tenant context, so the
- *   runtime adapts that higher-level intent onto the current host route
+ * - that host route owns commercial routing and persistence only; it does not
+ *   change the security principal or move controller keys into the host vault
+ * - `issuerDid` must be the exact controller DID registered through DCR for the
+ *   tenant in `routeCtx`; signed/encrypted transports therefore emit its
+ *   registered `kid`/`skid`, and GW resolves those public keys from that tenant
+ * - `aud` remains the tenant id so GW cannot confuse a host-routed Order with a
+ *   host-authored controller request
  */
 export type OrganizationLicenseOrderConfirmInput = Readonly<{
-    /** Exact DCR-registered controller DID that signs the protected request. */
+    /** Exact tenant DCR-registered controller DID used as `iss` and key owner. */
     issuerDid: string;
     offerId: string;
     hostNetwork?: string;

package/dist/resource-operations.d.ts

@@ -501,6 +501,33 @@ export type DigitalTwinGenerationInput = {
         intervalMs?: number;
     };
 };
+/** Subject decision controlling publication into the pseudonymous research index. */
+export type DigitalTwinSecondaryUseConsentInput = {
+    subjectDid: string;
+    /** Organization/tenant that provides and stores the subject's index. */
+    indexProviderOrganizationDid: string;
+    decision: 'permit' | 'deny';
+    /** Server-owned FHIR Consent identifier. Never accept it from the browser. */
+    consentIdentifier: string;
+    consentDate?: string;
+    dataType?: string;
+    pollOptions?: {
+        timeoutMs?: number;
+        intervalMs?: number;
+    };
+};
+/** Result of enabling or disabling one subject's digital-twin publication. */
+export type DigitalTwinSecondaryUseConsentResult = GrantProfessionalAccessResult;
+/** Provider-offboarding command that destroys only the private subject/twin binding. */
+export type DigitalTwinSubjectLinkPurgeInput = {
+    subjectDid: string;
+    pollOptions?: {
+        timeoutMs?: number;
+        intervalMs?: number;
+    };
+};
+/** Async GW result for a subject/twin binding purge. */
+export type DigitalTwinSubjectLinkPurgeResult = SubmitAndPollResult;
 export declare function createOrganizationEmployeeWithDeps(routeCtx: RouteContext, input: OrganizationEmployeeCreationInput, options: {
     timeoutMs?: number;
     intervalMs?: number;
@@ -882,6 +909,46 @@ export declare function grantProfessionalAccessWithDeps(routeCtx: RouteContext,
         intervalMs?: number;
     }) => Promise<SubmitAndPollResult>;
 }): Promise<GrantProfessionalAccessResult>;
+/**
+ * Enables or disables secondary research use for one subject.
+ *
+ * `permit` asks GW to build or rebuild the current pseudonymous projection;
+ * `deny` pauses later synchronization while preserving the published twin and
+ * tenant-private subject alias.
+ */
+export declare function setDigitalTwinSecondaryUseConsentWithDeps(routeCtx: RouteContext, input: DigitalTwinSecondaryUseConsentInput, deps: {
+    buildConsentClaimsWithCid: (input: GrantProfessionalAccessInput, options?: {
+        consentIdentifierFactory: () => string;
+    }) => {
+        actorIdentifier: string;
+        subjectIdentifier: string;
+        consentClaims: Record<string, unknown>;
+        claimsCid?: string;
+    };
+    individualConsentR4BatchPath: (ctx: RouteContext) => string;
+    individualConsentR4PollPath: (ctx: RouteContext) => string;
+    submitAndPoll: (submitPath: string, pollPath: string, payload: {
+        thid?: string;
+    } & Record<string, unknown>, pollOptions?: {
+        timeoutMs?: number;
+        intervalMs?: number;
+    }) => Promise<SubmitAndPollResult>;
+}): Promise<DigitalTwinSecondaryUseConsentResult>;
+/**
+ * Removes the index provider's private individual-to-twin correspondence.
+ * The anonymous twin is intentionally not deleted. A later enrollment gets a
+ * new UUID and cannot reconnect the detached twin to the individual.
+ */
+export declare function purgeDigitalTwinSubjectLinkWithDeps(routeCtx: RouteContext, input: DigitalTwinSubjectLinkPurgeInput, deps: {
+    individualResearchSubjectPurgePath: (ctx: RouteContext) => string;
+    individualResearchSubjectPurgePollPath: (ctx: RouteContext) => string;
+    submitAndPoll: (submitPath: string, pollPath: string, payload: {
+        thid?: string;
+    } & Record<string, unknown>, pollOptions?: {
+        timeoutMs?: number;
+        intervalMs?: number;
+    }) => Promise<SubmitAndPollResult>;
+}): Promise<DigitalTwinSubjectLinkPurgeResult>;
 export declare function revokeProfessionalAccessWithDeps(routeCtx: RouteContext, input: RevokeProfessionalAccessInput, deps: {
     individualConsentR4BatchPath: (ctx: RouteContext) => string;
     individualConsentR4PollPath: (ctx: RouteContext) => string;

package/dist/resource-operations.js

@@ -1,5 +1,5 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
-import { HealthcareBasicSections, ResourceTypesFhirR4 } from 'gdc-common-utils-ts/constants';
+import { HealthcareBasicSections, HealthcareConsentPurposes, ResourceTypesFhirR4, ServiceCapability, } from 'gdc-common-utils-ts/constants';
 import { Format } from 'gdc-common-utils-ts/constants/Schemas';
 import { RelatedPersonClaim } from 'gdc-common-utils-ts/models/interoperable-claims/related-person-claims';
 import { CommunicationClaim } from 'gdc-common-utils-ts/models/interoperable-claims/communication-claims';
@@ -9,6 +9,8 @@ import { DeviceAppTypes, DeviceUserClasses } from 'gdc-common-utils-ts/constants
 import { addFhirResourceToCommunication, createCommunicationResource, buildClinicalSummaryCommunicationJob, buildPermissionRequestCommunication, createClinicalSectionUpdateOutboxJob, createClinicalSummaryUpdateOutboxJob, readClinicalSummaryOperationResult, TransportProfiles, } from 'gdc-sdk-core-ts';
 import { GwCoreLifecycleRequestMethod, GwCoreLifecycleRequestType, GwCoreLifecycleTodo, } from './constants/lifecycle.js';
 import { buildEmployeeSearchBundle, ConsentClaims, } from 'gdc-sdk-core-ts';
+import { ClaimConsent } from 'gdc-common-utils-ts/models/consent-rule';
+import { assignCidToClaimsId } from 'gdc-common-utils-ts/utils/fhir-cid';
 export function buildClinicalSectionUpdateIngestion(input) {
     return {
         communicationJob: createClinicalSectionUpdateOutboxJob(input),
@@ -801,6 +803,65 @@ export async function grantProfessionalAccessWithDeps(routeCtx, input, deps) {
         claimsCid: built.claimsCid,
     };
 }
+/**
+ * Enables or disables secondary research use for one subject.
+ *
+ * `permit` asks GW to build or rebuild the current pseudonymous projection;
+ * `deny` pauses later synchronization while preserving the published twin and
+ * tenant-private subject alias.
+ */
+export async function setDigitalTwinSecondaryUseConsentWithDeps(routeCtx, input, deps) {
+    if (!String(input.consentIdentifier || '').trim()) {
+        throw new Error('consentIdentifier is required for idempotent digital-twin consent updates.');
+    }
+    const indexProviderOrganizationDid = String(input.indexProviderOrganizationDid || '').trim();
+    if (!indexProviderOrganizationDid) {
+        throw new Error('indexProviderOrganizationDid is required.');
+    }
+    const buildFhirConsentClaimsWithoutLegacyAttachment = (consentInput, options) => {
+        const built = deps.buildConsentClaimsWithCid(consentInput, options);
+        const claims = { ...built.consentClaims };
+        delete claims[ClaimConsent.attachmentContentType];
+        delete claims[ClaimConsent.attachmentData];
+        const context = String(claims['@context'] || '').trim();
+        if (context) {
+            delete claims[`${context}.${ClaimConsent.attachmentContentType}`];
+            delete claims[`${context}.${ClaimConsent.attachmentData}`];
+        }
+        const assigned = assignCidToClaimsId(claims);
+        return { ...built, consentClaims: assigned.claims, claimsCid: assigned.cid };
+    };
+    return grantProfessionalAccessWithDeps(routeCtx, {
+        subjectDid: input.subjectDid,
+        actorId: indexProviderOrganizationDid,
+        actorRole: '*',
+        purpose: HealthcareConsentPurposes.Research,
+        actions: [ServiceCapability.DigitalTwinReader],
+        decision: input.decision,
+        consentIdentifier: input.consentIdentifier,
+        consentDate: input.consentDate,
+        dataType: input.dataType,
+        pollOptions: input.pollOptions,
+    }, { ...deps, buildConsentClaimsWithCid: buildFhirConsentClaimsWithoutLegacyAttachment });
+}
+/**
+ * Removes the index provider's private individual-to-twin correspondence.
+ * The anonymous twin is intentionally not deleted. A later enrollment gets a
+ * new UUID and cannot reconnect the detached twin to the individual.
+ */
+export async function purgeDigitalTwinSubjectLinkWithDeps(routeCtx, input, deps) {
+    const subjectDid = String(input.subjectDid || '').trim();
+    if (!subjectDid)
+        throw new Error('subjectDid is required.');
+    const thid = `digital-twin-link-purge-${createRuntimeUuid()}`;
+    return deps.submitAndPoll(deps.individualResearchSubjectPurgePath(routeCtx), deps.individualResearchSubjectPurgePollPath(routeCtx), {
+        thid,
+        body: {
+            resourceType: 'Parameters',
+            parameter: [{ name: 'subject', valueString: subjectDid }],
+        },
+    }, input.pollOptions);
+}
 export async function revokeProfessionalAccessWithDeps(routeCtx, input, deps) {
     const revokedClaims = ConsentClaims
         .fromClaims(input.consentClaims)

package/dist/runtime-client-paths.d.ts

@@ -22,8 +22,16 @@ export declare class RuntimeClientPaths {
     hostRegistryOrganizationActivatePollPath(ctx?: HostRouteContext): string;
     hostRegistryOrganizationDisablePath(ctx?: HostRouteContext): string;
     hostRegistryOrganizationDisablePollPath(ctx?: HostRouteContext): string;
+    hostRegistryOrganizationEnablePath(ctx?: HostRouteContext): string;
+    hostRegistryOrganizationEnablePollPath(ctx?: HostRouteContext): string;
     hostRegistryOrganizationPurgePath(ctx?: HostRouteContext): string;
     hostRegistryOrganizationPurgePollPath(ctx?: HostRouteContext): string;
+    hostRegistryOrganizationStatusPath(ctx?: HostRouteContext): string;
+    hostRegistryOrganizationStatusPollPath(ctx?: HostRouteContext): string;
+    hostRegistryOrganizationDisableDescendantsPath(ctx?: HostRouteContext): string;
+    hostRegistryOrganizationDisableDescendantsPollPath(ctx?: HostRouteContext): string;
+    hostRegistryOrganizationPurgeDescendantsPath(ctx?: HostRouteContext): string;
+    hostRegistryOrganizationPurgeDescendantsPollPath(ctx?: HostRouteContext): string;
     hostRegistryOrderBatchPath(ctx?: HostRouteContext): string;
     hostRegistryOrderPollPath(ctx?: HostRouteContext): string;
     employeeBatchPath(ctx?: RouteContext): string;
@@ -75,6 +83,8 @@ export declare class RuntimeClientPaths {
     individualRelatedPersonPurgePollPath(ctx?: RouteContext): string;
     individualConsentR4BatchPath(ctx: RouteContext): string;
     individualConsentR4PollPath(ctx: RouteContext): string;
+    individualResearchSubjectPurgePath(ctx: RouteContext): string;
+    individualResearchSubjectPurgePollPath(ctx: RouteContext): string;
     individualCommunicationBatchPath(ctx: RouteContext, format: string): string;
     individualCommunicationPollPath(ctx: RouteContext, format: string): string;
     individualCommunicationSearchPath(ctx: RouteContext): string;

package/dist/runtime-client-paths.js

@@ -36,8 +36,16 @@ export class RuntimeClientPaths {
     hostRegistryOrganizationActivatePollPath(ctx) { return this.hostRegistryPath(ctx, 'Organization', '_activate-response'); }
     hostRegistryOrganizationDisablePath(ctx) { return this.hostRegistryPath(ctx, 'Organization', GwCoreLifecycleAction.Disable); }
     hostRegistryOrganizationDisablePollPath(ctx) { return this.hostRegistryPath(ctx, 'Organization', `${GwCoreLifecycleAction.Disable}-response`); }
+    hostRegistryOrganizationEnablePath(ctx) { return this.hostRegistryPath(ctx, 'Organization', GwCoreLifecycleAction.Enable); }
+    hostRegistryOrganizationEnablePollPath(ctx) { return this.hostRegistryPath(ctx, 'Organization', `${GwCoreLifecycleAction.Enable}-response`); }
     hostRegistryOrganizationPurgePath(ctx) { return this.hostRegistryPath(ctx, 'Organization', GwCoreLifecycleAction.Purge); }
     hostRegistryOrganizationPurgePollPath(ctx) { return this.hostRegistryPath(ctx, 'Organization', `${GwCoreLifecycleAction.Purge}-response`); }
+    hostRegistryOrganizationStatusPath(ctx) { return this.hostRegistryPath(ctx, 'Organization', GwCoreLifecycleAction.Status); }
+    hostRegistryOrganizationStatusPollPath(ctx) { return this.hostRegistryPath(ctx, 'Organization', `${GwCoreLifecycleAction.Status}-response`); }
+    hostRegistryOrganizationDisableDescendantsPath(ctx) { return this.hostRegistryPath(ctx, 'Organization', GwCoreLifecycleAction.DisableDescendants); }
+    hostRegistryOrganizationDisableDescendantsPollPath(ctx) { return this.hostRegistryPath(ctx, 'Organization', `${GwCoreLifecycleAction.DisableDescendants}-response`); }
+    hostRegistryOrganizationPurgeDescendantsPath(ctx) { return this.hostRegistryPath(ctx, 'Organization', GwCoreLifecycleAction.PurgeDescendants); }
+    hostRegistryOrganizationPurgeDescendantsPollPath(ctx) { return this.hostRegistryPath(ctx, 'Organization', `${GwCoreLifecycleAction.PurgeDescendants}-response`); }
     hostRegistryOrderBatchPath(ctx) { return this.hostRegistryPath(ctx, 'Order', '_batch'); }
     hostRegistryOrderPollPath(ctx) { return this.hostRegistryPath(ctx, 'Order', '_batch-response'); }
     employeeBatchPath(ctx) { return this.v1Path(ctx, 'entity', 'org.schema', 'Employee', GwCoreLifecycleAction.Batch); }
@@ -89,6 +97,8 @@ export class RuntimeClientPaths {
     individualRelatedPersonPurgePollPath(ctx) { return this.v1Path(ctx, 'individual', 'org.hl7.fhir.r4', 'RelatedPerson', '_purge-response'); }
     individualConsentR4BatchPath(ctx) { return this.v1Path(ctx, 'individual', 'org.hl7.fhir.r4', 'Consent', '_batch'); }
     individualConsentR4PollPath(ctx) { return this.v1Path(ctx, 'individual', 'org.hl7.fhir.r4', 'Consent', '_batch-response'); }
+    individualResearchSubjectPurgePath(ctx) { return this.v1Path(ctx, 'individual', 'org.hl7.fhir.r4', 'ResearchSubject', '_purge'); }
+    individualResearchSubjectPurgePollPath(ctx) { return this.v1Path(ctx, 'individual', 'org.hl7.fhir.r4', 'ResearchSubject', '_purge-response'); }
     individualCommunicationBatchPath(ctx, format) { return this.v1Path(ctx, 'individual', format, 'Communication', '_batch'); }
     individualCommunicationPollPath(ctx, format) { return this.v1Path(ctx, 'individual', format, 'Communication', '_batch-response'); }
     individualCommunicationSearchPath(ctx) { return this.v1Path(ctx, 'individual', 'org.hl7.fhir.r4', 'Communication', '_search'); }