gdc-sdk-node-ts 2.4.24 → 2.4.30

package/dist/node-runtime-client.js

@@ -1,6 +1,7 @@
 import { buildAppHeaders, createBootstrapFacade, decodeTransportResponse, renderCommunicationOutboxRequest, renderGatewayMessageRequest, renderTransportPollRequest, resolveAppInfo, TransportProfiles, } from 'gdc-sdk-core-ts';
 import { pollUntilCompleteWithMethod } from './async-polling.js';
 import { confirmLegalOrganizationOrderWithDeps, HostLifecycleRequestType, HostedTenantLifecycleRequestType, submitHostedTenantLifecycleWithDeps, } from './host-onboarding.js';
+import { GwCoreLifecycleRequestType } from './constants/lifecycle.js';
 import { confirmIndividualOrganizationOrderWithDeps, } from './individual-onboarding.js';
 import { ensureFamilyOrganizationRegistrationWithDeps, } from './family-organization-registration.js';
 import { searchFamilyOrganizationWithDeps } from './family-organization-search.js';
@@ -9,7 +10,7 @@ import { activateEmployeeDeviceWithActivationCodeWithDeps, activateEmployeeDevic
 import { extractOfferIdFromResponseBody, extractOfferPreviewFromResponseBody, } from './order-offer-summary.js';
 import { confirmOrganizationLicenseOrderWithDeps } from './organization-license-order.js';
 import { startIndividualOrganizationWithDeps } from './individual-start.js';
-import { createOrganizationEmployeeWithDeps, issueOrganizationEmployeeLicenseWithDeps, disableIndividualMemberWithDeps, disableIndividualOrganizationWithDeps, disableOrganizationEmployeeWithDeps, listIndividualLicenseOffersWithDeps, listIndividualLicenseOrdersWithDeps, listIndividualLicensesWithDeps, addFreeIndividualMemberLicensesWithDeps, issueIndividualMemberLicenseWithDeps, transitionIndividualMemberLicenseWithDeps, listOrganizationLicenseOffersWithDeps, listOrganizationLicenseOrdersWithDeps, listOrganizationLicensesWithDeps, grantProfessionalAccessWithDeps, buildClinicalSectionUpdateIngestion, buildClinicalSummaryUpdateIngestion, ingestCommunicationAndUpdateIndexWithDeps, requestProfessionalAccessWithDeps, buildVitalSignBatchCommunicationFromSearchResponse, registerBlockchainArtifactAndUpdateIndexWithDeps, requestClinicalSummaryWithDeps, revokeProfessionalAccessWithDeps, searchCommunicationParticipantsWithDeps, purgeIndividualMemberWithDeps, purgeIndividualOrganizationWithDeps, purgeOrganizationEmployeeWithDeps, prepareEmployeeLifecycleMessageForTransport, searchIndividualLicensesWithDeps, searchIndividualLicenseOffersWithDeps, searchIndividualLicenseOrdersWithDeps, searchOrganizationLicensesWithDeps, searchOrganizationLicenseOffersWithDeps, searchOrganizationLicenseOrdersWithDeps, searchOrganizationEmployeesWithDeps, searchClinicalBundleWithDeps, searchLatestIpsWithDeps, upsertRelatedPersonAndPollWithDeps, normalizeCommunicationPathFormatSegment, addFreeOrganizationEmployeeLicensesWithDeps, requestOrganizationEmployeeLicenseOfferWithDeps, } from './resource-operations.js';
+import { createOrganizationEmployeeWithDeps, issueOrganizationEmployeeLicenseWithDeps, disableIndividualMemberWithDeps, disableIndividualOrganizationWithDeps, disableOrganizationEmployeeWithDeps, listIndividualLicenseOffersWithDeps, listIndividualLicenseOrdersWithDeps, listIndividualLicensesWithDeps, addFreeIndividualMemberLicensesWithDeps, issueIndividualMemberLicenseWithDeps, transitionIndividualMemberLicenseWithDeps, listOrganizationLicenseOffersWithDeps, listOrganizationLicenseOrdersWithDeps, listOrganizationLicensesWithDeps, grantProfessionalAccessWithDeps, setDigitalTwinSecondaryUseConsentWithDeps, purgeDigitalTwinSubjectLinkWithDeps, buildClinicalSectionUpdateIngestion, buildClinicalSummaryUpdateIngestion, ingestCommunicationAndUpdateIndexWithDeps, requestProfessionalAccessWithDeps, buildVitalSignBatchCommunicationFromSearchResponse, registerBlockchainArtifactAndUpdateIndexWithDeps, requestClinicalSummaryWithDeps, revokeProfessionalAccessWithDeps, searchCommunicationParticipantsWithDeps, purgeIndividualMemberWithDeps, purgeIndividualOrganizationWithDeps, purgeOrganizationEmployeeWithDeps, prepareEmployeeLifecycleMessageForTransport, searchIndividualLicensesWithDeps, searchIndividualLicenseOffersWithDeps, searchIndividualLicenseOrdersWithDeps, searchOrganizationLicensesWithDeps, searchOrganizationLicenseOffersWithDeps, searchOrganizationLicenseOrdersWithDeps, searchOrganizationEmployeesWithDeps, searchClinicalBundleWithDeps, searchLatestIpsWithDeps, upsertRelatedPersonAndPollWithDeps, normalizeCommunicationPathFormatSegment, addFreeOrganizationEmployeeLicensesWithDeps, requestOrganizationEmployeeLicenseOfferWithDeps, } from './resource-operations.js';
 import { listOrganizationEmployeeLifecycleWithDeps, provisionOrganizationEmployeeWithDeps, } from './organization-employee-lifecycle.js';
 import { buildRuntimeHeaders, fetchWithTimeout, parseResponseBody, postRenderedWithRuntimeConfig, } from './runtime-transport.js';
 import { activateOrganizationInGatewayFromIcaProofWithDeps, submitLegalOrganizationCredentialReissuanceWithDeps, submitLegalOrganizationVerificationTransactionWithDeps, submitOrganizationDidBindingWithDeps, } from './runtime-host-submission.js';
@@ -355,6 +356,20 @@ export class HttpRuntimeClient {
             defaultIntervalMs: pollOptions?.intervalMs,
         });
     }
+    /** Re-enables one suspended hosted tenant without changing its legal identity. */
+    async enableTenant(hostCtx, input, pollOptions) {
+        return submitHostedTenantLifecycleWithDeps({
+            hostCtx,
+            input,
+            requestType: GwCoreLifecycleRequestType.TenantEnable,
+            submitPath: this.paths.hostRegistryOrganizationEnablePath.bind(this.paths),
+            pollPath: this.paths.hostRegistryOrganizationEnablePollPath.bind(this.paths),
+            thidPrefix: 'tenant-enable',
+            submitAndPoll: this.submitAndPoll.bind(this),
+            defaultTimeoutMs: pollOptions?.timeoutMs,
+            defaultIntervalMs: pollOptions?.intervalMs,
+        });
+    }
     /**
      * Purges one already-disabled hosted tenant through the host registry.
      */
@@ -371,6 +386,53 @@ export class HttpRuntimeClient {
             defaultIntervalMs: pollOptions?.intervalMs,
         });
     }
+    /** Reads authoritative tenant and descendant lifecycle state from the host registry. */
+    async getTenantLifecycleStatus(hostCtx, input, pollOptions) {
+        return submitHostedTenantLifecycleWithDeps({
+            hostCtx,
+            input,
+            requestType: GwCoreLifecycleRequestType.TenantStatus,
+            submitPath: this.paths.hostRegistryOrganizationStatusPath.bind(this.paths),
+            pollPath: this.paths.hostRegistryOrganizationStatusPollPath.bind(this.paths),
+            thidPrefix: 'tenant-status',
+            submitAndPoll: this.submitAndPoll.bind(this),
+            defaultTimeoutMs: pollOptions?.timeoutMs,
+            defaultIntervalMs: pollOptions?.intervalMs,
+        });
+    }
+    /** Explicitly disables one descendant group; tenant disable itself never cascades. */
+    async disableTenantDescendants(hostCtx, input, pollOptions) {
+        return this.submitTenantDescendantLifecycle(hostCtx, input, false, pollOptions);
+    }
+    /** Explicitly purges one descendant group; tenant purge itself never cascades. */
+    async purgeTenantDescendants(hostCtx, input, pollOptions) {
+        return this.submitTenantDescendantLifecycle(hostCtx, input, true, pollOptions);
+    }
+    submitTenantDescendantLifecycle(hostCtx, input, purge, pollOptions) {
+        return submitHostedTenantLifecycleWithDeps({
+            hostCtx,
+            input: {
+                ...input,
+                additionalClaims: {
+                    ...input.additionalClaims,
+                    'org.schema.Action.lifecycle.descendantKind': input.descendantKind,
+                },
+            },
+            requestType: purge
+                ? GwCoreLifecycleRequestType.TenantPurgeDescendants
+                : GwCoreLifecycleRequestType.TenantDisableDescendants,
+            submitPath: purge
+                ? this.paths.hostRegistryOrganizationPurgeDescendantsPath.bind(this.paths)
+                : this.paths.hostRegistryOrganizationDisableDescendantsPath.bind(this.paths),
+            pollPath: purge
+                ? this.paths.hostRegistryOrganizationPurgeDescendantsPollPath.bind(this.paths)
+                : this.paths.hostRegistryOrganizationDisableDescendantsPollPath.bind(this.paths),
+            thidPrefix: purge ? 'tenant-purge-descendants' : 'tenant-disable-descendants',
+            submitAndPoll: this.submitAndPoll.bind(this),
+            defaultTimeoutMs: pollOptions?.timeoutMs,
+            defaultIntervalMs: pollOptions?.intervalMs,
+        });
+    }
     /**
      * Creates an employee or professional entry under an existing organization tenant.
      */
@@ -763,6 +825,26 @@ export class HttpRuntimeClient {
             submitAndPoll: this.submitAndPoll.bind(this),
         });
     }
+    /**
+     * Applies the subject's reversible secondary-use decision and lets GW
+     * rebuild or pause the tenant-private digital-twin projection.
+     */
+    async setDigitalTwinSecondaryUseConsent(ctx, input) {
+        return setDigitalTwinSecondaryUseConsentWithDeps(ctx, input, {
+            buildConsentClaimsWithCid: this.buildConsentClaimsWithCid.bind(this),
+            individualConsentR4BatchPath: this.paths.individualConsentR4BatchPath.bind(this.paths),
+            individualConsentR4PollPath: this.paths.individualConsentR4PollPath.bind(this.paths),
+            submitAndPoll: this.submitAndPoll.bind(this),
+        });
+    }
+    /** Offboards the subject from this index provider without deleting the anonymous twin. */
+    async purgeDigitalTwinSubjectLink(ctx, input) {
+        return purgeDigitalTwinSubjectLinkWithDeps(ctx, input, {
+            individualResearchSubjectPurgePath: this.paths.individualResearchSubjectPurgePath.bind(this.paths),
+            individualResearchSubjectPurgePollPath: this.paths.individualResearchSubjectPurgePollPath.bind(this.paths),
+            submitAndPoll: this.submitAndPoll.bind(this),
+        });
+    }
     /**
      * Closes an existing professional consent by setting its period end and
      * resubmitting the updated consent resource.
@@ -820,6 +902,13 @@ export class HttpRuntimeClient {
             }),
         });
     }
+    /**
+     * Actor-facade name retained for organization controllers and employees.
+     * The implementation is actor-neutral and shares the profile-device flow.
+     */
+    async activateEmployeeDeviceWithActivationRequest(input) {
+        return this.activateProfileDeviceWithActivationRequest(input);
+    }
     /**
      * Creates or updates a `RelatedPerson` for non-employee family/caregiver
      * roles such as a grandfather, guardian, or external caregiver.
@@ -1164,6 +1253,8 @@ export class HttpRuntimeClient {
     individualRelatedPersonPurgePollPath(ctx) { return this.paths.individualRelatedPersonPurgePollPath(ctx); }
     individualConsentR4BatchPath(ctx) { return this.paths.individualConsentR4BatchPath(ctx); }
     individualConsentR4PollPath(ctx) { return this.paths.individualConsentR4PollPath(ctx); }
+    individualResearchSubjectPurgePath(ctx) { return this.paths.individualResearchSubjectPurgePath(ctx); }
+    individualResearchSubjectPurgePollPath(ctx) { return this.paths.individualResearchSubjectPurgePollPath(ctx); }
     individualCommunicationBatchPath(ctx, format) { return this.paths.individualCommunicationBatchPath(ctx, format); }
     individualCommunicationPollPath(ctx, format) { return this.paths.individualCommunicationPollPath(ctx, format); }
     individualCommunicationSearchPath(ctx) { return this.paths.individualCommunicationSearchPath(ctx); }

package/dist/orchestration/client-port.d.ts

@@ -18,7 +18,7 @@ import type { EnsureFamilyOrganizationRegistrationInput, EnsureFamilyOrganizatio
 import type { OrganizationLicenseOrderConfirmInput } from '../organization-license-order.js';
 import type { SmartTokenExchangeResult, SmartTokenRequestInput } from '../smart-token.js';
 import type { DigitalTwinMaterializationInput, DigitalTwinSearchInput, DigitalTwinSelectionInput } from '../digital-twin.js';
-import type { CommunicationIngestionInput, BlockchainArtifactRegistrationInput, CommunicationParticipantRuntimeSearchInput, ClinicalBundleSearchInput, ClinicalSectionUpdateInput, ClinicalSummaryReadResult, ClinicalSummaryRequestInput, ClinicalSummaryUpdateInput, VitalSignBatchCommunicationFromSearchResponseInput, DigitalTwinGenerationInput, GrantProfessionalAccessInput, GrantProfessionalAccessResult, IndividualMemberLifecycleInput, IndividualMemberLicenseAddInput, IndividualMemberLicenseInvitationInput, IndividualMemberLicenseTransitionInput, IpsOrFhirImportInput, OrganizationEmployeeCreationInput, OrganizationEmployeeLicenseAddInput, OrganizationEmployeeLicenseOfferInput, OrganizationEmployeeLicenseInvitationInput, OrganizationEmployeeLifecycleInput, OrganizationEmployeeSearchInput, ProfessionalAccessRequestInput, ProfessionalAccessRequestResult, RevokeProfessionalAccessInput, RevokeProfessionalAccessResult, RelatedPersonUpsertInput } from '../resource-operations.js';
+import type { CommunicationIngestionInput, BlockchainArtifactRegistrationInput, CommunicationParticipantRuntimeSearchInput, ClinicalBundleSearchInput, ClinicalSectionUpdateInput, ClinicalSummaryReadResult, ClinicalSummaryRequestInput, ClinicalSummaryUpdateInput, VitalSignBatchCommunicationFromSearchResponseInput, DigitalTwinGenerationInput, DigitalTwinSecondaryUseConsentInput, DigitalTwinSecondaryUseConsentResult, DigitalTwinSubjectLinkPurgeInput, DigitalTwinSubjectLinkPurgeResult, GrantProfessionalAccessInput, GrantProfessionalAccessResult, IndividualMemberLifecycleInput, IndividualMemberLicenseAddInput, IndividualMemberLicenseInvitationInput, IndividualMemberLicenseTransitionInput, IpsOrFhirImportInput, OrganizationEmployeeCreationInput, OrganizationEmployeeLicenseAddInput, OrganizationEmployeeLicenseOfferInput, OrganizationEmployeeLicenseInvitationInput, OrganizationEmployeeLifecycleInput, OrganizationEmployeeSearchInput, ProfessionalAccessRequestInput, ProfessionalAccessRequestResult, RevokeProfessionalAccessInput, RevokeProfessionalAccessResult, RelatedPersonUpsertInput } from '../resource-operations.js';
 /**
  * Shared node-runtime activation input.
  *
@@ -73,7 +73,15 @@ export type RuntimeClient = {
     disableHost?: (hostCtx: HostRouteContext, input: HostedTenantLifecycleInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
     purgeHost?: (hostCtx: HostRouteContext, input: HostedTenantLifecycleInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
     disableTenant?: (hostCtx: HostRouteContext, input: HostedTenantLifecycleInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
+    enableTenant?: (hostCtx: HostRouteContext, input: HostedTenantLifecycleInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
     purgeTenant?: (hostCtx: HostRouteContext, input: HostedTenantLifecycleInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
+    getTenantLifecycleStatus?: (hostCtx: HostRouteContext, input: HostedTenantLifecycleInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
+    disableTenantDescendants?: (hostCtx: HostRouteContext, input: HostedTenantLifecycleInput & {
+        descendantKind: 'individuals';
+    }, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
+    purgeTenantDescendants?: (hostCtx: HostRouteContext, input: HostedTenantLifecycleInput & {
+        descendantKind: 'individuals';
+    }, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
     createOrganizationEmployee?: (ctx: RouteContext, input: OrganizationEmployeeCreationInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
     provisionOrganizationEmployee?: (ctx: RouteContext, input: OrganizationEmployeeProvisioningInput) => Promise<OrganizationEmployeeProvisioningResult>;
     issueOrganizationEmployeeLicense?: (ctx: RouteContext, input: OrganizationEmployeeLicenseInvitationInput) => Promise<SubmitAndPollResult>;
@@ -127,6 +135,8 @@ export type RuntimeClient = {
     importIpsOrFhirAndUpdateIndex?: (ctx: RouteContext, input: IpsOrFhirImportInput) => Promise<SubmitAndPollResult>;
     upsertRelatedPersonAndPoll?: (ctx: RouteContext, input: RelatedPersonUpsertInput) => Promise<SubmitAndPollResult>;
     generateDigitalTwinFromSubjectData?: (ctx: RouteContext, input: DigitalTwinGenerationInput) => Promise<SubmitAndPollResult>;
+    setDigitalTwinSecondaryUseConsent?: (ctx: RouteContext, input: DigitalTwinSecondaryUseConsentInput) => Promise<DigitalTwinSecondaryUseConsentResult>;
+    purgeDigitalTwinSubjectLink?: (ctx: RouteContext, input: DigitalTwinSubjectLinkPurgeInput) => Promise<DigitalTwinSubjectLinkPurgeResult>;
     searchClinicalBundle?: (ctx: RouteContext, input: ClinicalBundleSearchInput) => Promise<SubmitAndPollResult>;
     searchDigitalTwins?: (ctx: RouteContext, input: DigitalTwinSearchInput) => Promise<SubmitAndPollResult>;
     saveDigitalTwinSelection?: (ctx: RouteContext, input: DigitalTwinSelectionInput) => Promise<SubmitAndPollResult>;

package/dist/orchestration/digital-twin-sdk.js

@@ -1,7 +1,7 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
 import { HealthcareConsentPurposes, ServiceCapability } from 'gdc-common-utils-ts/constants';
 import { CompositionClaim } from 'gdc-common-utils-ts/models';
-import { DigitalTwinSearchParameter, readDigitalTwinSearchResult } from '../digital-twin.js';
+import { assertDigitalTwinSubjectId, DigitalTwinSearchParameter, readDigitalTwinSearchResult, } from '../digital-twin.js';
 import { requireClientMethod } from './client-port.js';
 /** Public research facade for licensed digital-twin access. */
 export class DigitalTwinSdk {
@@ -62,6 +62,7 @@ export class DigitalTwinSdk {
      * The canonical clinical twin is never modified.
      */
     saveSelection(ctx, input) {
+        assertDigitalTwinSubjectId(input.twinSubjectId);
         const requestedAuthorDid = String(input.authorDid || '').trim() || undefined;
         if (this.researcherDid && requestedAuthorDid && requestedAuthorDid !== this.researcherDid) {
             throw new Error('Digital twin selection authorDid must match the actor session.');
@@ -92,6 +93,7 @@ export class DigitalTwinSdk {
     }
     /** Materializes one selected research subject through `ResearchSubject/$summary`. */
     materialize(ctx, input) {
+        assertDigitalTwinSubjectId(input.twinSubjectId);
         return requireClientMethod(this.client, 'materializeDigitalTwin')(ctx, {
             ...input,
             accessToken: input.accessToken || this.smartAccessToken,

package/dist/orchestration/host-onboarding-sdk.d.ts

@@ -1,10 +1,16 @@
-import { type NodeRuntimeClient, type NodeOrganizationActivationInput, type PollOptions, type SubmitAndPollResult, type SubmitPayload } from './client-port.js';
+import { type NodeRuntimeClient, type NodeLegalOrganizationVerificationTransactionInput, type NodeOrganizationActivationInput, type PollOptions, type SubmitAndPollResult, type SubmitPayload } from './client-port.js';
 import type { HostingControllerFacade, HostLifecycleInput, HostRouteContext, LegalOrganizationOrderInput } from '../host-onboarding.js';
 import type { NodeCapability } from '../session.js';
 export declare class HostOnboardingSdk implements HostingControllerFacade {
     private readonly client;
-    private readonly capabilities;
-    constructor(client: NodeRuntimeClient, capabilities?: readonly NodeCapability[]);
+    private readonly capabilities?;
+    constructor(client: NodeRuntimeClient, capabilities?: readonly NodeCapability[] | undefined);
+    /**
+     * Starts the canonical host-side legal-organization verification
+     * transaction. Confirm the returned Offer through
+     * `confirmLegalOrganizationOrder(...)`.
+     */
+    submitLegalOrganizationVerificationTransaction(hostCtx: HostRouteContext, input: NodeLegalOrganizationVerificationTransactionInput, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
     /**
      * Submits the legal organization activation proof and required declared
      * service capabilities to GW CORE.

package/dist/orchestration/host-onboarding-sdk.js

@@ -4,10 +4,19 @@ import { requireClientMethod, submitAndPollWithClient, } from './client-port.js'
 import { ActorCapabilities, ActorKinds } from 'gdc-common-utils-ts/constants/actor-session';
 import { assertFacadeCapability } from './capability-guard.js';
 export class HostOnboardingSdk {
-    constructor(client, capabilities = []) {
+    constructor(client, capabilities) {
         this.client = client;
         this.capabilities = capabilities;
     }
+    /**
+     * Starts the canonical host-side legal-organization verification
+     * transaction. Confirm the returned Offer through
+     * `confirmLegalOrganizationOrder(...)`.
+     */
+    submitLegalOrganizationVerificationTransaction(hostCtx, input, pollOptions) {
+        assertFacadeCapability(this.capabilities, ActorCapabilities.HostingActivateOrganization, ActorKinds.HostOnboarding, 'submitLegalOrganizationVerificationTransaction');
+        return requireClientMethod(this.client, 'submitLegalOrganizationVerificationTransaction')(hostCtx, input, pollOptions);
+    }
     /**
      * Submits the legal organization activation proof and required declared
      * service capabilities to GW CORE.

package/dist/orchestration/individual-controller-sdk.d.ts

@@ -1,3 +1,4 @@
+import { type ConsentRule } from 'gdc-common-utils-ts/models/consent-rule';
 import { type IndividualControllerCredentialInput, type IndividualControllerVpPayloadInput, type IndividualSubjectCredentialInput } from 'gdc-common-utils-ts';
 import { type NodeRuntimeClient, type PollOptions, type SubmitAndPollResult, type SubmitPayload } from './client-port.js';
 import type { FamilyOrganizationSummary } from 'gdc-common-utils-ts/utils/family-organization-summary';
@@ -7,7 +8,7 @@ import type { IndividualOrganizationConfirmOrderInput, RouteContext } from '../i
 import type { IndividualOrganizationBootstrapInput, IndividualOrganizationStartResult } from '../individual-start.js';
 import type { NodeCapability } from '../session.js';
 import type { IndividualOrganizationLifecycleInput } from 'gdc-sdk-core-ts';
-import type { BlockchainArtifactRegistrationInput, ClinicalBundleSearchInput, ClinicalSectionUpdateInput, ClinicalSummaryReadResult, ClinicalSummaryRequestInput, ClinicalSummaryUpdateInput, CommunicationIngestionInput, CommunicationParticipantRuntimeSearchInput, DigitalTwinGenerationInput, GrantProfessionalAccessInput, GrantProfessionalAccessResult, IndividualMemberLifecycleInput, IndividualMemberLicenseAddInput, IndividualMemberLicenseInvitationInput, IndividualMemberLicenseTransitionInput, IpsOrFhirImportInput, LicenseListRuntimeSearchInput, LicenseOfferRuntimeSearchInput, LicenseOrderRuntimeSearchInput, RevokeProfessionalAccessInput, RevokeProfessionalAccessResult, ProfessionalAccessRequestDecisionInput, ProfessionalAccessRequestSearchInput, RelatedPersonUpsertInput } from '../resource-operations.js';
+import type { BlockchainArtifactRegistrationInput, ClinicalBundleSearchInput, ClinicalSectionUpdateInput, ClinicalSummaryReadResult, ClinicalSummaryRequestInput, ClinicalSummaryUpdateInput, CommunicationIngestionInput, CommunicationParticipantRuntimeSearchInput, DigitalTwinGenerationInput, DigitalTwinSecondaryUseConsentInput, DigitalTwinSecondaryUseConsentResult, DigitalTwinSubjectLinkPurgeInput, DigitalTwinSubjectLinkPurgeResult, GrantProfessionalAccessInput, GrantProfessionalAccessResult, IndividualMemberLifecycleInput, IndividualMemberLicenseAddInput, IndividualMemberLicenseInvitationInput, IndividualMemberLicenseTransitionInput, IpsOrFhirImportInput, LicenseListRuntimeSearchInput, LicenseOfferRuntimeSearchInput, LicenseOrderRuntimeSearchInput, RevokeProfessionalAccessInput, RevokeProfessionalAccessResult, ProfessionalAccessRequestDecisionInput, ProfessionalAccessRequestSearchInput, RelatedPersonUpsertInput } from '../resource-operations.js';
 import type { SmartTokenExchangeResult, SmartTokenRequestInput } from '../smart-token.js';
 /**
  * Individual-controller oriented facade over a `NodeRuntimeClient`.
@@ -117,10 +118,35 @@ export declare class IndividualControllerSdk {
      */
     searchCommunicationParticipants(ctx: RouteContext, input: CommunicationParticipantRuntimeSearchInput): Promise<SubmitAndPollResult>;
     /**
-     * Explicitly packages subject data for a study/transfer flow.
-     * Normal clinical ingestion is projected into the tenant research index by GW.
+     * Legacy direct Composition transfer hook.
+     *
+     * @deprecated Canonical twins are created only by GW from current subject
+     * data after `setDigitalTwinSecondaryUseConsent(..., { decision: 'permit' })`.
+     * The Node runtime intentionally does not publish canonical Compositions.
      */
     generateDigitalTwinFromSubjectData(ctx: RouteContext, input: DigitalTwinGenerationInput): Promise<SubmitAndPollResult>;
+    /**
+     * Enables or disables the subject's secondary-use digital-twin projection.
+     * This is the canonical patient-side operation; application code must not
+     * publish a canonical Composition directly into the research index.
+     */
+    setDigitalTwinSecondaryUseConsent(ctx: RouteContext, input: DigitalTwinSecondaryUseConsentInput): Promise<DigitalTwinSecondaryUseConsentResult>;
+    /**
+     * Offboards the subject from the current index provider. This removes only
+     * the private subject/twin correspondence; it never deletes anonymous twin
+     * data already shared for research.
+     */
+    purgeDigitalTwinSubjectLink(ctx: RouteContext, input: DigitalTwinSubjectLinkPurgeInput): Promise<DigitalTwinSubjectLinkPurgeResult>;
+    /** Returns whether the subject currently permits projection by its index provider. */
+    getDigitalTwinSecondaryUseConsentStatus(ctx: RouteContext, input: Readonly<{
+        subjectDid: string;
+        indexProviderOrganizationDid: string;
+        consentIdentifier: string;
+    }>): Promise<Readonly<{
+        exists: boolean;
+        enabled: boolean;
+        consent?: ConsentRule;
+    }>>;
     /**
      * Searches indexed clinical bundles for the current subject/controller context.
      */

package/dist/orchestration/individual-controller-sdk.js

@@ -1,8 +1,11 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
 import { ActorCapabilities, ActorKinds } from 'gdc-common-utils-ts/constants/actor-session';
+import { HealthcareConsentPurposes, ServiceCapability } from 'gdc-common-utils-ts/constants';
+import { ClaimConsent } from 'gdc-common-utils-ts/models/consent-rule';
 import { buildIndividualControllerIdentityVpPayload, buildUnsignedIndividualControllerIdentityVpJwt, getIndividualControllerIdentitySameAs, getIndividualControllerIdentityVC, getIndividualSubjectVC, } from 'gdc-common-utils-ts';
 import { requireClientMethod, submitAndPollWithClient, } from './client-port.js';
 import { assertFacadeCapability } from './capability-guard.js';
+import { GatewayActiveConsentProvider } from '../gateway-active-consent-provider.js';
 import { buildProfessionalAccessRequestDecisionGrant } from '../resource-operations.js';
 import { buildProfessionalAccessRequestSearchInput } from '../resource-operations.js';
 /**
@@ -175,13 +178,56 @@ export class IndividualControllerSdk {
         return requireClientMethod(this.client, 'searchCommunicationParticipants')(ctx, input);
     }
     /**
-     * Explicitly packages subject data for a study/transfer flow.
-     * Normal clinical ingestion is projected into the tenant research index by GW.
+     * Legacy direct Composition transfer hook.
+     *
+     * @deprecated Canonical twins are created only by GW from current subject
+     * data after `setDigitalTwinSecondaryUseConsent(..., { decision: 'permit' })`.
+     * The Node runtime intentionally does not publish canonical Compositions.
      */
     generateDigitalTwinFromSubjectData(ctx, input) {
         assertFacadeCapability(this.capabilities, ActorCapabilities.IndividualGenerateDigitalTwin, ActorKinds.IndividualController, 'generateDigitalTwinFromSubjectData');
         return requireClientMethod(this.client, 'generateDigitalTwinFromSubjectData')(ctx, input);
     }
+    /**
+     * Enables or disables the subject's secondary-use digital-twin projection.
+     * This is the canonical patient-side operation; application code must not
+     * publish a canonical Composition directly into the research index.
+     */
+    setDigitalTwinSecondaryUseConsent(ctx, input) {
+        assertFacadeCapability(this.capabilities, ActorCapabilities.IndividualGenerateDigitalTwin, ActorKinds.IndividualController, 'setDigitalTwinSecondaryUseConsent');
+        return requireClientMethod(this.client, 'setDigitalTwinSecondaryUseConsent')(ctx, input);
+    }
+    /**
+     * Offboards the subject from the current index provider. This removes only
+     * the private subject/twin correspondence; it never deletes anonymous twin
+     * data already shared for research.
+     */
+    purgeDigitalTwinSubjectLink(ctx, input) {
+        assertFacadeCapability(this.capabilities, ActorCapabilities.IndividualGenerateDigitalTwin, ActorKinds.IndividualController, 'purgeDigitalTwinSubjectLink');
+        return requireClientMethod(this.client, 'purgeDigitalTwinSubjectLink')(ctx, input);
+    }
+    /** Returns whether the subject currently permits projection by its index provider. */
+    async getDigitalTwinSecondaryUseConsentStatus(ctx, input) {
+        assertFacadeCapability(this.capabilities, ActorCapabilities.IndividualGenerateDigitalTwin, ActorKinds.IndividualController, 'getDigitalTwinSecondaryUseConsentStatus');
+        const activeConsents = await new GatewayActiveConsentProvider(this.client, ctx)
+            .getActiveConsentsForSubject(input.subjectDid);
+        const consentIdentifier = String(input.consentIdentifier || '').trim();
+        if (!consentIdentifier)
+            throw new Error('consentIdentifier is required to distinguish the portal rule from study consents.');
+        const indexProviderOrganizationDid = String(input.indexProviderOrganizationDid || '').trim();
+        if (!indexProviderOrganizationDid)
+            throw new Error('indexProviderOrganizationDid is required.');
+        const consent = activeConsents.find((rule) => {
+            const actions = String(rule[ClaimConsent.action] || '').split(',').map((value) => value.trim());
+            return String(rule[ClaimConsent.identifier] || '').trim() === consentIdentifier
+                && String(rule[ClaimConsent.actorIdentifier] || '').trim() === indexProviderOrganizationDid
+                && String(rule[ClaimConsent.purpose] || '').trim().toUpperCase() === String(HealthcareConsentPurposes.Research).toUpperCase()
+                && actions.includes(ServiceCapability.DigitalTwinReader);
+        });
+        return consent
+            ? { exists: true, enabled: String(consent[ClaimConsent.decision] || '').trim().toLowerCase() === 'permit', consent }
+            : { exists: false, enabled: false };
+    }
     /**
      * Searches indexed clinical bundles for the current subject/controller context.
      */

package/dist/orchestration/organization-controller-sdk.d.ts

@@ -107,17 +107,18 @@ export declare class OrganizationControllerSdk {
     listLicenseOrders(ctx: RouteContext, input?: LicenseOrderRuntimeSearchInput): Promise<SubmitAndPollResult>;
     /**
      * Confirms an already paid organization-side license order so GW CORE can
-     * activate additional tenant seats once the public route exists.
+     * activate additional tenant seats.
      *
      * The commercial/payment step happens outside GW CORE. This method models
      * the follow-up confirmation that should materialize new seats from the
      * accepted order.
      *
-     * Current runtime note:
-     * - search/list of organization license offers and orders already exists
-     * - the public/write post-payment seat-activation route is not converged yet
-     * - current runtime clients therefore throw an explicit unsupported-flow
-     *   error instead of fabricating an unstable payload contract
+     * Security/routing contract:
+     * - the request is routed through the host `Order/_batch` endpoint
+     * - the signed `iss` is still the exact controller DID registered by DCR for
+     *   `ctx.tenantId`; its `kid`/`skid` keys belong to that tenant, not the host
+     * - the configured runtime transport profile applies unchanged, including
+     *   DIDComm encryption in protected staging/production runtimes
      */
     confirmOrganizationLicenseOrder(ctx: RouteContext, input: OrganizationLicenseOrderConfirmInput, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
     /**
@@ -133,11 +134,23 @@ export declare class OrganizationControllerSdk {
      * employees or individual/member descendants remain.
      */
     disableTenant(hostCtx: HostRouteContext, input: HostedTenantLifecycleInput, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
+    /** Re-enables the same suspended tenant and immutable legal identifier. */
+    enableTenant(hostCtx: HostRouteContext, input: HostedTenantLifecycleInput, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
     /**
      * Purges the hosted tenant through the host registry after tenant disable and
      * descendant purges have both completed.
      */
     purgeTenant(hostCtx: HostRouteContext, input: HostedTenantLifecycleInput, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
+    /** Returns host-confirmed tenant state and descendant counters. */
+    getTenantLifecycleStatus(hostCtx: HostRouteContext, input: HostedTenantLifecycleInput, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
+    /** Explicitly disables individuals before tenant disable. Employees use their dedicated lifecycle. */
+    disableTenantDescendants(hostCtx: HostRouteContext, input: HostedTenantLifecycleInput & {
+        descendantKind: 'individuals';
+    }, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
+    /** Explicitly purges individuals before tenant purge. Employees use their dedicated lifecycle. */
+    purgeTenantDescendants(hostCtx: HostRouteContext, input: HostedTenantLifecycleInput & {
+        descendantKind: 'individuals';
+    }, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
     /**
      * Activates the employee device from a previously issued activation request.
      */

package/dist/orchestration/organization-controller-sdk.js

@@ -147,17 +147,18 @@ export class OrganizationControllerSdk {
     }
     /**
      * Confirms an already paid organization-side license order so GW CORE can
-     * activate additional tenant seats once the public route exists.
+     * activate additional tenant seats.
      *
      * The commercial/payment step happens outside GW CORE. This method models
      * the follow-up confirmation that should materialize new seats from the
      * accepted order.
      *
-     * Current runtime note:
-     * - search/list of organization license offers and orders already exists
-     * - the public/write post-payment seat-activation route is not converged yet
-     * - current runtime clients therefore throw an explicit unsupported-flow
-     *   error instead of fabricating an unstable payload contract
+     * Security/routing contract:
+     * - the request is routed through the host `Order/_batch` endpoint
+     * - the signed `iss` is still the exact controller DID registered by DCR for
+     *   `ctx.tenantId`; its `kid`/`skid` keys belong to that tenant, not the host
+     * - the configured runtime transport profile applies unchanged, including
+     *   DIDComm encryption in protected staging/production runtimes
      */
     confirmOrganizationLicenseOrder(ctx, input, pollOptions) {
         return requireClientMethod(this.client, 'confirmOrganizationLicenseOrder')(ctx, input, pollOptions);
@@ -184,6 +185,11 @@ export class OrganizationControllerSdk {
         assertFacadeCapability(this.capabilities, ActorCapabilities.OrganizationDisableTenant, ActorKinds.OrganizationController, 'disableTenant');
         return requireClientMethod(this.client, 'disableTenant')(hostCtx, input, pollOptions);
     }
+    /** Re-enables the same suspended tenant and immutable legal identifier. */
+    enableTenant(hostCtx, input, pollOptions) {
+        assertFacadeCapability(this.capabilities, ActorCapabilities.OrganizationDisableTenant, ActorKinds.OrganizationController, 'enableTenant');
+        return requireClientMethod(this.client, 'enableTenant')(hostCtx, input, pollOptions);
+    }
     /**
      * Purges the hosted tenant through the host registry after tenant disable and
      * descendant purges have both completed.
@@ -192,6 +198,21 @@ export class OrganizationControllerSdk {
         assertFacadeCapability(this.capabilities, ActorCapabilities.OrganizationPurgeTenant, ActorKinds.OrganizationController, 'purgeTenant');
         return requireClientMethod(this.client, 'purgeTenant')(hostCtx, input, pollOptions);
     }
+    /** Returns host-confirmed tenant state and descendant counters. */
+    getTenantLifecycleStatus(hostCtx, input, pollOptions) {
+        assertFacadeCapability(this.capabilities, ActorCapabilities.OrganizationDisableTenant, ActorKinds.OrganizationController, 'getTenantLifecycleStatus');
+        return requireClientMethod(this.client, 'getTenantLifecycleStatus')(hostCtx, input, pollOptions);
+    }
+    /** Explicitly disables individuals before tenant disable. Employees use their dedicated lifecycle. */
+    disableTenantDescendants(hostCtx, input, pollOptions) {
+        assertFacadeCapability(this.capabilities, ActorCapabilities.OrganizationDisableTenant, ActorKinds.OrganizationController, 'disableTenantDescendants');
+        return requireClientMethod(this.client, 'disableTenantDescendants')(hostCtx, input, pollOptions);
+    }
+    /** Explicitly purges individuals before tenant purge. Employees use their dedicated lifecycle. */
+    purgeTenantDescendants(hostCtx, input, pollOptions) {
+        assertFacadeCapability(this.capabilities, ActorCapabilities.OrganizationPurgeTenant, ActorKinds.OrganizationController, 'purgeTenantDescendants');
+        return requireClientMethod(this.client, 'purgeTenantDescendants')(hostCtx, input, pollOptions);
+    }
     /**
      * Activates the employee device from a previously issued activation request.
      */

package/dist/organization-controller-recovery.d.ts

@@ -1,13 +1,15 @@
 import type { NodeLegalOrganizationVerificationTransactionInput, PollOptions, SubmitAndPollResult } from './orchestration/client-port.js';
 import type { HostRouteContext } from './host-onboarding.js';
 import type { RouteContext } from './individual-onboarding.js';
-import type { EmployeeDeviceActivationResult } from './device-activation.js';
+import type { EmployeeDeviceActivationResult, ProfileDeviceRegistrationInput } from './device-activation.js';
 export type OrganizationControllerRecoveryInput = {
     credentialReissuanceInput?: NodeLegalOrganizationVerificationTransactionInput;
     /** @deprecated Use `credentialReissuanceInput`. */
     issueInput?: NodeLegalOrganizationVerificationTransactionInput;
     controllerIdToken: string;
-    dcrPayload: Record<string, unknown>;
+    deviceRegistration?: ProfileDeviceRegistrationInput;
+    /** @deprecated Use a profile-device draft and pass its `deviceRegistration`. */
+    dcrPayload?: Record<string, unknown>;
     credentialReissuancePollOptions?: PollOptions;
     /** @deprecated Use `credentialReissuancePollOptions`. */
     issuePollOptions?: PollOptions;

package/dist/organization-controller-recovery.js

@@ -1,5 +1,5 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
-import { activateEmployeeDeviceWithActivationCodeWithDeps } from './device-activation.js';
+import { activateEmployeeDeviceWithActivationCodeWithDeps, activateEmployeeDeviceWithActivationRequestWithDeps, } from './device-activation.js';
 export async function recoverOrganizationControllerWithCredentialReissuanceWithDeps(deps) {
     /**
      * Existing-tenant controller recovery contract:
@@ -24,19 +24,25 @@ export async function recoverOrganizationControllerWithCredentialReissuanceWithD
     if (!activationCode) {
         throw new Error('recoverOrganizationControllerWithCredentialReissuance: missing org.schema.IndividualProduct.serialNumber in Organization/_issue response.');
     }
-    const activation = await activateEmployeeDeviceWithActivationCodeWithDeps({
+    const activation = await activateEmployeeDeviceWithActivationRequestWithDeps({
         routeCtx: deps.tenantCtx,
         input: {
             activationCode,
             idToken: deps.input.controllerIdToken,
+            deviceRegistration: deps.input.deviceRegistration,
             dcrPayload: deps.input.dcrPayload,
-            pollOptions: deps.input.activationPollOptions,
         },
-        identityTokenExchangePath: deps.identityTokenExchangePath,
-        identityTokenExchangePollPath: deps.identityTokenExchangePollPath,
-        identityDeviceDcrPath: deps.identityDeviceDcrPath,
-        identityDeviceDcrPollPath: deps.identityDeviceDcrPollPath,
-        submitAndPollWithBearerToken: deps.submitAndPollWithBearerToken,
+        defaultTimeoutMs: deps.input.activationPollOptions?.timeoutMs,
+        defaultIntervalMs: deps.input.activationPollOptions?.intervalMs,
+        activateEmployeeDeviceWithActivationCode: (routeCtx, input) => activateEmployeeDeviceWithActivationCodeWithDeps({
+            routeCtx,
+            input,
+            identityTokenExchangePath: deps.identityTokenExchangePath,
+            identityTokenExchangePollPath: deps.identityTokenExchangePollPath,
+            identityDeviceDcrPath: deps.identityDeviceDcrPath,
+            identityDeviceDcrPollPath: deps.identityDeviceDcrPollPath,
+            submitAndPollWithBearerToken: deps.submitAndPollWithBearerToken,
+        }),
     });
     return {
         credentialReissuance,

package/dist/organization-employee-lifecycle.d.ts

@@ -21,6 +21,8 @@ export type OrganizationEmployeeProvisioningResult = Readonly<{
     license: SubmitAndPollResult;
     licenseOrder?: SubmitAndPollResult;
     activationCode: string;
+    /** Effective installation allowance returned by the reserved GW seat. */
+    maxDevices?: number;
 }>;
 /** Shared dependencies for the create plus seat issuance workflow. */
 export type OrganizationEmployeeProvisioningDeps = Readonly<{
@@ -34,6 +36,8 @@ export type OrganizationEmployeeProvisioningDeps = Readonly<{
  * returns the exact GW activation credential.
  */
 export declare function provisionOrganizationEmployeeWithDeps(routeContext: RouteContext, input: OrganizationEmployeeProvisioningInput, deps: OrganizationEmployeeProvisioningDeps): Promise<OrganizationEmployeeProvisioningResult>;
+/** Reads the effective positive installation allowance returned by `License/_issue`. */
+export declare function readEmployeeLicenseMaxDevices(value: unknown): number | undefined;
 /**
  * Reads the pending seat Offer from an employee-create response.
  *

package/dist/organization-employee-lifecycle.js

@@ -35,7 +35,23 @@ export async function provisionOrganizationEmployeeWithDeps(routeContext, input,
     if (!activationCode) {
         throw new Error('provisionOrganizationEmployee: GW response did not contain an employee activation credential.');
     }
-    return { employee, license, licenseOrder, activationCode };
+    const maxDevices = readEmployeeLicenseMaxDevices(license.poll.body);
+    return {
+        employee,
+        license,
+        licenseOrder,
+        activationCode,
+        ...(maxDevices ? { maxDevices } : {}),
+    };
+}
+/** Reads the effective positive installation allowance returned by `License/_issue`. */
+export function readEmployeeLicenseMaxDevices(value) {
+    for (const candidate of nestedRecords(value)) {
+        const configured = Number(record(candidate.meta)?.maxDevices ?? candidate.maxDevices);
+        if (Number.isInteger(configured) && configured > 0)
+            return configured;
+    }
+    return undefined;
 }
 /**
  * Reads the pending seat Offer from an employee-create response.

package/dist/organization-license-order.d.ts

@@ -14,11 +14,16 @@ import type { RouteContext } from './individual-onboarding.js';
  * Transport note:
  * - current GW CORE exposes this confirmation step through the host
  *   `registry/org.schema/Order/_batch` route
- * - the organization controller still reasons in tenant context, so the
- *   runtime adapts that higher-level intent onto the current host route
+ * - that host route owns commercial routing and persistence only; it does not
+ *   change the security principal or move controller keys into the host vault
+ * - `issuerDid` must be the exact controller DID registered through DCR for the
+ *   tenant in `routeCtx`; signed/encrypted transports therefore emit its
+ *   registered `kid`/`skid`, and GW resolves those public keys from that tenant
+ * - `aud` remains the tenant id so GW cannot confuse a host-routed Order with a
+ *   host-authored controller request
  */
 export type OrganizationLicenseOrderConfirmInput = Readonly<{
-    /** Exact DCR-registered controller DID that signs the protected request. */
+    /** Exact tenant DCR-registered controller DID used as `iss` and key owner. */
     issuerDid: string;
     offerId: string;
     hostNetwork?: string;