sos-sdk-node-ts 0.1.13 → 0.1.15

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## Unreleased
+
+## 0.1.15 - 2026-10-22
+
+- Add product-neutral verification and resolution for an existing professional
+  DID, employee-authorization URN or signed professional SHC. Invitation and
+  device registration remain separate host-managed operations.
+
+## 0.1.14 - 2026-10-21
+
+- Add a product-neutral server-profile owner assertion for personal passkey
+  registration. It binds the selected profile to the authenticated Firebase
+  principal without misinterpreting an individual-member actor DID as a
+  professional employee identifier; mandatory passkey enrollment after PIN
+  verification remains unchanged.
+- Accept the browser WebAuthn secure-context exception for local loopback
+  origins while continuing to reject plain HTTP origins on remote hosts.
+
+- Adopt the product-neutral secure organization registration runtime previously
+  specialized in the clinical Node SDK: reviewed controller bootstrap-wallet
+  reconstruction, encrypted verification/reissuance transport, Offer-to-Order
+  confirmation and terminal OperationOutcome rejection. Portal forms, sector
+  admission policy, profile persistence and deployment values remain outside
+  this package.
+
 ## 0.1.13 - 2026-10-21
 
 - Add the trusted-BFF host organization directory client. It submits and polls

package/README.md

@@ -24,6 +24,15 @@ begins only after exact registry packages are installed and verified.
 
 Product-neutral Node adapters for trusted SOSCHAIN runtimes.
 
+`secure-organization-registration` owns the trusted Node transport used after
+an application has been reviewed: deterministic reconstruction of the exact
+controller bootstrap wallet, encrypted organization verification or credential
+reissuance, and confirmation of the exact accepted Offer through Order. It
+does not own portal forms, admission policy, user authentication, application
+storage, payment policy or professional operations.
+The capability-by-capability source decision is recorded in
+[`docs/ORGANIZATION_REGISTRATION_SOURCE_EVALUATION.md`](docs/ORGANIZATION_REGISTRATION_SOURCE_EVALUATION.md).
+
 ```text
 gdc-* frozen
     ↓

package/dist/index.d.ts

@@ -9,3 +9,5 @@ export * from './bff-email-assertion.js';
 export * from './subject-card-directory-client.js';
 export * from './server-passkey-profile.js';
 export * from './host-organization-directory-client.js';
+export * from './secure-organization-registration.js';
+export * from './portable-professional-evidence.js';

package/dist/index.js

@@ -9,3 +9,5 @@ export * from './bff-email-assertion.js';
 export * from './subject-card-directory-client.js';
 export * from './server-passkey-profile.js';
 export * from './host-organization-directory-client.js';
+export * from './secure-organization-registration.js';
+export * from './portable-professional-evidence.js';

package/dist/portable-professional-evidence.d.ts

@@ -0,0 +1,55 @@
+export type PortableProfessionalProvider = Readonly<{
+    baseUrl: string;
+    tenantId: string;
+    jurisdiction: string;
+    sector: string;
+}>;
+export type PortableProfessionalEnrollment = Readonly<{
+    sector: string;
+    employeeAuthorizationUrn: string;
+    professionalDid: string;
+    providerDid: string;
+    gatewayBaseUrl: string;
+    tenantId: string;
+    jurisdiction: string;
+    role: string;
+}>;
+/**
+ * Derives routing candidates only from evidence shape plus a server-owned host
+ * and sector allowlist. The returned candidate grants no authority: the signed
+ * credential or authoritative DID documents are still verified by the
+ * resolution functions below.
+ */
+export declare function derivePortableProfessionalProviderCandidates(input: Readonly<{
+    professionalCredential?: unknown;
+    professionalIdentifier?: unknown;
+    sectorHint?: unknown;
+    trustedGatewayBaseUrls: readonly string[];
+    allowedSectors: readonly string[];
+}>): PortableProfessionalProvider[];
+/**
+ * Verifies one signed professional SHC and returns only its existing
+ * organization-issued authorization reference. It creates neither an
+ * invitation nor a device registration.
+ */
+export declare function resolveProfessionalShcEnrollment(input: Readonly<{
+    credential: unknown;
+    providers: readonly PortableProfessionalProvider[];
+    fetchImpl?: typeof fetch;
+    nowSeconds?: number;
+}>): Promise<Readonly<{
+    professionalIdentifier: string;
+    sectorHint: string;
+}>>;
+/**
+ * Resolves one organization-issued DID or authorization URN through
+ * server-owned provider configuration. The result still requires the host
+ * profile manager to perform licence, contact and device-registration checks.
+ */
+export declare function resolvePortableProfessionalEnrollment(input: Readonly<{
+    professionalIdentifier: unknown;
+    sectorHint: unknown;
+    verifiedEmail: unknown;
+    providers: readonly PortableProfessionalProvider[];
+    fetchImpl?: typeof fetch;
+}>): Promise<PortableProfessionalEnrollment>;

package/dist/portable-professional-evidence.js

@@ -0,0 +1,260 @@
+import { createPublicKey, verify } from 'node:crypto';
+import { inflateRawSync } from 'node:zlib';
+import { buildProfessionalDidWeb } from 'gdc-common-utils-ts/utils/did';
+const EMPLOYEE_AUTHORIZATION_URN_PATTERN = /^urn:cds-([a-z]{2}(?:-[a-z0-9]{2,3})?):v[1-9][0-9]*:organization:([a-z][a-z0-9-]*):([^:]+):member:(z[1-9A-HJ-NP-Za-km-z]+):([0-9]+)$/i;
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+function text(value) {
+    return typeof value === 'string' ? value.trim() : '';
+}
+function identifiers(resource) {
+    return (Array.isArray(resource.identifier) ? resource.identifier : [])
+        .map(item => text(record(item).value))
+        .filter(Boolean);
+}
+function providerIssuer(provider) {
+    return `${new URL(provider.baseUrl).origin}/${encodeURIComponent(provider.tenantId)}/cds-${encodeURIComponent(provider.jurisdiction)}/v1/${encodeURIComponent(provider.sector)}`;
+}
+function decodeShcQr(value) {
+    const normalized = text(value);
+    if (!/^shc:\/\d+$/.test(normalized))
+        throw new TypeError('professional_credential_shc_required');
+    const digits = normalized.slice('shc:/'.length);
+    if (!digits || digits.length % 2 !== 0)
+        throw new TypeError('professional_credential_shc_invalid');
+    let compact = '';
+    for (let index = 0; index < digits.length; index += 2) {
+        const pair = Number(digits.slice(index, index + 2));
+        if (pair > 77)
+            throw new TypeError('professional_credential_shc_invalid');
+        compact += String.fromCharCode(pair + 45);
+    }
+    return compact;
+}
+/**
+ * Derives routing candidates only from evidence shape plus a server-owned host
+ * and sector allowlist. The returned candidate grants no authority: the signed
+ * credential or authoritative DID documents are still verified by the
+ * resolution functions below.
+ */
+export function derivePortableProfessionalProviderCandidates(input) {
+    const hasCredential = Boolean(text(input.professionalCredential));
+    const professionalIdentifier = text(input.professionalIdentifier);
+    if (hasCredential === Boolean(professionalIdentifier))
+        throw new TypeError('professional_evidence_path_invalid');
+    let tenantId = '';
+    let jurisdiction = '';
+    let sector = text(input.sectorHint).toLowerCase();
+    let issuerOrigin = '';
+    if (hasCredential) {
+        const parts = decodeShcQr(input.professionalCredential).split('.');
+        if (parts.length !== 3)
+            throw new TypeError('professional_credential_shc_invalid');
+        let payload;
+        try {
+            payload = record(JSON.parse(inflateRawSync(Buffer.from(parts[1], 'base64url')).toString('utf8')));
+        }
+        catch {
+            throw new TypeError('professional_credential_shc_invalid');
+        }
+        const issuer = new URL(text(payload.iss));
+        const match = issuer.pathname.match(/^\/([^/]+)\/cds-([^/]+)\/v[1-9][0-9]*\/([a-z][a-z0-9-]*)\/?$/i);
+        if (!match)
+            throw new TypeError('professional_credential_issuer_invalid');
+        tenantId = decodeURIComponent(match[1]);
+        jurisdiction = decodeURIComponent(match[2]);
+        sector = decodeURIComponent(match[3]).toLowerCase();
+        issuerOrigin = issuer.origin;
+    }
+    else {
+        const authorization = EMPLOYEE_AUTHORIZATION_URN_PATTERN.exec(professionalIdentifier);
+        const did = professionalIdentifier.match(/:([^:]+):cds-([^:]+):v[1-9][0-9]*:([a-z][a-z0-9-]*):employee:/i);
+        if (authorization) {
+            jurisdiction = authorization[1];
+            tenantId = authorization[3];
+        }
+        else if (did) {
+            tenantId = did[1];
+            jurisdiction = did[2];
+            if (sector && sector !== did[3].toLowerCase())
+                throw new TypeError('professional_sector_mismatch');
+            sector = did[3].toLowerCase();
+        }
+        else {
+            throw new TypeError('professional_credential_invalid');
+        }
+    }
+    const allowedSectors = new Set(input.allowedSectors.map(value => text(value).toLowerCase()).filter(Boolean));
+    if (!sector || !allowedSectors.has(sector))
+        throw new TypeError('professional_sector_not_allowed');
+    const origins = [...new Set(input.trustedGatewayBaseUrls.map(value => new URL(value).origin))]
+        .filter(origin => !issuerOrigin || origin === issuerOrigin);
+    if (origins.length === 0)
+        throw new TypeError('professional_provider_not_allowed');
+    return origins.map(baseUrl => Object.freeze({ baseUrl, tenantId, jurisdiction: jurisdiction.toUpperCase(), sector }));
+}
+/**
+ * Verifies one signed professional SHC and returns only its existing
+ * organization-issued authorization reference. It creates neither an
+ * invitation nor a device registration.
+ */
+export async function resolveProfessionalShcEnrollment(input) {
+    const compact = decodeShcQr(input.credential);
+    const parts = compact.split('.');
+    if (parts.length !== 3)
+        throw new TypeError('professional_credential_shc_invalid');
+    let header;
+    let payload;
+    try {
+        header = record(JSON.parse(Buffer.from(parts[0], 'base64url').toString('utf8')));
+        payload = record(JSON.parse(inflateRawSync(Buffer.from(parts[1], 'base64url')).toString('utf8')));
+    }
+    catch {
+        throw new TypeError('professional_credential_shc_invalid');
+    }
+    if (header.alg !== 'ES256' || header.zip !== 'DEF' || !text(header.kid)) {
+        throw new TypeError('professional_credential_header_invalid');
+    }
+    const issuer = text(payload.iss);
+    const notBefore = Number(payload.nbf);
+    if (!issuer.startsWith('https://') || !Number.isInteger(notBefore)
+        || notBefore > (input.nowSeconds ?? Math.floor(Date.now() / 1000))) {
+        throw new TypeError('professional_credential_time_or_issuer_invalid');
+    }
+    const provider = input.providers.find(candidate => providerIssuer(candidate) === issuer);
+    if (!provider)
+        throw new TypeError('professional_credential_provider_not_allowed');
+    const jwksResponse = await (input.fetchImpl ?? fetch)(`${issuer}/.well-known/jwks.json`, {
+        headers: { accept: 'application/jwk-set+json, application/json' },
+    });
+    if (!jwksResponse.ok)
+        throw new TypeError('professional_credential_jwks_unavailable');
+    const jwks = record(await jwksResponse.json());
+    const key = (Array.isArray(jwks.keys) ? jwks.keys : []).map(record)
+        .find(candidate => candidate.kid === header.kid && candidate.kty === 'EC' && candidate.crv === 'P-256');
+    if (!key)
+        throw new TypeError('professional_credential_key_not_found');
+    let valid = false;
+    try {
+        valid = verify('sha256', Buffer.from(`${parts[0]}.${parts[1]}`), {
+            key: createPublicKey({ key: key, format: 'jwk' }),
+            dsaEncoding: 'ieee-p1363',
+        }, Buffer.from(parts[2], 'base64url'));
+    }
+    catch {
+        valid = false;
+    }
+    if (!valid)
+        throw new TypeError('professional_credential_signature_invalid');
+    const credentialSubject = record(record(payload.vc).credentialSubject);
+    const bundle = record(credentialSubject.fhirBundle);
+    if (bundle.resourceType !== 'Bundle')
+        throw new TypeError('professional_credential_bundle_invalid');
+    const resources = (Array.isArray(bundle.entry) ? bundle.entry : [])
+        .map(entry => record(record(entry).resource));
+    const organization = resources.find(resource => resource.resourceType === 'Organization');
+    const practitioner = resources.find(resource => resource.resourceType === 'Practitioner');
+    const practitionerRole = resources.find(resource => resource.resourceType === 'PractitionerRole');
+    if (!organization || !practitioner || !practitionerRole || practitionerRole.active === false) {
+        throw new TypeError('professional_credential_resources_required');
+    }
+    const authorizationUrn = identifiers(practitionerRole)
+        .find(value => EMPLOYEE_AUTHORIZATION_URN_PATTERN.test(value));
+    const authorization = authorizationUrn
+        ? EMPLOYEE_AUTHORIZATION_URN_PATTERN.exec(authorizationUrn)
+        : undefined;
+    if (!authorization || !authorizationUrn)
+        throw new TypeError('professional_credential_authorization_missing');
+    const [, jurisdiction, , organizationOfficialId] = authorization;
+    if (jurisdiction.toLowerCase() !== provider.jurisdiction.toLowerCase()
+        || organizationOfficialId !== provider.tenantId
+        || !identifiers(organization).includes(provider.tenantId)
+        || identifiers(practitioner).length === 0
+        || text(record(practitionerRole.organization).reference) !== 'resource:0'
+        || text(record(practitionerRole.practitioner).reference) !== 'resource:1') {
+        throw new TypeError('professional_credential_binding_invalid');
+    }
+    return Object.freeze({ professionalIdentifier: authorizationUrn, sectorHint: provider.sector });
+}
+/**
+ * Resolves one organization-issued DID or authorization URN through
+ * server-owned provider configuration. The result still requires the host
+ * profile manager to perform licence, contact and device-registration checks.
+ */
+export async function resolvePortableProfessionalEnrollment(input) {
+    const professionalIdentifier = text(input.professionalIdentifier);
+    const sectorHint = text(input.sectorHint).toLowerCase();
+    const verifiedEmail = text(input.verifiedEmail).toLowerCase();
+    if (!/^[a-z][a-z0-9-]*$/.test(sectorHint))
+        throw new TypeError('professional_sector_hint_required');
+    if (!verifiedEmail)
+        throw new TypeError('verified_email_required');
+    const fetchImpl = input.fetchImpl ?? fetch;
+    let employeeAuthorizationUrn = professionalIdentifier;
+    let authorization = EMPLOYEE_AUTHORIZATION_URN_PATTERN.exec(employeeAuthorizationUrn);
+    if (!authorization && professionalIdentifier.startsWith('did:web:')) {
+        const didMatches = input.providers.flatMap(provider => {
+            const context = `:${provider.tenantId}:cds-${provider.jurisdiction}:v1:${provider.sector}:employee:`;
+            if (provider.sector.toLowerCase() !== sectorHint || !professionalIdentifier.includes(context))
+                return [];
+            const employeePath = professionalIdentifier.slice(professionalIdentifier.indexOf(context) + context.length);
+            const [memberId, ...roleParts] = employeePath.split(':');
+            const role = roleParts.join(':');
+            return memberId && role ? [{ provider, memberId, role }] : [];
+        });
+        if (didMatches.length === 0)
+            throw new TypeError('professional_provider_not_found');
+        if (didMatches.length > 1)
+            throw new TypeError('multiple_professional_providers_found');
+        const { provider, memberId, role } = didMatches[0];
+        const didUrl = `${providerIssuer(provider)}/employee/${encodeURIComponent(memberId)}/${encodeURIComponent(role)}/did.json`;
+        const didResponse = await fetchImpl(didUrl, { headers: { accept: 'application/did+json, application/json' } });
+        if (!didResponse.ok)
+            throw new TypeError('professional_did_unavailable');
+        const didDocument = record(await didResponse.json());
+        if (text(didDocument.id) !== professionalIdentifier)
+            throw new TypeError('professional_did_invalid');
+        employeeAuthorizationUrn = (Array.isArray(didDocument.alsoKnownAs) ? didDocument.alsoKnownAs : [])
+            .map(String).find(value => EMPLOYEE_AUTHORIZATION_URN_PATTERN.test(value)) || '';
+        authorization = EMPLOYEE_AUTHORIZATION_URN_PATTERN.exec(employeeAuthorizationUrn);
+    }
+    if (!authorization)
+        throw new TypeError('professional_credential_invalid');
+    const [, authorizationJurisdiction, , organizationOfficialId, , authorizationRoleCode] = authorization;
+    const matches = input.providers.filter(provider => provider.tenantId === organizationOfficialId
+        && provider.jurisdiction.toLowerCase() === authorizationJurisdiction.toLowerCase()
+        && provider.sector.toLowerCase() === sectorHint);
+    if (matches.length === 0)
+        throw new TypeError('professional_provider_not_found');
+    if (matches.length > 1)
+        throw new TypeError('multiple_professional_providers_found');
+    const provider = matches[0];
+    const gatewayBaseUrl = new URL(provider.baseUrl).origin;
+    const response = await fetchImpl(`${providerIssuer(provider)}/.well-known/did.json`, {
+        headers: { accept: 'application/did+json, application/json' },
+    });
+    if (!response.ok)
+        throw new TypeError('professional_tenant_did_unavailable');
+    const document = record(await response.json());
+    const providerDid = text(document.id);
+    const expectedContext = `:${provider.tenantId}:cds-${provider.jurisdiction}:v1:${provider.sector}`;
+    const services = Array.isArray(document.service) ? document.service : [];
+    const hasJwks = services.some(service => text(record(service).type) === 'JsonWebKeyService2020'
+        && /^https:\/\//i.test(text(record(service).serviceEndpoint)));
+    if (!providerDid.startsWith('did:web:') || !providerDid.endsWith(expectedContext) || !hasJwks) {
+        throw new TypeError('professional_tenant_did_invalid');
+    }
+    const role = `ISCO-08|${authorizationRoleCode}`;
+    const professionalDid = buildProfessionalDidWeb({ organizationDidWeb: providerDid, email: verifiedEmail, role });
+    return Object.freeze({
+        sector: provider.sector,
+        employeeAuthorizationUrn,
+        professionalDid,
+        providerDid,
+        gatewayBaseUrl,
+        tenantId: provider.tenantId,
+        jurisdiction: provider.jurisdiction.toUpperCase(),
+        role,
+    });
+}

package/dist/secure-organization-registration.d.ts

@@ -0,0 +1,58 @@
+import { resolveDidWebKeyAgreementJwk, type AppInfo, type HostRouteContext, type LegalOrganizationOrderInput, type NodeLegalOrganizationVerificationTransactionInput, type PollOptions, type RouteContext, type SubmitAndPollResult } from 'gdc-sdk-node-ts';
+type PublicJwk = Readonly<Record<string, unknown>>;
+export type HostScopedDidWebResolverOptions = Readonly<{
+    gatewayBaseUrl: string;
+    hostCoverageScope: string;
+    version: string;
+    hostNetwork: string;
+    fetchImpl?: typeof fetch;
+}>;
+export declare function buildHostScopedDidDocumentUrl(options: Omit<HostScopedDidWebResolverOptions, 'fetchImpl'>): string;
+export declare function createHostScopedDidWebKeyAgreementResolver(options: HostScopedDidWebResolverOptions): (recipientDid: string) => ReturnType<typeof resolveDidWebKeyAgreementJwk>;
+export type SecureOrganizationRegistrationRuntimeOptions = Readonly<{
+    gatewayBaseUrl: string;
+    appInfo?: AppInfo;
+    resolveRecipientJwk(recipientDid: string): Promise<PublicJwk>;
+    fetchImpl?: typeof fetch;
+    requestTimeoutMs?: number;
+}>;
+type SecureOrganizationBootstrapInput = Readonly<{
+    walletSeed: string;
+    walletKeyDerivationId: string;
+    bearerToken: string;
+    providerDid: string;
+    routeContext: RouteContext;
+    hostContext: HostRouteContext;
+    pollOptions?: PollOptions;
+}>;
+export type SecureOrganizationRegistrationInput = SecureOrganizationBootstrapInput & Readonly<{
+    verificationInput: NodeLegalOrganizationVerificationTransactionInput;
+}>;
+export type SecureOrganizationOrderInput = SecureOrganizationBootstrapInput & Readonly<{
+    orderInput: LegalOrganizationOrderInput;
+}>;
+export declare function buildOrganizationRegistrationWalletContext(walletKeyDerivationId: string): {
+    readonly profile: {
+        readonly profileId: string;
+    };
+    readonly runtime: {
+        readonly runtimeId: `${string}:server-runtime`;
+        readonly runtimeType: "backend-service";
+    };
+};
+/** Trusted-server facade for encrypted verification, reissuance and Offer-to-Order confirmation. */
+export declare class SecureOrganizationRegistrationRuntime {
+    private readonly options;
+    constructor(options: SecureOrganizationRegistrationRuntimeOptions);
+    submitVerificationWithBootstrapWallet(input: SecureOrganizationRegistrationInput): Promise<SubmitAndPollResult>;
+    submitCredentialReissuanceWithBootstrapWallet(input: SecureOrganizationRegistrationInput): Promise<SubmitAndPollResult>;
+    confirmOrderWithBootstrapWallet(input: SecureOrganizationOrderInput): Promise<SubmitAndPollResult>;
+    private createEncryptedClient;
+}
+export declare function assertSuccessfulOrganizationRegistrationResult<T extends Readonly<{
+    poll: Readonly<{
+        status: number;
+        body: unknown;
+    }>;
+}>>(result: T): T;
+export {};

package/dist/secure-organization-registration.js

@@ -0,0 +1,128 @@
+// Copyright 2026 Connecting Solution & Applications Ltd under the Apache License, Version 2.0.
+import { NodeHttpClient, NodeManagedWallet, TransportProfiles, resolveDidWebKeyAgreementJwk, } from 'gdc-sdk-node-ts';
+import { buildAuthorityDidWeb } from 'gdc-common-utils-ts/utils/authority-resolution';
+export function buildHostScopedDidDocumentUrl(options) {
+    const gatewayOrigin = secureOrigin(options.gatewayBaseUrl, 'host_did_gateway_url_required');
+    const coverage = routeSegment(options.hostCoverageScope, 'host_did_coverage_scope_required').toUpperCase();
+    const version = routeSegment(options.version, 'host_did_version_required');
+    const network = routeSegment(options.hostNetwork, 'host_did_network_required');
+    return `${gatewayOrigin}/host/cds-${coverage}/${version}/${network}/.well-known/did.json`;
+}
+export function createHostScopedDidWebKeyAgreementResolver(options) {
+    const gatewayOrigin = secureOrigin(options.gatewayBaseUrl, 'host_did_gateway_url_required');
+    const hostDid = buildAuthorityDidWeb({ authority: gatewayOrigin }).toLowerCase();
+    const didDocumentUrl = buildHostScopedDidDocumentUrl(options);
+    return recipientDid => resolveDidWebKeyAgreementJwk(recipientDid, {
+        fetchImpl: options.fetchImpl,
+        ...(String(recipientDid || '').trim().toLowerCase() === hostDid ? { didDocumentUrl } : {}),
+    });
+}
+export function buildOrganizationRegistrationWalletContext(walletKeyDerivationId) {
+    const id = required(walletKeyDerivationId, 'organization_registration_wallet_context_required');
+    return { profile: { profileId: id }, runtime: { runtimeId: `${id}:server-runtime`, runtimeType: 'backend-service' } };
+}
+/** Trusted-server facade for encrypted verification, reissuance and Offer-to-Order confirmation. */
+export class SecureOrganizationRegistrationRuntime {
+    options;
+    constructor(options) {
+        this.options = options;
+        secureOrigin(options.gatewayBaseUrl, 'organization_registration_gateway_url_required');
+    }
+    async submitVerificationWithBootstrapWallet(input) {
+        const client = await this.createEncryptedClient(input);
+        return assertSuccessfulOrganizationRegistrationResult(await client.submitLegalOrganizationVerificationTransaction(input.hostContext, input.verificationInput, input.pollOptions));
+    }
+    async submitCredentialReissuanceWithBootstrapWallet(input) {
+        const client = await this.createEncryptedClient(input);
+        return assertSuccessfulOrganizationRegistrationResult(await client.submitLegalOrganizationCredentialReissuance(input.hostContext, input.verificationInput, input.pollOptions));
+    }
+    async confirmOrderWithBootstrapWallet(input) {
+        const client = await this.createEncryptedClient(input);
+        return assertSuccessfulOrganizationRegistrationResult(await client.confirmLegalOrganizationOrder(input.hostContext, input.orderInput, input.pollOptions));
+    }
+    async createEncryptedClient(input) {
+        const walletKeyDerivationId = required(input.walletKeyDerivationId, 'organization_registration_wallet_context_required');
+        const walletSeed = required(input.walletSeed, 'organization_registration_wallet_seed_required');
+        const providerDid = required(input.providerDid, 'organization_registration_provider_did_required');
+        const bearerToken = required(input.bearerToken, 'organization_registration_bearer_required');
+        const wallet = new NodeManagedWallet({ resolveRecipientJwk: this.options.resolveRecipientJwk });
+        const context = buildOrganizationRegistrationWalletContext(walletKeyDerivationId);
+        await wallet.provisionManagedKeys(context, { ownerScope: 'profile', purposes: ['actor-signing', 'document-at-rest'], mode: 'deterministic', seedMaterial: walletSeed });
+        await wallet.provisionManagedKeys(context, { ownerScope: 'runtime', purposes: ['openid-id-token-signing', 'vp-token-signing', 'comm-signing', 'comm-encryption'], mode: 'deterministic', seedMaterial: walletSeed });
+        return new NodeHttpClient({
+            baseUrl: this.options.gatewayBaseUrl, bearerToken, ctx: input.routeContext,
+            appInfo: this.options.appInfo, fetchImpl: this.options.fetchImpl, requestTimeoutMs: this.options.requestTimeoutMs,
+            transportProfile: TransportProfiles.DidcommEncryptedForm,
+            secureTransportAdapter: {
+                pack: message => wallet.packForRecipientWithContext(message, providerDid, { context }),
+                unpack: async (jwe) => (await wallet.unpackWithContext(jwe, { context })).content,
+            },
+        });
+    }
+}
+export function assertSuccessfulOrganizationRegistrationResult(result) {
+    const failure = findFailedOperationOutcome(result.poll.body);
+    if (result.poll.status >= 400 || failure) {
+        const code = String(failure?.issue.code || 'operation-outcome').trim() || 'operation-outcome';
+        const status = failure?.status || result.poll.status;
+        throw new Error(`organization_registration_gateway_failed:${status}:${code}`);
+    }
+    return result;
+}
+function findFailedOperationOutcome(value) {
+    const seen = new WeakSet();
+    const visit = (candidate, inheritedStatus) => {
+        if (!candidate || typeof candidate !== 'object' || seen.has(candidate))
+            return undefined;
+        seen.add(candidate);
+        if (Array.isArray(candidate)) {
+            for (const item of candidate) {
+                const failure = visit(item, inheritedStatus);
+                if (failure)
+                    return failure;
+            }
+            return undefined;
+        }
+        const record = asRecord(candidate);
+        const responseStatus = parseHttpStatus(asRecord(record.response).status) || inheritedStatus;
+        if (record.resourceType === 'OperationOutcome') {
+            const issues = Array.isArray(record.issue) ? record.issue.map(asRecord) : [];
+            const issue = issues.find(item => ['error', 'fatal'].includes(String(item.severity || '').toLowerCase()));
+            if (issue)
+                return { issue, status: parseHttpStatus(issue.responseStatus) || responseStatus };
+        }
+        for (const nested of Object.values(record)) {
+            const failure = visit(nested, responseStatus);
+            if (failure)
+                return failure;
+        }
+        return undefined;
+    };
+    return visit(value);
+}
+function parseHttpStatus(value) {
+    const status = Number.parseInt(String(value ?? ''), 10);
+    return Number.isInteger(status) && status >= 100 && status <= 599 ? status : undefined;
+}
+function asRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+function required(value, error) {
+    const normalized = String(value ?? '').trim();
+    if (!normalized)
+        throw new TypeError(error);
+    return normalized;
+}
+function routeSegment(value, error) {
+    const normalized = required(value, error);
+    if (!/^[A-Za-z0-9-]+$/u.test(normalized))
+        throw new TypeError(error);
+    return normalized;
+}
+function secureOrigin(value, error) {
+    const url = new URL(required(value, error));
+    if (url.protocol !== 'https:' && !(url.protocol === 'http:' && ['localhost', '127.0.0.1', '::1'].includes(url.hostname))) {
+        throw new TypeError('organization_registration_gateway_https_required');
+    }
+    return url.origin;
+}

package/dist/server-passkey-profile.d.ts

@@ -102,6 +102,14 @@ export type ServerPasskeyProfileServiceOptions = Readonly<{
     ceremonyTtlMs?: number;
     accessTtlMs?: number;
 }>;
+/**
+ * Confirms that an authenticated Firebase principal owns the selected server
+ * profile. Personal actor DIDs describe the subject relationship and are not
+ * professional employee identifiers, so they must not be parsed as one.
+ */
+export declare function assertServerProfileOwner<T extends Readonly<{
+    ownerId: string;
+}>>(profile: T | undefined, ownerId: string): asserts profile is T;
 /** Product-neutral passkey state machine for SOS, health and animal portal BFFs. */
 export declare class ServerPasskeyProfileService {
     private readonly options;

package/dist/server-passkey-profile.js

@@ -2,6 +2,17 @@ import { createHash, randomBytes, randomUUID } from 'node:crypto';
 import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse, } from '@simplewebauthn/server';
 const CEREMONY_TTL_MS = 5 * 60 * 1000;
 const ACCESS_TTL_MS = 15 * 60 * 1000;
+/**
+ * Confirms that an authenticated Firebase principal owns the selected server
+ * profile. Personal actor DIDs describe the subject relationship and are not
+ * professional employee identifiers, so they must not be parsed as one.
+ */
+export function assertServerProfileOwner(profile, ownerId) {
+    const expectedOwnerId = ownerId.trim();
+    if (!profile || !expectedOwnerId || profile.ownerId !== expectedOwnerId) {
+        throw new Error('profile_not_found');
+    }
+}
 /** Product-neutral passkey state machine for SOS, health and animal portal BFFs. */
 export class ServerPasskeyProfileService {
     options;
@@ -140,7 +151,7 @@ export function createSimpleWebAuthnCeremonyAdapter(input) {
     const rpName = String(input.rpName || '').trim();
     const rpId = String(input.rpId || '').trim();
     const origins = input.origins.map(value => String(value || '').trim()).filter(Boolean);
-    if (!rpName || !rpId || !origins.length || origins.some(origin => !origin.startsWith('https://'))) {
+    if (!rpName || !rpId || !origins.length || origins.some(origin => !isSecureWebAuthnOrigin(origin))) {
         throw new Error('passkey_relying_party_not_configured');
     }
     return {
@@ -204,3 +215,15 @@ export function createSimpleWebAuthnCeremonyAdapter(input) {
         },
     };
 }
+function isSecureWebAuthnOrigin(origin) {
+    try {
+        const parsed = new URL(origin);
+        if (parsed.protocol === 'https:')
+            return true;
+        return parsed.protocol === 'http:'
+            && (parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1' || parsed.hostname === '[::1]');
+    }
+    catch {
+        return false;
+    }
+}

package/docs/ORGANIZATION_REGISTRATION_SOURCE_EVALUATION.md

@@ -0,0 +1,27 @@
+# Organization registration source evaluation
+
+The shared SOS Node SDK evaluated the existing clinical organization
+registration runtime capability-by-capability. It did not copy a portal,
+product policy or deployment configuration.
+
+| Capability | Decision | Shared boundary |
+| --- | --- | --- |
+| deterministic controller bootstrap-wallet reconstruction | adopted | trusted Node SDK |
+| encrypted DIDComm form transport to SOS Gateway | adopted | trusted Node SDK |
+| organization verification and credential reissuance submission | adopted | trusted Node SDK |
+| exact accepted Offer continuation through Order | adopted | trusted Node SDK |
+| terminal nested `OperationOutcome` rejection | adopted | trusted Node SDK |
+| host DID document route and recipient key resolution | adopted | trusted Node SDK |
+| host organization search and lifecycle | already equivalent | existing host-directory client |
+| application form, localization and product branding | rejected | hosting/controller presentation |
+| sector and jurisdiction admission policy | rejected | trusted portal BFF and ICA |
+| application, PIN and controller-profile persistence | rejected | trusted portal BFF |
+| user authentication and account recovery | rejected | portal identity boundary |
+| payment adapter and commercial policy | rejected | marketplace and billing boundary |
+| professional groups, subjects, services, studies and scheduling | rejected | delegated professional workflows |
+| tenant, host, network, credentials and deployment values | rejected | private deployment configuration |
+
+This extraction is a transport prerequisite, not proof of an organization
+onboarding journey. A consumer still has to prove application submission,
+review, verification, Offer, Order, activation, device registration and
+authoritative readback through its real BFF and Gateway environment.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sos-sdk-node-ts",
-  "version": "0.1.13",
+  "version": "0.1.15",
   "description": "Product-neutral Node adapters shared by SOSChain, Vet and UHC runtimes",
   "license": "Apache-2.0",
   "author": "Connecting Solution & Applications Ltd",
@@ -51,6 +51,14 @@
     "./host-organization-directory-client": {
       "types": "./dist/host-organization-directory-client.d.ts",
       "default": "./dist/host-organization-directory-client.js"
+    },
+    "./secure-organization-registration": {
+      "types": "./dist/secure-organization-registration.d.ts",
+      "default": "./dist/secure-organization-registration.js"
+    },
+    "./portable-professional-evidence": {
+      "types": "./dist/portable-professional-evidence.d.ts",
+      "default": "./dist/portable-professional-evidence.js"
     }
   },
   "files": [
@@ -70,6 +78,8 @@
   },
   "dependencies": {
     "@simplewebauthn/server": "13.3.2",
+    "gdc-common-utils-ts": "2.9.30",
+    "gdc-sdk-node-ts": "2.9.32",
     "sos-data-utils-ts": "0.6.13",
     "sos-sdk-core-ts": "0.5.2"
   },