gdc-common-utils-ts 2.3.20 → 2.3.22

package/dist/utils/actor.d.ts

@@ -2,6 +2,7 @@ export type ParsedActor = {
     /**
      * The token subject / authenticated actor identifier (as provided in the token request).
      * Examples:
+     * - did:web:api.acme.org:member:z6MksExampleHashedMemberId:ISCO-08|2211
      * - did:web:api.acme.org:employee:z6MksExampleHashedEmployeeId:ISCO-08|2211
      * - did:web:api.acme.org:employee:z6MksExampleHashedEmployeeId:ISCO-08|2211:<device-uuid>
      * - did:web:api.acme.org:employee:doctor1@acme.org:ISCO-08|2211
@@ -10,10 +11,15 @@ export type ParsedActor = {
      * - did:web:api.acme.org:family:<id>:v3-RoleCode|CHILD:<device-uuid>
      */
     sub: string;
-    /** The actor identifier (employee hashed-id/email token, familyId, or raw email). */
+    /** The terminal member identifier (hashed email/phone, family id, or raw email). */
     identifier?: string;
     /** The employee role code if present (e.g. "ISCO-08|2211"). */
     role?: string;
+    /**
+     * Membership domain inferred from the terminal role contract, not from a
+     * provider-specific `member`/`employee` path label.
+     */
+    memberKind?: 'organization' | 'individual';
     /** The base organization did:web if `sub` is did:web (e.g. "did:web:api.acme.org"). */
     organization?: string;
 };

package/dist/utils/actor.js

@@ -11,20 +11,40 @@ export function parseActorFromSub(sub) {
         const host = after.split(':')[0];
         if (host)
             parsed.organization = `did:web:${host}`;
-        // Extract email and role from endpoint-style DID shapes:
-        // did:web:<host>:(employee|family):<id>:<roleSystem>|<roleCode>[:<uuid>]
+        // Member vocabulary is provider-specific (`member`, `employee`, `family`,
+        // `individual-member`, ...). The interoperable identity tuple is the
+        // terminal `<identifier>:<role-system>|<role-code>` pair, optionally
+        // followed by a device id. Do not make consent matching depend on a path
+        // label chosen by a hosted or external DID provider.
         const parts = after.split(':');
-        const employeeIdx = parts.indexOf('employee');
-        const familyIdx = parts.indexOf('family');
-        const idIdx = employeeIdx >= 0 ? employeeIdx + 1 : familyIdx >= 0 ? familyIdx + 1 : -1;
+        const roleIdx = parts.findIndex((part) => {
+            try {
+                return decodeURIComponent(part).includes('|');
+            }
+            catch {
+                return part.includes('|');
+            }
+        });
+        const hasRoleLabel = roleIdx > 0 && parts[roleIdx - 1].toLowerCase() === 'role';
+        const idIdx = roleIdx > 0 ? roleIdx - (hasRoleLabel ? 2 : 1) : -1;
         const identifier = idIdx >= 0 ? parts[idIdx] : undefined;
         if (identifier) {
             parsed.identifier = identifier.includes('@') ? identifier.toLowerCase() : identifier;
         }
-        if (idIdx >= 0 && parts.length > idIdx + 1) {
-            const roleCandidate = parts[idIdx + 1];
-            if (roleCandidate && roleCandidate.includes('|'))
-                parsed.role = roleCandidate;
+        if (roleIdx >= 0) {
+            const encodedRole = parts[roleIdx];
+            try {
+                parsed.role = decodeURIComponent(encodedRole);
+            }
+            catch {
+                parsed.role = encodedRole;
+            }
+            const normalizedRole = String(parsed.role || '').trim().toLowerCase();
+            const pathLabels = parts.slice(1, Math.max(1, idIdx)).map((part) => part.toLowerCase());
+            parsed.memberKind = normalizedRole.startsWith('v3-rolecode|')
+                || pathLabels.some((part) => part === 'family' || part === 'related-person' || part === 'individual-member')
+                ? 'individual'
+                : 'organization';
         }
         return parsed;
     }

package/dist/utils/communication-bundle-document-request.d.ts

@@ -157,8 +157,13 @@ export declare function buildBundleSearchReferenceUrl(input: Readonly<{
  */
 export declare function createSummaryOperationRequestParameters(subjectIdOrInput: string | CreateSummaryOperationParametersInput, filterSections?: string[]): ReadonlyArray<ParameterData>;
 /**
- * Flattens semantic summary-operation parameters to the relative `Bundle/_search`
- * path currently stored in `Communication.content-reference`.
+ * Compatibility escape hatch that flattens semantic summary parameters into a
+ * relative `Bundle/_search` operation reference.
+ *
+ * New application/BFF code uses the actor facade `requestClinicalSummary(...)`.
+ * The facade submits a `Communication`; GW interprets its content reference
+ * internally. Callers must not turn this returned value into a second direct
+ * HTTP request to the subject index.
  */
 export declare function createSummaryOperationRequestReferencePath(parameters: ReadonlyArray<ParameterData>): string;
 /**

package/dist/utils/communication-bundle-document-request.js

@@ -246,8 +246,13 @@ export function createSummaryOperationRequestParameters(subjectIdOrInput, filter
     ];
 }
 /**
- * Flattens semantic summary-operation parameters to the relative `Bundle/_search`
- * path currently stored in `Communication.content-reference`.
+ * Compatibility escape hatch that flattens semantic summary parameters into a
+ * relative `Bundle/_search` operation reference.
+ *
+ * New application/BFF code uses the actor facade `requestClinicalSummary(...)`.
+ * The facade submits a `Communication`; GW interprets its content reference
+ * internally. Callers must not turn this returned value into a second direct
+ * HTTP request to the subject index.
  */
 export function createSummaryOperationRequestReferencePath(parameters) {
     const params = ['type=document'];

package/dist/utils/consent.d.ts

@@ -54,6 +54,10 @@ export type BuildConsentClaimsSimpleInput = SubjectIdentifierInput & {
     consentIdentifier?: string;
     consentDate?: string;
     decision?: 'permit' | 'deny';
+    /** Stable identifier/thread of the permission request that caused this decision. */
+    eventBasedOn?: string;
+    /** Canonical Communication reference for the permission request being answered. */
+    sourceReference?: string;
     attachmentContentType?: string;
     attachmentBase64?: string;
 };

package/dist/utils/consent.js

@@ -169,6 +169,12 @@ export function buildConsentClaimsSimple(input, options = {}) {
             [ClaimConsent.action]: (input.actions || []).join(','),
             [ClaimConsent.actorIdentifier]: actorIdentifier,
             [ClaimConsent.actorRole]: input.actorRole,
+            ...(String(input.eventBasedOn || '').trim()
+                ? { [ClaimConsent.eventBasedOn]: String(input.eventBasedOn).trim() }
+                : {}),
+            ...(String(input.sourceReference || '').trim()
+                ? { [ClaimConsent.sourceReference]: String(input.sourceReference).trim() }
+                : {}),
             [ClaimConsent.attachmentContentType]: input.attachmentContentType || 'application/odrl+json',
             [ClaimConsent.attachmentData]: input.attachmentBase64 || 'e30=',
         },

package/dist/utils/professional-smart.d.ts

@@ -20,6 +20,13 @@ export type ProfessionalSmartVpPayloadInput = Readonly<{
     additionalVp?: Record<string, unknown>;
     additionalPayload?: Record<string, unknown>;
 }>;
+/** Identity fields read from an already-verified professional credential. */
+export type ProfessionalCredentialSummary = Readonly<{
+    actorDid: string;
+    role: string;
+    issuerDid?: string;
+    sameAs: string[];
+}>;
 /**
  * Returns the normalized public continuity aliases for one professional
  * identity VC.
@@ -62,6 +69,16 @@ export declare function getProfessionalIdentityTelephone(input: Readonly<Pick<Pr
  * @param input Professional identity source values.
  */
 export declare function getProfessionalIdentityVC(input: ProfessionalEmployeeCredentialInput): Record<string, unknown>;
+/**
+ * Reads the actor and role asserted by one professional credential. Signature
+ * and employer/issuer trust verification belongs to the enclosing VP verifier.
+ */
+export declare function summarizeProfessionalIdentityCredential(credential: unknown): ProfessionalCredentialSummary | undefined;
+/** Finds the exact actor and role in an already-verified professional VP. */
+export declare function getMatchingProfessionalCredentialFromVpToken(vpToken: string, criteria: Readonly<{
+    actorDid: string;
+    role: string;
+}>): ProfessionalCredentialSummary | undefined;
 /**
  * Backwards-compatible alias kept for existing SMART demo callers.
  *

package/dist/utils/professional-smart.js

@@ -2,6 +2,7 @@ import { ClaimsPersonSchemaorg } from '../constants/schemaorg.js';
 import { ProfessionalCredentialTypes, W3cCredentialTypes, } from '../constants/verifiable-credentials.js';
 import { normalizeSameAsHashCsv, normalizeSameAsHashList, normalizeTelephoneHash } from './same-as.js';
 import { buildUnsignedVpJwt } from './jwt.js';
+import { getVpCredentials } from './vp-token.js';
 /**
  * Returns the normalized public continuity aliases for one professional
  * identity VC.
@@ -84,6 +85,38 @@ export function getProfessionalIdentityVC(input) {
         ...(input.additionalCredential || {}),
     };
 }
+/**
+ * Reads the actor and role asserted by one professional credential. Signature
+ * and employer/issuer trust verification belongs to the enclosing VP verifier.
+ */
+export function summarizeProfessionalIdentityCredential(credential) {
+    const source = credential;
+    const types = Array.isArray(source?.type) ? source.type.map(String) : [String(source?.type || '')];
+    if (!types.includes(ProfessionalCredentialTypes.EmployeeCredential))
+        return undefined;
+    const subject = source?.credentialSubject || {};
+    const actorDid = String(subject.id || '').trim();
+    const role = String(subject.hasOccupation || '').trim();
+    if (!actorDid || !role)
+        return undefined;
+    const issuerDid = String(source?.issuer?.id || source?.issuer || '').trim();
+    return {
+        actorDid,
+        role,
+        ...(issuerDid ? { issuerDid } : {}),
+        sameAs: normalizeSameAsHashList(subject.sameAs),
+    };
+}
+/** Finds the exact actor and role in an already-verified professional VP. */
+export function getMatchingProfessionalCredentialFromVpToken(vpToken, criteria) {
+    const actorDid = String(criteria.actorDid || '').trim();
+    const role = String(criteria.role || '').trim().toLowerCase();
+    return getVpCredentials(vpToken)
+        .map(summarizeProfessionalIdentityCredential)
+        .find((summary) => Boolean(summary
+        && summary.actorDid === actorDid
+        && summary.role.toLowerCase() === role));
+}
 /**
  * Backwards-compatible alias kept for existing SMART demo callers.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-common-utils-ts",
-  "version": "2.3.20",
+  "version": "2.3.22",
   "publishConfig": {
     "access": "public"
   },