gdc-sdk-node-ts 2.4.43 → 2.4.45

package/README.md

@@ -650,13 +650,13 @@ modules below.
   - types: `SmartTokenRequestInput`, `SmartTokenExchangeResult`
   - function: `requestSmartTokenWithDeps(...)`
 - [`src/resource-operations.ts`](src/resource-operations.ts)
-  - types: `OrganizationEmployeeCreationInput`, `IpsOrFhirImportInput`, `RelatedPersonUpsertInput`, `CommunicationIngestionInput`, `ClinicalDateRange`, `ClinicalBundleSearchInput`, `ConsentActorTargetInput`, `GrantProfessionalAccessInput`, `GrantProfessionalAccessResult`, `DigitalTwinSecondaryUseConsentInput`, `DigitalTwinSubjectLinkPurgeInput`
-  - functions: `createOrganizationEmployeeWithDeps(...)`, `importIpsOrFhirAndUpdateIndexWithDeps(...)`, `upsertRelatedPersonAndPollWithDeps(...)`, `ingestCommunicationAndUpdateIndexWithDeps(...)`, `searchClinicalBundleWithDeps(...)`, `searchLatestIpsWithDeps(...)`, `grantProfessionalAccessWithDeps(...)`, `setDigitalTwinSecondaryUseConsentWithDeps(...)`, `purgeDigitalTwinSubjectLinkWithDeps(...)`
+  - types: `OrganizationEmployeeCreationInput`, `IpsOrFhirImportInput`, `RelatedPersonUpsertInput`, `CommunicationIngestionInput`, `ClinicalDateRange`, `ClinicalBundleSearchInput`, `ConsentActorTargetInput`, `GrantProfessionalAccessInput`, `GrantProfessionalAccessResult`, `DigitalTwinSecondaryUseConsentInput`, `DigitalTwinSubjectLinkPurgeInput`, `SubjectConsentSearchInput`
+  - functions: `createOrganizationEmployeeWithDeps(...)`, `importIpsOrFhirAndUpdateIndexWithDeps(...)`, `upsertRelatedPersonAndPollWithDeps(...)`, `ingestCommunicationAndUpdateIndexWithDeps(...)`, `searchClinicalBundleWithDeps(...)`, `searchSubjectConsentsWithDeps(...)`, `searchLatestIpsWithDeps(...)`, `grantProfessionalAccessWithDeps(...)`, `setDigitalTwinSecondaryUseConsentWithDeps(...)`, `purgeDigitalTwinSubjectLinkWithDeps(...)`
 - [`src/digital-twin.ts`](src/digital-twin.ts)
   - types: `DigitalTwinSearchInput`, `DigitalTwinSelectionInput`, `DigitalTwinResearchTag`, `DigitalTwinMaterializationInput`
   - functions: `searchDigitalTwinsWithDeps(...)`, `saveDigitalTwinSelectionWithDeps(...)`, `materializeDigitalTwinWithDeps(...)`
 - [`src/orchestration/digital-twin-sdk.ts`](src/orchestration/digital-twin-sdk.ts)
-  - class: `DigitalTwinSdk` (`requestSmartToken`, `search`, `saveSelection`, `materialize`)
+  - class: `DigitalTwinSdk` (`requestSmartToken`, `search`, `saveSelection`, `searchSelections`, `materialize`); both searches expose `ResearchSubject` through FHIR Parameters, with its canonical internal Composition available as `composition`
 - [`src/session.ts`](src/session.ts)
   - types: `NodeCapability`, `NodeActorSessionContext`, `ActorSessionContext`
   - classes: `ActorSession`, `NodeActorSession`

package/dist/digital-twin.d.ts

@@ -7,7 +7,7 @@ export type DigitalTwinFhirFormat = 'org.hl7.fhir.r4' | 'org.hl7.fhir.api';
 export declare function isDigitalTwinSubjectId(value: unknown): value is string;
 /** Rejects operational DIDs and malformed or caller-invented subject shapes. */
 export declare function assertDigitalTwinSubjectId(value: unknown): asserts value is string;
-/** Search parameters added by the digital-twin Composition profile. */
+/** Search parameters evaluated against a ResearchSubject's canonical Composition index. */
 export declare const DigitalTwinSearchParameter: Readonly<{
     Section: "section";
     DateFrom: "date-from";
@@ -20,7 +20,8 @@ export type DigitalTwinSearchInput = {
     accessToken?: string;
     thid?: string;
     format?: DigitalTwinFhirFormat;
-    resourceType?: string;
+    /** Public twin search resource; exposed for low-level request inspection only. */
+    resourceType?: 'ResearchSubject';
     /** One or more IPS section tokens. Basic search uses OR across sections. */
     sections?: readonly string[];
     /** Inclusive clinical-event lower bound as ISO date or dateTime. */
@@ -33,11 +34,19 @@ export type DigitalTwinSearchInput = {
     filters?: Readonly<Record<string, string | readonly string[] | undefined>>;
     pollOptions?: PollOptions;
 };
-/** One pseudonymous Composition returned by a digital-twin search. */
+/**
+ * One public ResearchSubject digital twin returned by search.
+ *
+ * `composition` is the canonical Composition GW uses as the aggregate's
+ * internal index document. It joins the ResearchSubject to the projected
+ * clinical resources later returned by `ResearchSubject/$summary`.
+ */
 export type DigitalTwinSearchMatch = Record<string, unknown> & {
+    resourceType?: 'ResearchSubject';
     id?: string;
     [CompositionClaim.Subject]: string;
     [CompositionClaim.Section]?: string;
+    composition?: Record<string, unknown>;
     meta?: {
         tag?: DigitalTwinResearchTag[];
     };
@@ -120,11 +129,15 @@ export type DigitalTwinRuntimeDeps = {
         body: Record<string, unknown>;
     }, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
 };
-/** Opens the GW async response and exposes the matched Compositions directly. */
+/** Opens the GW async response and exposes the matched ResearchSubjects directly. */
 export declare function readDigitalTwinSearchResult(operation: SubmitAndPollResult): DigitalTwinSearchResult;
 /** Persists one tagged researcher working copy through `digitaltwin/Composition/_batch`. */
 export declare function saveDigitalTwinSelectionWithDeps(ctx: RouteContext, input: DigitalTwinSelectionInput, deps: DigitalTwinRuntimeDeps): Promise<SubmitAndPollResult>;
-/** Searches the tenant digital-twin index through its public asynchronous route. */
+/**
+ * Searches ResearchSubject digital twins through the public asynchronous route.
+ * GW filters their canonical Composition index documents internally; callers
+ * never switch to a separate public Composition search surface.
+ */
 export declare function searchDigitalTwinsWithDeps(ctx: RouteContext, input: DigitalTwinSearchInput, deps: DigitalTwinRuntimeDeps): Promise<SubmitAndPollResult>;
 /** Materializes one selected pseudonymous twin as a research summary Bundle. */
 export declare function materializeDigitalTwinWithDeps(ctx: RouteContext, input: DigitalTwinMaterializationInput, deps: DigitalTwinRuntimeDeps): Promise<SubmitAndPollResult>;

package/dist/digital-twin.js

@@ -13,7 +13,7 @@ export function assertDigitalTwinSubjectId(value) {
         throw new Error('Digital twin subject must be a valid urn:uuid identifier.');
     }
 }
-/** Search parameters added by the digital-twin Composition profile. */
+/** Search parameters evaluated against a ResearchSubject's canonical Composition index. */
 export const DigitalTwinSearchParameter = Object.freeze({
     Section: 'section',
     DateFrom: 'date-from',
@@ -59,7 +59,7 @@ function normalizeResearchTags(tags) {
     }
     return normalized;
 }
-/** Opens the GW async response and exposes the matched Compositions directly. */
+/** Opens the GW async response and exposes the matched ResearchSubjects directly. */
 export function readDigitalTwinSearchResult(operation) {
     const body = operation?.poll?.body;
     const responseEntries = Array.isArray(body?.data)
@@ -129,10 +129,14 @@ export async function saveDigitalTwinSelectionWithDeps(ctx, input, deps) {
             : { resourceType: 'Bundle', type: 'batch', entry: [entry] },
     }, input.pollOptions);
 }
-/** Searches the tenant digital-twin index through its public asynchronous route. */
+/**
+ * Searches ResearchSubject digital twins through the public asynchronous route.
+ * GW filters their canonical Composition index documents internally; callers
+ * never switch to a separate public Composition search surface.
+ */
 export async function searchDigitalTwinsWithDeps(ctx, input, deps) {
     const format = input.format || 'org.hl7.fhir.r4';
-    const resourceType = String(input.resourceType || 'Composition').trim();
+    const resourceType = String(input.resourceType || 'ResearchSubject').trim();
     if (!resourceType)
         throw new Error('Digital twin resourceType is required.');
     const usesBasicSearch = Boolean(input.sections || input.dateFrom || input.dateTo || input.text);

package/dist/gateway-active-consent-provider.d.ts

@@ -2,6 +2,7 @@ import { type ConsentRule } from 'gdc-common-utils-ts/models/consent-rule';
 import type { ActiveConsentProvider } from 'gdc-sdk-core-ts';
 import type { RouteContext } from './individual-onboarding.js';
 import { type NodeRuntimeClient } from './orchestration/client-port.js';
+import type { SubjectConsentSearchInput } from './resource-operations.js';
 /**
  * GW-backed implementation of the runtime-neutral ActiveConsentProvider.
  *
@@ -13,7 +14,7 @@ export declare class GatewayActiveConsentProvider implements ActiveConsentProvid
     private readonly routeContext;
     constructor(client: NodeRuntimeClient, routeContext: RouteContext);
     /** Loads and normalizes the active Consent rules owned by one subject. */
-    getActiveConsentsForSubject(subject: string): Promise<ConsentRule[]>;
+    getActiveConsentsForSubject(subject: string, filters?: Omit<SubjectConsentSearchInput, 'subject' | 'pollOptions'>): Promise<ConsentRule[]>;
 }
 /** Extracts canonical Consent claim maps from current GW Bundle wrappers. */
 export declare function extractConsentRules(value: unknown): ConsentRule[];

package/dist/gateway-active-consent-provider.js

@@ -1,5 +1,4 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
-import { ResourceTypesFhirR4 } from 'gdc-common-utils-ts/constants/fhir-resource-types';
 import { ClaimConsent } from 'gdc-common-utils-ts/models/consent-rule';
 import { isConsentRuleActive } from 'gdc-common-utils-ts/utils/consent';
 import { requireClientMethod } from './orchestration/client-port.js';
@@ -15,15 +14,12 @@ export class GatewayActiveConsentProvider {
         this.routeContext = routeContext;
     }
     /** Loads and normalizes the active Consent rules owned by one subject. */
-    async getActiveConsentsForSubject(subject) {
+    async getActiveConsentsForSubject(subject, filters = {}) {
         const normalizedSubject = String(subject || '').trim();
         if (!normalizedSubject.startsWith('did:')) {
             throw new Error('Active Consent lookup requires a subject DID.');
         }
-        const result = await requireClientMethod(this.client, 'searchClinicalBundle')(this.routeContext, {
-            subject: normalizedSubject,
-            includedTypes: [ResourceTypesFhirR4.Consent],
-        });
+        const result = await requireClientMethod(this.client, 'searchSubjectConsents')(this.routeContext, { subject: normalizedSubject, ...filters });
         return extractConsentRules(result.poll.body)
             .filter((rule) => isConsentRuleActive(rule, { subject: normalizedSubject }));
     }

package/dist/node-runtime-client.d.ts

@@ -12,7 +12,7 @@ import { type SmartTokenRequestInput } from './smart-token.js';
 import { type EmployeeDeviceActivationRequestInput, type EmployeeDeviceActivationResult, type EmployeeDeviceOtpRecoveryInput, type EmployeeDeviceOtpRecoveryResult, type EmployeeDeviceRevocationInput } from './device-activation.js';
 import { type OrganizationLicenseOrderConfirmInput } from './organization-license-order.js';
 import { type IndividualOrganizationBootstrapInput, type IndividualOrganizationStartResult } from './individual-start.js';
-import { type CommunicationIngestionInput, type BlockchainArtifactRegistrationInput, type VitalSignBatchCommunicationFromSearchResponseInput, type CommunicationParticipantRuntimeSearchInput, type ClinicalBundleSearchInput, type ClinicalSectionUpdateInput, type ClinicalSummaryReadResult, type ClinicalSummaryRequestInput, type ClinicalSummaryUpdateInput, type GrantProfessionalAccessInput, type GrantProfessionalAccessResult, type DigitalTwinSecondaryUseConsentInput, type DigitalTwinSecondaryUseConsentResult, type DigitalTwinSubjectLinkPurgeInput, type DigitalTwinSubjectLinkPurgeResult, type IndividualMemberLifecycleInput, type IndividualMemberLicenseAddInput, type IndividualMemberLicenseInvitationInput, type IndividualMemberLicenseTransitionInput, type LicenseListRuntimeSearchInput, type LicenseOfferRuntimeSearchInput, type LicenseOrderRuntimeSearchInput, type OrganizationEmployeeCreationInput, type OrganizationEmployeeLicenseAddInput, type OrganizationEmployeeLicenseOfferInput, type OrganizationEmployeeLicenseInvitationInput, type OrganizationEmployeeLifecycleInput, type OrganizationEmployeeSearchInput, type ProfessionalAccessRequestInput, type ProfessionalAccessRequestResult, type RevokeProfessionalAccessInput, type RevokeProfessionalAccessResult, type RelatedPersonUpsertInput } from './resource-operations.js';
+import { type CommunicationIngestionInput, type BlockchainArtifactRegistrationInput, type VitalSignBatchCommunicationFromSearchResponseInput, type CommunicationParticipantRuntimeSearchInput, type ClinicalBundleSearchInput, type ClinicalSectionUpdateInput, type ClinicalSummaryReadResult, type ClinicalSummaryRequestInput, type ClinicalSummaryUpdateInput, type GrantProfessionalAccessInput, type GrantProfessionalAccessResult, type DigitalTwinSecondaryUseConsentInput, type DigitalTwinSecondaryUseConsentResult, type DigitalTwinSubjectLinkPurgeInput, type DigitalTwinSubjectLinkPurgeResult, type SubjectConsentSearchInput, type IndividualMemberLifecycleInput, type IndividualMemberLicenseAddInput, type IndividualMemberLicenseInvitationInput, type IndividualMemberLicenseTransitionInput, type LicenseListRuntimeSearchInput, type LicenseOfferRuntimeSearchInput, type LicenseOrderRuntimeSearchInput, type OrganizationEmployeeCreationInput, type OrganizationEmployeeLicenseAddInput, type OrganizationEmployeeLicenseOfferInput, type OrganizationEmployeeLicenseInvitationInput, type OrganizationEmployeeLifecycleInput, type OrganizationEmployeeSearchInput, type ProfessionalAccessRequestInput, type ProfessionalAccessRequestResult, type RevokeProfessionalAccessInput, type RevokeProfessionalAccessResult, type RelatedPersonUpsertInput } from './resource-operations.js';
 import type { LegalOrganizationOrderInput } from './host-onboarding.js';
 import type { SmartTokenExchangeResult } from './smart-token.js';
 import { type OrganizationEmployeeProvisioningInput, type OrganizationEmployeeProvisioningResult } from './organization-employee-lifecycle.js';
@@ -447,6 +447,8 @@ export declare class HttpRuntimeClient implements NodeRuntimeClient {
     setDigitalTwinSecondaryUseConsent(ctx: RouteContext, input: DigitalTwinSecondaryUseConsentInput): Promise<DigitalTwinSecondaryUseConsentResult>;
     /** Offboards the subject from this index provider without deleting the anonymous twin. */
     purgeDigitalTwinSubjectLink(ctx: RouteContext, input: DigitalTwinSubjectLinkPurgeInput): Promise<DigitalTwinSubjectLinkPurgeResult>;
+    /** Reads the subject-owned Consent records through Communication -> Subject/_search. */
+    searchSubjectConsents(ctx: RouteContext, input: SubjectConsentSearchInput): Promise<SubmitAndPollResult>;
     /**
      * Closes an existing professional consent by setting its period end and
      * resubmitting the updated consent resource.

package/dist/node-runtime-client.js

@@ -10,7 +10,7 @@ import { activateEmployeeDeviceWithActivationCodeWithDeps, activateEmployeeDevic
 import { extractOfferIdFromResponseBody, extractOfferPreviewFromResponseBody, } from './order-offer-summary.js';
 import { confirmOrganizationLicenseOrderWithDeps } from './organization-license-order.js';
 import { startIndividualOrganizationWithDeps } from './individual-start.js';
-import { createOrganizationEmployeeWithDeps, issueOrganizationEmployeeLicenseWithDeps, disableIndividualMemberWithDeps, disableIndividualOrganizationWithDeps, disableOrganizationEmployeeWithDeps, listIndividualLicenseOffersWithDeps, listIndividualLicenseOrdersWithDeps, listIndividualLicensesWithDeps, addFreeIndividualMemberLicensesWithDeps, issueIndividualMemberLicenseWithDeps, transitionIndividualMemberLicenseWithDeps, listOrganizationLicenseOffersWithDeps, listOrganizationLicenseOrdersWithDeps, listOrganizationLicensesWithDeps, grantProfessionalAccessWithDeps, setDigitalTwinSecondaryUseConsentWithDeps, purgeDigitalTwinSubjectLinkWithDeps, buildClinicalSectionUpdateIngestion, buildClinicalSummaryUpdateIngestion, ingestCommunicationAndUpdateIndexWithDeps, requestProfessionalAccessWithDeps, buildVitalSignBatchCommunicationFromSearchResponse, registerBlockchainArtifactAndUpdateIndexWithDeps, requestClinicalSummaryWithDeps, revokeProfessionalAccessWithDeps, searchCommunicationParticipantsWithDeps, purgeIndividualMemberWithDeps, purgeIndividualOrganizationWithDeps, purgeOrganizationEmployeeWithDeps, prepareEmployeeLifecycleMessageForTransport, searchIndividualLicensesWithDeps, searchIndividualLicenseOffersWithDeps, searchIndividualLicenseOrdersWithDeps, searchOrganizationLicensesWithDeps, searchOrganizationLicenseOffersWithDeps, searchOrganizationLicenseOrdersWithDeps, searchOrganizationEmployeesWithDeps, searchClinicalBundleWithDeps, searchLatestIpsWithDeps, upsertRelatedPersonAndPollWithDeps, normalizeCommunicationPathFormatSegment, addFreeOrganizationEmployeeLicensesWithDeps, requestOrganizationEmployeeLicenseOfferWithDeps, } from './resource-operations.js';
+import { createOrganizationEmployeeWithDeps, issueOrganizationEmployeeLicenseWithDeps, disableIndividualMemberWithDeps, disableIndividualOrganizationWithDeps, disableOrganizationEmployeeWithDeps, listIndividualLicenseOffersWithDeps, listIndividualLicenseOrdersWithDeps, listIndividualLicensesWithDeps, addFreeIndividualMemberLicensesWithDeps, issueIndividualMemberLicenseWithDeps, transitionIndividualMemberLicenseWithDeps, listOrganizationLicenseOffersWithDeps, listOrganizationLicenseOrdersWithDeps, listOrganizationLicensesWithDeps, grantProfessionalAccessWithDeps, setDigitalTwinSecondaryUseConsentWithDeps, purgeDigitalTwinSubjectLinkWithDeps, searchSubjectConsentsWithDeps, buildClinicalSectionUpdateIngestion, buildClinicalSummaryUpdateIngestion, ingestCommunicationAndUpdateIndexWithDeps, requestProfessionalAccessWithDeps, buildVitalSignBatchCommunicationFromSearchResponse, registerBlockchainArtifactAndUpdateIndexWithDeps, requestClinicalSummaryWithDeps, revokeProfessionalAccessWithDeps, searchCommunicationParticipantsWithDeps, purgeIndividualMemberWithDeps, purgeIndividualOrganizationWithDeps, purgeOrganizationEmployeeWithDeps, prepareEmployeeLifecycleMessageForTransport, searchIndividualLicensesWithDeps, searchIndividualLicenseOffersWithDeps, searchIndividualLicenseOrdersWithDeps, searchOrganizationLicensesWithDeps, searchOrganizationLicenseOffersWithDeps, searchOrganizationLicenseOrdersWithDeps, searchOrganizationEmployeesWithDeps, searchClinicalBundleWithDeps, searchLatestIpsWithDeps, upsertRelatedPersonAndPollWithDeps, normalizeCommunicationPathFormatSegment, addFreeOrganizationEmployeeLicensesWithDeps, requestOrganizationEmployeeLicenseOfferWithDeps, } from './resource-operations.js';
 import { listOrganizationEmployeeLifecycleWithDeps, provisionOrganizationEmployeeWithDeps, } from './organization-employee-lifecycle.js';
 import { buildRuntimeHeaders, fetchWithTimeout, parseResponseBody, postRenderedWithRuntimeConfig, } from './runtime-transport.js';
 import { activateOrganizationInGatewayFromIcaProofWithDeps, submitLegalOrganizationCredentialReissuanceWithDeps, submitLegalOrganizationVerificationTransactionWithDeps, submitOrganizationDidBindingWithDeps, } from './runtime-host-submission.js';
@@ -860,6 +860,14 @@ export class HttpRuntimeClient {
             submitAndPoll: this.submitAndPoll.bind(this),
         });
     }
+    /** Reads the subject-owned Consent records through Communication -> Subject/_search. */
+    async searchSubjectConsents(ctx, input) {
+        return searchSubjectConsentsWithDeps(ctx, input, {
+            individualCommunicationBatchPath: this.paths.individualCommunicationBatchPath.bind(this.paths),
+            individualCommunicationPollPath: this.paths.individualCommunicationPollPath.bind(this.paths),
+            submitAndPoll: this.submitAndPoll.bind(this),
+        });
+    }
     /**
      * Closes an existing professional consent by setting its period end and
      * resubmitting the updated consent resource.

package/dist/orchestration/client-port.d.ts

@@ -19,7 +19,7 @@ import type { OrganizationLicenseOrderConfirmInput } from '../organization-licen
 import type { SmartTokenExchangeResult, SmartTokenRequestInput } from '../smart-token.js';
 import type { DigitalTwinMaterializationInput, DigitalTwinSearchInput, DigitalTwinSelectionInput } from '../digital-twin.js';
 import type { AuthorizedIndividualSubject, AuthorizedIndividualSubjectDirectoryInput } from '../authorized-subject-directory.js';
-import type { CommunicationIngestionInput, BlockchainArtifactRegistrationInput, CommunicationParticipantRuntimeSearchInput, ClinicalBundleSearchInput, ClinicalSectionUpdateInput, ClinicalSummaryReadResult, ClinicalSummaryRequestInput, ClinicalSummaryUpdateInput, VitalSignBatchCommunicationFromSearchResponseInput, DigitalTwinGenerationInput, DigitalTwinSecondaryUseConsentInput, DigitalTwinSecondaryUseConsentResult, DigitalTwinSubjectLinkPurgeInput, DigitalTwinSubjectLinkPurgeResult, GrantProfessionalAccessInput, GrantProfessionalAccessResult, IndividualMemberLifecycleInput, IndividualMemberLicenseAddInput, IndividualMemberLicenseInvitationInput, IndividualMemberLicenseTransitionInput, IpsOrFhirImportInput, OrganizationEmployeeCreationInput, OrganizationEmployeeLicenseAddInput, OrganizationEmployeeLicenseOfferInput, OrganizationEmployeeLicenseInvitationInput, OrganizationEmployeeLifecycleInput, OrganizationEmployeeSearchInput, ProfessionalAccessRequestInput, ProfessionalAccessRequestResult, RevokeProfessionalAccessInput, RevokeProfessionalAccessResult, RelatedPersonUpsertInput } from '../resource-operations.js';
+import type { CommunicationIngestionInput, BlockchainArtifactRegistrationInput, CommunicationParticipantRuntimeSearchInput, ClinicalBundleSearchInput, ClinicalSectionUpdateInput, ClinicalSummaryReadResult, ClinicalSummaryRequestInput, ClinicalSummaryUpdateInput, VitalSignBatchCommunicationFromSearchResponseInput, DigitalTwinGenerationInput, DigitalTwinSecondaryUseConsentInput, DigitalTwinSecondaryUseConsentResult, DigitalTwinSubjectLinkPurgeInput, DigitalTwinSubjectLinkPurgeResult, GrantProfessionalAccessInput, GrantProfessionalAccessResult, IndividualMemberLifecycleInput, IndividualMemberLicenseAddInput, IndividualMemberLicenseInvitationInput, IndividualMemberLicenseTransitionInput, IpsOrFhirImportInput, OrganizationEmployeeCreationInput, OrganizationEmployeeLicenseAddInput, OrganizationEmployeeLicenseOfferInput, OrganizationEmployeeLicenseInvitationInput, OrganizationEmployeeLifecycleInput, OrganizationEmployeeSearchInput, ProfessionalAccessRequestInput, ProfessionalAccessRequestResult, RevokeProfessionalAccessInput, RevokeProfessionalAccessResult, RelatedPersonUpsertInput, SubjectConsentSearchInput } from '../resource-operations.js';
 /**
  * Shared node-runtime activation input.
  *
@@ -140,6 +140,7 @@ export type RuntimeClient = {
     generateDigitalTwinFromSubjectData?: (ctx: RouteContext, input: DigitalTwinGenerationInput) => Promise<SubmitAndPollResult>;
     setDigitalTwinSecondaryUseConsent?: (ctx: RouteContext, input: DigitalTwinSecondaryUseConsentInput) => Promise<DigitalTwinSecondaryUseConsentResult>;
     purgeDigitalTwinSubjectLink?: (ctx: RouteContext, input: DigitalTwinSubjectLinkPurgeInput) => Promise<DigitalTwinSubjectLinkPurgeResult>;
+    searchSubjectConsents?: (ctx: RouteContext, input: SubjectConsentSearchInput) => Promise<SubmitAndPollResult>;
     searchClinicalBundle?: (ctx: RouteContext, input: ClinicalBundleSearchInput) => Promise<SubmitAndPollResult>;
     searchDigitalTwins?: (ctx: RouteContext, input: DigitalTwinSearchInput) => Promise<SubmitAndPollResult>;
     saveDigitalTwinSelection?: (ctx: RouteContext, input: DigitalTwinSelectionInput) => Promise<SubmitAndPollResult>;

package/dist/orchestration/digital-twin-sdk.d.ts

@@ -11,7 +11,9 @@ export declare class DigitalTwinSdk {
     /** Requests the SMART token used by subsequent digital-twin operations. */
     requestSmartToken(input: SmartTokenRequestInput): Promise<SmartTokenExchangeResult>;
     /**
-     * Searches pseudonymous records and exposes matched Compositions directly.
+     * Searches the public `ResearchSubject/_search` aggregate with FHIR
+     * Parameters. Each match includes the canonical Composition GW uses
+     * internally to index that ResearchSubject and connect its resources.
      *
      * MVP basic search supplies `sections`, `dateFrom`, optional `dateTo`, and
      * `text`. GW resolves an omitted `dateTo` to its current time, applies OR
@@ -24,7 +26,11 @@ export declare class DigitalTwinSdk {
      * The canonical clinical twin is never modified.
      */
     saveSelection(ctx: RouteContext, input: DigitalTwinSelectionInput): Promise<SubmitAndPollResult>;
-    /** Reopens only this employee's saved selections for one exact custom tag. */
+    /**
+     * Reopens this employee's saved ResearchSubjects through the same public
+     * route. The tag is combined with an author filter bound to the actor DID;
+     * GW verifies that author against the authenticated SMART `sub`.
+     */
     searchSelections(ctx: RouteContext, input: Omit<DigitalTwinSearchInput, 'filters'> & {
         section: string;
         tag: Readonly<{

package/dist/orchestration/digital-twin-sdk.js

@@ -16,11 +16,18 @@ export class DigitalTwinSdk {
             throw new Error('DigitalTwinSdk actorDid must match the actor session.');
         }
         const actorDid = this.researcherDid || requestedActorDid;
+        const requestedScopes = input.scopes?.length
+            ? input.scopes
+            : [ServiceCapability.DigitalTwinReader];
         const result = await requireClientMethod(this.client, 'requestSmartToken')({
             ...input,
             actorDid,
             purpose: input.purpose || HealthcareConsentPurposes.Research,
-            scopes: input.scopes?.length ? input.scopes : [ServiceCapability.DigitalTwinReader],
+            // GW root scopes are explicit queries. Complete the common bare SDK
+            // capability so callers do not have to know the SMART wire syntax.
+            scopes: requestedScopes.map((scope) => scope === ServiceCapability.DigitalTwinReader
+                ? `${scope}?subject=*`
+                : scope),
         });
         if (result.accessToken)
             this.smartAccessToken = result.accessToken;
@@ -29,7 +36,9 @@ export class DigitalTwinSdk {
         return result;
     }
     /**
-     * Searches pseudonymous records and exposes matched Compositions directly.
+     * Searches the public `ResearchSubject/_search` aggregate with FHIR
+     * Parameters. Each match includes the canonical Composition GW uses
+     * internally to index that ResearchSubject and connect its resources.
      *
      * MVP basic search supplies `sections`, `dateFrom`, optional `dateTo`, and
      * `text`. GW resolves an omitted `dateTo` to its current time, applies OR
@@ -59,6 +68,7 @@ export class DigitalTwinSdk {
         }
         const operation = await requireClientMethod(this.client, 'searchDigitalTwins')(ctx, {
             ...input,
+            resourceType: 'ResearchSubject',
             filters,
             accessToken: input.accessToken || this.smartAccessToken,
         });
@@ -80,7 +90,11 @@ export class DigitalTwinSdk {
             accessToken: input.accessToken || this.smartAccessToken,
         });
     }
-    /** Reopens only this employee's saved selections for one exact custom tag. */
+    /**
+     * Reopens this employee's saved ResearchSubjects through the same public
+     * route. The tag is combined with an author filter bound to the actor DID;
+     * GW verifies that author against the authenticated SMART `sub`.
+     */
     searchSelections(ctx, input) {
         const section = String(input.section || '').trim();
         const system = String(input.tag?.system || '').trim();

package/dist/orchestration/individual-controller-sdk.d.ts

@@ -138,7 +138,11 @@ export declare class IndividualControllerSdk {
      * data already shared for research.
      */
     purgeDigitalTwinSubjectLink(ctx: RouteContext, input: DigitalTwinSubjectLinkPurgeInput): Promise<DigitalTwinSubjectLinkPurgeResult>;
-    /** Returns the current decision for one portal, software or research study. */
+    /**
+     * Returns the current decision for one portal, software or research study.
+     * Consent is read through Communication -> individual `Subject/_search`;
+     * this does not query a clinical Bundle or the twin ResearchSubject index.
+     */
     getDigitalTwinSecondaryUseConsentStatus(ctx: RouteContext, input: Readonly<{
         subjectDid: string;
         indexProviderOrganizationDid: string;

package/dist/orchestration/individual-controller-sdk.js

@@ -208,11 +208,20 @@ export class IndividualControllerSdk {
         assertFacadeCapability(this.capabilities, ActorCapabilities.IndividualGenerateDigitalTwin, ActorKinds.IndividualController, 'purgeDigitalTwinSubjectLink');
         return requireClientMethod(this.client, 'purgeDigitalTwinSubjectLink')(ctx, input);
     }
-    /** Returns the current decision for one portal, software or research study. */
+    /**
+     * Returns the current decision for one portal, software or research study.
+     * Consent is read through Communication -> individual `Subject/_search`;
+     * this does not query a clinical Bundle or the twin ResearchSubject index.
+     */
     async getDigitalTwinSecondaryUseConsentStatus(ctx, input) {
         assertFacadeCapability(this.capabilities, ActorCapabilities.IndividualGenerateDigitalTwin, ActorKinds.IndividualController, 'getDigitalTwinSecondaryUseConsentStatus');
         const consents = await new GatewayActiveConsentProvider(this.client, ctx)
-            .getActiveConsentsForSubject(input.subjectDid);
+            .getActiveConsentsForSubject(input.subjectDid, {
+            actorIdentifier: input.indexProviderOrganizationDid,
+            purpose: HealthcareConsentPurposes.Research,
+            action: ServiceCapability.DigitalTwinReader,
+            sourceReference: input.researchUseReference,
+        });
         const researchUseReference = String(input.researchUseReference || '').trim();
         if (!researchUseReference)
             throw new Error('researchUseReference is required to identify the portal, software or study consent.');

package/dist/organization-registration-authorization.d.ts

@@ -0,0 +1,16 @@
+import type { VerifiableCredentialV2 } from 'gdc-common-utils-ts/models/verifiable-credential';
+import type { IWallet, WalletExecutionContext, WalletKeySelection } from 'gdc-sdk-core-ts';
+/** Input required to add one human-authorizer proof to the out-of-band VC. */
+export type SignOrganizationRegistrationAuthorizationInput = Readonly<{
+    credential: VerifiableCredentialV2;
+    wallet: IWallet;
+    context: WalletExecutionContext;
+    key: WalletKeySelection;
+    verificationMethod: string;
+    createdAt?: string;
+}>;
+/**
+ * Adds one detached JWS proof made by the already-unlocked professional
+ * profile. The browser never receives the private key or clear wallet seed.
+ */
+export declare function signOrganizationRegistrationAuthorizationCredential(input: SignOrganizationRegistrationAuthorizationInput): Promise<VerifiableCredentialV2>;

package/dist/organization-registration-authorization.js

@@ -0,0 +1,34 @@
+import { canonicalizeOrganizationRegistrationAuthorizationCredential, } from 'gdc-common-utils-ts/utils/organization-registration-authorization';
+/**
+ * Adds one detached JWS proof made by the already-unlocked professional
+ * profile. The browser never receives the private key or clear wallet seed.
+ */
+export async function signOrganizationRegistrationAuthorizationCredential(input) {
+    if (!input.wallet.signDetachedJws) {
+        throw new Error('Wallet does not support detached organization authorization proofs.');
+    }
+    const verificationMethod = String(input.verificationMethod || '').trim();
+    if (!verificationMethod)
+        throw new Error('Organization authorization proof requires verificationMethod.');
+    const payload = canonicalizeOrganizationRegistrationAuthorizationCredential(input.credential);
+    const jws = await input.wallet.signDetachedJws(input.context, {
+        payload,
+        header: { typ: 'application/vc+ld+json' },
+        key: input.key,
+    });
+    const existingProofs = Array.isArray(input.credential.proof)
+        ? input.credential.proof
+        : input.credential.proof
+            ? [input.credential.proof]
+            : [];
+    return {
+        ...input.credential,
+        proof: [...existingProofs, {
+                type: 'JsonWebSignature2020',
+                created: input.createdAt || new Date().toISOString(),
+                proofPurpose: 'contractAgreement',
+                verificationMethod,
+                jws,
+            }],
+    };
+}

package/dist/resource-operations.d.ts

@@ -532,6 +532,18 @@ export type DigitalTwinSubjectLinkPurgeInput = {
 };
 /** Async GW result for a subject/twin binding purge. */
 export type DigitalTwinSubjectLinkPurgeResult = SubmitAndPollResult;
+/** Input for reading the subject-owned Consent records through its individual aggregate. */
+export type SubjectConsentSearchInput = Readonly<{
+    subject: string;
+    actorIdentifier?: string;
+    purpose?: string;
+    action?: string;
+    sourceReference?: string;
+    pollOptions?: {
+        timeoutMs?: number;
+        intervalMs?: number;
+    };
+}>;
 export declare function createOrganizationEmployeeWithDeps(routeCtx: RouteContext, input: OrganizationEmployeeCreationInput, options: {
     timeoutMs?: number;
     intervalMs?: number;
@@ -953,6 +965,22 @@ export declare function purgeDigitalTwinSubjectLinkWithDeps(routeCtx: RouteConte
         intervalMs?: number;
     }) => Promise<SubmitAndPollResult>;
 }): Promise<DigitalTwinSubjectLinkPurgeResult>;
+/**
+ * Reads Consent through the individual `Subject/_search` aggregate carried by
+ * an auditable Communication. `Subject` is the individual aggregate; it is
+ * intentionally separate from the public digital-twin `ResearchSubject`
+ * aggregate, whose canonical index document is a Composition.
+ */
+export declare function searchSubjectConsentsWithDeps(routeCtx: RouteContext, input: SubjectConsentSearchInput, deps: {
+    individualCommunicationBatchPath: (ctx: RouteContext, pathFormatSegment: string) => string;
+    individualCommunicationPollPath: (ctx: RouteContext, pathFormatSegment: string) => string;
+    submitAndPoll: (submitPath: string, pollPath: string, payload: {
+        thid?: string;
+    } & Record<string, unknown>, pollOptions?: {
+        timeoutMs?: number;
+        intervalMs?: number;
+    }) => Promise<SubmitAndPollResult>;
+}): Promise<SubmitAndPollResult>;
 export declare function revokeProfessionalAccessWithDeps(routeCtx: RouteContext, input: RevokeProfessionalAccessInput, deps: {
     individualConsentR4BatchPath: (ctx: RouteContext) => string;
     individualConsentR4PollPath: (ctx: RouteContext) => string;

package/dist/resource-operations.js

@@ -865,6 +865,61 @@ export async function purgeDigitalTwinSubjectLinkWithDeps(routeCtx, input, deps)
         },
     }, input.pollOptions);
 }
+/**
+ * Reads Consent through the individual `Subject/_search` aggregate carried by
+ * an auditable Communication. `Subject` is the individual aggregate; it is
+ * intentionally separate from the public digital-twin `ResearchSubject`
+ * aggregate, whose canonical index document is a Composition.
+ */
+export async function searchSubjectConsentsWithDeps(routeCtx, input, deps) {
+    const subject = String(input.subject || '').trim();
+    if (!subject.startsWith('did:')) {
+        throw new Error('Consent search requires a subject DID.');
+    }
+    const format = 'org.hl7.fhir.r4';
+    const optionalParameters = [
+        ['actor-identifier', input.actorIdentifier],
+        ['purpose', input.purpose],
+        ['action', input.action],
+        ['source-reference', input.sourceReference],
+    ];
+    const parameters = {
+        resourceType: 'Parameters',
+        parameter: [
+            { name: 'subject', valueString: subject },
+            ...optionalParameters
+                .map(([name, rawValue]) => ({ name, valueString: String(rawValue || '').trim() }))
+                .filter((parameter) => parameter.valueString),
+        ],
+    };
+    const thid = `subject-consent-search-${createRuntimeUuid()}`;
+    const communication = {
+        resourceType: 'Communication',
+        status: 'completed',
+        subject: { reference: subject },
+        payload: [{
+                contentReference: {
+                    reference: 'individual/org.hl7.fhir.api/Subject/_search',
+                },
+                contentAttachment: {
+                    contentType: 'application/fhir+json',
+                    title: 'subject-consent-search-parameters.json',
+                    data: Buffer.from(JSON.stringify(parameters), 'utf8').toString('base64'),
+                },
+            }],
+    };
+    return deps.submitAndPoll(deps.individualCommunicationBatchPath(routeCtx, format), deps.individualCommunicationPollPath(routeCtx, format), {
+        thid,
+        body: {
+            resourceType: 'Bundle',
+            type: 'batch',
+            entry: [{
+                    request: { method: 'POST', url: 'Communication' },
+                    resource: communication,
+                }],
+        },
+    }, input.pollOptions);
+}
 export async function revokeProfessionalAccessWithDeps(routeCtx, input, deps) {
     const revokedClaims = ConsentClaims
         .fromClaims(input.consentClaims)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-sdk-node-ts",
-  "version": "2.4.43",
+  "version": "2.4.45",
   "description": "Next-generation Node runtime package for the GDC SDK family",
   "license": "Apache-2.0",
   "author": "Antifraud Services Inc.",