sos-sdk-node-ts 0.1.12 → 0.1.14

package/CHANGELOG.md

@@ -2,6 +2,32 @@
 
 ## Unreleased
 
+## 0.1.14 - 2026-10-21
+
+- Add a product-neutral server-profile owner assertion for personal passkey
+  registration. It binds the selected profile to the authenticated Firebase
+  principal without misinterpreting an individual-member actor DID as a
+  professional employee identifier; mandatory passkey enrollment after PIN
+  verification remains unchanged.
+- Accept the browser WebAuthn secure-context exception for local loopback
+  origins while continuing to reject plain HTTP origins on remote hosts.
+
+- Adopt the product-neutral secure organization registration runtime previously
+  specialized in the clinical Node SDK: reviewed controller bootstrap-wallet
+  reconstruction, encrypted verification/reissuance transport, Offer-to-Order
+  confirmation and terminal OperationOutcome rejection. Portal forms, sector
+  admission policy, profile persistence and deployment values remain outside
+  this package.
+
+## 0.1.13 - 2026-10-21
+
+- Add the trusted-BFF host organization directory client. It submits and polls
+  the canonical host `org.schema/Organization/_search` route, reads a
+  DIDComm-wrapped paginated Bundle, preserves opaque cursors and surfaces
+  Bundle `OperationOutcome` failures without accepting browser-selected host
+  authority. The same client performs status, suspend, reactivate and purge
+  operations and reads their authoritative Bundle results.
+
 ## 0.1.12 - 2026-10-21
 
 - Add the product-neutral server passkey state machine used by SOSChain, UHC

package/README.md

@@ -24,6 +24,15 @@ begins only after exact registry packages are installed and verified.
 
 Product-neutral Node adapters for trusted SOSCHAIN runtimes.
 
+`secure-organization-registration` owns the trusted Node transport used after
+an application has been reviewed: deterministic reconstruction of the exact
+controller bootstrap wallet, encrypted organization verification or credential
+reissuance, and confirmation of the exact accepted Offer through Order. It
+does not own portal forms, admission policy, user authentication, application
+storage, payment policy or professional operations.
+The capability-by-capability source decision is recorded in
+[`docs/ORGANIZATION_REGISTRATION_SOURCE_EVALUATION.md`](docs/ORGANIZATION_REGISTRATION_SOURCE_EVALUATION.md).
+
 ```text
 gdc-* frozen
     ↓
@@ -69,6 +78,13 @@ BFF. It matches exact aliases inside `Organization.sameAs` CSV values and
 rejects removed animal-card DID layouts before UI mapping. See
 [the authorized subject directory contract](docs/AUTHORIZED_SUBJECT_DIRECTORY.md).
 
+`sos-sdk-node-ts/host-organization-directory-client` is the separate trusted-
+BFF client for a host operator's organization directory. It sends the
+canonical `org.schema/Organization/_search` request, polls the matching
+response route and returns the privacy-minimized, paginated Bundle projection.
+The host jurisdiction and network come from trusted server configuration;
+they are never browser-selected authority.
+
 ## Secure-message CSPRNG adapter
 
 `sos-sdk-node-ts/secure-message-crypto` exports `NodeSecureRandomSource` and

package/dist/host-organization-directory-client.d.ts

@@ -0,0 +1,78 @@
+export type HostOrganizationDirectoryRoute = Readonly<{
+    jurisdiction: string;
+    network: 'test' | 'local-network' | 'test-network' | 'network';
+}>;
+export type HostOrganizationDirectoryFilters = Readonly<{
+    jurisdiction?: string;
+    sector?: string;
+    status?: 'active' | 'suspended' | 'revoked';
+    identifierType?: string;
+    identifierValue?: string;
+    legalName?: string;
+    name?: string;
+}>;
+export type HostOrganizationDirectoryEntry = Readonly<{
+    id: string;
+    legalName: string;
+    name: string;
+    identifierType: string;
+    identifierValue: string;
+    jurisdiction: string;
+    sector: string;
+    status: 'active' | 'suspended' | 'revoked';
+    sameAs?: string;
+    claims: Readonly<Record<string, unknown>>;
+}>;
+export type HostOrganizationDirectoryPage = Readonly<{
+    total: number;
+    pageSize: number;
+    returned: number;
+    hasNext: boolean;
+    nextCursor?: string;
+    organizations: readonly HostOrganizationDirectoryEntry[];
+}>;
+export type HostOrganizationDirectorySearch = Readonly<{
+    filters?: HostOrganizationDirectoryFilters;
+    pageSize?: number;
+    cursor?: string;
+    requestThid?: string;
+    pollOptions?: Readonly<{
+        timeoutMs?: number;
+        intervalMs?: number;
+    }>;
+}>;
+export type HostOrganizationLifecycleAction = '_status' | '_disable' | '_enable' | '_purge';
+export type HostOrganizationLifecycleTarget = Readonly<{
+    identifierType: string;
+    identifierValue: string;
+    sameAs?: string;
+}>;
+export type HostOrganizationLifecycleResult = Readonly<{
+    status: 'active' | 'suspended' | 'revoked';
+    disposition?: string;
+    organizationId?: string;
+}>;
+export type SosGatewayHostOrganizationDirectoryClientOptions = Readonly<{
+    baseUrl: string;
+    bearerToken?: string;
+    appId?: string;
+    appVersion?: string;
+    defaultHeaders?: Readonly<Record<string, string>>;
+    requestTimeoutMs?: number;
+    fetchImpl?: typeof fetch;
+}>;
+/** Trusted-BFF transport for the host-only Organization registry directory. */
+export declare class SosGatewayHostOrganizationDirectoryClient {
+    private readonly baseUrl;
+    private readonly headers;
+    private readonly requestTimeoutMs;
+    private readonly fetchImpl;
+    constructor(options: SosGatewayHostOrganizationDirectoryClientOptions);
+    search(route: HostOrganizationDirectoryRoute, input?: HostOrganizationDirectorySearch): Promise<HostOrganizationDirectoryPage>;
+    lifecycle(route: HostOrganizationDirectoryRoute, action: HostOrganizationLifecycleAction, target: HostOrganizationLifecycleTarget, options?: Readonly<{
+        timeoutMs?: number;
+        intervalMs?: number;
+    }>): Promise<HostOrganizationLifecycleResult>;
+    private submitAndPoll;
+    private post;
+}

package/dist/host-organization-directory-client.js

@@ -0,0 +1,248 @@
+import { randomUUID } from 'node:crypto';
+import { buildGatewayApplicationHeaders } from 'sos-data-utils-ts/gateway-application-identity';
+const CLAIM_LEGAL_NAME = 'org.schema.Organization.legalName';
+const CLAIM_NAME = 'org.schema.Organization.name';
+const CLAIM_IDENTIFIER_TYPE = 'org.schema.Organization.identifier.additionalType';
+const CLAIM_IDENTIFIER_VALUE = 'org.schema.Organization.identifier.value';
+const CLAIM_JURISDICTION = 'org.schema.Organization.address.addressCountry';
+const CLAIM_SAME_AS = 'org.schema.Organization.sameAs';
+const CLAIM_SECTOR = 'org.schema.Service.category';
+const CLAIM_STATUS = 'org.schema.Action.tenantAuthorization.status';
+/** Trusted-BFF transport for the host-only Organization registry directory. */
+export class SosGatewayHostOrganizationDirectoryClient {
+    baseUrl;
+    headers;
+    requestTimeoutMs;
+    fetchImpl;
+    constructor(options) {
+        this.baseUrl = normalizeBaseUrl(options.baseUrl);
+        this.requestTimeoutMs = positiveInteger(options.requestTimeoutMs ?? 15_000, 'request_timeout_invalid');
+        this.fetchImpl = options.fetchImpl ?? fetch;
+        const bearerToken = optional(options.bearerToken);
+        const appId = optional(options.appId);
+        this.headers = Object.freeze({
+            'Content-Type': 'application/didcomm-plain+json',
+            Accept: 'application/didcomm-plain+json',
+            ...(bearerToken ? { Authorization: `Bearer ${bearerToken}` } : {}),
+            ...(appId ? buildGatewayApplicationHeaders({ appId, appVersion: options.appVersion }) : {}),
+            ...(options.defaultHeaders ?? {}),
+        });
+    }
+    async search(route, input = {}) {
+        const context = normalizeRoute(route);
+        const thid = optional(input.requestThid) || `host-organization-directory-${randomUUID()}`;
+        const claims = filterClaims(input.filters);
+        const body = {
+            resourceType: 'Bundle',
+            type: 'searchset',
+            data: [{
+                    type: 'Organization-search-v1.0',
+                    request: { method: 'GET', url: 'Organization/_search' },
+                    resource: { resourceType: 'Organization', meta: { claims } },
+                }],
+            meta: { pagination: {
+                    ...(input.pageSize === undefined ? {} : { pageSize: positiveInteger(input.pageSize, 'page_size_invalid') }),
+                    ...(optional(input.cursor) ? { cursor: optional(input.cursor) } : {}),
+                } },
+        };
+        const prefix = `/host/cds-${encodeURIComponent(context.jurisdiction)}/v1/${encodeURIComponent(context.network)}/registry/org.schema/Organization`;
+        const response = await this.submitAndPoll(`${prefix}/_search`, `${prefix}/_search-response`, { thid, body }, input.pollOptions);
+        return readPage(response.body);
+    }
+    async lifecycle(route, action, target, options) {
+        const context = normalizeRoute(route);
+        const identifierType = required(target.identifierType, 'host_lifecycle_identifier_type_required');
+        const identifierValue = required(target.identifierValue, 'host_lifecycle_identifier_value_required');
+        const thid = `host-organization-lifecycle-${randomUUID()}`;
+        const claims = {
+            [CLAIM_IDENTIFIER_TYPE]: identifierType,
+            [CLAIM_IDENTIFIER_VALUE]: identifierValue,
+            ...(optional(target.sameAs) ? { [CLAIM_SAME_AS]: optional(target.sameAs) } : {}),
+        };
+        const body = {
+            resourceType: 'Bundle',
+            type: 'batch',
+            data: [{
+                    type: `Organization-${action.slice(1)}-request-v1.0`,
+                    request: { method: 'POST', url: `Organization/${action}` },
+                    resource: { resourceType: 'Organization', meta: { claims } },
+                }],
+        };
+        const prefix = `/host/cds-${encodeURIComponent(context.jurisdiction)}/v1/${encodeURIComponent(context.network)}/registry/org.schema/Organization`;
+        const response = await this.submitAndPoll(`${prefix}/${action}`, `${prefix}/${action}-response`, { thid, body }, options);
+        return readLifecycleResult(response.body);
+    }
+    async submitAndPoll(submitPath, pollPath, payload, options) {
+        const submit = await this.post(submitPath, payload);
+        requireSuccessfulResponse(submit, 'gateway_submit_failed');
+        const timeoutMs = positiveInteger(options?.timeoutMs ?? 30_000, 'poll_timeout_invalid');
+        const intervalMs = positiveInteger(options?.intervalMs ?? 250, 'poll_interval_invalid');
+        const started = Date.now();
+        for (;;) {
+            const poll = await this.post(pollPath, { thid: payload.thid });
+            if (poll.status !== 202) {
+                requireSuccessfulResponse(poll, 'gateway_poll_failed');
+                return poll;
+            }
+            if (Date.now() - started >= timeoutMs)
+                throw new Error('gateway_poll_timeout');
+            await new Promise(resolve => setTimeout(resolve, intervalMs));
+        }
+    }
+    async post(path, payload) {
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), this.requestTimeoutMs);
+        try {
+            const response = await this.fetchImpl(`${this.baseUrl}${path}`, {
+                method: 'POST', headers: this.headers, body: JSON.stringify(payload), signal: controller.signal,
+            });
+            const raw = await response.text();
+            let body = {};
+            if (raw) {
+                try {
+                    body = JSON.parse(raw);
+                }
+                catch {
+                    body = raw;
+                }
+            }
+            return { status: response.status, body };
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+}
+function normalizeRoute(value) {
+    const keys = Object.keys(value);
+    if (keys.some(key => key !== 'jurisdiction' && key !== 'network'))
+        throw new Error('route_context_invalid');
+    const jurisdiction = segment(value.jurisdiction);
+    const network = segment(value.network);
+    if (!['test', 'local-network', 'test-network', 'network'].includes(network))
+        throw new Error('route_context_invalid');
+    return Object.freeze({ jurisdiction, network: network });
+}
+function filterClaims(filters = {}) {
+    return Object.freeze(Object.fromEntries([
+        [CLAIM_JURISDICTION, filters.jurisdiction],
+        [CLAIM_SECTOR, filters.sector],
+        [CLAIM_STATUS, filters.status],
+        [CLAIM_IDENTIFIER_TYPE, filters.identifierType],
+        [CLAIM_IDENTIFIER_VALUE, filters.identifierValue],
+        [CLAIM_LEGAL_NAME, filters.legalName],
+        [CLAIM_NAME, filters.name],
+    ].flatMap(([key, value]) => optional(value) ? [[key, optional(value)]] : [])));
+}
+function readPage(value) {
+    const root = record(value);
+    const bundle = record(root.body || root);
+    const data = Array.isArray(bundle.data) ? bundle.data : [];
+    const outcome = data.flatMap((entry) => {
+        const response = record(record(entry).response);
+        const result = record(response.outcome);
+        return result.resourceType === 'OperationOutcome' && Array.isArray(result.issue) ? result.issue : [];
+    }).map(record).find(issue => ['fatal', 'error'].includes(String(issue.severity || '').toLowerCase()));
+    if (outcome)
+        throw new Error(`host_directory_failed:${String(outcome.diagnostics || outcome.code || 'operation_outcome')}`);
+    if (bundle.resourceType !== 'Bundle' || bundle.type !== 'searchset')
+        throw new Error('host_directory_bundle_invalid');
+    const organizations = data.flatMap((entry) => {
+        const row = record(entry);
+        const response = record(row.response);
+        const resource = record(row.resource);
+        const claims = Object.freeze({ ...record(record(resource.meta).claims) });
+        if (resource.resourceType !== 'Organization' || !String(response.status || '').startsWith('2'))
+            return [];
+        const status = String(claims[CLAIM_STATUS] || '');
+        if (!['active', 'suspended', 'revoked'].includes(status))
+            throw new Error('host_directory_status_invalid');
+        return [Object.freeze({
+                id: String(resource.id || row.id || ''),
+                legalName: String(claims[CLAIM_LEGAL_NAME] || ''),
+                name: String(claims[CLAIM_NAME] || claims[CLAIM_LEGAL_NAME] || ''),
+                identifierType: String(claims[CLAIM_IDENTIFIER_TYPE] || ''),
+                identifierValue: String(claims[CLAIM_IDENTIFIER_VALUE] || ''),
+                jurisdiction: String(claims[CLAIM_JURISDICTION] || ''),
+                sector: String(claims[CLAIM_SECTOR] || ''),
+                status: status,
+                ...(optional(claims[CLAIM_SAME_AS]) ? { sameAs: optional(claims[CLAIM_SAME_AS]) } : {}),
+                claims,
+            })];
+    });
+    const pagination = record(record(bundle.meta).pagination);
+    return Object.freeze({
+        total: nonNegativeInteger(bundle.total, 'host_directory_total_invalid'),
+        pageSize: positiveInteger(pagination.pageSize, 'host_directory_page_size_invalid'),
+        returned: nonNegativeInteger(pagination.returned, 'host_directory_returned_invalid'),
+        hasNext: pagination.hasNext === true,
+        ...(optional(pagination.nextCursor) ? { nextCursor: optional(pagination.nextCursor) } : {}),
+        organizations: Object.freeze(organizations),
+    });
+}
+function readLifecycleResult(value) {
+    const root = record(value);
+    const bundle = record(root.body || root);
+    const data = Array.isArray(bundle.data) ? bundle.data : [];
+    const issue = data.flatMap((entry) => {
+        const outcome = record(record(record(entry).response).outcome);
+        return outcome.resourceType === 'OperationOutcome' && Array.isArray(outcome.issue) ? outcome.issue : [];
+    }).map(record).find(candidate => ['fatal', 'error'].includes(String(candidate.severity || '').toLowerCase()));
+    if (issue)
+        throw new Error(`host_lifecycle_failed:${String(issue.diagnostics || issue.code || 'operation_outcome')}`);
+    const entry = data.map(record).find(candidate => String(record(candidate.response).status || '').startsWith('2'));
+    if (!entry)
+        throw new Error('host_lifecycle_response_invalid');
+    const resource = record(entry.resource);
+    const claims = record(record(resource.meta).claims);
+    const status = String(claims[CLAIM_STATUS] || '');
+    if (!['active', 'suspended', 'revoked'].includes(status))
+        throw new Error('host_lifecycle_status_invalid');
+    return Object.freeze({
+        status: status,
+        ...(optional(claims['org.schema.Action.tenantAuthorization.lifecycleDisposition']) ? { disposition: optional(claims['org.schema.Action.tenantAuthorization.lifecycleDisposition']) } : {}),
+        ...(optional(resource.id) ? { organizationId: optional(resource.id) } : {}),
+    });
+}
+function requireSuccessfulResponse(response, code) {
+    if (response.status >= 200 && response.status < 300)
+        return;
+    throw new Error(`${code}:${response.status}`);
+}
+function normalizeBaseUrl(value) {
+    const url = new URL(value);
+    if (url.protocol !== 'https:' && url.hostname !== 'localhost' && url.hostname !== '127.0.0.1')
+        throw new Error('gateway_base_url_insecure');
+    return url.href.replace(/\/$/u, '');
+}
+function segment(value) {
+    const result = String(value ?? '').trim();
+    if (!result || result.includes('/') || result === '.' || result === '..')
+        throw new Error('route_context_invalid');
+    return result;
+}
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+function optional(value) {
+    const result = String(value ?? '').trim();
+    return result || undefined;
+}
+function required(value, code) {
+    const result = optional(value);
+    if (!result)
+        throw new Error(code);
+    return result;
+}
+function positiveInteger(value, code) {
+    const result = Number(value);
+    if (!Number.isInteger(result) || result < 1)
+        throw new Error(code);
+    return result;
+}
+function nonNegativeInteger(value, code) {
+    const result = Number(value);
+    if (!Number.isInteger(result) || result < 0)
+        throw new Error(code);
+    return result;
+}

package/dist/index.d.ts

@@ -8,3 +8,5 @@ export * from './encounter-transfer-audience-service.js';
 export * from './bff-email-assertion.js';
 export * from './subject-card-directory-client.js';
 export * from './server-passkey-profile.js';
+export * from './host-organization-directory-client.js';
+export * from './secure-organization-registration.js';

package/dist/index.js

@@ -8,3 +8,5 @@ export * from './encounter-transfer-audience-service.js';
 export * from './bff-email-assertion.js';
 export * from './subject-card-directory-client.js';
 export * from './server-passkey-profile.js';
+export * from './host-organization-directory-client.js';
+export * from './secure-organization-registration.js';

package/dist/secure-organization-registration.d.ts

@@ -0,0 +1,58 @@
+import { resolveDidWebKeyAgreementJwk, type AppInfo, type HostRouteContext, type LegalOrganizationOrderInput, type NodeLegalOrganizationVerificationTransactionInput, type PollOptions, type RouteContext, type SubmitAndPollResult } from 'gdc-sdk-node-ts';
+type PublicJwk = Readonly<Record<string, unknown>>;
+export type HostScopedDidWebResolverOptions = Readonly<{
+    gatewayBaseUrl: string;
+    hostCoverageScope: string;
+    version: string;
+    hostNetwork: string;
+    fetchImpl?: typeof fetch;
+}>;
+export declare function buildHostScopedDidDocumentUrl(options: Omit<HostScopedDidWebResolverOptions, 'fetchImpl'>): string;
+export declare function createHostScopedDidWebKeyAgreementResolver(options: HostScopedDidWebResolverOptions): (recipientDid: string) => ReturnType<typeof resolveDidWebKeyAgreementJwk>;
+export type SecureOrganizationRegistrationRuntimeOptions = Readonly<{
+    gatewayBaseUrl: string;
+    appInfo?: AppInfo;
+    resolveRecipientJwk(recipientDid: string): Promise<PublicJwk>;
+    fetchImpl?: typeof fetch;
+    requestTimeoutMs?: number;
+}>;
+type SecureOrganizationBootstrapInput = Readonly<{
+    walletSeed: string;
+    walletKeyDerivationId: string;
+    bearerToken: string;
+    providerDid: string;
+    routeContext: RouteContext;
+    hostContext: HostRouteContext;
+    pollOptions?: PollOptions;
+}>;
+export type SecureOrganizationRegistrationInput = SecureOrganizationBootstrapInput & Readonly<{
+    verificationInput: NodeLegalOrganizationVerificationTransactionInput;
+}>;
+export type SecureOrganizationOrderInput = SecureOrganizationBootstrapInput & Readonly<{
+    orderInput: LegalOrganizationOrderInput;
+}>;
+export declare function buildOrganizationRegistrationWalletContext(walletKeyDerivationId: string): {
+    readonly profile: {
+        readonly profileId: string;
+    };
+    readonly runtime: {
+        readonly runtimeId: `${string}:server-runtime`;
+        readonly runtimeType: "backend-service";
+    };
+};
+/** Trusted-server facade for encrypted verification, reissuance and Offer-to-Order confirmation. */
+export declare class SecureOrganizationRegistrationRuntime {
+    private readonly options;
+    constructor(options: SecureOrganizationRegistrationRuntimeOptions);
+    submitVerificationWithBootstrapWallet(input: SecureOrganizationRegistrationInput): Promise<SubmitAndPollResult>;
+    submitCredentialReissuanceWithBootstrapWallet(input: SecureOrganizationRegistrationInput): Promise<SubmitAndPollResult>;
+    confirmOrderWithBootstrapWallet(input: SecureOrganizationOrderInput): Promise<SubmitAndPollResult>;
+    private createEncryptedClient;
+}
+export declare function assertSuccessfulOrganizationRegistrationResult<T extends Readonly<{
+    poll: Readonly<{
+        status: number;
+        body: unknown;
+    }>;
+}>>(result: T): T;
+export {};

package/dist/secure-organization-registration.js

@@ -0,0 +1,128 @@
+// Copyright 2026 Connecting Solution & Applications Ltd under the Apache License, Version 2.0.
+import { NodeHttpClient, NodeManagedWallet, TransportProfiles, resolveDidWebKeyAgreementJwk, } from 'gdc-sdk-node-ts';
+import { buildAuthorityDidWeb } from 'gdc-common-utils-ts/utils/authority-resolution';
+export function buildHostScopedDidDocumentUrl(options) {
+    const gatewayOrigin = secureOrigin(options.gatewayBaseUrl, 'host_did_gateway_url_required');
+    const coverage = routeSegment(options.hostCoverageScope, 'host_did_coverage_scope_required').toUpperCase();
+    const version = routeSegment(options.version, 'host_did_version_required');
+    const network = routeSegment(options.hostNetwork, 'host_did_network_required');
+    return `${gatewayOrigin}/host/cds-${coverage}/${version}/${network}/.well-known/did.json`;
+}
+export function createHostScopedDidWebKeyAgreementResolver(options) {
+    const gatewayOrigin = secureOrigin(options.gatewayBaseUrl, 'host_did_gateway_url_required');
+    const hostDid = buildAuthorityDidWeb({ authority: gatewayOrigin }).toLowerCase();
+    const didDocumentUrl = buildHostScopedDidDocumentUrl(options);
+    return recipientDid => resolveDidWebKeyAgreementJwk(recipientDid, {
+        fetchImpl: options.fetchImpl,
+        ...(String(recipientDid || '').trim().toLowerCase() === hostDid ? { didDocumentUrl } : {}),
+    });
+}
+export function buildOrganizationRegistrationWalletContext(walletKeyDerivationId) {
+    const id = required(walletKeyDerivationId, 'organization_registration_wallet_context_required');
+    return { profile: { profileId: id }, runtime: { runtimeId: `${id}:server-runtime`, runtimeType: 'backend-service' } };
+}
+/** Trusted-server facade for encrypted verification, reissuance and Offer-to-Order confirmation. */
+export class SecureOrganizationRegistrationRuntime {
+    options;
+    constructor(options) {
+        this.options = options;
+        secureOrigin(options.gatewayBaseUrl, 'organization_registration_gateway_url_required');
+    }
+    async submitVerificationWithBootstrapWallet(input) {
+        const client = await this.createEncryptedClient(input);
+        return assertSuccessfulOrganizationRegistrationResult(await client.submitLegalOrganizationVerificationTransaction(input.hostContext, input.verificationInput, input.pollOptions));
+    }
+    async submitCredentialReissuanceWithBootstrapWallet(input) {
+        const client = await this.createEncryptedClient(input);
+        return assertSuccessfulOrganizationRegistrationResult(await client.submitLegalOrganizationCredentialReissuance(input.hostContext, input.verificationInput, input.pollOptions));
+    }
+    async confirmOrderWithBootstrapWallet(input) {
+        const client = await this.createEncryptedClient(input);
+        return assertSuccessfulOrganizationRegistrationResult(await client.confirmLegalOrganizationOrder(input.hostContext, input.orderInput, input.pollOptions));
+    }
+    async createEncryptedClient(input) {
+        const walletKeyDerivationId = required(input.walletKeyDerivationId, 'organization_registration_wallet_context_required');
+        const walletSeed = required(input.walletSeed, 'organization_registration_wallet_seed_required');
+        const providerDid = required(input.providerDid, 'organization_registration_provider_did_required');
+        const bearerToken = required(input.bearerToken, 'organization_registration_bearer_required');
+        const wallet = new NodeManagedWallet({ resolveRecipientJwk: this.options.resolveRecipientJwk });
+        const context = buildOrganizationRegistrationWalletContext(walletKeyDerivationId);
+        await wallet.provisionManagedKeys(context, { ownerScope: 'profile', purposes: ['actor-signing', 'document-at-rest'], mode: 'deterministic', seedMaterial: walletSeed });
+        await wallet.provisionManagedKeys(context, { ownerScope: 'runtime', purposes: ['openid-id-token-signing', 'vp-token-signing', 'comm-signing', 'comm-encryption'], mode: 'deterministic', seedMaterial: walletSeed });
+        return new NodeHttpClient({
+            baseUrl: this.options.gatewayBaseUrl, bearerToken, ctx: input.routeContext,
+            appInfo: this.options.appInfo, fetchImpl: this.options.fetchImpl, requestTimeoutMs: this.options.requestTimeoutMs,
+            transportProfile: TransportProfiles.DidcommEncryptedForm,
+            secureTransportAdapter: {
+                pack: message => wallet.packForRecipientWithContext(message, providerDid, { context }),
+                unpack: async (jwe) => (await wallet.unpackWithContext(jwe, { context })).content,
+            },
+        });
+    }
+}
+export function assertSuccessfulOrganizationRegistrationResult(result) {
+    const failure = findFailedOperationOutcome(result.poll.body);
+    if (result.poll.status >= 400 || failure) {
+        const code = String(failure?.issue.code || 'operation-outcome').trim() || 'operation-outcome';
+        const status = failure?.status || result.poll.status;
+        throw new Error(`organization_registration_gateway_failed:${status}:${code}`);
+    }
+    return result;
+}
+function findFailedOperationOutcome(value) {
+    const seen = new WeakSet();
+    const visit = (candidate, inheritedStatus) => {
+        if (!candidate || typeof candidate !== 'object' || seen.has(candidate))
+            return undefined;
+        seen.add(candidate);
+        if (Array.isArray(candidate)) {
+            for (const item of candidate) {
+                const failure = visit(item, inheritedStatus);
+                if (failure)
+                    return failure;
+            }
+            return undefined;
+        }
+        const record = asRecord(candidate);
+        const responseStatus = parseHttpStatus(asRecord(record.response).status) || inheritedStatus;
+        if (record.resourceType === 'OperationOutcome') {
+            const issues = Array.isArray(record.issue) ? record.issue.map(asRecord) : [];
+            const issue = issues.find(item => ['error', 'fatal'].includes(String(item.severity || '').toLowerCase()));
+            if (issue)
+                return { issue, status: parseHttpStatus(issue.responseStatus) || responseStatus };
+        }
+        for (const nested of Object.values(record)) {
+            const failure = visit(nested, responseStatus);
+            if (failure)
+                return failure;
+        }
+        return undefined;
+    };
+    return visit(value);
+}
+function parseHttpStatus(value) {
+    const status = Number.parseInt(String(value ?? ''), 10);
+    return Number.isInteger(status) && status >= 100 && status <= 599 ? status : undefined;
+}
+function asRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+function required(value, error) {
+    const normalized = String(value ?? '').trim();
+    if (!normalized)
+        throw new TypeError(error);
+    return normalized;
+}
+function routeSegment(value, error) {
+    const normalized = required(value, error);
+    if (!/^[A-Za-z0-9-]+$/u.test(normalized))
+        throw new TypeError(error);
+    return normalized;
+}
+function secureOrigin(value, error) {
+    const url = new URL(required(value, error));
+    if (url.protocol !== 'https:' && !(url.protocol === 'http:' && ['localhost', '127.0.0.1', '::1'].includes(url.hostname))) {
+        throw new TypeError('organization_registration_gateway_https_required');
+    }
+    return url.origin;
+}

package/dist/server-passkey-profile.d.ts

@@ -102,6 +102,14 @@ export type ServerPasskeyProfileServiceOptions = Readonly<{
     ceremonyTtlMs?: number;
     accessTtlMs?: number;
 }>;
+/**
+ * Confirms that an authenticated Firebase principal owns the selected server
+ * profile. Personal actor DIDs describe the subject relationship and are not
+ * professional employee identifiers, so they must not be parsed as one.
+ */
+export declare function assertServerProfileOwner<T extends Readonly<{
+    ownerId: string;
+}>>(profile: T | undefined, ownerId: string): asserts profile is T;
 /** Product-neutral passkey state machine for SOS, health and animal portal BFFs. */
 export declare class ServerPasskeyProfileService {
     private readonly options;

package/dist/server-passkey-profile.js

@@ -2,6 +2,17 @@ import { createHash, randomBytes, randomUUID } from 'node:crypto';
 import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse, } from '@simplewebauthn/server';
 const CEREMONY_TTL_MS = 5 * 60 * 1000;
 const ACCESS_TTL_MS = 15 * 60 * 1000;
+/**
+ * Confirms that an authenticated Firebase principal owns the selected server
+ * profile. Personal actor DIDs describe the subject relationship and are not
+ * professional employee identifiers, so they must not be parsed as one.
+ */
+export function assertServerProfileOwner(profile, ownerId) {
+    const expectedOwnerId = ownerId.trim();
+    if (!profile || !expectedOwnerId || profile.ownerId !== expectedOwnerId) {
+        throw new Error('profile_not_found');
+    }
+}
 /** Product-neutral passkey state machine for SOS, health and animal portal BFFs. */
 export class ServerPasskeyProfileService {
     options;
@@ -140,7 +151,7 @@ export function createSimpleWebAuthnCeremonyAdapter(input) {
     const rpName = String(input.rpName || '').trim();
     const rpId = String(input.rpId || '').trim();
     const origins = input.origins.map(value => String(value || '').trim()).filter(Boolean);
-    if (!rpName || !rpId || !origins.length || origins.some(origin => !origin.startsWith('https://'))) {
+    if (!rpName || !rpId || !origins.length || origins.some(origin => !isSecureWebAuthnOrigin(origin))) {
         throw new Error('passkey_relying_party_not_configured');
     }
     return {
@@ -204,3 +215,15 @@ export function createSimpleWebAuthnCeremonyAdapter(input) {
         },
     };
 }
+function isSecureWebAuthnOrigin(origin) {
+    try {
+        const parsed = new URL(origin);
+        if (parsed.protocol === 'https:')
+            return true;
+        return parsed.protocol === 'http:'
+            && (parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1' || parsed.hostname === '[::1]');
+    }
+    catch {
+        return false;
+    }
+}

package/docs/ORGANIZATION_REGISTRATION_SOURCE_EVALUATION.md

@@ -0,0 +1,27 @@
+# Organization registration source evaluation
+
+The shared SOS Node SDK evaluated the existing clinical organization
+registration runtime capability-by-capability. It did not copy a portal,
+product policy or deployment configuration.
+
+| Capability | Decision | Shared boundary |
+| --- | --- | --- |
+| deterministic controller bootstrap-wallet reconstruction | adopted | trusted Node SDK |
+| encrypted DIDComm form transport to SOS Gateway | adopted | trusted Node SDK |
+| organization verification and credential reissuance submission | adopted | trusted Node SDK |
+| exact accepted Offer continuation through Order | adopted | trusted Node SDK |
+| terminal nested `OperationOutcome` rejection | adopted | trusted Node SDK |
+| host DID document route and recipient key resolution | adopted | trusted Node SDK |
+| host organization search and lifecycle | already equivalent | existing host-directory client |
+| application form, localization and product branding | rejected | hosting/controller presentation |
+| sector and jurisdiction admission policy | rejected | trusted portal BFF and ICA |
+| application, PIN and controller-profile persistence | rejected | trusted portal BFF |
+| user authentication and account recovery | rejected | portal identity boundary |
+| payment adapter and commercial policy | rejected | marketplace and billing boundary |
+| professional groups, subjects, services, studies and scheduling | rejected | delegated professional workflows |
+| tenant, host, network, credentials and deployment values | rejected | private deployment configuration |
+
+This extraction is a transport prerequisite, not proof of an organization
+onboarding journey. A consumer still has to prove application submission,
+review, verification, Offer, Order, activation, device registration and
+authoritative readback through its real BFF and Gateway environment.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sos-sdk-node-ts",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "description": "Product-neutral Node adapters shared by SOSChain, Vet and UHC runtimes",
   "license": "Apache-2.0",
   "author": "Connecting Solution & Applications Ltd",
@@ -47,6 +47,14 @@
     "./subject-card-directory-client": {
       "types": "./dist/subject-card-directory-client.d.ts",
       "default": "./dist/subject-card-directory-client.js"
+    },
+    "./host-organization-directory-client": {
+      "types": "./dist/host-organization-directory-client.d.ts",
+      "default": "./dist/host-organization-directory-client.js"
+    },
+    "./secure-organization-registration": {
+      "types": "./dist/secure-organization-registration.d.ts",
+      "default": "./dist/secure-organization-registration.js"
     }
   },
   "files": [
@@ -66,6 +74,8 @@
   },
   "dependencies": {
     "@simplewebauthn/server": "13.3.2",
+    "gdc-common-utils-ts": "2.9.30",
+    "gdc-sdk-node-ts": "2.9.32",
     "sos-data-utils-ts": "0.6.13",
     "sos-sdk-core-ts": "0.5.2"
   },