gdc-common-utils-ts 2.3.6 → 2.3.8

package/README.md

@@ -59,6 +59,10 @@ boundaries used in `gdc-common-utils-ts`.
 - Only define custom names when no canonical FHIR SearchParameter exists.
 - `resource.meta.claims` is the canonical project-specific claims container and must be preserved across conversions/transports.
 - `resource.meta.claims` is not part of base FHIR; it is a claims-first extension carried by FHIR-like resources in GDC contracts.
+- Native FHIR resources received from EHR systems do not need that extension:
+  normalize them with `normalizeClaimsFromFhirResource(...)` at the processing
+  boundary before indexed storage. Existing `resource.meta.claims` take
+  precedence so SDK-authored semantics survive transport conversion.
 
 ## Identity Continuity
 

package/dist/constants/healthcare.d.ts

@@ -1724,6 +1724,8 @@ export declare const HealthcareActorRoles: Readonly<{
     readonly MidwiferyProfessional: "ISCO-08|2222";
     readonly Paramedic: "ISCO-08|2240";
     readonly Veterinarian: "ISCO-08|2250";
+    /** Administrative health occupation; it does not imply clinical authority. */
+    readonly MedicalSecretary: "ISCO-08|3344";
 }>;
 export declare const HealthcareActorRoleCodes: Readonly<{
     readonly Controller: "1120";
@@ -1744,6 +1746,7 @@ export declare const HealthcareActorRoleCodes: Readonly<{
     readonly MidwiferyProfessional: "2222";
     readonly Paramedic: "2240";
     readonly Veterinarian: "2250";
+    readonly MedicalSecretary: "3344";
 }>;
 export declare const HealthcareRolesByFamily: Readonly<{
     readonly professionalOccupationIsco08: Readonly<Record<string, Readonly<{
@@ -1776,15 +1779,15 @@ export declare const HealthcareRolesByFamily: Readonly<{
 }>;
 export declare const HealthcareAllRolesByClaim: Readonly<Record<string, HealthcareActorRoleDescriptor>>;
 export declare const HealthcareProfessionalRoleCodesBySector: Readonly<{
-    readonly "health-care": readonly ("1120" | "221" | "2211" | "2212" | "2221" | "2222" | "2240")[];
-    readonly "health-research": readonly ("1120" | "221" | "2211" | "2212")[];
+    readonly "health-care": readonly ("1120" | "221" | "2211" | "2212" | "2221" | "2222" | "2240" | "3344")[];
+    readonly "health-research": readonly ("1120" | "221" | "2211" | "2212" | "3344")[];
     readonly "health-tech": readonly "1120"[];
     readonly "health-insurance": readonly "1120"[];
     readonly "animal-care": readonly ("1120" | "2250")[];
     readonly "animal-research": readonly ("1120" | "2250")[];
     readonly "animal-insurance": readonly "1120"[];
     readonly "animal-tech": readonly "1120"[];
-    readonly "onehealth-research": readonly ("1120" | "221" | "2211" | "2212" | "2250")[];
+    readonly "onehealth-research": readonly ("1120" | "221" | "2211" | "2212" | "2250" | "3344")[];
     readonly "onehealth-tech": readonly "1120"[];
 }>;
 export declare const HealthcareProfessionalRolesBySector: Readonly<{

package/dist/constants/healthcare.js

@@ -356,6 +356,8 @@ export const HealthcareActorRoles = Object.freeze({
     MidwiferyProfessional: 'ISCO-08|2222',
     Paramedic: 'ISCO-08|2240',
     Veterinarian: 'ISCO-08|2250',
+    /** Administrative health occupation; it does not imply clinical authority. */
+    MedicalSecretary: 'ISCO-08|3344',
 });
 export const HealthcareActorRoleCodes = Object.freeze({
     Controller: '1120',
@@ -376,6 +378,7 @@ export const HealthcareActorRoleCodes = Object.freeze({
     MidwiferyProfessional: '2222',
     Paramedic: '2240',
     Veterinarian: '2250',
+    MedicalSecretary: '3344',
 });
 function buildProfessionalIscoRoles() {
     const entries = [
@@ -467,6 +470,17 @@ function buildProfessionalIscoRoles() {
                 titleEn: 'Veterinarian',
             }),
         ],
+        [
+            HealthcareActorRoleCodes.MedicalSecretary,
+            Object.freeze({
+                family: HealthcareRoleFamilies.ProfessionalOccupationIsco08,
+                codingSystem: ISCO08_CODING_SYSTEM,
+                code: HealthcareActorRoleCodes.MedicalSecretary,
+                claim: HealthcareActorRoles.MedicalSecretary,
+                i18nKey: `${ISCO08_I18N_NAMESPACE}.${HealthcareActorRoleCodes.MedicalSecretary}`,
+                titleEn: 'Medical secretary',
+            }),
+        ],
     ];
     return Object.freeze(Object.fromEntries(entries));
 }
@@ -523,12 +537,14 @@ export const HealthcareProfessionalRoleCodesBySector = Object.freeze({
         HealthcareActorRoleCodes.NursingProfessional,
         HealthcareActorRoleCodes.MidwiferyProfessional,
         HealthcareActorRoleCodes.Paramedic,
+        HealthcareActorRoleCodes.MedicalSecretary,
     ]),
     [DataspaceSectors.HealthResearch]: Object.freeze([
         HealthcareActorRoleCodes.Controller,
         HealthcareActorRoleCodes.MedicalDoctors,
         HealthcareActorRoleCodes.GeneralistMedicalPractitioner,
         HealthcareActorRoleCodes.SpecialistMedicalPractitioner,
+        HealthcareActorRoleCodes.MedicalSecretary,
     ]),
     [DataspaceSectors.HealthTech]: Object.freeze([HealthcareActorRoleCodes.Controller]),
     [DataspaceSectors.HealthInsurance]: Object.freeze([HealthcareActorRoleCodes.Controller]),
@@ -548,6 +564,7 @@ export const HealthcareProfessionalRoleCodesBySector = Object.freeze({
         HealthcareActorRoleCodes.GeneralistMedicalPractitioner,
         HealthcareActorRoleCodes.SpecialistMedicalPractitioner,
         HealthcareActorRoleCodes.Veterinarian,
+        HealthcareActorRoleCodes.MedicalSecretary,
     ]),
     [DataspaceSectors.OneHealthTech]: Object.freeze([HealthcareActorRoleCodes.Controller]),
 });

package/dist/convert/convert-allergy-intolerance.js

@@ -17,6 +17,9 @@ export function allergyIntoleranceFlatToFhirR4(claims) {
         code: claims[AllergyIntoleranceClaim.Code] ? { coding: codingFromValue(claims[AllergyIntoleranceClaim.Code]) } : undefined,
         clinicalStatus: claims[AllergyIntoleranceClaim.ClinicalStatus] ? { coding: [{ code: claims[AllergyIntoleranceClaim.ClinicalStatus] }] } : undefined,
         verificationStatus: claims[AllergyIntoleranceClaim.VerificationStatus] ? { coding: [{ code: claims[AllergyIntoleranceClaim.VerificationStatus] }] } : undefined,
+        category: claims[AllergyIntoleranceClaim.Category] ? [claims[AllergyIntoleranceClaim.Category]] : undefined,
+        criticality: claims[AllergyIntoleranceClaim.Criticality],
+        onsetDateTime: claims[AllergyIntoleranceClaim.OnsetDateTime],
         recorder: recorder ? { reference: recorder } : undefined,
     };
 }
@@ -30,6 +33,9 @@ export function allergyIntoleranceFhirR4ToFlat(resource) {
         [AllergyIntoleranceClaim.Code]: codingToValue(code?.coding?.[0]) || code?.text,
         [AllergyIntoleranceClaim.ClinicalStatus]: resource.clinicalStatus?.coding?.[0]?.code,
         [AllergyIntoleranceClaim.VerificationStatus]: resource.verificationStatus?.coding?.[0]?.code,
+        [AllergyIntoleranceClaim.Category]: resource.category?.[0],
+        [AllergyIntoleranceClaim.Criticality]: resource.criticality,
+        [AllergyIntoleranceClaim.OnsetDateTime]: resource.onsetDateTime,
         [AllergyIntoleranceClaim.Recorder]: resource.recorder?.reference,
     };
 }

package/dist/convert/schemaorg-to-gaia-x.d.ts

@@ -1,5 +1,5 @@
 import type { ClaimsRecord } from '../models/resource-document';
-import { type GaiaXCredentialDraft, type GaiaXLegalPersonCredentialSubject, type GaiaXServiceOfferingCredentialSubject, type GaiaXVcJwtAttachment, type IcaMemberDiscoveryData } from '../models/gaia-x';
+import { type GaiaXCredentialAttachmentRoleValue, type GaiaXCredentialDraft, type GaiaXLegalPersonCredentialSubject, type GaiaXServiceOfferingCredentialSubject, type GaiaXVcJwtAttachment, type IcaMemberDiscoveryData } from '../models/gaia-x';
 import type { DidDocument } from '../models/did';
 export interface SchemaOrgOrganizationRegistrationIdentifier {
     additionalType: string;
@@ -94,6 +94,27 @@ export declare function buildGaiaXVcJwtAttachment(input: Readonly<{
     jwt: string;
     role: GaiaXVcJwtAttachment['role'];
 }>): GaiaXVcJwtAttachment;
+/**
+ * Enforces the semantic contract of a signed Gaia-X discovery VC-JWT.
+ *
+ * This assertion deliberately does not verify the cryptographic signature.
+ * Signature, issuer, status and trust-chain verification remain the verifier's
+ * responsibility. It prevents a validly shaped schema.org
+ * OrganizationCredential from being merely serialized as JWT and mislabeled
+ * as the distinct Gaia-X participant credential.
+ *
+ * Participant attachments require `gx:LegalPerson` with the ICAM 25.11 legal
+ * properties. Service-offering attachments require `gx:ServiceOffering`,
+ * `gx:providedBy` and `gx:serviceOfferingTermsAndConditions`.
+ *
+ * This validates member-level `data[].attachments[]`; it does not describe
+ * `_retrieve?format=vc+jwt` or credential-internal
+ * `credential.evidence[].attachments`.
+ *
+ * @see https://docs.gaia-x.eu/technical-committee/identity-credential-access-management/25.11/gaia-x_credentials/
+ * @see https://docs.gaia-x.eu/technical-committee/identity-credential-access-management/25.11/semantic_model/
+ */
+export declare function assertGaiaXDiscoveryAttachmentSemantics(jwt: string, role: GaiaXCredentialAttachmentRoleValue): void;
 /**
  * Assembles one ICA member discovery entry and enforces the interoperable
  * ordering contract: schema.org OrganizationCredential first in `vc[]`, and

package/dist/convert/schemaorg-to-gaia-x.js

@@ -174,14 +174,90 @@ export function buildGaiaXParticipantAttachment(input) {
 }
 /** Wraps an exact signed Gaia-X VC-JWT without decoding or re-signing it. */
 export function buildGaiaXVcJwtAttachment(input) {
+    const jwt = requiredInput(input.jwt, 'VC-JWT');
+    assertGaiaXDiscoveryAttachmentSemantics(jwt, input.role);
     return {
         id: requiredInput(input.id, 'attachment id'),
         format: GaiaXCredentialAttachmentFormat,
         role: input.role,
         media_type: GaiaXCredentialMediaType.VcJwt,
-        data: { json: { jwt: requiredInput(input.jwt, 'VC-JWT') } },
+        data: { json: { jwt } },
     };
 }
+function decodeVcJwtCredential(jwt) {
+    const parts = jwt.split('.');
+    if (parts.length !== 3 || parts.some((part) => !part)) {
+        throw new Error('Gaia-X attachment must contain one compact three-part VC-JWT.');
+    }
+    let payload;
+    try {
+        payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
+    }
+    catch {
+        throw new Error('Gaia-X attachment VC-JWT payload is not valid base64url JSON.');
+    }
+    return asObject(payload.vc) || payload;
+}
+function gaiaXCredentialSubject(document) {
+    const raw = document.credentialSubject;
+    if (Array.isArray(raw)) {
+        return raw.map(asObject).find((value) => Boolean(value));
+    }
+    return asObject(raw);
+}
+function requireGaiaXProperties(subject, names, role) {
+    const missing = names.filter((name) => !(name in subject));
+    if (missing.length) {
+        throw new Error(`Gaia-X ${role} VC-JWT is missing required semantic properties: ${missing.join(', ')}.`);
+    }
+}
+/**
+ * Enforces the semantic contract of a signed Gaia-X discovery VC-JWT.
+ *
+ * This assertion deliberately does not verify the cryptographic signature.
+ * Signature, issuer, status and trust-chain verification remain the verifier's
+ * responsibility. It prevents a validly shaped schema.org
+ * OrganizationCredential from being merely serialized as JWT and mislabeled
+ * as the distinct Gaia-X participant credential.
+ *
+ * Participant attachments require `gx:LegalPerson` with the ICAM 25.11 legal
+ * properties. Service-offering attachments require `gx:ServiceOffering`,
+ * `gx:providedBy` and `gx:serviceOfferingTermsAndConditions`.
+ *
+ * This validates member-level `data[].attachments[]`; it does not describe
+ * `_retrieve?format=vc+jwt` or credential-internal
+ * `credential.evidence[].attachments`.
+ *
+ * @see https://docs.gaia-x.eu/technical-committee/identity-credential-access-management/25.11/gaia-x_credentials/
+ * @see https://docs.gaia-x.eu/technical-committee/identity-credential-access-management/25.11/semantic_model/
+ */
+export function assertGaiaXDiscoveryAttachmentSemantics(jwt, role) {
+    const document = decodeVcJwtCredential(jwt);
+    const subject = gaiaXCredentialSubject(document);
+    if (!subject)
+        throw new Error(`Gaia-X ${role} VC-JWT requires one credentialSubject object.`);
+    const subjectType = asString(subject.type);
+    if (role === GaiaXCredentialAttachmentRole.Participant) {
+        if (subjectType !== 'gx:LegalPerson') {
+            throw new Error('Gaia-X participant VC-JWT credentialSubject.type must be gx:LegalPerson.');
+        }
+        requireGaiaXProperties(subject, [
+            'gx:legalName',
+            'gx:legalRegistrationNumber',
+            'gx:headquarterAddress',
+            'gx:legalAddress',
+        ], 'participant');
+    }
+    if (role === GaiaXCredentialAttachmentRole.ServiceOffering) {
+        if (subjectType !== 'gx:ServiceOffering') {
+            throw new Error('Gaia-X service-offering VC-JWT credentialSubject.type must be gx:ServiceOffering.');
+        }
+        requireGaiaXProperties(subject, [
+            'gx:providedBy',
+            'gx:serviceOfferingTermsAndConditions',
+        ], 'service-offering');
+    }
+}
 /**
  * Assembles one ICA member discovery entry and enforces the interoperable
  * ordering contract: schema.org OrganizationCredential first in `vc[]`, and

package/dist/examples/individual-controller.d.ts

@@ -88,9 +88,7 @@ export declare const EXAMPLE_CONSENT_GRANT_INPUT: {
 };
 export declare const EXAMPLE_LIVE_CONSENT_GRANT_INPUT: {
     readonly subjectDid: string;
-    readonly actor: {
-        readonly identifier: "did:web:api.acme.org";
-    };
+    readonly actorId: string;
     readonly actorRole: "ISCO-08|2211";
     readonly purpose: "TREAT";
     readonly actions: readonly [string];

package/dist/examples/individual-controller.js

@@ -1,5 +1,5 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
-import { EXAMPLE_CONTROLLER_DID, EXAMPLE_API_ORGANIZATION_DID, EXAMPLE_CLINICAL_CODE_PROBLEM, EXAMPLE_CLINICAL_DATE_RANGE, EXAMPLE_CLINICAL_SECTION_ALLERGIES, EXAMPLE_CLINICAL_SECTION_PATIENT_SUMMARY, EXAMPLE_CONSENT_PURPOSE_TREATMENT, EXAMPLE_EMAIL_CONTROLLER_INDIVIDUAL, EXAMPLE_GENERIC_SUBJECT_DID, EXAMPLE_HEALTHCARE_ACTOR_ROLE_PHYSICIAN, EXAMPLE_HEALTHCARE_JURISDICTION, EXAMPLE_HEALTHCARE_ROLE_PHYSICIAN_TEXT, EXAMPLE_PRACTITIONER_DID, EXAMPLE_PROFESSIONAL_DID, EXAMPLE_SUBJECT_DID, EXAMPLE_FORM_CONTROLLER_PHONE, } from './shared.js';
+import { EXAMPLE_CONTROLLER_DID, EXAMPLE_CLINICAL_CODE_PROBLEM, EXAMPLE_CLINICAL_DATE_RANGE, EXAMPLE_CLINICAL_SECTION_ALLERGIES, EXAMPLE_CLINICAL_SECTION_PATIENT_SUMMARY, EXAMPLE_CONSENT_PURPOSE_TREATMENT, EXAMPLE_EMAIL_CONTROLLER_INDIVIDUAL, EXAMPLE_GENERIC_SUBJECT_DID, EXAMPLE_HEALTHCARE_ACTOR_ROLE_GENERALIST_MEDICAL_PRACTITIONER, EXAMPLE_HEALTHCARE_JURISDICTION, EXAMPLE_HEALTHCARE_ROLE_PHYSICIAN_TEXT, EXAMPLE_PRACTITIONER_DID, EXAMPLE_PROFESSIONAL_DID, EXAMPLE_SUBJECT_DID, EXAMPLE_FORM_CONTROLLER_PHONE, } from './shared.js';
 export const EXAMPLE_INDIVIDUAL_ORGANIZATION_START_INPUT = {
     alternateName: 'ana',
     controllerEmail: EXAMPLE_EMAIL_CONTROLLER_INDIVIDUAL,
@@ -57,8 +57,8 @@ export const EXAMPLE_CONSENT_GRANT_INPUT = {
 };
 export const EXAMPLE_LIVE_CONSENT_GRANT_INPUT = {
     subjectDid: EXAMPLE_SUBJECT_DID,
-    actor: { identifier: EXAMPLE_API_ORGANIZATION_DID },
-    actorRole: EXAMPLE_HEALTHCARE_ACTOR_ROLE_PHYSICIAN,
+    actorId: EXAMPLE_PROFESSIONAL_DID,
+    actorRole: EXAMPLE_HEALTHCARE_ACTOR_ROLE_GENERALIST_MEDICAL_PRACTITIONER,
     purpose: EXAMPLE_CONSENT_PURPOSE_TREATMENT,
     actions: [EXAMPLE_CLINICAL_SECTION_ALLERGIES],
 };

package/dist/examples/professional.d.ts

@@ -75,36 +75,36 @@ export declare const EXAMPLE_SEARCH_CLINICAL_BUNDLE_INPUT: {
  *
  * - use `EXAMPLE_TOKEN_EXCHANGE_SMART_INPUT` or `EXAMPLE_OPENID_SMART_TOKEN_INPUT`
  *   for the first read-only examples
- * - use the scenarios below when you explicitly want the composition read scope
- *   plus `organization/Consent.cruds`
+ * - do not append `organization/Consent.cruds` to a clinical read unless a
+ *   separate rule explicitly grants that resource capability
  */
 export declare const EXAMPLE_PROFESSIONAL_ACCESS_SCENARIOS: Readonly<{
     readonly physicianAllergiesRead: {
         readonly actorRole: "ISCO-08|2211";
         readonly purpose: "TREAT";
         readonly consentActions: readonly [string];
-        readonly smartScopes: readonly [string, "organization/Consent.cruds"];
+        readonly smartScopes: readonly [string];
         readonly includedTypes: readonly ["Composition", "AllergyIntolerance", "DocumentReference"];
     };
     readonly nursingMedicationRead: {
         readonly actorRole: "ISCO-08|2221";
         readonly purpose: "TREAT";
         readonly consentActions: readonly [string];
-        readonly smartScopes: readonly [string, "organization/Consent.cruds"];
+        readonly smartScopes: readonly [string];
         readonly includedTypes: readonly ["Composition", "MedicationStatement", "DocumentReference"];
     };
     readonly paramedicEmergencySummaryRead: {
         readonly actorRole: "ISCO-08|2240";
         readonly purpose: "ETREAT";
         readonly consentActions: readonly [string];
-        readonly smartScopes: readonly [string, "organization/Consent.cruds"];
+        readonly smartScopes: readonly [string];
         readonly includedTypes: readonly ["Composition", "DocumentReference", "Observation"];
     };
     readonly physicianResultsAndProblemsRead: {
         readonly actorRole: "ISCO-08|2211";
         readonly purpose: "TREAT";
         readonly consentActions: readonly [string, string];
-        readonly smartScopes: readonly [string, "organization/Consent.cruds"];
+        readonly smartScopes: readonly [string];
         readonly includedTypes: readonly ["Composition", "Condition", "DiagnosticReport", "DocumentReference"];
     };
 }>;

package/dist/examples/professional.js

@@ -1,7 +1,6 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
-import { HealthcareActorRoles, HealthcareBasicSections, HealthcareConsentPurposes, } from '../constants/healthcare.js';
+import { HealthcareActorRoles, HealthcareBasicSections, HealthcareConsentActions, HealthcareConsentPurposes, } from '../constants/healthcare.js';
 import { ResourceTypesFhirR4 } from '../constants/fhir-resource-types.js';
-import { SmartGatewayScopesFhirR4 } from '../constants/smart.js';
 import { buildSmartCompositionReadScope } from '../utils/smart-scope.js';
 import { EXAMPLE_CLINICAL_SECTION_ALLERGIES, EXAMPLE_EMAIL_PROFESSIONAL, EXAMPLE_HEALTHCARE_JURISDICTION, EXAMPLE_PATIENT_DID, EXAMPLE_PROVIDER_ORGANIZATION_URL, EXAMPLE_SUBJECT_DID, } from './shared.js';
 /**
@@ -12,7 +11,7 @@ import { EXAMPLE_CLINICAL_SECTION_ALLERGIES, EXAMPLE_EMAIL_PROFESSIONAL, EXAMPLE
  * - the actor role of the professional (`Physician`, `NursingProfessional`, ...)
  * - the consented action/section over an individual subject
  * - the SMART scope ultimately requested against GW CORE
- * - the difference between a minimal read scope and an elevated consent-management scope
+ * - a read scope containing only capabilities covered by the consent
  *
  * This differs from organization-controller and individual-owner bootstrap
  * examples, where the main concern is identity/bootstrap rather than
@@ -28,10 +27,6 @@ const EXAMPLE_CANONICAL_SMART_READ_SCOPES = [
         sections: EXAMPLE_CLINICAL_SECTION_ALLERGIES,
     }),
 ];
-const EXAMPLE_CANONICAL_SMART_SCOPES = [
-    ...EXAMPLE_CANONICAL_SMART_READ_SCOPES,
-    SmartGatewayScopesFhirR4.ConsentCruds,
-];
 export const EXAMPLE_TOKEN_EXCHANGE_SMART_INPUT = {
     idToken: 'employee-id-token-001',
     scopes: [...EXAMPLE_CANONICAL_SMART_READ_SCOPES],
@@ -99,20 +94,19 @@ export const EXAMPLE_SEARCH_CLINICAL_BUNDLE_INPUT = {
  *
  * - use `EXAMPLE_TOKEN_EXCHANGE_SMART_INPUT` or `EXAMPLE_OPENID_SMART_TOKEN_INPUT`
  *   for the first read-only examples
- * - use the scenarios below when you explicitly want the composition read scope
- *   plus `organization/Consent.cruds`
+ * - do not append `organization/Consent.cruds` to a clinical read unless a
+ *   separate rule explicitly grants that resource capability
  */
 export const EXAMPLE_PROFESSIONAL_ACCESS_SCENARIOS = Object.freeze({
     physicianAllergiesRead: {
-        actorRole: HealthcareActorRoles.Physician,
+        actorRole: HealthcareActorRoles.GeneralistMedicalPractitioner,
         purpose: HealthcareConsentPurposes.Treatment,
-        consentActions: [HealthcareBasicSections.AllergiesAndIntolerances.claim],
+        consentActions: [HealthcareConsentActions.AllergiesAndIntolerances],
         smartScopes: [
             buildSmartCompositionReadScope({
                 subjectDid: EXAMPLE_SMART_SUBJECT_DID,
-                sections: HealthcareBasicSections.AllergiesAndIntolerances.claim,
+                sections: HealthcareConsentActions.AllergiesAndIntolerances,
             }),
-            SmartGatewayScopesFhirR4.ConsentCruds,
         ],
         includedTypes: [
             ResourceTypesFhirR4.Composition,
@@ -129,7 +123,6 @@ export const EXAMPLE_PROFESSIONAL_ACCESS_SCENARIOS = Object.freeze({
                 subjectDid: EXAMPLE_SMART_SUBJECT_DID,
                 sections: HealthcareBasicSections.HistoryOfMedicationUse.claim,
             }),
-            SmartGatewayScopesFhirR4.ConsentCruds,
         ],
         includedTypes: [
             ResourceTypesFhirR4.Composition,
@@ -146,7 +139,6 @@ export const EXAMPLE_PROFESSIONAL_ACCESS_SCENARIOS = Object.freeze({
                 subjectDid: EXAMPLE_SMART_SUBJECT_DID,
                 sections: HealthcareBasicSections.PatientSummaryDocument.claim,
             }),
-            SmartGatewayScopesFhirR4.ConsentCruds,
         ],
         includedTypes: [
             ResourceTypesFhirR4.Composition,
@@ -155,7 +147,7 @@ export const EXAMPLE_PROFESSIONAL_ACCESS_SCENARIOS = Object.freeze({
         ],
     },
     physicianResultsAndProblemsRead: {
-        actorRole: HealthcareActorRoles.Physician,
+        actorRole: HealthcareActorRoles.GeneralistMedicalPractitioner,
         purpose: HealthcareConsentPurposes.Treatment,
         consentActions: [
             HealthcareBasicSections.Results.claim,
@@ -169,7 +161,6 @@ export const EXAMPLE_PROFESSIONAL_ACCESS_SCENARIOS = Object.freeze({
                     HealthcareBasicSections.ProblemList.claim,
                 ],
             }),
-            SmartGatewayScopesFhirR4.ConsentCruds,
         ],
         includedTypes: [
             ResourceTypesFhirR4.Composition,
@@ -190,7 +181,6 @@ function buildConsentDecisionScenario(params) {
                 subjectDid: EXAMPLE_SMART_SUBJECT_DID,
                 sections: params.requestedSections,
             }),
-            SmartGatewayScopesFhirR4.ConsentCruds,
         ],
         includedTypes: [...params.includedTypes],
         expectedSmartTokenDecision: params.expectedSmartTokenDecision,
@@ -212,7 +202,7 @@ function buildConsentDecisionScenario(params) {
 export const EXAMPLE_PROFESSIONAL_CONSENT_SCENARIOS = Object.freeze({
     physicianByEmailContinuousCareAllergiesAllowed: buildConsentDecisionScenario({
         actorId: EXAMPLE_PHYSICIAN_EMAIL,
-        actorRole: HealthcareActorRoles.Physician,
+        actorRole: HealthcareActorRoles.GeneralistMedicalPractitioner,
         purpose: HealthcareConsentPurposes.Treatment,
         consentActions: [HealthcareBasicSections.AllergiesAndIntolerances.claim],
         requestedSections: HealthcareBasicSections.AllergiesAndIntolerances.claim,
@@ -226,7 +216,7 @@ export const EXAMPLE_PROFESSIONAL_CONSENT_SCENARIOS = Object.freeze({
     }),
     physicianByEmailEmergencySummaryAllowed: buildConsentDecisionScenario({
         actorId: EXAMPLE_PHYSICIAN_EMAIL,
-        actorRole: HealthcareActorRoles.Physician,
+        actorRole: HealthcareActorRoles.GeneralistMedicalPractitioner,
         purpose: HealthcareConsentPurposes.EmergencyTreatment,
         consentActions: [HealthcareBasicSections.PatientSummaryDocument.claim],
         requestedSections: HealthcareBasicSections.PatientSummaryDocument.claim,
@@ -240,7 +230,7 @@ export const EXAMPLE_PROFESSIONAL_CONSENT_SCENARIOS = Object.freeze({
     }),
     physicianByOrganizationResultsAllowed: buildConsentDecisionScenario({
         actorId: { organizationUrl: EXAMPLE_PROVIDER_ORG_URL },
-        actorRole: HealthcareActorRoles.Physician,
+        actorRole: HealthcareActorRoles.GeneralistMedicalPractitioner,
         purpose: HealthcareConsentPurposes.Treatment,
         consentActions: [HealthcareBasicSections.Results.claim],
         requestedSections: HealthcareBasicSections.Results.claim,
@@ -254,7 +244,7 @@ export const EXAMPLE_PROFESSIONAL_CONSENT_SCENARIOS = Object.freeze({
     }),
     physicianByJurisdictionEmergencySummaryAllowed: buildConsentDecisionScenario({
         actorId: EXAMPLE_JURISDICTION,
-        actorRole: HealthcareActorRoles.Physician,
+        actorRole: HealthcareActorRoles.GeneralistMedicalPractitioner,
         purpose: HealthcareConsentPurposes.EmergencyTreatment,
         consentActions: [HealthcareBasicSections.PatientSummaryDocument.claim],
         requestedSections: HealthcareBasicSections.PatientSummaryDocument.claim,
@@ -296,7 +286,7 @@ export const EXAMPLE_PROFESSIONAL_CONSENT_SCENARIOS = Object.freeze({
     }),
     physicianObstetricianDeniedWhenOnlyAllergiesConsent: buildConsentDecisionScenario({
         actorId: EXAMPLE_PHYSICIAN_EMAIL,
-        actorRole: `${HealthcareActorRoles.Physician}:obstetrician`,
+        actorRole: `${HealthcareActorRoles.GeneralistMedicalPractitioner}:obstetrician`,
         purpose: HealthcareConsentPurposes.Treatment,
         consentActions: [HealthcareBasicSections.AllergiesAndIntolerances.claim],
         requestedSections: HealthcareBasicSections.Results.claim,
@@ -310,7 +300,7 @@ export const EXAMPLE_PROFESSIONAL_CONSENT_SCENARIOS = Object.freeze({
     }),
     physicianByEmailDeniedWhenConsentRevokedAndNoOrgNorJurisdictionConsentIsActive: buildConsentDecisionScenario({
         actorId: EXAMPLE_PHYSICIAN_EMAIL,
-        actorRole: HealthcareActorRoles.Physician,
+        actorRole: HealthcareActorRoles.GeneralistMedicalPractitioner,
         purpose: HealthcareConsentPurposes.EmergencyTreatment,
         consentActions: [HealthcareBasicSections.PatientSummaryDocument.claim],
         requestedSections: HealthcareBasicSections.PatientSummaryDocument.claim,

package/dist/examples/shared.js

@@ -128,7 +128,7 @@ export const EXAMPLE_SERVICE_PUBLIC_DID = 'did:web:public.acme.org';
 export const EXAMPLE_PROFESSIONAL_DID = buildProfessionalDidWeb({
     organizationDidWeb: 'did:web:api.acme.org',
     email: 'doctor.oncall@example.org',
-    role: HealthcareActorRoles.Physician,
+    role: HealthcareActorRoles.GeneralistMedicalPractitioner,
 });
 export const EXAMPLE_PROVIDER_ORGANIZATION_DID = 'did:web:hospital.acme.org';
 export const EXAMPLE_PROVIDER_ORGANIZATION_URL = 'https://hospital.acme.org';

package/dist/utils/did.d.ts

@@ -148,7 +148,13 @@ export declare function buildOrganizationDidWeb(input: {
 /**
  * Builds a professional/member DID under a hosted organization DID.
  *
- * The stable actor identifier is derived from the email using multibase(base58btc(multihash(sha384))).
+ * The stable actor path identifier is derived from the lower-cased email using
+ * multibase(base58btc(multihash(SHA3-256))). The raw email is never embedded
+ * in the DID.
+ *
+ * This is the same multibase payload used by the ICA-compatible credential
+ * `sameAs`; only the representation differs: the DID path uses `z...` and the
+ * credential alias uses `urn:multibase:z...`.
  *
  * @param input.organizationDidWeb Canonical hosted organization DID.
  * @param input.email Professional email used to derive a stable member identifier.

package/dist/utils/did.js

@@ -1,6 +1,6 @@
 // crypto-ts/utils/did.ts
 // Copyright 2025 Antifraud Services Inc. under the Apache License, Version 2.0.
-import { encodeMultibaseSha384 } from './multibasehash.js';
+import { multibase58MultihashSha3_256 } from './same-as.js';
 /**
  * Canonical DID path markers for hosted/provider individual identities.
  *
@@ -240,7 +240,13 @@ export function buildOrganizationDidWeb(input) {
 /**
  * Builds a professional/member DID under a hosted organization DID.
  *
- * The stable actor identifier is derived from the email using multibase(base58btc(multihash(sha384))).
+ * The stable actor path identifier is derived from the lower-cased email using
+ * multibase(base58btc(multihash(SHA3-256))). The raw email is never embedded
+ * in the DID.
+ *
+ * This is the same multibase payload used by the ICA-compatible credential
+ * `sameAs`; only the representation differs: the DID path uses `z...` and the
+ * credential alias uses `urn:multibase:z...`.
  *
  * @param input.organizationDidWeb Canonical hosted organization DID.
  * @param input.email Professional email used to derive a stable member identifier.
@@ -254,7 +260,7 @@ export function buildProfessionalDidWeb(input) {
         throw new Error('buildProfessionalDidWeb requires email.');
     if (!role)
         throw new Error('buildProfessionalDidWeb requires role.');
-    const memberId = encodeMultibaseSha384(normalizedEmail);
+    const memberId = multibase58MultihashSha3_256(normalizedEmail);
     return [
         String(input.organizationDidWeb).trim(),
         'employee',

package/dist/utils/professional-smart.d.ts

@@ -29,6 +29,10 @@ export type ProfessionalSmartVpPayloadInput = Readonly<{
  * - otherwise the public employee email
  *
  * When both are present they are merged and deduplicated after normalization.
+ * Plain emails become ICA-compatible
+ * `urn:multibase:<base58btc(multihash(SHA3-256))>` values. The multibase
+ * payload is the same value used in the professional DID actor path; `sameAs`
+ * adds only the `urn:multibase:` prefix.
  *
  * @param input Professional identity source values.
  */

package/dist/utils/professional-smart.js

@@ -11,6 +11,10 @@ import { buildUnsignedVpJwt } from './jwt.js';
  * - otherwise the public employee email
  *
  * When both are present they are merged and deduplicated after normalization.
+ * Plain emails become ICA-compatible
+ * `urn:multibase:<base58btc(multihash(SHA3-256))>` values. The multibase
+ * payload is the same value used in the professional DID actor path; `sameAs`
+ * adds only the `urn:multibase:` prefix.
  *
  * @param input Professional identity source values.
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-common-utils-ts",
-  "version": "2.3.6",
+  "version": "2.3.8",
   "publishConfig": {
     "access": "public"
   },