gdc-common-utils-ts 2.0.17 → 2.1.0

package/dist/utils/inter-tenant-access-contract.js

@@ -0,0 +1,358 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+import { ContractCredentialTypes, W3cCredentialContexts, W3cCredentialTypes } from '../constants/verifiable-credentials.js';
+import { ClaimConsent } from '../models/consent-rule.js';
+import { ClaimInterTenantAccessContract } from '../models/inter-tenant-access-contract.js';
+import { sanitizeBlockchainReference } from './evidence-blockchain-references.js';
+import { getVpCredentials } from './vp-token.js';
+const ACTIVE_CONTRACT_STATUSES = new Set(['executed', 'amended', 'appended']);
+const PROVIDER_ROLE = 'provider';
+const CONSUMER_ROLE = 'consumer';
+const PROVIDER_CONTROLLER_ROLE = 'provider-controller';
+const CONSUMER_CONTROLLER_ROLE = 'consumer-controller';
+function splitCsv(value) {
+    return Array.from(new Set(String(value || '')
+        .split(',')
+        .map((item) => item.trim())
+        .filter(Boolean)));
+}
+function readClaimWithAliases(claims, canonicalKey, aliases = []) {
+    const direct = String(claims[canonicalKey] || '').trim();
+    if (direct)
+        return direct;
+    for (const alias of aliases) {
+        const value = String(claims[alias] || '').trim();
+        if (value)
+            return value;
+    }
+    return undefined;
+}
+function firstIdentifierValue(input) {
+    if (Array.isArray(input)) {
+        for (const candidate of input) {
+            const found = firstIdentifierValue(candidate);
+            if (found)
+                return found;
+        }
+        return undefined;
+    }
+    if (!input || typeof input !== 'object')
+        return undefined;
+    const direct = String(input.value || input.id || '').trim();
+    return direct || undefined;
+}
+function extractRoleTexts(input) {
+    const items = Array.isArray(input) ? input : input ? [input] : [];
+    return items
+        .flatMap((item) => {
+        if (!item || typeof item !== 'object')
+            return [];
+        const text = String(item.text || '').trim();
+        const codingItems = Array.isArray(item.coding) ? item.coding : item.coding ? [item.coding] : [];
+        const codingValues = codingItems
+            .map((coding) => String(coding?.code || coding?.display || '').trim())
+            .filter(Boolean);
+        return [text, ...codingValues].filter(Boolean);
+    });
+}
+function extractCapabilityValues(input) {
+    const items = Array.isArray(input) ? input : input ? [input] : [];
+    return Array.from(new Set(items.flatMap((item) => {
+        if (!item || typeof item !== 'object')
+            return [];
+        const text = String(item.text || '').trim();
+        const codingItems = Array.isArray(item.coding) ? item.coding : item.coding ? [item.coding] : [];
+        const codingValues = codingItems
+            .map((coding) => String(coding?.code || coding?.display || '').trim())
+            .filter(Boolean);
+        return [text, ...codingValues].flatMap((value) => splitCsv(value));
+    })));
+}
+function extractOfferPartyReference(contract, expectedRole) {
+    const terms = Array.isArray(contract.term) ? contract.term : contract.term ? [contract.term] : [];
+    for (const term of terms) {
+        const parties = Array.isArray(term?.offer?.party) ? term.offer.party : term?.offer?.party ? [term.offer.party] : [];
+        for (const party of parties) {
+            const roleTexts = extractRoleTexts(party?.role).map((value) => value.toLowerCase());
+            if (!roleTexts.includes(expectedRole))
+                continue;
+            const reference = String(party?.reference?.reference || party?.reference || '').trim();
+            if (reference)
+                return reference;
+        }
+    }
+    return undefined;
+}
+function extractSignerReference(contract, expectedRole) {
+    const signers = Array.isArray(contract.signer) ? contract.signer : contract.signer ? [contract.signer] : [];
+    for (const signer of signers) {
+        const roleTexts = extractRoleTexts(signer?.type).map((value) => value.toLowerCase());
+        if (!roleTexts.includes(expectedRole))
+            continue;
+        const reference = String(signer?.party?.reference || signer?.party?.identifier?.value || '').trim();
+        if (reference)
+            return reference;
+    }
+    return undefined;
+}
+function extractPurposes(contract) {
+    const terms = Array.isArray(contract.term) ? contract.term : contract.term ? [contract.term] : [];
+    return Array.from(new Set(terms.flatMap((term) => {
+        const typeItems = Array.isArray(term?.type) ? term.type : term?.type ? [term.type] : [];
+        return typeItems.flatMap((item) => {
+            if (!item || typeof item !== 'object')
+                return [];
+            const text = String(item.text || '').trim();
+            const codingItems = Array.isArray(item.coding) ? item.coding : item.coding ? [item.coding] : [];
+            const codingValues = codingItems
+                .map((coding) => String(coding?.code || coding?.display || '').trim())
+                .filter(Boolean);
+            return [text, ...codingValues].flatMap((value) => splitCsv(value));
+        });
+    })));
+}
+function extractCapabilities(contract) {
+    const terms = Array.isArray(contract.term) ? contract.term : contract.term ? [contract.term] : [];
+    return Array.from(new Set(terms.flatMap((term) => extractCapabilityValues(term?.offer?.securityLabel))));
+}
+function normalizeNow(input) {
+    if (input instanceof Date)
+        return input.getTime();
+    if (input)
+        return new Date(input).getTime();
+    return Date.now();
+}
+export function buildInterTenantAccessContractResource(claims) {
+    const identifier = readClaimWithAliases(claims, ClaimInterTenantAccessContract.identifier) || '';
+    const status = readClaimWithAliases(claims, ClaimInterTenantAccessContract.status) || 'executed';
+    const issued = readClaimWithAliases(claims, ClaimInterTenantAccessContract.issued) || '';
+    const appliesStart = readClaimWithAliases(claims, ClaimInterTenantAccessContract.appliesStart, ['Contract.applies.start']) || '';
+    const appliesEnd = readClaimWithAliases(claims, ClaimInterTenantAccessContract.appliesEnd, ['Contract.applies.end']) || '';
+    const providerOrganization = readClaimWithAliases(claims, ClaimInterTenantAccessContract.providerOrganization, ['Contract.term.offer.party.provider']) || '';
+    const consumerOrganization = readClaimWithAliases(claims, ClaimInterTenantAccessContract.consumerOrganization, ['Contract.term.offer.party.consumer']) || '';
+    const providerController = readClaimWithAliases(claims, ClaimInterTenantAccessContract.providerController, ['Contract.signer.provider']) || '';
+    const consumerController = readClaimWithAliases(claims, ClaimInterTenantAccessContract.consumerController, ['Contract.signer.consumer']) || '';
+    const instantiatesUri = readClaimWithAliases(claims, ClaimInterTenantAccessContract.instantiatesUri, ['Contract.instantiatesUri']) || '';
+    const capabilities = splitCsv(readClaimWithAliases(claims, ClaimInterTenantAccessContract.capability, ['Contract.term.offer.securityLabel']));
+    const purposes = splitCsv(readClaimWithAliases(claims, ClaimInterTenantAccessContract.purpose, ['Contract.term.type']));
+    return {
+        resourceType: 'Contract',
+        id: identifier || undefined,
+        identifier: identifier ? [{ value: identifier }] : undefined,
+        status,
+        issued: issued || undefined,
+        instantiatesUri: instantiatesUri || undefined,
+        applies: {
+            ...(appliesStart ? { start: appliesStart } : {}),
+            ...(appliesEnd ? { end: appliesEnd } : {}),
+        },
+        signer: [
+            providerController
+                ? {
+                    type: [{ text: PROVIDER_CONTROLLER_ROLE }],
+                    party: { reference: providerController },
+                }
+                : undefined,
+            consumerController
+                ? {
+                    type: [{ text: CONSUMER_CONTROLLER_ROLE }],
+                    party: { reference: consumerController },
+                }
+                : undefined,
+        ].filter(Boolean),
+        term: [{
+                type: purposes.map((purpose) => ({ text: purpose })),
+                offer: {
+                    party: [
+                        providerOrganization
+                            ? {
+                                reference: { reference: providerOrganization },
+                                role: [{ text: PROVIDER_ROLE }],
+                            }
+                            : undefined,
+                        consumerOrganization
+                            ? {
+                                reference: { reference: consumerOrganization },
+                                role: [{ text: CONSUMER_ROLE }],
+                            }
+                            : undefined,
+                    ].filter(Boolean),
+                    securityLabel: capabilities.map((capability) => ({ text: capability })),
+                },
+            }],
+    };
+}
+export function buildInterTenantAccessContractCredential(input) {
+    return {
+        '@context': [W3cCredentialContexts.V2],
+        type: [
+            W3cCredentialTypes.VerifiableCredential,
+            ContractCredentialTypes.InterTenantAccessContractCredential,
+        ],
+        issuer: String(input.issuer || '').trim(),
+        validFrom: String(input.validFrom || '').trim(),
+        ...(input.validUntil ? { validUntil: String(input.validUntil).trim() } : {}),
+        credentialSubject: buildInterTenantAccessContractResource(input.claims),
+        ...(input.additionalCredential || {}),
+    };
+}
+export function summarizeInterTenantAccessContract(credential) {
+    if (!credential || typeof credential !== 'object')
+        return undefined;
+    const typeRaw = Array.isArray(credential.type) ? credential.type : [credential.type].filter(Boolean);
+    if (!typeRaw.includes(ContractCredentialTypes.InterTenantAccessContractCredential))
+        return undefined;
+    const subject = (credential.credentialSubject || {});
+    if (String(subject.resourceType || '').trim() !== 'Contract')
+        return undefined;
+    return {
+        identifier: firstIdentifierValue(subject.identifier) || String(subject.id || '').trim() || undefined,
+        status: String(subject.status || '').trim() || undefined,
+        issued: String(subject.issued || '').trim() || undefined,
+        appliesStart: String(subject.applies?.start || '').trim() || undefined,
+        appliesEnd: String(subject.applies?.end || '').trim() || undefined,
+        providerOrganizationDid: extractOfferPartyReference(subject, PROVIDER_ROLE),
+        consumerOrganizationDid: extractOfferPartyReference(subject, CONSUMER_ROLE),
+        providerControllerDid: extractSignerReference(subject, PROVIDER_CONTROLLER_ROLE),
+        consumerControllerDid: extractSignerReference(subject, CONSUMER_CONTROLLER_ROLE),
+        capabilities: extractCapabilities(subject),
+        purposes: extractPurposes(subject),
+    };
+}
+export function isInterTenantAccessContractActive(summary, options = {}) {
+    if (!summary)
+        return false;
+    const status = String(summary.status || '').trim().toLowerCase();
+    if (!ACTIVE_CONTRACT_STATUSES.has(status))
+        return false;
+    const nowMs = normalizeNow(options.now);
+    const startMs = summary.appliesStart ? Date.parse(summary.appliesStart) : NaN;
+    const endMs = summary.appliesEnd ? Date.parse(summary.appliesEnd) : NaN;
+    if (!Number.isNaN(startMs) && startMs > nowMs)
+        return false;
+    if (!Number.isNaN(endMs) && endMs < nowMs)
+        return false;
+    return true;
+}
+export function matchesInterTenantAccessContract(summary, criteria) {
+    if (!isInterTenantAccessContractActive(summary, { now: criteria.now }))
+        return false;
+    if (String(summary?.providerOrganizationDid || '').trim() !== String(criteria.providerOrganizationDid || '').trim())
+        return false;
+    if (String(summary?.consumerOrganizationDid || '').trim() !== String(criteria.consumerOrganizationDid || '').trim())
+        return false;
+    const requiredCapabilities = Array.from(new Set((criteria.requiredCapabilities || []).map((value) => String(value || '').trim()).filter(Boolean)));
+    if (requiredCapabilities.length > 0) {
+        const contractCapabilities = new Set((summary?.capabilities || []).map((value) => String(value || '').trim()));
+        if (!requiredCapabilities.every((value) => contractCapabilities.has(value)))
+            return false;
+    }
+    const purpose = String(criteria.purpose || '').trim();
+    if (purpose) {
+        const contractPurposes = new Set((summary?.purposes || []).map((value) => String(value || '').trim()));
+        if (contractPurposes.size > 0 && !contractPurposes.has(purpose))
+            return false;
+    }
+    return true;
+}
+export function getMatchingInterTenantAccessContractFromVpToken(vpToken, criteria) {
+    const credentials = getVpCredentials(vpToken);
+    return credentials.find((credential) => matchesInterTenantAccessContract(summarizeInterTenantAccessContract(credential), criteria));
+}
+function splitClaimCsv(value) {
+    return Array.from(new Set(String(value || '')
+        .split(',')
+        .map((item) => item.trim())
+        .filter(Boolean)));
+}
+function isConsentLikeRuleActive(rule, now) {
+    const nowMs = normalizeNow(now);
+    const startMs = Date.parse(String(rule[ClaimConsent.periodStart] || '').trim());
+    const endMs = Date.parse(String(rule[ClaimConsent.periodEnd] || '').trim());
+    if (!Number.isNaN(startMs) && startMs > nowMs)
+        return false;
+    if (!Number.isNaN(endMs) && endMs < nowMs)
+        return false;
+    return true;
+}
+/**
+ * Returns the public blockchain-safe reference that a reused consent-style
+ * authorization rule should store under `Consent.source-reference` when it
+ * delegates use of one inter-tenant contract VC to an employee/researcher.
+ *
+ * Source-of-truth order:
+ * - VC `id`
+ * - FHIR `Contract.identifier`
+ *
+ * In both cases the reference is normalized through the same blockchain-safe
+ * sanitization rule already used by consent-access assets.
+ */
+export function getInterTenantAccessContractBlockchainReference(credential) {
+    if (!credential || typeof credential !== 'object')
+        return undefined;
+    const vcId = sanitizeBlockchainReference(credential.id);
+    if (vcId)
+        return vcId;
+    const summary = summarizeInterTenantAccessContract(credential);
+    return sanitizeBlockchainReference(summary?.identifier);
+}
+/**
+ * Evaluates one consent-style rule reused as an organization-to-employee
+ * delegation for inter-tenant contract usage.
+ *
+ * Shared semantic contract:
+ * - `Consent.subject` = consumer organization DID
+ * - `Consent.actor-identifier` = delegated employee/researcher identifier
+ * - `Consent.action` = allowed capabilities/scopes
+ * - `Consent.purpose` = allowed purpose
+ * - `Consent.source-reference` = blockchain-safe hash/reference of the
+ *   underlying contract VC
+ */
+export function matchesInterTenantContractAuthorizationConsentRule(rule, contractCredential, criteria) {
+    const summary = summarizeInterTenantAccessContract(contractCredential);
+    if (!isInterTenantAccessContractActive(summary, { now: criteria.now })) {
+        return false;
+    }
+    if (String(rule[ClaimConsent.decision] || '').trim() !== 'permit')
+        return false;
+    if (!isConsentLikeRuleActive(rule, criteria.now))
+        return false;
+    if (String(rule[ClaimConsent.subject] || '').trim() !== String(criteria.consumerOrganizationDid || '').trim())
+        return false;
+    if (String(rule[ClaimConsent.actorIdentifier] || '').trim() !== String(criteria.actorIdentifier || '').trim())
+        return false;
+    const expectedReference = getInterTenantAccessContractBlockchainReference(contractCredential);
+    const ruleReference = String(rule[ClaimConsent.sourceReference]
+        || rule[ClaimConsent.eventBasedOn]
+        || '').trim();
+    if (!expectedReference || ruleReference !== expectedReference)
+        return false;
+    const purpose = String(criteria.purpose || '').trim();
+    if (purpose) {
+        const rulePurpose = String(rule[ClaimConsent.purpose] || '').trim();
+        if (rulePurpose && rulePurpose !== purpose)
+            return false;
+    }
+    const actorRole = String(criteria.actorRole || '').trim();
+    if (actorRole) {
+        const allowedRoles = splitClaimCsv(rule[ClaimConsent.actorRole]);
+        if (allowedRoles.length > 0 && !allowedRoles.includes(actorRole))
+            return false;
+    }
+    const requiredCapabilities = Array.from(new Set((criteria.requiredCapabilities || []).map((value) => String(value || '').trim()).filter(Boolean)));
+    if (requiredCapabilities.length > 0) {
+        const allowedCapabilities = new Set(splitClaimCsv(rule[ClaimConsent.action]));
+        if (!requiredCapabilities.every((value) => allowedCapabilities.has(value) || allowedCapabilities.has('*')))
+            return false;
+    }
+    if (requiredCapabilities.length > 0) {
+        const contractCapabilities = new Set((summary?.capabilities || []).map((value) => String(value || '').trim()));
+        if (!requiredCapabilities.every((value) => contractCapabilities.has(value)))
+            return false;
+    }
+    if (purpose) {
+        const contractPurposes = new Set((summary?.purposes || []).map((value) => String(value || '').trim()));
+        if (contractPurposes.size > 0 && !contractPurposes.has(purpose))
+            return false;
+    }
+    return true;
+}

package/dist/utils/organization-authorization-urn.d.ts

@@ -0,0 +1,43 @@
+import type { ClaimsRecord } from '../models/resource-document';
+export type OrganizationAuthorizationUrnInput = Readonly<{
+    identifierType: string;
+    identifierValue: string;
+}>;
+export type MemberAuthorizationUrnInput = Readonly<{
+    organizationUrn?: string;
+    identifierType?: string;
+    identifierValue?: string;
+    memberId: string;
+    /** Optional compatibility input. Role must be persisted separately, not inside the canonical member URN. */
+    roleCode?: string;
+}>;
+/**
+ * Canonical organization authorization identifier used by ledger, consent-like
+ * rules, and inter-tenant authorization persistence.
+ *
+ * Format:
+ * - `urn:org:<identifierType-lowercase>:<identifierValue-as-canonical-input>`
+ *
+ * Examples:
+ * - `urn:org:tax:VATES-B12345678`
+ * - `urn:org:tax:acme-id`
+ */
+export declare function buildOrganizationAuthorizationUrn(input: OrganizationAuthorizationUrnInput): string;
+/**
+ * Accepts either the legacy `TYPE|VALUE` input or an already-canonical
+ * `urn:org:...` identifier and always returns the canonical URN form.
+ */
+export declare function normalizeOrganizationAuthorizationUrn(input: string): string;
+export declare function buildOrganizationAuthorizationUrnFromClaims(claims?: ClaimsRecord): string;
+/**
+ * Canonical member authorization identifier rooted in one canonical
+ * `urn:org:...`.
+ *
+ * Format:
+ * - `urn:org:<type>:<value>:member:<memberId>`
+ *
+ * Important rule:
+ * - role must be stored as a separate claim, not inside the canonical member
+ *   identifier
+ */
+export declare function buildMemberAuthorizationUrn(input: MemberAuthorizationUrnInput): string;

package/dist/utils/organization-authorization-urn.js

@@ -0,0 +1,87 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+import { ClaimsOrganizationSchemaorg } from '../constants/schemaorg.js';
+const ORGANIZATION_URN_PREFIX = 'urn:org:';
+function normalizeTypeSegment(identifierType) {
+    return String(identifierType || '').trim().toLowerCase();
+}
+function normalizeValueSegment(identifierValue) {
+    return String(identifierValue || '').trim();
+}
+/**
+ * Canonical organization authorization identifier used by ledger, consent-like
+ * rules, and inter-tenant authorization persistence.
+ *
+ * Format:
+ * - `urn:org:<identifierType-lowercase>:<identifierValue-as-canonical-input>`
+ *
+ * Examples:
+ * - `urn:org:tax:VATES-B12345678`
+ * - `urn:org:tax:acme-id`
+ */
+export function buildOrganizationAuthorizationUrn(input) {
+    const identifierType = normalizeTypeSegment(input.identifierType);
+    const identifierValue = normalizeValueSegment(input.identifierValue);
+    if (!identifierType || !identifierValue) {
+        throw new Error('Organization authorization URN requires identifierType and identifierValue.');
+    }
+    return `${ORGANIZATION_URN_PREFIX}${identifierType}:${identifierValue}`;
+}
+/**
+ * Accepts either the legacy `TYPE|VALUE` input or an already-canonical
+ * `urn:org:...` identifier and always returns the canonical URN form.
+ */
+export function normalizeOrganizationAuthorizationUrn(input) {
+    const normalized = String(input || '').trim();
+    if (!normalized) {
+        throw new Error('Organization authorization identifier cannot be empty.');
+    }
+    if (normalized.toLowerCase().startsWith(ORGANIZATION_URN_PREFIX)) {
+        const parts = normalized.split(':');
+        const identifierType = String(parts[2] || '').trim();
+        const value = parts.slice(3).join(':').trim();
+        return buildOrganizationAuthorizationUrn({
+            identifierType,
+            identifierValue: value,
+        });
+    }
+    const legacyMatch = normalized.match(/^([^|:]+)\|(.+)$/);
+    if (legacyMatch) {
+        return buildOrganizationAuthorizationUrn({
+            identifierType: legacyMatch[1],
+            identifierValue: legacyMatch[2],
+        });
+    }
+    throw new Error(`Unsupported organization authorization identifier format: ${normalized}`);
+}
+export function buildOrganizationAuthorizationUrnFromClaims(claims) {
+    const identifierType = String(claims?.[ClaimsOrganizationSchemaorg.identifierType] || '').trim();
+    const identifierValue = String(claims?.[ClaimsOrganizationSchemaorg.identifierValue] || '').trim();
+    return buildOrganizationAuthorizationUrn({
+        identifierType,
+        identifierValue,
+    });
+}
+/**
+ * Canonical member authorization identifier rooted in one canonical
+ * `urn:org:...`.
+ *
+ * Format:
+ * - `urn:org:<type>:<value>:member:<memberId>`
+ *
+ * Important rule:
+ * - role must be stored as a separate claim, not inside the canonical member
+ *   identifier
+ */
+export function buildMemberAuthorizationUrn(input) {
+    const organizationUrn = input.organizationUrn
+        ? normalizeOrganizationAuthorizationUrn(input.organizationUrn)
+        : buildOrganizationAuthorizationUrn({
+            identifierType: String(input.identifierType || '').trim(),
+            identifierValue: String(input.identifierValue || '').trim(),
+        });
+    const memberId = String(input.memberId || '').trim();
+    if (!memberId) {
+        throw new Error('Member authorization URN requires memberId.');
+    }
+    return `${organizationUrn}:member:${memberId}`;
+}

package/dist/utils/profile-manager-mem.d.ts

@@ -0,0 +1,69 @@
+import type { IWallet } from '../interfaces/IWallet';
+import type { IProfileOutboxRepository } from '../interfaces/IProfileOutboxRepository';
+import type { BackendMessageResponseRecord, BackendMessageTransport, ProfileOutboxMessageRecord, ProfileManagerMemProfile, QueueProfileMessageInput } from '../models/profile-manager';
+import type { WalletQueuedMessage } from '../models/wallet';
+import { BackendMessageManagerMem } from './backend-message-manager-mem';
+export type ProfileManagerMemOptions = Readonly<{
+    profile: ProfileManagerMemProfile;
+    wallet: IWallet;
+    transport: BackendMessageTransport;
+    outboxRepository?: IProfileOutboxRepository;
+}>;
+/**
+ * Minimal memory-backed profile manager for low-level tests.
+ *
+ * Responsibility:
+ * - own one logical profile
+ * - ensure the profile keys exist in the wallet
+ * - delegate queue/submit/response operations to `BackendMessageManagerMem`
+ *
+ * Non-goal:
+ * - actor-specific orchestration belongs to higher SDK layers
+ */
+export declare class ProfileManagerMem {
+    readonly profile: ProfileManagerMemProfile;
+    readonly wallet: IWallet;
+    readonly messageManager: BackendMessageManagerMem;
+    readonly outboxRepository: IProfileOutboxRepository;
+    constructor(options: ProfileManagerMemOptions);
+    /**
+     * Provisions the local profile keys before any queue or transport operation.
+     */
+    initialize(): Promise<void>;
+    /**
+     * Queues one outbound profile payload.
+     */
+    queueMessage(input: QueueProfileMessageInput): Promise<WalletQueuedMessage>;
+    /**
+     * Returns the current queued messages in processing order.
+     */
+    listQueuedMessages(): Promise<WalletQueuedMessage[]>;
+    /**
+     * Submits the next pending message and optionally stores the decoded response.
+     */
+    submitNextPendingMessage(recipientEncryptionJwk: Record<string, unknown>): Promise<{
+        message: WalletQueuedMessage;
+        response?: BackendMessageResponseRecord;
+        pending?: boolean;
+    }>;
+    /**
+     * Reads the latest decoded response for one thread id.
+     */
+    getResponseByThreadId(thid: string): BackendMessageResponseRecord | undefined;
+    /**
+     * Reads one decoded response by thread id from memory or repository storage.
+     */
+    readResponseByThreadId(thid: string): Promise<BackendMessageResponseRecord | undefined>;
+    /**
+     * Lists historical outbox records already submitted through this profile manager.
+     */
+    listOutboxHistory(): Promise<ProfileOutboxMessageRecord[]>;
+    /**
+     * Polls one asynchronous outbox record by id.
+     */
+    pollSubmittedMessage(messageId: string): Promise<{
+        pending: boolean;
+        response?: BackendMessageResponseRecord;
+        record: ProfileOutboxMessageRecord;
+    }>;
+}

package/dist/utils/profile-manager-mem.js

@@ -0,0 +1,79 @@
+// Copyright 2026 Conectate Soluciones y Aplicaciones SL under the Apache License, Version 2.0.
+import { BackendMessageManagerMem } from './backend-message-manager-mem.js';
+import { MemoryProfileOutboxRepository } from './profile-outbox-memory-repository.js';
+/**
+ * Minimal memory-backed profile manager for low-level tests.
+ *
+ * Responsibility:
+ * - own one logical profile
+ * - ensure the profile keys exist in the wallet
+ * - delegate queue/submit/response operations to `BackendMessageManagerMem`
+ *
+ * Non-goal:
+ * - actor-specific orchestration belongs to higher SDK layers
+ */
+export class ProfileManagerMem {
+    profile;
+    wallet;
+    messageManager;
+    outboxRepository;
+    constructor(options) {
+        this.profile = options.profile;
+        this.wallet = options.wallet;
+        this.outboxRepository = options.outboxRepository ?? new MemoryProfileOutboxRepository();
+        this.messageManager = new BackendMessageManagerMem({
+            wallet: options.wallet,
+            entityId: options.profile.profileId,
+            transport: options.transport,
+            outboxRepository: this.outboxRepository,
+        });
+    }
+    /**
+     * Provisions the local profile keys before any queue or transport operation.
+     */
+    async initialize() {
+        await this.wallet.provisionKeys(this.profile.profileId);
+    }
+    /**
+     * Queues one outbound profile payload.
+     */
+    async queueMessage(input) {
+        return this.messageManager.queueMessage(input);
+    }
+    /**
+     * Returns the current queued messages in processing order.
+     */
+    async listQueuedMessages() {
+        return this.messageManager.listQueuedMessages();
+    }
+    /**
+     * Submits the next pending message and optionally stores the decoded response.
+     */
+    async submitNextPendingMessage(recipientEncryptionJwk) {
+        return this.messageManager.submitNextPendingMessage(recipientEncryptionJwk);
+    }
+    /**
+     * Reads the latest decoded response for one thread id.
+     */
+    getResponseByThreadId(thid) {
+        return this.messageManager.getResponseByThreadId(thid);
+    }
+    /**
+     * Reads one decoded response by thread id from memory or repository storage.
+     */
+    async readResponseByThreadId(thid) {
+        return this.messageManager.readResponseByThreadId(thid);
+    }
+    /**
+     * Lists historical outbox records already submitted through this profile manager.
+     */
+    async listOutboxHistory() {
+        return this.messageManager.listOutboxHistory();
+    }
+    /**
+     * Polls one asynchronous outbox record by id.
+     */
+    async pollSubmittedMessage(messageId) {
+        return this.messageManager.pollSubmittedMessage(messageId);
+    }
+}

package/dist/utils/profile-outbox-memory-repository.d.ts

@@ -0,0 +1,34 @@
+import type { IProfileOutboxRepository } from '../interfaces/IProfileOutboxRepository';
+import type { BackendMessageResponseRecord, ProfileOutboxMessageRecord } from '../models/profile-manager';
+/**
+ * In-memory profile outbox repository used by low-level tests and as the
+ * default history/response store for `ProfileManagerMem`.
+ */
+export declare class MemoryProfileOutboxRepository implements IProfileOutboxRepository {
+    private readonly messages;
+    private readonly responses;
+    /**
+     * Stores one immutable message history record.
+     */
+    putMessage(record: ProfileOutboxMessageRecord): Promise<ProfileOutboxMessageRecord>;
+    /**
+     * Reads one message history record.
+     */
+    getMessage(messageId: string): Promise<ProfileOutboxMessageRecord | undefined>;
+    /**
+     * Lists all message history records in insertion order.
+     */
+    listMessages(): Promise<ProfileOutboxMessageRecord[]>;
+    /**
+     * Stores one decoded response record grouped by thread id.
+     */
+    putResponse(record: BackendMessageResponseRecord): Promise<BackendMessageResponseRecord>;
+    /**
+     * Returns the latest decoded response for the provided thread id.
+     */
+    getLatestResponseByThreadId(thid: string): Promise<BackendMessageResponseRecord | undefined>;
+    /**
+     * Lists all decoded responses across all threads.
+     */
+    listResponses(): Promise<BackendMessageResponseRecord[]>;
+}