@nexalink/carecompass-sdk 0.5.0 → 0.6.0

package/README.md

@@ -185,6 +185,11 @@ field. The hosted runtime authorizes the workflow from the issued embed key and
 server-side tenant entitlement. Values in user context do not authorize a
 workflow.
 
+Development and staging RCM requests must include `claimContext.stage` set to
+the configured SDK environment (`"development"` or `"staging"`). Production
+may omit the field. The hosted runtime validates any supplied value against the
+authenticated key environment; this marker never grants workflow access.
+
 For the hosted RCM path, configure the tenant's RCM policy corpus in the
 CareCompass tenant portal before embedding: an authorized administrator must
 have an executed BAA, enable the RCM entitlement, set up the corpus, upload a
@@ -210,13 +215,11 @@ import {
 />;
 ```
 
-The included demo input is synthetic and contains no patient data. Use it only
-with synthetic, approved policy material during development. The package
-includes [`DEMO-ENC-1042-rcm-policy.md`](qa-fixtures/DEMO-ENC-1042-rcm-policy.md)
-for the matching demo. Upload that file through **RCM policy corpus**, give it
-the `2026.1-demo` version, explicitly approve it, and wait for ingestion before
-submitting `CARECOMPASS_RCM_SYNTHETIC_DEMO`. It is deliberately not a real payer
-policy or coding manual.
+The included demo input is synthetic and contains no patient data. Its same-day
+observation scenario is designed to retrieve the official CMS E/M evidence for
+CPT 99236 from the Nexalink base corpus. Tenant policies may supplement the
+base, but the runtime still requires an approved, active corpus and grounded
+citations before returning a candidate.
 
 A production tenant must have an executed BAA, an RCM entitlement, and a
 healthy active corpus; otherwise the hosted workflow fails closed with a

package/dist/client.js

@@ -1,5 +1,6 @@
 import { validateCareCompassConfig } from "./schema.js";
 import { CARECOMPASS_TELEMETRY_ERROR_CODES, CARECOMPASS_TELEMETRY_EVENTS, createCareCompassTelemetry, } from "./telemetry.js";
+import { CARECOMPASS_SDK_VERSION } from "./version.js";
 // Internal error metadata keeps telemetry classification separate from messages,
 // which may include user-visible API details that should not be emitted.
 class CareCompassClientError extends Error {
@@ -185,6 +186,8 @@ export function createCareCompassClient(inputConfig, options = {}) {
                         requestId: request.requestId,
                         workflow: request.workflow,
                         sessionId: request.sessionId,
+                        sdkVersion: CARECOMPASS_SDK_VERSION,
+                        applicationSurface: config.deploymentTarget,
                         userContext: request.userContext,
                         promptConfig: config.prompt,
                         // Public routing preferences; the hosted runtime validates model

package/dist/rcm.d.ts

@@ -10,6 +10,8 @@ export type RcmCodingAssistanceInput = {
     serviceDate?: string;
     placeOfService?: string;
     claimContext?: {
+        /** Required in development and staging; when supplied, it must match the authenticated SDK environment. */
+        stage?: CareCompassConfig["environment"];
         payerName?: string;
         submittedCodes?: string[];
     };

package/dist/rcm.js

@@ -241,11 +241,15 @@ export function createRcmCodingWorkflow(config, options = {}) {
 }
 export const CARECOMPASS_RCM_SYNTHETIC_DEMO = {
     encounterId: "DEMO-ENC-1042",
-    diagnosisNarrative: "Synthetic outpatient visit for persistent knee pain after activity.",
-    procedureNarrative: "Synthetic clinician documentation describes a focused musculoskeletal evaluation.",
+    diagnosisNarrative: "Synthetic Medicare hospital observation encounter with same-day admission and discharge.",
+    procedureNarrative: "Synthetic clinician documented 110 minutes of qualifying same-day admission and discharge management time.",
     serviceDate: "2026-07-01",
-    placeOfService: "11",
-    claimContext: { payerName: "Demo Health Plan", submittedCodes: [] },
+    placeOfService: "22",
+    claimContext: {
+        stage: "development",
+        payerName: "Synthetic Medicare demo",
+        submittedCodes: ["99236"],
+    },
 };
 /** A small branded form suitable for embedding the pilot workflow in a host app. */
 export function RcmCodingAssistant({ config, initialInput = CARECOMPASS_RCM_SYNTHETIC_DEMO, onAuditEvent, onResult, onSafetyEvent, workflowOptions, }) {

package/dist/telemetry.d.ts

@@ -1,4 +1,4 @@
-import type { CareCompassConfig } from "./schema.js";
+import { type CareCompassConfig } from "./schema.js";
 export declare const CARECOMPASS_TELEMETRY_EVENTS: {
     readonly SDK_INITIALIZED: "carecompass_sdk_initialized";
     readonly SDK_INITIALIZATION_FAILED: "carecompass_sdk_initialization_failed";
@@ -98,11 +98,12 @@ export type CareCompassTelemetry = {
     captureAsync: (event: CareCompassTelemetryEvent, options?: CareCompassTelemetryCaptureOptions) => Promise<void>;
 };
 export declare const careCompassTelemetryDurationBucket: (durationMs: number) => CareCompassTelemetryDurationBucket;
-export declare function createCareCompassTelemetry(config: Pick<CareCompassConfig, "environment" | "payerId">, options?: {
+export declare function createCareCompassTelemetry(config: Pick<CareCompassConfig, "apiBaseUrl" | "environment" | "payerId">, options?: {
     fetcher?: Fetcher;
     now?: () => Date;
 }): CareCompassTelemetry;
 export declare function createCareCompassCliTelemetry(sessionId: string, context?: {
+    apiBaseUrl?: string;
     environment?: CareCompassConfig["environment"];
     payerId?: string;
 }, options?: {

package/dist/telemetry.js

@@ -1,3 +1,4 @@
+import { careCompassApiBaseUrlSchema, } from "./schema.js";
 import { CARECOMPASS_COMPONENT_VERSION, CARECOMPASS_SDK_VERSION, CARECOMPASS_TELEMETRY_CONTRACT_VERSION, } from "./version.js";
 export const CARECOMPASS_TELEMETRY_EVENTS = {
     SDK_INITIALIZED: "carecompass_sdk_initialized",
@@ -62,12 +63,9 @@ export const CARECOMPASS_TELEMETRY_ERROR_CODES = {
     CLI_COMMAND_UNKNOWN: "CLI_COMMAND_UNKNOWN",
     UNKNOWN_ERROR: "UNKNOWN_ERROR",
 };
-const POSTHOG_PROJECT_TOKEN_RE = /^phc_[A-Za-z0-9_-]{8,}$/;
-const POSTHOG_HOSTNAMES = new Set(["us.i.posthog.com", "eu.i.posthog.com"]);
-const CARECOMPASS_DEFAULT_POSTHOG_API_HOST = "https://us.i.posthog.com";
-const CARECOMPASS_DEFAULT_POSTHOG_PROJECT_TOKEN = "phc_vYl3rpIu6Iz5vCeJUG62BBA3nlPCeF4RSYpCb8FjnOl";
+const CARECOMPASS_DEFAULT_API_BASE_URL = "https://www.nexalink.care";
+const CARECOMPASS_TELEMETRY_PATH = "/api/carecompass/telemetry";
 const TELEMETRY_CAPTURE_TIMEOUT_MS = 1_000;
-const ANONYMOUS_DISTINCT_ID = "carecompass-sdk-anonymous";
 const TELEMETRY_EVENTS = new Set(Object.values(CARECOMPASS_TELEMETRY_EVENTS));
 const TELEMETRY_ERROR_CODES = new Set(Object.values(CARECOMPASS_TELEMETRY_ERROR_CODES));
 const FAILURE_CATEGORIES = new Set([
@@ -121,28 +119,15 @@ const disabledTelemetry = {
     capture: () => undefined,
     captureAsync: async () => undefined,
 };
-const approvedApiHost = (value, environment) => {
-    // Telemetry is restricted to known PostHog ingestion hosts; localhost is only
-    // accepted in development so tests and local captures can be isolated.
-    if (typeof value !== "string")
+const approvedRelayBaseUrl = (value, environment) => {
+    const parsed = careCompassApiBaseUrlSchema.safeParse(value);
+    if (!parsed.success)
         return null;
-    try {
-        const url = new URL(value);
-        if (url.pathname !== "/" || url.search || url.hash)
-            return null;
-        const isLocalhost = url.hostname === "localhost" ||
-            url.hostname === "127.0.0.1" ||
-            url.hostname === "[::1]";
-        if (isLocalhost) {
-            return environment === "development" ? value.replace(/\/+$/, "") : null;
-        }
-        return url.protocol === "https:" && POSTHOG_HOSTNAMES.has(url.hostname)
-            ? value.replace(/\/+$/, "")
-            : null;
-    }
-    catch {
-        return null;
-    }
+    const url = new URL(parsed.data);
+    const isLocalhost = url.hostname === "localhost" ||
+        url.hostname === "127.0.0.1" ||
+        url.hostname === "[::1]";
+    return isLocalhost && environment !== "development" ? null : parsed.data;
 };
 export const careCompassTelemetryDurationBucket = (durationMs) => {
     if (durationMs < 250)
@@ -166,14 +151,10 @@ const allowedEnvironment = (value) => value === "development" || value === "stag
     ? value
     : "unknown";
 function createTelemetry(context, options = {}) {
-    const projectToken = CARECOMPASS_DEFAULT_POSTHOG_PROJECT_TOKEN;
-    if (!POSTHOG_PROJECT_TOKEN_RE.test(projectToken)) {
-        return disabledTelemetry;
-    }
     const fetcher = options.fetcher ?? fetch;
     const now = options.now ?? (() => new Date());
-    const apiHost = approvedApiHost(CARECOMPASS_DEFAULT_POSTHOG_API_HOST, context.environment);
-    if (!apiHost)
+    const relayBaseUrl = approvedRelayBaseUrl(context.apiBaseUrl, context.environment);
+    if (!relayBaseUrl)
         return disabledTelemetry;
     const captureAsync = async (event, captureOptions = {}) => {
         if (!TELEMETRY_EVENTS.has(event))
@@ -251,12 +232,10 @@ function createTelemetry(context, options = {}) {
         const controller = new AbortController();
         const timeout = setTimeout(() => controller.abort(), TELEMETRY_CAPTURE_TIMEOUT_MS);
         try {
-            await fetcher(`${apiHost}/i/v0/e/`, {
+            await fetcher(`${relayBaseUrl}${CARECOMPASS_TELEMETRY_PATH}`, {
                 method: "POST",
                 headers: { "content-type": "application/json" },
                 body: JSON.stringify({
-                    api_key: projectToken,
-                    distinct_id: ANONYMOUS_DISTINCT_ID,
                     event,
                     properties,
                     timestamp: eventTimestamp,
@@ -279,6 +258,7 @@ function createTelemetry(context, options = {}) {
 }
 export function createCareCompassTelemetry(config, options = {}) {
     return createTelemetry({
+        apiBaseUrl: config.apiBaseUrl,
         environment: config.environment,
         platform: "web",
     }, options);
@@ -288,6 +268,7 @@ export function createCareCompassCliTelemetry(sessionId, context = {}, options =
     void sessionId;
     const environment = context.environment ?? "unknown";
     return createTelemetry({
+        apiBaseUrl: context.apiBaseUrl ?? CARECOMPASS_DEFAULT_API_BASE_URL,
         environment,
         platform: "cli",
     }, options);

package/dist/version.js

@@ -1,3 +1,3 @@
-export const CARECOMPASS_SDK_VERSION = "0.5.0"; // x-release-please-version
+export const CARECOMPASS_SDK_VERSION = "0.6.0"; // x-release-please-version
 export const CARECOMPASS_COMPONENT_VERSION = "1.0.0";
 export const CARECOMPASS_TELEMETRY_CONTRACT_VERSION = "1.1.0";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nexalink/carecompass-sdk",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Embeddable CareCompass SDK and CLI for healthcare ecosystem integrations with Nexalink onboarding, BAA coverage, and API keys.",
   "type": "module",
   "packageManager": "bun@1.3.9",
@@ -74,8 +74,9 @@
     "tidy": "bun run lint && bun run format",
     "test": "NODE_OPTIONS=--experimental-vm-modules jest --runInBand --watchman=false",
     "audit": "bun audit",
-    "release:check": "bun install --frozen-lockfile && bun run lint && bun run test && bun run build && bun run audit && bun run pack:dry-run",
-    "pack:dry-run": "bun pm pack --dry-run --ignore-scripts"
+    "release:check": "bun install --frozen-lockfile && bun run lint && bun run test && bun run build && bun run audit && bun run verify:package-safety && bun run pack:dry-run",
+    "pack:dry-run": "bun pm pack --dry-run --ignore-scripts",
+    "verify:package-safety": "node scripts/verify-package-safety.mjs"
   },
   "dependencies": {
     "zod": "^4.4.3"
@@ -112,7 +113,7 @@
     "typescript-eslint": "^8.65.0"
   },
   "overrides": {
-    "js-yaml": "4.3.0",
+    "js-yaml": "4.3.1",
     "minimatch": "10.2.5",
     "brace-expansion": "5.0.9"
   },