gdc-sdk-node-ts 2.4.24 → 2.4.31

package/dist/resource-operations.d.ts

@@ -501,6 +501,33 @@ export type DigitalTwinGenerationInput = {
         intervalMs?: number;
     };
 };
+/** Subject decision controlling publication into the pseudonymous research index. */
+export type DigitalTwinSecondaryUseConsentInput = {
+    subjectDid: string;
+    /** Organization/tenant that provides and stores the subject's index. */
+    indexProviderOrganizationDid: string;
+    decision: 'permit' | 'deny';
+    /** Server-owned FHIR Consent identifier. Never accept it from the browser. */
+    consentIdentifier: string;
+    consentDate?: string;
+    dataType?: string;
+    pollOptions?: {
+        timeoutMs?: number;
+        intervalMs?: number;
+    };
+};
+/** Result of enabling or disabling one subject's digital-twin publication. */
+export type DigitalTwinSecondaryUseConsentResult = GrantProfessionalAccessResult;
+/** Provider-offboarding command that destroys only the private subject/twin binding. */
+export type DigitalTwinSubjectLinkPurgeInput = {
+    subjectDid: string;
+    pollOptions?: {
+        timeoutMs?: number;
+        intervalMs?: number;
+    };
+};
+/** Async GW result for a subject/twin binding purge. */
+export type DigitalTwinSubjectLinkPurgeResult = SubmitAndPollResult;
 export declare function createOrganizationEmployeeWithDeps(routeCtx: RouteContext, input: OrganizationEmployeeCreationInput, options: {
     timeoutMs?: number;
     intervalMs?: number;
@@ -882,6 +909,46 @@ export declare function grantProfessionalAccessWithDeps(routeCtx: RouteContext,
         intervalMs?: number;
     }) => Promise<SubmitAndPollResult>;
 }): Promise<GrantProfessionalAccessResult>;
+/**
+ * Enables or disables secondary research use for one subject.
+ *
+ * `permit` asks GW to build or rebuild the current pseudonymous projection;
+ * `deny` pauses later synchronization while preserving the published twin and
+ * tenant-private subject alias.
+ */
+export declare function setDigitalTwinSecondaryUseConsentWithDeps(routeCtx: RouteContext, input: DigitalTwinSecondaryUseConsentInput, deps: {
+    buildConsentClaimsWithCid: (input: GrantProfessionalAccessInput, options?: {
+        consentIdentifierFactory: () => string;
+    }) => {
+        actorIdentifier: string;
+        subjectIdentifier: string;
+        consentClaims: Record<string, unknown>;
+        claimsCid?: string;
+    };
+    individualConsentR4BatchPath: (ctx: RouteContext) => string;
+    individualConsentR4PollPath: (ctx: RouteContext) => string;
+    submitAndPoll: (submitPath: string, pollPath: string, payload: {
+        thid?: string;
+    } & Record<string, unknown>, pollOptions?: {
+        timeoutMs?: number;
+        intervalMs?: number;
+    }) => Promise<SubmitAndPollResult>;
+}): Promise<DigitalTwinSecondaryUseConsentResult>;
+/**
+ * Removes the index provider's private individual-to-twin correspondence.
+ * The anonymous twin is intentionally not deleted. A later enrollment gets a
+ * new UUID and cannot reconnect the detached twin to the individual.
+ */
+export declare function purgeDigitalTwinSubjectLinkWithDeps(routeCtx: RouteContext, input: DigitalTwinSubjectLinkPurgeInput, deps: {
+    individualResearchSubjectPurgePath: (ctx: RouteContext) => string;
+    individualResearchSubjectPurgePollPath: (ctx: RouteContext) => string;
+    submitAndPoll: (submitPath: string, pollPath: string, payload: {
+        thid?: string;
+    } & Record<string, unknown>, pollOptions?: {
+        timeoutMs?: number;
+        intervalMs?: number;
+    }) => Promise<SubmitAndPollResult>;
+}): Promise<DigitalTwinSubjectLinkPurgeResult>;
 export declare function revokeProfessionalAccessWithDeps(routeCtx: RouteContext, input: RevokeProfessionalAccessInput, deps: {
     individualConsentR4BatchPath: (ctx: RouteContext) => string;
     individualConsentR4PollPath: (ctx: RouteContext) => string;

package/dist/resource-operations.js

@@ -1,5 +1,5 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
-import { HealthcareBasicSections, ResourceTypesFhirR4 } from 'gdc-common-utils-ts/constants';
+import { HealthcareBasicSections, HealthcareConsentPurposes, ResourceTypesFhirR4, ServiceCapability, } from 'gdc-common-utils-ts/constants';
 import { Format } from 'gdc-common-utils-ts/constants/Schemas';
 import { RelatedPersonClaim } from 'gdc-common-utils-ts/models/interoperable-claims/related-person-claims';
 import { CommunicationClaim } from 'gdc-common-utils-ts/models/interoperable-claims/communication-claims';
@@ -9,6 +9,8 @@ import { DeviceAppTypes, DeviceUserClasses } from 'gdc-common-utils-ts/constants
 import { addFhirResourceToCommunication, createCommunicationResource, buildClinicalSummaryCommunicationJob, buildPermissionRequestCommunication, createClinicalSectionUpdateOutboxJob, createClinicalSummaryUpdateOutboxJob, readClinicalSummaryOperationResult, TransportProfiles, } from 'gdc-sdk-core-ts';
 import { GwCoreLifecycleRequestMethod, GwCoreLifecycleRequestType, GwCoreLifecycleTodo, } from './constants/lifecycle.js';
 import { buildEmployeeSearchBundle, ConsentClaims, } from 'gdc-sdk-core-ts';
+import { ClaimConsent } from 'gdc-common-utils-ts/models/consent-rule';
+import { assignCidToClaimsId } from 'gdc-common-utils-ts/utils/fhir-cid';
 export function buildClinicalSectionUpdateIngestion(input) {
     return {
         communicationJob: createClinicalSectionUpdateOutboxJob(input),
@@ -801,6 +803,65 @@ export async function grantProfessionalAccessWithDeps(routeCtx, input, deps) {
         claimsCid: built.claimsCid,
     };
 }
+/**
+ * Enables or disables secondary research use for one subject.
+ *
+ * `permit` asks GW to build or rebuild the current pseudonymous projection;
+ * `deny` pauses later synchronization while preserving the published twin and
+ * tenant-private subject alias.
+ */
+export async function setDigitalTwinSecondaryUseConsentWithDeps(routeCtx, input, deps) {
+    if (!String(input.consentIdentifier || '').trim()) {
+        throw new Error('consentIdentifier is required for idempotent digital-twin consent updates.');
+    }
+    const indexProviderOrganizationDid = String(input.indexProviderOrganizationDid || '').trim();
+    if (!indexProviderOrganizationDid) {
+        throw new Error('indexProviderOrganizationDid is required.');
+    }
+    const buildFhirConsentClaimsWithoutLegacyAttachment = (consentInput, options) => {
+        const built = deps.buildConsentClaimsWithCid(consentInput, options);
+        const claims = { ...built.consentClaims };
+        delete claims[ClaimConsent.attachmentContentType];
+        delete claims[ClaimConsent.attachmentData];
+        const context = String(claims['@context'] || '').trim();
+        if (context) {
+            delete claims[`${context}.${ClaimConsent.attachmentContentType}`];
+            delete claims[`${context}.${ClaimConsent.attachmentData}`];
+        }
+        const assigned = assignCidToClaimsId(claims);
+        return { ...built, consentClaims: assigned.claims, claimsCid: assigned.cid };
+    };
+    return grantProfessionalAccessWithDeps(routeCtx, {
+        subjectDid: input.subjectDid,
+        actorId: indexProviderOrganizationDid,
+        actorRole: '*',
+        purpose: HealthcareConsentPurposes.Research,
+        actions: [ServiceCapability.DigitalTwinReader],
+        decision: input.decision,
+        consentIdentifier: input.consentIdentifier,
+        consentDate: input.consentDate,
+        dataType: input.dataType,
+        pollOptions: input.pollOptions,
+    }, { ...deps, buildConsentClaimsWithCid: buildFhirConsentClaimsWithoutLegacyAttachment });
+}
+/**
+ * Removes the index provider's private individual-to-twin correspondence.
+ * The anonymous twin is intentionally not deleted. A later enrollment gets a
+ * new UUID and cannot reconnect the detached twin to the individual.
+ */
+export async function purgeDigitalTwinSubjectLinkWithDeps(routeCtx, input, deps) {
+    const subjectDid = String(input.subjectDid || '').trim();
+    if (!subjectDid)
+        throw new Error('subjectDid is required.');
+    const thid = `digital-twin-link-purge-${createRuntimeUuid()}`;
+    return deps.submitAndPoll(deps.individualResearchSubjectPurgePath(routeCtx), deps.individualResearchSubjectPurgePollPath(routeCtx), {
+        thid,
+        body: {
+            resourceType: 'Parameters',
+            parameter: [{ name: 'subject', valueString: subjectDid }],
+        },
+    }, input.pollOptions);
+}
 export async function revokeProfessionalAccessWithDeps(routeCtx, input, deps) {
     const revokedClaims = ConsentClaims
         .fromClaims(input.consentClaims)

package/dist/runtime-client-paths.d.ts

@@ -22,8 +22,16 @@ export declare class RuntimeClientPaths {
     hostRegistryOrganizationActivatePollPath(ctx?: HostRouteContext): string;
     hostRegistryOrganizationDisablePath(ctx?: HostRouteContext): string;
     hostRegistryOrganizationDisablePollPath(ctx?: HostRouteContext): string;
+    hostRegistryOrganizationEnablePath(ctx?: HostRouteContext): string;
+    hostRegistryOrganizationEnablePollPath(ctx?: HostRouteContext): string;
     hostRegistryOrganizationPurgePath(ctx?: HostRouteContext): string;
     hostRegistryOrganizationPurgePollPath(ctx?: HostRouteContext): string;
+    hostRegistryOrganizationStatusPath(ctx?: HostRouteContext): string;
+    hostRegistryOrganizationStatusPollPath(ctx?: HostRouteContext): string;
+    hostRegistryOrganizationDisableDescendantsPath(ctx?: HostRouteContext): string;
+    hostRegistryOrganizationDisableDescendantsPollPath(ctx?: HostRouteContext): string;
+    hostRegistryOrganizationPurgeDescendantsPath(ctx?: HostRouteContext): string;
+    hostRegistryOrganizationPurgeDescendantsPollPath(ctx?: HostRouteContext): string;
     hostRegistryOrderBatchPath(ctx?: HostRouteContext): string;
     hostRegistryOrderPollPath(ctx?: HostRouteContext): string;
     employeeBatchPath(ctx?: RouteContext): string;
@@ -75,6 +83,8 @@ export declare class RuntimeClientPaths {
     individualRelatedPersonPurgePollPath(ctx?: RouteContext): string;
     individualConsentR4BatchPath(ctx: RouteContext): string;
     individualConsentR4PollPath(ctx: RouteContext): string;
+    individualResearchSubjectPurgePath(ctx: RouteContext): string;
+    individualResearchSubjectPurgePollPath(ctx: RouteContext): string;
     individualCommunicationBatchPath(ctx: RouteContext, format: string): string;
     individualCommunicationPollPath(ctx: RouteContext, format: string): string;
     individualCommunicationSearchPath(ctx: RouteContext): string;

package/dist/runtime-client-paths.js

@@ -36,8 +36,16 @@ export class RuntimeClientPaths {
     hostRegistryOrganizationActivatePollPath(ctx) { return this.hostRegistryPath(ctx, 'Organization', '_activate-response'); }
     hostRegistryOrganizationDisablePath(ctx) { return this.hostRegistryPath(ctx, 'Organization', GwCoreLifecycleAction.Disable); }
     hostRegistryOrganizationDisablePollPath(ctx) { return this.hostRegistryPath(ctx, 'Organization', `${GwCoreLifecycleAction.Disable}-response`); }
+    hostRegistryOrganizationEnablePath(ctx) { return this.hostRegistryPath(ctx, 'Organization', GwCoreLifecycleAction.Enable); }
+    hostRegistryOrganizationEnablePollPath(ctx) { return this.hostRegistryPath(ctx, 'Organization', `${GwCoreLifecycleAction.Enable}-response`); }
     hostRegistryOrganizationPurgePath(ctx) { return this.hostRegistryPath(ctx, 'Organization', GwCoreLifecycleAction.Purge); }
     hostRegistryOrganizationPurgePollPath(ctx) { return this.hostRegistryPath(ctx, 'Organization', `${GwCoreLifecycleAction.Purge}-response`); }
+    hostRegistryOrganizationStatusPath(ctx) { return this.hostRegistryPath(ctx, 'Organization', GwCoreLifecycleAction.Status); }
+    hostRegistryOrganizationStatusPollPath(ctx) { return this.hostRegistryPath(ctx, 'Organization', `${GwCoreLifecycleAction.Status}-response`); }
+    hostRegistryOrganizationDisableDescendantsPath(ctx) { return this.hostRegistryPath(ctx, 'Organization', GwCoreLifecycleAction.DisableDescendants); }
+    hostRegistryOrganizationDisableDescendantsPollPath(ctx) { return this.hostRegistryPath(ctx, 'Organization', `${GwCoreLifecycleAction.DisableDescendants}-response`); }
+    hostRegistryOrganizationPurgeDescendantsPath(ctx) { return this.hostRegistryPath(ctx, 'Organization', GwCoreLifecycleAction.PurgeDescendants); }
+    hostRegistryOrganizationPurgeDescendantsPollPath(ctx) { return this.hostRegistryPath(ctx, 'Organization', `${GwCoreLifecycleAction.PurgeDescendants}-response`); }
     hostRegistryOrderBatchPath(ctx) { return this.hostRegistryPath(ctx, 'Order', '_batch'); }
     hostRegistryOrderPollPath(ctx) { return this.hostRegistryPath(ctx, 'Order', '_batch-response'); }
     employeeBatchPath(ctx) { return this.v1Path(ctx, 'entity', 'org.schema', 'Employee', GwCoreLifecycleAction.Batch); }
@@ -89,6 +97,8 @@ export class RuntimeClientPaths {
     individualRelatedPersonPurgePollPath(ctx) { return this.v1Path(ctx, 'individual', 'org.hl7.fhir.r4', 'RelatedPerson', '_purge-response'); }
     individualConsentR4BatchPath(ctx) { return this.v1Path(ctx, 'individual', 'org.hl7.fhir.r4', 'Consent', '_batch'); }
     individualConsentR4PollPath(ctx) { return this.v1Path(ctx, 'individual', 'org.hl7.fhir.r4', 'Consent', '_batch-response'); }
+    individualResearchSubjectPurgePath(ctx) { return this.v1Path(ctx, 'individual', 'org.hl7.fhir.r4', 'ResearchSubject', '_purge'); }
+    individualResearchSubjectPurgePollPath(ctx) { return this.v1Path(ctx, 'individual', 'org.hl7.fhir.r4', 'ResearchSubject', '_purge-response'); }
     individualCommunicationBatchPath(ctx, format) { return this.v1Path(ctx, 'individual', format, 'Communication', '_batch'); }
     individualCommunicationPollPath(ctx, format) { return this.v1Path(ctx, 'individual', format, 'Communication', '_batch-response'); }
     individualCommunicationSearchPath(ctx) { return this.v1Path(ctx, 'individual', 'org.hl7.fhir.r4', 'Communication', '_search'); }

package/dist/server-profile-session.d.ts

@@ -57,24 +57,53 @@ export type ServerProfileStore = Readonly<{
     deleteSession(sessionId: string): Promise<void>;
 }>;
 export type ServerProfileEnrollmentInput = Readonly<{
+    /** Stable confidential id of the authenticated portal account that owns and lists this profile. */
     ownerId: string;
+    /** Stable local id of this wallet/profile record. This is not the DCR `client_id`. */
     profileId: string;
+    /** SDK capability family being enrolled, for example an organization controller or employee. */
     actorKind: ActorKind;
+    /** Authorization semantics already granted to the profile; never take this from an untrusted UI field. */
     actorMode: ServerActorMode;
+    /** Exact role/controller DID used by the actor proof, including the VP issuer when a VP is supplied. */
     actorDid: string;
+    /** DID represented by the managed wallet. It may equal `actorDid`, as in a controller enrollment. */
     profileDid: string;
+    /** Organization/provider DID whose configured route and policies this profile will use. */
     providerDid: string;
+    /** Server-owned tenant, jurisdiction and sector routing context. */
     routeContext: RouteContext;
+    /** Server-derived subject authorization boundary; never accept arbitrary browser-selected DIDs here. */
     allowedSubjectDids: string[];
+    /**
+     * Unlock secret for the locally protected wallet seed. It is neither sent
+     * to GW nor persisted by the SDK. The integrating product decides whether
+     * it is user-entered or a separately stored, high-entropy per-profile BFF
+     * secret; it must never be logged or reused as one shared deployment PIN.
+     */
     pin: string;
+    /**
+     * Signed OIDC `id_token` used by GW to bind the activation code to an
+     * authenticated account/email. Its issuer, audience, signature `kid` and
+     * public JWKS must be trusted by GW. A controller VP cannot replace it.
+     */
     idToken: string;
+    /** One-time code returned by the completed organization flow or employee `License/_issue`. */
     activationCode: string;
-    /** Explicit per-installation id. Older callers fall back to the first DCR key id. */
+    /**
+     * Optional explicit installation identity. Normally omit it so the SDK
+     * derives the identity from the wallet key it creates for this profile.
+     */
     clientInstanceId?: string;
+    /** Signed actor/controller VP protected with the profile for later proof and session operations. */
     vpToken: string;
-    /** Registered web redirect URIs included in the OpenID DCR metadata. */
+    /** Redirect URIs owned by this portal/app installation. */
+    redirectUris?: string[];
+    /** Human-readable portal/app name. */
+    clientName?: string;
+    /** @deprecated Use `redirectUris`; OpenID metadata is authored internally. */
     dcrRedirectUris?: string[];
-    /** Human-readable DCR client name. */
+    /** @deprecated Use `clientName`; OpenID metadata is authored internally. */
     dcrClientName?: string;
     /**
      * Optional server-only recovery seed. It must be 32 bytes encoded as

package/dist/server-profile-session.js

@@ -1,11 +1,11 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
 import { randomBytes } from 'node:crypto';
-import { IdentityDcrMetadataFields, IdentityDeviceInfoFields } from 'gdc-common-utils-ts/constants/identity-auth';
 import { ActorKinds } from 'gdc-common-utils-ts/constants/actor-session';
 import { TransportProfiles, } from 'gdc-sdk-core-ts';
 import { NodeManagedWallet } from './node-managed-wallet.js';
 import { NodeHttpClient } from './node-runtime-client.js';
 import { buildIdentityOpenIdSmartTokenPath } from './runtime-paths.js';
+import { createProfileDeviceActivationRequest } from './device-activation.js';
 import { ProfilePinRejectedError, openServerProfileSecret, protectServerProfileSecret, } from './server-profile-protection.js';
 /**
  * Coordinates device registration, two-factor profile protection and SMART sessions.
@@ -36,23 +36,26 @@ export class ServerProfileSessionManager {
         const storagePublicJwk = publicKeys.find((entry) => entry.purpose === 'document-at-rest')?.publicJwk;
         if (!storagePublicJwk)
             throw new Error('Server profile enrollment requires a document-at-rest ML-KEM key.');
-        const client = this.createClient(input.routeContext, input.idToken);
-        const activation = await client.activateProfileDeviceWithActivationRequest({
-            ...input.routeContext,
+        const idToken = String(input.idToken || '').trim();
+        if (!idToken)
+            throw new Error('Profile enrollment requires a signed OIDC idToken for account/email binding.');
+        const client = this.createClient(input.routeContext, idToken);
+        const redirectUris = input.redirectUris || input.dcrRedirectUris || [];
+        const clientName = String(input.clientName || input.dcrClientName || '').trim();
+        const activationRequest = createProfileDeviceActivationRequest({
             activationCode: input.activationCode,
-            idToken: input.idToken,
-            dcrPayload: {
-                [IdentityDcrMetadataFields.ExtendedDeviceInfo]: {
-                    [IdentityDeviceInfoFields.DeviceId]: clientInstanceId,
-                },
-                application_type: 'web',
-                ...(input.dcrRedirectUris?.length ? { redirect_uris: unique(input.dcrRedirectUris) } : {}),
-                ...(input.dcrClientName ? { client_name: input.dcrClientName } : {}),
-                actor_did: input.actorDid,
-                profile_did: input.profileDid,
-                jwks: { keys: publicKeys.filter((entry) => entry.purpose !== 'document-at-rest').map((entry) => entry.publicJwk) },
-            },
-        });
+            idToken,
+            ...input.routeContext,
+        })
+            .setClientInstanceId(clientInstanceId)
+            .setClientName(clientName)
+            .setApplicationType('web')
+            .setRedirectUris(redirectUris)
+            .setPublicJwks(publicKeys.filter((entry) => entry.purpose !== 'document-at-rest').map((entry) => entry.publicJwk))
+            .setActorDid(input.actorDid)
+            .setProfileDid(input.profileDid)
+            .build();
+        const activation = await client.activateProfileDeviceWithActivationRequest(activationRequest);
         const dcrBody = terminalBody(activation.dcr.poll.body);
         const clientId = findText(dcrBody, ['client_id', 'clientId']);
         if (!clientId)
@@ -357,6 +360,7 @@ function requireEnrollment(input) {
         profileDid: input.profileDid,
         providerDid: input.providerDid,
         activationCode: input.activationCode,
+        idToken: input.idToken,
         vpToken: input.vpToken,
     }))
         if (!String(value || '').trim())

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-sdk-node-ts",
-  "version": "2.4.24",
+  "version": "2.4.31",
   "description": "Next-generation Node runtime package for the GDC SDK family",
   "license": "Apache-2.0",
   "author": "Antifraud Services Inc.",