gdc-common-utils-ts 2.3.19 → 2.3.21

package/dist/models/animal-onboarding.d.ts

@@ -1,12 +1,22 @@
+/**
+ * @deprecated Animal-card vocabulary is owned by the consuming product SDK.
+ * Retained only so consumers of 2.3.x can migrate without a breaking removal.
+ */
 export declare const AnimalSubjectKinds: Readonly<{
     readonly Animal: "animal";
 }>;
+/**
+ * @deprecated Use the species registry from the consuming product SDK.
+ * NCBI Taxonomy identifiers are external identifiers and are not a GDC model.
+ */
 export declare const NcbiTaxonomy: Readonly<{
     readonly Dog: "9615";
     readonly Cat: "9685";
     readonly Horse: "9796";
 }>;
+/** @deprecated Import the taxonomy identifier type from the product SDK. */
 export type NcbiTaxonomyId = string;
+/** @deprecated Import the animal onboarding input from the product SDK. */
 export type AnimalOnboardingInput = Readonly<{
     subjectId: string;
     cardDidWeb: string;
@@ -20,8 +30,11 @@ export type AnimalOnboardingInput = Readonly<{
     controllerTelephone?: string;
     sector?: string;
 }>;
+/** @deprecated Import the animal onboarding claims type from the product SDK. */
 export type AnimalOnboardingClaims = Readonly<Record<string, string>>;
 /**
+ * @deprecated Use the taxonomy URI builder from the product SDK.
+ *
  * Builds the canonical OBO URI for one NCBI Taxonomy numeric identifier.
  *
  * The URI is public taxonomy metadata, not an animal identifier. Callers must
@@ -30,6 +43,9 @@ export type AnimalOnboardingClaims = Readonly<Record<string, string>>;
  */
 export declare function buildNcbiTaxonomyUri(id: NcbiTaxonomyId): string;
 /**
+ * @deprecated Use the animal onboarding builder from the product SDK. This
+ * compatibility implementation will be removed in the next major release.
+ *
  * Projects one controller-authorized animal card request to the existing
  * schema.org individual-organization claim envelope.
  *

package/dist/models/animal-onboarding.js

@@ -1,14 +1,24 @@
 import { ClaimsOrganizationSchemaorg, ClaimsServiceSchemaorg } from '../constants/schemaorg.js';
 import { DataspaceSectors } from '../constants/sectors.js';
+/**
+ * @deprecated Animal-card vocabulary is owned by the consuming product SDK.
+ * Retained only so consumers of 2.3.x can migrate without a breaking removal.
+ */
 export const AnimalSubjectKinds = Object.freeze({
     Animal: 'animal',
 });
+/**
+ * @deprecated Use the species registry from the consuming product SDK.
+ * NCBI Taxonomy identifiers are external identifiers and are not a GDC model.
+ */
 export const NcbiTaxonomy = Object.freeze({
     Dog: '9615',
     Cat: '9685',
     Horse: '9796',
 });
 /**
+ * @deprecated Use the taxonomy URI builder from the product SDK.
+ *
  * Builds the canonical OBO URI for one NCBI Taxonomy numeric identifier.
  *
  * The URI is public taxonomy metadata, not an animal identifier. Callers must
@@ -26,6 +36,9 @@ export function buildNcbiTaxonomyUri(id) {
     return `http://purl.obolibrary.org/obo/NCBITaxon_${normalized}`;
 }
 /**
+ * @deprecated Use the animal onboarding builder from the product SDK. This
+ * compatibility implementation will be removed in the next major release.
+ *
  * Projects one controller-authorized animal card request to the existing
  * schema.org individual-organization claim envelope.
  *

package/dist/utils/actor.d.ts

@@ -2,6 +2,7 @@ export type ParsedActor = {
     /**
      * The token subject / authenticated actor identifier (as provided in the token request).
      * Examples:
+     * - did:web:api.acme.org:member:z6MksExampleHashedMemberId:ISCO-08|2211
      * - did:web:api.acme.org:employee:z6MksExampleHashedEmployeeId:ISCO-08|2211
      * - did:web:api.acme.org:employee:z6MksExampleHashedEmployeeId:ISCO-08|2211:<device-uuid>
      * - did:web:api.acme.org:employee:doctor1@acme.org:ISCO-08|2211
@@ -10,10 +11,15 @@ export type ParsedActor = {
      * - did:web:api.acme.org:family:<id>:v3-RoleCode|CHILD:<device-uuid>
      */
     sub: string;
-    /** The actor identifier (employee hashed-id/email token, familyId, or raw email). */
+    /** The terminal member identifier (hashed email/phone, family id, or raw email). */
     identifier?: string;
     /** The employee role code if present (e.g. "ISCO-08|2211"). */
     role?: string;
+    /**
+     * Membership domain inferred from the terminal role contract, not from a
+     * provider-specific `member`/`employee` path label.
+     */
+    memberKind?: 'organization' | 'individual';
     /** The base organization did:web if `sub` is did:web (e.g. "did:web:api.acme.org"). */
     organization?: string;
 };

package/dist/utils/actor.js

@@ -11,20 +11,40 @@ export function parseActorFromSub(sub) {
         const host = after.split(':')[0];
         if (host)
             parsed.organization = `did:web:${host}`;
-        // Extract email and role from endpoint-style DID shapes:
-        // did:web:<host>:(employee|family):<id>:<roleSystem>|<roleCode>[:<uuid>]
+        // Member vocabulary is provider-specific (`member`, `employee`, `family`,
+        // `individual-member`, ...). The interoperable identity tuple is the
+        // terminal `<identifier>:<role-system>|<role-code>` pair, optionally
+        // followed by a device id. Do not make consent matching depend on a path
+        // label chosen by a hosted or external DID provider.
         const parts = after.split(':');
-        const employeeIdx = parts.indexOf('employee');
-        const familyIdx = parts.indexOf('family');
-        const idIdx = employeeIdx >= 0 ? employeeIdx + 1 : familyIdx >= 0 ? familyIdx + 1 : -1;
+        const roleIdx = parts.findIndex((part) => {
+            try {
+                return decodeURIComponent(part).includes('|');
+            }
+            catch {
+                return part.includes('|');
+            }
+        });
+        const hasRoleLabel = roleIdx > 0 && parts[roleIdx - 1].toLowerCase() === 'role';
+        const idIdx = roleIdx > 0 ? roleIdx - (hasRoleLabel ? 2 : 1) : -1;
         const identifier = idIdx >= 0 ? parts[idIdx] : undefined;
         if (identifier) {
             parsed.identifier = identifier.includes('@') ? identifier.toLowerCase() : identifier;
         }
-        if (idIdx >= 0 && parts.length > idIdx + 1) {
-            const roleCandidate = parts[idIdx + 1];
-            if (roleCandidate && roleCandidate.includes('|'))
-                parsed.role = roleCandidate;
+        if (roleIdx >= 0) {
+            const encodedRole = parts[roleIdx];
+            try {
+                parsed.role = decodeURIComponent(encodedRole);
+            }
+            catch {
+                parsed.role = encodedRole;
+            }
+            const normalizedRole = String(parsed.role || '').trim().toLowerCase();
+            const pathLabels = parts.slice(1, Math.max(1, idIdx)).map((part) => part.toLowerCase());
+            parsed.memberKind = normalizedRole.startsWith('v3-rolecode|')
+                || pathLabels.some((part) => part === 'family' || part === 'related-person' || part === 'individual-member')
+                ? 'individual'
+                : 'organization';
         }
         return parsed;
     }

package/dist/utils/consent.d.ts

@@ -54,6 +54,10 @@ export type BuildConsentClaimsSimpleInput = SubjectIdentifierInput & {
     consentIdentifier?: string;
     consentDate?: string;
     decision?: 'permit' | 'deny';
+    /** Stable identifier/thread of the permission request that caused this decision. */
+    eventBasedOn?: string;
+    /** Canonical Communication reference for the permission request being answered. */
+    sourceReference?: string;
     attachmentContentType?: string;
     attachmentBase64?: string;
 };

package/dist/utils/consent.js

@@ -169,6 +169,12 @@ export function buildConsentClaimsSimple(input, options = {}) {
             [ClaimConsent.action]: (input.actions || []).join(','),
             [ClaimConsent.actorIdentifier]: actorIdentifier,
             [ClaimConsent.actorRole]: input.actorRole,
+            ...(String(input.eventBasedOn || '').trim()
+                ? { [ClaimConsent.eventBasedOn]: String(input.eventBasedOn).trim() }
+                : {}),
+            ...(String(input.sourceReference || '').trim()
+                ? { [ClaimConsent.sourceReference]: String(input.sourceReference).trim() }
+                : {}),
             [ClaimConsent.attachmentContentType]: input.attachmentContentType || 'application/odrl+json',
             [ClaimConsent.attachmentData]: input.attachmentBase64 || 'e30=',
         },

package/dist/utils/professional-smart.d.ts

@@ -20,6 +20,13 @@ export type ProfessionalSmartVpPayloadInput = Readonly<{
     additionalVp?: Record<string, unknown>;
     additionalPayload?: Record<string, unknown>;
 }>;
+/** Identity fields read from an already-verified professional credential. */
+export type ProfessionalCredentialSummary = Readonly<{
+    actorDid: string;
+    role: string;
+    issuerDid?: string;
+    sameAs: string[];
+}>;
 /**
  * Returns the normalized public continuity aliases for one professional
  * identity VC.
@@ -62,6 +69,16 @@ export declare function getProfessionalIdentityTelephone(input: Readonly<Pick<Pr
  * @param input Professional identity source values.
  */
 export declare function getProfessionalIdentityVC(input: ProfessionalEmployeeCredentialInput): Record<string, unknown>;
+/**
+ * Reads the actor and role asserted by one professional credential. Signature
+ * and employer/issuer trust verification belongs to the enclosing VP verifier.
+ */
+export declare function summarizeProfessionalIdentityCredential(credential: unknown): ProfessionalCredentialSummary | undefined;
+/** Finds the exact actor and role in an already-verified professional VP. */
+export declare function getMatchingProfessionalCredentialFromVpToken(vpToken: string, criteria: Readonly<{
+    actorDid: string;
+    role: string;
+}>): ProfessionalCredentialSummary | undefined;
 /**
  * Backwards-compatible alias kept for existing SMART demo callers.
  *

package/dist/utils/professional-smart.js

@@ -2,6 +2,7 @@ import { ClaimsPersonSchemaorg } from '../constants/schemaorg.js';
 import { ProfessionalCredentialTypes, W3cCredentialTypes, } from '../constants/verifiable-credentials.js';
 import { normalizeSameAsHashCsv, normalizeSameAsHashList, normalizeTelephoneHash } from './same-as.js';
 import { buildUnsignedVpJwt } from './jwt.js';
+import { getVpCredentials } from './vp-token.js';
 /**
  * Returns the normalized public continuity aliases for one professional
  * identity VC.
@@ -84,6 +85,38 @@ export function getProfessionalIdentityVC(input) {
         ...(input.additionalCredential || {}),
     };
 }
+/**
+ * Reads the actor and role asserted by one professional credential. Signature
+ * and employer/issuer trust verification belongs to the enclosing VP verifier.
+ */
+export function summarizeProfessionalIdentityCredential(credential) {
+    const source = credential;
+    const types = Array.isArray(source?.type) ? source.type.map(String) : [String(source?.type || '')];
+    if (!types.includes(ProfessionalCredentialTypes.EmployeeCredential))
+        return undefined;
+    const subject = source?.credentialSubject || {};
+    const actorDid = String(subject.id || '').trim();
+    const role = String(subject.hasOccupation || '').trim();
+    if (!actorDid || !role)
+        return undefined;
+    const issuerDid = String(source?.issuer?.id || source?.issuer || '').trim();
+    return {
+        actorDid,
+        role,
+        ...(issuerDid ? { issuerDid } : {}),
+        sameAs: normalizeSameAsHashList(subject.sameAs),
+    };
+}
+/** Finds the exact actor and role in an already-verified professional VP. */
+export function getMatchingProfessionalCredentialFromVpToken(vpToken, criteria) {
+    const actorDid = String(criteria.actorDid || '').trim();
+    const role = String(criteria.role || '').trim().toLowerCase();
+    return getVpCredentials(vpToken)
+        .map(summarizeProfessionalIdentityCredential)
+        .find((summary) => Boolean(summary
+        && summary.actorDid === actorDid
+        && summary.role.toLowerCase() === role));
+}
 /**
  * Backwards-compatible alias kept for existing SMART demo callers.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-common-utils-ts",
-  "version": "2.3.19",
+  "version": "2.3.21",
   "publishConfig": {
     "access": "public"
   },