@swal/edge-mesh 0.0.0-stage → 0.1.1

package/dist/medico/registro-profesional.d.ts

@@ -0,0 +1,84 @@
+/**
+ * `RegistroProfesional` — the professional half of a node's public record, and
+ * the rules that keep a node from being mistaken for a person.
+ *
+ * ─── WHAT THIS TYPE DELIBERATELY CANNOT HOLD ────────────────────────────────
+ *
+ * There is no field here capable of holding a patient record. Not "we won't
+ * populate it" — the shape does not admit it. Health data is a special category
+ * under GDPR Art. 9 and sensitive under Ley 1581/2012 Art. 5, whose
+ * household/personal exemption of Art. 2(a) is lost the moment a peer node
+ * holds a copy. A mesh is a replication substrate (`src/op-log/index.ts`,
+ * `src/snapshot/index.ts`): anything written is designed to be copied and kept,
+ * so a patient's record inside an OpLog is a breach waiting for a payload bug,
+ * and no amount of per-envelope encryption helps once five nodes hold the
+ * cleartext. Any future feature needing patient-adjacent data needs a different
+ * transport, not a field added here.
+ *
+ * ─── ONE HUMAN, SEVERAL NODES ───────────────────────────────────────────────
+ *
+ * We never assert `nodoId → person`. A physician may legitimately run a private
+ * clinical node and a public teaching node — different trust surfaces. The
+ * per-human fact we store is `idLicencia`, and the anti-Sybil rules in
+ * `docs/medico/reglas-red.md` are built on that, not on `nodoId`. Note the
+ * consequence: because `nodoId` is derived from the KEM key, key rotation
+ * changes it, so a `nodoId` change on a known physician is a *new node*
+ * requiring re-validation of layer 1 — never a continuity.
+ */
+import { resumirAvales } from "./aval.js";
+import { MOTIVO_RECHAZO_CREDENCIAL } from "./credencial.js";
+import { type RegistroProfesional } from "./types.js";
+/** Why a `RegistroProfesional` was refused. */
+export declare const MOTIVO_RECHAZO_REGISTRO: {
+    /** Not an object, or `version` unsupported. */
+    readonly ESTRUCTURA_INVALIDA: "estructura_invalida";
+    /** A credential inside failed `validarCredencial`. */
+    readonly CREDENCIAL_INVALIDA: "credencial_invalida";
+    /** Two credentials in the same record share an `id`. */
+    readonly CREDENCIAL_DUPLICADA: "credencial_duplicada";
+    /** `declaracion.jurisdiccion` missing or not ISO alpha-2. */
+    readonly JURISDICCION_INVALIDA: "jurisdiccion_invalida";
+    /** `especialidades` claims a specialty with no matching credential. */
+    readonly ESPECIALIDAD_SIN_CREDENCIAL: "especialidad_sin_credencial";
+    /** A specialty credential with `tipo: 'especialidad'` and no `especialidad`. */
+    readonly ESPECIALIDAD_SIN_NOMBRE: "especialidad_sin_nombre";
+};
+export type MotivoRechazoRegistro = (typeof MOTIVO_RECHAZO_REGISTRO)[keyof typeof MOTIVO_RECHAZO_REGISTRO];
+export type ResultadoValidacionRegistro = {
+    readonly ok: true;
+    readonly registro: RegistroProfesional;
+    readonly esCertificado: boolean;
+} | {
+    readonly ok: false;
+    readonly motivo: MotivoRechazoRegistro;
+    readonly detalle: string;
+    readonly accesoPermitido: false;
+};
+/**
+ * Structural validation of a whole `RegistroProfesional`.
+ *
+ * Runs every contained credential through {@link validarCredencial} — a record
+ * carrying one lapsed credential is a record with a lapsed credential, and the
+ * aggregate being valid must not launder its parts.
+ *
+ * @param ahora - injected clock (ms epoch). The function never reads it itself.
+ * @returns `ok: true` plus whether the node qualifies as a *certified doctor*
+ *   (`licencia ∧ especialidad`, both strongly emitted and unexpired). A record
+ *   that validates but is not certified is a legitimate node with a smaller
+ *   capability set, not a failure (DECISIÓN A.4).
+ */
+export declare function validarRegistroProfesional(registro: RegistroProfesional, ahora: number): ResultadoValidacionRegistro;
+/**
+ * Recompute a record's `avalRecibido` from its live `Aval`s.
+ *
+ * The stored summary is a cache, never the truth. Revocation works only because
+ * this fold can be re-run: an `Aval` withdrawn by its author simply stops
+ * appearing in the input and the count falls. A design that stored "verified" as
+ * a flag would have no path back.
+ *
+ * @param ahora - injected clock; lapsed `Aval`s are dropped from the fold.
+ */
+export declare function recalcularAvalRecibido(registro: RegistroProfesional, avalesVivos: Parameters<typeof resumirAvales>[0], ahora: number): RegistroProfesional;
+/** Reasons a credential can be refused, re-exported for callers of this module. */
+export { MOTIVO_RECHAZO_CREDENCIAL };
+//# sourceMappingURL=registro-profesional.d.ts.map

package/dist/medico/registro-profesional.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registro-profesional.d.ts","sourceRoot":"","sources":["../../src/medico/registro-profesional.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAEN,yBAAyB,EAEzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEN,KAAK,mBAAmB,EAExB,MAAM,YAAY,CAAC;AAEpB,+CAA+C;AAC/C,eAAO,MAAM,uBAAuB;IACnC,+CAA+C;aAC/C,mBAAmB,EAAE,qBAAqB;IAC1C,sDAAsD;aACtD,mBAAmB,EAAE,qBAAqB;IAC1C,wDAAwD;aACxD,oBAAoB,EAAE,sBAAsB;IAC5C,6DAA6D;aAC7D,qBAAqB,EAAE,uBAAuB;IAC9C,uEAAuE;aACvE,2BAA2B,EAAE,6BAA6B;IAC1D,gFAAgF;aAChF,uBAAuB,EAAE,yBAAyB;CACzC,CAAC;AAEX,MAAM,MAAM,qBAAqB,GAChC,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,OAAO,uBAAuB,CAAC,CAAC;AAExE,MAAM,MAAM,2BAA2B,GACpC;IACA,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;CAC/B,GACD;IACA,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,eAAe,EAAE,KAAK,CAAC;CAC/B,CAAC;AAWL;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACzC,QAAQ,EAAE,mBAAmB,EAC7B,KAAK,EAAE,MAAM,GACX,2BAA2B,CA0F7B;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACrC,QAAQ,EAAE,mBAAmB,EAC7B,WAAW,EAAE,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC,EAChD,KAAK,EAAE,MAAM,GACX,mBAAmB,CAErB;AAED,mFAAmF;AACnF,OAAO,EAAE,yBAAyB,EAAE,CAAC"}

package/dist/medico/registro-profesional.js

@@ -0,0 +1,135 @@
+/**
+ * `RegistroProfesional` — the professional half of a node's public record, and
+ * the rules that keep a node from being mistaken for a person.
+ *
+ * ─── WHAT THIS TYPE DELIBERATELY CANNOT HOLD ────────────────────────────────
+ *
+ * There is no field here capable of holding a patient record. Not "we won't
+ * populate it" — the shape does not admit it. Health data is a special category
+ * under GDPR Art. 9 and sensitive under Ley 1581/2012 Art. 5, whose
+ * household/personal exemption of Art. 2(a) is lost the moment a peer node
+ * holds a copy. A mesh is a replication substrate (`src/op-log/index.ts`,
+ * `src/snapshot/index.ts`): anything written is designed to be copied and kept,
+ * so a patient's record inside an OpLog is a breach waiting for a payload bug,
+ * and no amount of per-envelope encryption helps once five nodes hold the
+ * cleartext. Any future feature needing patient-adjacent data needs a different
+ * transport, not a field added here.
+ *
+ * ─── ONE HUMAN, SEVERAL NODES ───────────────────────────────────────────────
+ *
+ * We never assert `nodoId → person`. A physician may legitimately run a private
+ * clinical node and a public teaching node — different trust surfaces. The
+ * per-human fact we store is `idLicencia`, and the anti-Sybil rules in
+ * `docs/medico/reglas-red.md` are built on that, not on `nodoId`. Note the
+ * consequence: because `nodoId` is derived from the KEM key, key rotation
+ * changes it, so a `nodoId` change on a known physician is a *new node*
+ * requiring re-validation of layer 1 — never a continuity.
+ */
+import { resumirAvales } from "./aval.js";
+import { esMedicoCertificado, MOTIVO_RECHAZO_CREDENCIAL, validarCredencial, } from "./credencial.js";
+import { TIPO_CREDENCIAL, } from "./types.js";
+/** Why a `RegistroProfesional` was refused. */
+export const MOTIVO_RECHAZO_REGISTRO = {
+    /** Not an object, or `version` unsupported. */
+    ESTRUCTURA_INVALIDA: "estructura_invalida",
+    /** A credential inside failed `validarCredencial`. */
+    CREDENCIAL_INVALIDA: "credencial_invalida",
+    /** Two credentials in the same record share an `id`. */
+    CREDENCIAL_DUPLICADA: "credencial_duplicada",
+    /** `declaracion.jurisdiccion` missing or not ISO alpha-2. */
+    JURISDICCION_INVALIDA: "jurisdiccion_invalida",
+    /** `especialidades` claims a specialty with no matching credential. */
+    ESPECIALIDAD_SIN_CREDENCIAL: "especialidad_sin_credencial",
+    /** A specialty credential with `tipo: 'especialidad'` and no `especialidad`. */
+    ESPECIALIDAD_SIN_NOMBRE: "especialidad_sin_nombre",
+};
+const RE_PAIS_ALFA2 = /^[A-Z]{2}$/;
+function fallo(motivo, detalle) {
+    return { ok: false, motivo, detalle, accesoPermitido: false };
+}
+/**
+ * Structural validation of a whole `RegistroProfesional`.
+ *
+ * Runs every contained credential through {@link validarCredencial} — a record
+ * carrying one lapsed credential is a record with a lapsed credential, and the
+ * aggregate being valid must not launder its parts.
+ *
+ * @param ahora - injected clock (ms epoch). The function never reads it itself.
+ * @returns `ok: true` plus whether the node qualifies as a *certified doctor*
+ *   (`licencia ∧ especialidad`, both strongly emitted and unexpired). A record
+ *   that validates but is not certified is a legitimate node with a smaller
+ *   capability set, not a failure (DECISIÓN A.4).
+ */
+export function validarRegistroProfesional(registro, ahora) {
+    if (!registro || typeof registro !== "object") {
+        return fallo(MOTIVO_RECHAZO_REGISTRO.ESTRUCTURA_INVALIDA, "el registro no es un objeto");
+    }
+    if (registro.version !== 1) {
+        return fallo(MOTIVO_RECHAZO_REGISTRO.ESTRUCTURA_INVALIDA, `version no soportada: ${String(registro.version)}`);
+    }
+    if (!registro.nodoId) {
+        return fallo(MOTIVO_RECHAZO_REGISTRO.ESTRUCTURA_INVALIDA, "falta nodoId");
+    }
+    if (!Array.isArray(registro.credenciales)) {
+        return fallo(MOTIVO_RECHAZO_REGISTRO.ESTRUCTURA_INVALIDA, "credenciales debe ser un array");
+    }
+    // ── Jurisdiction ──
+    const juris = registro.declaracion?.jurisdiccion;
+    if (!juris || !RE_PAIS_ALFA2.test(juris)) {
+        return fallo(MOTIVO_RECHAZO_REGISTRO.JURISDICCION_INVALIDA, `jurisdiccion debe ser ISO 3166-1 alpha-2 en mayúsculas: ${String(juris)}`);
+    }
+    // ── Every credential, individually ──
+    const vistos = new Set();
+    for (const credencial of registro.credenciales) {
+        const resultado = validarCredencial(credencial, ahora);
+        if (!resultado.ok) {
+            // The credential's own reason is preserved in `detalle`: a caller
+            // debugging an expired record needs to know *which* field expired, not
+            // just that "a credential is invalid".
+            return fallo(MOTIVO_RECHAZO_REGISTRO.CREDENCIAL_INVALIDA, `credencial ${credencial?.id ?? "(sin id)"}: ${resultado.motivo} — ${resultado.detalle}`);
+        }
+        if (vistos.has(credencial.id)) {
+            return fallo(MOTIVO_RECHAZO_REGISTRO.CREDENCIAL_DUPLICADA, `id de credencial repetido: ${credencial.id}`);
+        }
+        vistos.add(credencial.id);
+        if (credencial.tipo === TIPO_CREDENCIAL.ESPECIALIDAD &&
+            !credencial.especialidad) {
+            return fallo(MOTIVO_RECHAZO_REGISTRO.ESPECIALIDAD_SIN_NOMBRE, `credencial de especialidad ${credencial.id} sin campo 'especialidad'`);
+        }
+    }
+    // ── `especialidades` must not over-claim ──
+    // The summary array is what a directory renders. If it can list a specialty
+    // the credential set does not prove, it is an unauthenticated claim about a
+    // person's qualifications, which is the one thing this network must never
+    // publish.
+    const specialtiesConCredencial = new Set(registro.credenciales
+        .filter((c) => c.tipo === TIPO_CREDENCIAL.ESPECIALIDAD)
+        .map((c) => c.especialidad));
+    for (const esp of registro.especialidades) {
+        if (!specialtiesConCredencial.has(esp)) {
+            return fallo(MOTIVO_RECHAZO_REGISTRO.ESPECIALIDAD_SIN_CREDENCIAL, `especialidad '${esp}' listada sin credencial de tipo 'especialidad' que la respalde`);
+        }
+    }
+    const credencialesValidas = registro.credenciales;
+    return {
+        ok: true,
+        registro,
+        esCertificado: esMedicoCertificado(credencialesValidas, ahora),
+    };
+}
+/**
+ * Recompute a record's `avalRecibido` from its live `Aval`s.
+ *
+ * The stored summary is a cache, never the truth. Revocation works only because
+ * this fold can be re-run: an `Aval` withdrawn by its author simply stops
+ * appearing in the input and the count falls. A design that stored "verified" as
+ * a flag would have no path back.
+ *
+ * @param ahora - injected clock; lapsed `Aval`s are dropped from the fold.
+ */
+export function recalcularAvalRecibido(registro, avalesVivos, ahora) {
+    return { ...registro, avalRecibido: resumirAvales(avalesVivos, ahora) };
+}
+/** Reasons a credential can be refused, re-exported for callers of this module. */
+export { MOTIVO_RECHAZO_CREDENCIAL };
+//# sourceMappingURL=registro-profesional.js.map

package/dist/medico/registro-profesional.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registro-profesional.js","sourceRoot":"","sources":["../../src/medico/registro-profesional.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EACN,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,GACjB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAGN,eAAe,GACf,MAAM,YAAY,CAAC;AAEpB,+CAA+C;AAC/C,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACtC,+CAA+C;IAC/C,mBAAmB,EAAE,qBAAqB;IAC1C,sDAAsD;IACtD,mBAAmB,EAAE,qBAAqB;IAC1C,wDAAwD;IACxD,oBAAoB,EAAE,sBAAsB;IAC5C,6DAA6D;IAC7D,qBAAqB,EAAE,uBAAuB;IAC9C,uEAAuE;IACvE,2BAA2B,EAAE,6BAA6B;IAC1D,gFAAgF;IAChF,uBAAuB,EAAE,yBAAyB;CACzC,CAAC;AAkBX,MAAM,aAAa,GAAG,YAAY,CAAC;AAEnC,SAAS,KAAK,CACb,MAA6B,EAC7B,OAAe;IAEf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,0BAA0B,CACzC,QAA6B,EAC7B,KAAa;IAEb,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC/C,OAAO,KAAK,CACX,uBAAuB,CAAC,mBAAmB,EAC3C,6BAA6B,CAC7B,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,KAAK,CACX,uBAAuB,CAAC,mBAAmB,EAC3C,yBAAyB,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CACnD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC,uBAAuB,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3C,OAAO,KAAK,CACX,uBAAuB,CAAC,mBAAmB,EAC3C,gCAAgC,CAChC,CAAC;IACH,CAAC;IAED,qBAAqB;IACrB,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,YAAY,CAAC;IACjD,IAAI,CAAC,KAAK,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,KAAK,CACX,uBAAuB,CAAC,qBAAqB,EAC7C,2DAA2D,MAAM,CAAC,KAAK,CAAC,EAAE,CAC1E,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QAChD,MAAM,SAAS,GAAG,iBAAiB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACvD,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YACnB,kEAAkE;YAClE,uEAAuE;YACvE,uCAAuC;YACvC,OAAO,KAAK,CACX,uBAAuB,CAAC,mBAAmB,EAC3C,cAAc,UAAU,EAAE,EAAE,IAAI,UAAU,KAAK,SAAS,CAAC,MAAM,MAAM,SAAS,CAAC,OAAO,EAAE,CACxF,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/B,OAAO,KAAK,CACX,uBAAuB,CAAC,oBAAoB,EAC5C,8BAA8B,UAAU,CAAC,EAAE,EAAE,CAC7C,CAAC;QACH,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAE1B,IACC,UAAU,CAAC,IAAI,KAAK,eAAe,CAAC,YAAY;YAChD,CAAC,UAAU,CAAC,YAAY,EACvB,CAAC;YACF,OAAO,KAAK,CACX,uBAAuB,CAAC,uBAAuB,EAC/C,8BAA8B,UAAU,CAAC,EAAE,2BAA2B,CACtE,CAAC;QACH,CAAC;IACF,CAAC;IAED,6CAA6C;IAC7C,4EAA4E;IAC5E,4EAA4E;IAC5E,0EAA0E;IAC1E,WAAW;IACX,MAAM,wBAAwB,GAAG,IAAI,GAAG,CACvC,QAAQ,CAAC,YAAY;SACnB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,YAAY,CAAC;SACtD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAC5B,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;QAC3C,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,OAAO,KAAK,CACX,uBAAuB,CAAC,2BAA2B,EACnD,iBAAiB,GAAG,iEAAiE,CACrF,CAAC;QACH,CAAC;IACF,CAAC;IAED,MAAM,mBAAmB,GACxB,QAAQ,CAAC,YAA2C,CAAC;IACtD,OAAO;QACN,EAAE,EAAE,IAAI;QACR,QAAQ;QACR,aAAa,EAAE,mBAAmB,CAAC,mBAAmB,EAAE,KAAK,CAAC;KAC9D,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACrC,QAA6B,EAC7B,WAAgD,EAChD,KAAa;IAEb,OAAO,EAAE,GAAG,QAAQ,EAAE,YAAY,EAAE,aAAa,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC;AACzE,CAAC;AAED,mFAAmF;AACnF,OAAO,EAAE,yBAAyB,EAAE,CAAC"}

package/dist/medico/registro.d.ts

@@ -0,0 +1,149 @@
+/**
+ * The extension point for Phase 3, and the reason this layer fails closed.
+ *
+ * ─── THE ORIONHEALTH PATTERN AND ITS TWO DEFECTS ────────────────────────────
+ *
+ * `apps/OrionHealth/lib/features/doctor_verification/domain/services/license_verifier.dart`
+ * gets "is this licence number real" right with the right primitive:
+ *
+ * ```dart
+ * final normalized = licenseNumber.replaceAll(RegExp(r'\s+'), '').toUpperCase();
+ * final hash = sha256.convert(utf8.encode(normalized)).toString();
+ * final countryHashes = await _registry.getHashesForCountry(countryCode);
+ * if (countryHashes.isEmpty) return LicenseVerificationResult.unknown;
+ * if (countryHashes.contains(hash)) return LicenseVerificationResult.valid;
+ * return LicenseVerificationResult.invalid;
+ * ```
+ *
+ * Three properties worth keeping: only the hash travels (the number is PII under
+ * Ley 1581/2012), registries are country-scoped (ReTHUS and the Spanish
+ * colleges are different datasets with different cadences), and the result is
+ * three-valued.
+ *
+ * Two properties that are defects *for our use case*:
+ *
+ * 1. **`unknown` is not `valid`.** An empty country registry yields `unknown`.
+ *    Fine for a UI that says "we don't know yet". Fatal here: a node that treats
+ *    `unknown` as "not refused" turns *an unsupported country* into a bypass. A
+ *    physician presents a licence from a country nobody has downloaded a
+ *    snapshot for, and every node that has not yet fetched that registry waves
+ *    them through. So {@link EstadoVerificacionRegistro} has exactly two members.
+ *    There is no third state, so the bug is not representable.
+ *
+ * 2. **`expired` is declared but never returned.** A hash-set membership carries
+ *    no validity window, so a licence cancelled in 2027 verifies forever. The
+ *    fix is not in this file: it is the issuer-signed `vigenteHasta` on
+ *    {@link CredencialMedica}, checked by `validarCredencial`.
+ *
+ * ─── WHAT THIS FILE DELIBERATELY DOES NOT DO ────────────────────────────────
+ *
+ * It does no I/O. No fetch, no registry file, no snapshot download. The
+ * interface below is the seam; Phase 3 implements it against a replicated,
+ * append-only, hash-compared country snapshot. Because the seam is pure data in
+ * and pure data out, this module is fully testable with a fixture and no network.
+ */
+import type { CredencialMedica } from "./types.js";
+/**
+ * The result of consulting a country registry.
+ *
+ * Two states, not three. `no_verificado` covers both "the licence is not in the
+ * registry" and "we have no registry for this country" — the caller does not get
+ * to tell them apart, because acting differently on them is exactly the bug.
+ * Access stays closed in both cases.
+ */
+export declare const ESTADO_VERIFICACION_REGISTRO: {
+    readonly VERIFICADO: "verificado";
+    readonly NO_VERIFICADO: "no_verificado";
+};
+export type EstadoVerificacionRegistro = (typeof ESTADO_VERIFICACION_REGISTRO)[keyof typeof ESTADO_VERIFICACION_REGISTRO];
+/** A per-country snapshot of licence hashes, plus the version that dated it. */
+export interface InstantaneaRegistroPais {
+    /** ISO 3166-1 alpha-2. */
+    readonly pais: string;
+    /**
+     * Version of the snapshot. Mandatory on the wire too, not just here: an `Aval`
+     * with `metodoVerificacion.clase: 'registro_por_pais'` is refused without it,
+     * because a stale snapshot that cannot be named cannot be reasoned about.
+     */
+    readonly version: string;
+    /** Hex SHA-256 of normalised licence numbers. Membership only, never a number. */
+    readonly hashes: ReadonlySet<string>;
+}
+/**
+ * The Phase 3 seam. One method, no I/O in this module.
+ *
+ * An implementation is *injected* rather than imported so this file stays free
+ * of any dependency on where snapshots come from — a local file today, a gossiped
+ * replica later — and so a test can supply a fixture.
+ */
+export interface VerificadorRegistroPais {
+    /**
+     * @returns the snapshot for `pais`, or `undefined` when none is available.
+     *   `undefined` means *unsupported country* and is handled fail-closed.
+     */
+    instantanea(pais: string): InstantaneaRegistroPais | undefined;
+    /** Version of the snapshot this verifier would consult, for audit logs. */
+    versionInstantanea(pais: string): string | undefined;
+}
+/** An in-memory verifier. Pure: a fixture map, no I/O. Useful in tests. */
+export declare class VerificadorRegistroEnMemoria implements VerificadorRegistroPais {
+    private readonly porPais;
+    constructor(instantaneas?: readonly InstantaneaRegistroPais[]);
+    instantanea(pais: string): InstantaneaRegistroPais | undefined;
+    versionInstantanea(pais: string): string | undefined;
+    /** Add or replace a snapshot. The append-only, hash-compared path is Phase 3. */
+    publicar(instantanea: InstantaneaRegistroPais): void;
+}
+export type ResultadoVerificacionRegistro = {
+    readonly estado: "verificado";
+    readonly idLicencia: string;
+    readonly versionRegistro: string;
+} | {
+    /**
+     * Fail-closed. Covers both "not in the registry" and "no registry for this
+     * country". `causa` is for operators and logs only — it must never widen
+     * what a caller may do.
+     */
+    readonly estado: "no_verificado";
+    readonly causa: "pais_sin_registro" | "licencia_no_encontrada" | "licencia_caducada";
+    readonly accesoPermitido: false;
+};
+/**
+ * The OrionHealth primitive, fail-closed.
+ *
+ * The whole behavioural difference from OrionHealth is the empty-registry branch:
+ * it returns `no_verificado` / `pais_sin_registro`, not `unknown`. Same
+ * normalisation, same hash, same membership test.
+ *
+ * @param numeroLicencia - the raw number, hashed here and nowhere else.
+ * @param pais - ISO 3166-1 alpha-2.
+ */
+export declare function verificarLicenciaContraRegistro(numeroLicencia: string, pais: string, verificador: VerificadorRegistroPais): Promise<ResultadoVerificacionRegistro>;
+/**
+ * Membership test over an **already-hashed** `idLicencia`.
+ *
+ * Separate from {@link verificarLicenciaContraRegistro} because hashing is not
+ * idempotent: feeding a stored `idLicencia` (which is already
+ * `sha256(normalize(numero))`) back through `hashLicencia` hashes the digest a
+ * second time and can never match the set. A credential on the wire carries the
+ * hash, never the number, so the credential path must consult the set directly.
+ *
+ * @param idLicencia - a `sha256` hex digest. NOT a licence number.
+ */
+export declare function verificarHashContraRegistro(idLicencia: string, pais: string, verificador: VerificadorRegistroPais): Promise<ResultadoVerificacionRegistro>;
+/**
+ * Registry membership is necessary but not sufficient.
+ *
+ * OrionHealth's `expired` defect lives here: set membership carries no validity
+ * window, so a licence cancelled in 2027 stays in the snapshot and keeps
+ * matching. The window must come from the credential's issuer-signed
+ * `vigenteHasta`, which is why this check cannot be folded into the membership
+ * test.
+ *
+ * @param ahora - injected clock. Pure: no `Date.now()` here.
+ * @returns `true` only when the credential is in the registry *and* unexpired.
+ */
+export declare function verificarCredencialContraRegistro(credencial: CredencialMedica, verificador: VerificadorRegistroPais, ahora: number): Promise<ResultadoVerificacionRegistro>;
+/** Countries with a real snapshot behind them. Colombia only at launch (DECISIÓN C.1). */
+export declare const PAISES_SOPORTADOS: readonly ["CO"];
+//# sourceMappingURL=registro.d.ts.map

package/dist/medico/registro.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registro.d.ts","sourceRoot":"","sources":["../../src/medico/registro.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B;aACxC,UAAU,EAAE,YAAY;aACxB,aAAa,EAAE,eAAe;CACrB,CAAC;AAEX,MAAM,MAAM,0BAA0B,GACrC,CAAC,OAAO,4BAA4B,CAAC,CAAC,MAAM,OAAO,4BAA4B,CAAC,CAAC;AAElF,gFAAgF;AAChF,MAAM,WAAW,uBAAuB;IACvC,0BAA0B;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,kFAAkF;IAClF,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACrC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACvC;;;OAGG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,GAAG,SAAS,CAAC;IAE/D,2EAA2E;IAC3E,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CACrD;AAED,2EAA2E;AAC3E,qBAAa,4BAA6B,YAAW,uBAAuB;IAC3E,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8C;IAEtE,YAAY,YAAY,GAAE,SAAS,uBAAuB,EAAO,EAOhE;IAED,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,GAAG,SAAS,CAE7D;IAED,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEnD;IAED,iFAAiF;IACjF,QAAQ,CAAC,WAAW,EAAE,uBAAuB,GAAG,IAAI,CAKnD;CACD;AAED,MAAM,MAAM,6BAA6B,GACtC;IACA,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAChC,GACD;IACA;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,KAAK,EACX,mBAAmB,GACnB,wBAAwB,GACxB,mBAAmB,CAAC;IACvB,QAAQ,CAAC,eAAe,EAAE,KAAK,CAAC;CAC/B,CAAC;AAEL;;;;;;;;;GASG;AACH,wBAAsB,+BAA+B,CACpD,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,uBAAuB,GAClC,OAAO,CAAC,6BAA6B,CAAC,CAMxC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,2BAA2B,CAChD,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,uBAAuB,GAClC,OAAO,CAAC,6BAA6B,CAAC,CAExC;AAwCD;;;;;;;;;;;GAWG;AACH,wBAAsB,iCAAiC,CACtD,UAAU,EAAE,gBAAgB,EAC5B,WAAW,EAAE,uBAAuB,EACpC,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,6BAA6B,CAAC,CAwBxC;AAED,0FAA0F;AAC1F,eAAO,MAAM,iBAAiB,YAAI,IAAI,CAAU,CAAC"}

package/dist/medico/registro.js

@@ -0,0 +1,173 @@
+/**
+ * The extension point for Phase 3, and the reason this layer fails closed.
+ *
+ * ─── THE ORIONHEALTH PATTERN AND ITS TWO DEFECTS ────────────────────────────
+ *
+ * `apps/OrionHealth/lib/features/doctor_verification/domain/services/license_verifier.dart`
+ * gets "is this licence number real" right with the right primitive:
+ *
+ * ```dart
+ * final normalized = licenseNumber.replaceAll(RegExp(r'\s+'), '').toUpperCase();
+ * final hash = sha256.convert(utf8.encode(normalized)).toString();
+ * final countryHashes = await _registry.getHashesForCountry(countryCode);
+ * if (countryHashes.isEmpty) return LicenseVerificationResult.unknown;
+ * if (countryHashes.contains(hash)) return LicenseVerificationResult.valid;
+ * return LicenseVerificationResult.invalid;
+ * ```
+ *
+ * Three properties worth keeping: only the hash travels (the number is PII under
+ * Ley 1581/2012), registries are country-scoped (ReTHUS and the Spanish
+ * colleges are different datasets with different cadences), and the result is
+ * three-valued.
+ *
+ * Two properties that are defects *for our use case*:
+ *
+ * 1. **`unknown` is not `valid`.** An empty country registry yields `unknown`.
+ *    Fine for a UI that says "we don't know yet". Fatal here: a node that treats
+ *    `unknown` as "not refused" turns *an unsupported country* into a bypass. A
+ *    physician presents a licence from a country nobody has downloaded a
+ *    snapshot for, and every node that has not yet fetched that registry waves
+ *    them through. So {@link EstadoVerificacionRegistro} has exactly two members.
+ *    There is no third state, so the bug is not representable.
+ *
+ * 2. **`expired` is declared but never returned.** A hash-set membership carries
+ *    no validity window, so a licence cancelled in 2027 verifies forever. The
+ *    fix is not in this file: it is the issuer-signed `vigenteHasta` on
+ *    {@link CredencialMedica}, checked by `validarCredencial`.
+ *
+ * ─── WHAT THIS FILE DELIBERATELY DOES NOT DO ────────────────────────────────
+ *
+ * It does no I/O. No fetch, no registry file, no snapshot download. The
+ * interface below is the seam; Phase 3 implements it against a replicated,
+ * append-only, hash-compared country snapshot. Because the seam is pure data in
+ * and pure data out, this module is fully testable with a fixture and no network.
+ */
+import { hashLicencia } from "./canonica.js";
+/**
+ * The result of consulting a country registry.
+ *
+ * Two states, not three. `no_verificado` covers both "the licence is not in the
+ * registry" and "we have no registry for this country" — the caller does not get
+ * to tell them apart, because acting differently on them is exactly the bug.
+ * Access stays closed in both cases.
+ */
+export const ESTADO_VERIFICACION_REGISTRO = {
+    VERIFICADO: "verificado",
+    NO_VERIFICADO: "no_verificado",
+};
+/** An in-memory verifier. Pure: a fixture map, no I/O. Useful in tests. */
+export class VerificadorRegistroEnMemoria {
+    porPais = new Map();
+    constructor(instantaneas = []) {
+        for (const inst of instantaneas) {
+            this.porPais.set(inst.pais.toUpperCase(), {
+                ...inst,
+                pais: inst.pais.toUpperCase(),
+            });
+        }
+    }
+    instantanea(pais) {
+        return this.porPais.get(pais.toUpperCase());
+    }
+    versionInstantanea(pais) {
+        return this.porPais.get(pais.toUpperCase())?.version;
+    }
+    /** Add or replace a snapshot. The append-only, hash-compared path is Phase 3. */
+    publicar(instantanea) {
+        this.porPais.set(instantanea.pais.toUpperCase(), {
+            ...instantanea,
+            pais: instantanea.pais.toUpperCase(),
+        });
+    }
+}
+/**
+ * The OrionHealth primitive, fail-closed.
+ *
+ * The whole behavioural difference from OrionHealth is the empty-registry branch:
+ * it returns `no_verificado` / `pais_sin_registro`, not `unknown`. Same
+ * normalisation, same hash, same membership test.
+ *
+ * @param numeroLicencia - the raw number, hashed here and nowhere else.
+ * @param pais - ISO 3166-1 alpha-2.
+ */
+export async function verificarLicenciaContraRegistro(numeroLicencia, pais, verificador) {
+    return consultarInstantanea(await hashLicencia(numeroLicencia), pais, verificador);
+}
+/**
+ * Membership test over an **already-hashed** `idLicencia`.
+ *
+ * Separate from {@link verificarLicenciaContraRegistro} because hashing is not
+ * idempotent: feeding a stored `idLicencia` (which is already
+ * `sha256(normalize(numero))`) back through `hashLicencia` hashes the digest a
+ * second time and can never match the set. A credential on the wire carries the
+ * hash, never the number, so the credential path must consult the set directly.
+ *
+ * @param idLicencia - a `sha256` hex digest. NOT a licence number.
+ */
+export async function verificarHashContraRegistro(idLicencia, pais, verificador) {
+    return consultarInstantanea(idLicencia, pais, verificador);
+}
+/** Shared fail-closed membership test. */
+async function consultarInstantanea(idLicencia, pais, verificador) {
+    const instantanea = verificador.instantanea(pais);
+    // ── FAIL CLOSED ──
+    // This is the branch OrionHealth returns `unknown` from. An empty registry and
+    // a missing country are the same thing operationally: we cannot verify, so we
+    // do not verify. Treating this as "not refused" makes an unsupported country
+    // a universal bypass, and the owner has decided the launch market is Colombia
+    // only — `CO` is supported, everything else fails closed until a real
+    // snapshot exists for it.
+    if (!instantanea || instantanea.hashes.size === 0) {
+        return {
+            estado: "no_verificado",
+            causa: "pais_sin_registro",
+            accesoPermitido: false,
+        };
+    }
+    if (!instantanea.hashes.has(idLicencia)) {
+        return {
+            estado: "no_verificado",
+            causa: "licencia_no_encontrada",
+            accesoPermitido: false,
+        };
+    }
+    return {
+        estado: "verificado",
+        idLicencia,
+        versionRegistro: instantanea.version,
+    };
+}
+/**
+ * Registry membership is necessary but not sufficient.
+ *
+ * OrionHealth's `expired` defect lives here: set membership carries no validity
+ * window, so a licence cancelled in 2027 stays in the snapshot and keeps
+ * matching. The window must come from the credential's issuer-signed
+ * `vigenteHasta`, which is why this check cannot be folded into the membership
+ * test.
+ *
+ * @param ahora - injected clock. Pure: no `Date.now()` here.
+ * @returns `true` only when the credential is in the registry *and* unexpired.
+ */
+export async function verificarCredencialContraRegistro(credencial, verificador, ahora) {
+    const porPais = await verificarHashContraRegistro(credencial.idLicencia, credencial.pais, verificador);
+    if (porPais.estado === "no_verificado")
+        return porPais;
+    if (credencial.vigenteHasta <= ahora) {
+        // Membership holds and the credential is still within its own window only
+        // when both are true. Without this, "in the set" means "forever".
+        return {
+            estado: "no_verificado",
+            causa: "licencia_caducada",
+            accesoPermitido: false,
+        };
+    }
+    return {
+        estado: "verificado",
+        idLicencia: credencial.idLicencia,
+        versionRegistro: verificador.versionInstantanea(credencial.pais) ?? "desconocida",
+    };
+}
+/** Countries with a real snapshot behind them. Colombia only at launch (DECISIÓN C.1). */
+export const PAISES_SOPORTADOS = ["CO"];
+//# sourceMappingURL=registro.js.map

package/dist/medico/registro.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registro.js","sourceRoot":"","sources":["../../src/medico/registro.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG7C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC3C,UAAU,EAAE,YAAY;IACxB,aAAa,EAAE,eAAe;CACrB,CAAC;AAqCX,2EAA2E;AAC3E,MAAM,OAAO,4BAA4B;IACvB,OAAO,GAAG,IAAI,GAAG,EAAmC,CAAC;IAEtE,YAAY,YAAY,GAAuC,EAAE;QAChE,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;YACjC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE;gBACzC,GAAG,IAAI;gBACP,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;aAC7B,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,WAAW,CAAC,IAAY;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,kBAAkB,CAAC,IAAY;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,OAAO,CAAC;IACtD,CAAC;IAED,iFAAiF;IACjF,QAAQ,CAAC,WAAoC;QAC5C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE;YAChD,GAAG,WAAW;YACd,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;IACJ,CAAC;CACD;AAsBD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACpD,cAAsB,EACtB,IAAY,EACZ,WAAoC;IAEpC,OAAO,oBAAoB,CAC1B,MAAM,YAAY,CAAC,cAAc,CAAC,EAClC,IAAI,EACJ,WAAW,CACX,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAChD,UAAkB,EAClB,IAAY,EACZ,WAAoC;IAEpC,OAAO,oBAAoB,CAAC,UAAU,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;AAC5D,CAAC;AAED,0CAA0C;AAC1C,KAAK,UAAU,oBAAoB,CAClC,UAAkB,EAClB,IAAY,EACZ,WAAoC;IAEpC,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAElD,oBAAoB;IACpB,+EAA+E;IAC/E,8EAA8E;IAC9E,6EAA6E;IAC7E,8EAA8E;IAC9E,sEAAsE;IACtE,0BAA0B;IAC1B,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACnD,OAAO;YACN,MAAM,EAAE,eAAe;YACvB,KAAK,EAAE,mBAAmB;YAC1B,eAAe,EAAE,KAAK;SACtB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACzC,OAAO;YACN,MAAM,EAAE,eAAe;YACvB,KAAK,EAAE,wBAAwB;YAC/B,eAAe,EAAE,KAAK;SACtB,CAAC;IACH,CAAC;IAED,OAAO;QACN,MAAM,EAAE,YAAY;QACpB,UAAU;QACV,eAAe,EAAE,WAAW,CAAC,OAAO;KACpC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACtD,UAA4B,EAC5B,WAAoC,EACpC,KAAa;IAEb,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAChD,UAAU,CAAC,UAAU,EACrB,UAAU,CAAC,IAAI,EACf,WAAW,CACX,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,eAAe;QAAE,OAAO,OAAO,CAAC;IAEvD,IAAI,UAAU,CAAC,YAAY,IAAI,KAAK,EAAE,CAAC;QACtC,0EAA0E;QAC1E,kEAAkE;QAClE,OAAO;YACN,MAAM,EAAE,eAAe;YACvB,KAAK,EAAE,mBAAmB;YAC1B,eAAe,EAAE,KAAK;SACtB,CAAC;IACH,CAAC;IAED,OAAO;QACN,MAAM,EAAE,YAAY;QACpB,UAAU,EAAE,UAAU,CAAC,UAAU;QACjC,eAAe,EACd,WAAW,CAAC,kBAAkB,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,aAAa;KACjE,CAAC;AACH,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,IAAI,CAAU,CAAC"}