gdc-sdk-front-ts 2.1.2 → 2.3.0

package/dist/orchestration/client-port.d.ts

@@ -3,10 +3,16 @@ import type { LicenseListSearchState } from 'gdc-common-utils-ts/utils/license-l
 import type { LicenseOfferSearchState, LicenseOrderSearchState } from 'gdc-common-utils-ts/utils/license-commercial-search';
 import type { IndividualOrganizationLifecycleEditor } from 'gdc-common-utils-ts/utils/individual-organization-lifecycle';
 import type { IndividualOnboardingDraftInput, IndividualOnboardingDraftResult } from 'gdc-common-utils-ts/models/individual-onboarding';
-import type { BundleSearchQuery, CommunicationInput, EmployeeSearchValue, HostLifecycleInput, HostRouteContext, HostedTenantLifecycleInput, OrganizationDidBindingInput, LegalOrganizationOrderInput, PollOptions, SmartTokenRequestContract, SubmitAndPollResult, SubmitPayload } from 'gdc-sdk-core-ts';
+import type { BundleSearchQuery, CommMsgExtendedCommunicationOutboxJob, CommunicationOutboxJob, CommunicationInput, EmployeeSearchValue, HostLifecycleInput, HostRouteContext, HostedTenantLifecycleInput, OrganizationDidBindingInput, LegalOrganizationOrderInput, PollOptions, SmartTokenRequestContract, SubmitAndPollResult, SubmitPayload, TransportProfile } from 'gdc-sdk-core-ts';
 export type FrontRouteContext = {
     providerDid: string;
     idToken: string;
+    /** Direct-to-GW runtimes use the SMART access token, never the login token. */
+    accessToken?: string;
+    /** Direct mobile/browser runtimes require explicit GW routing. */
+    tenantId?: string;
+    jurisdiction?: string;
+    sector?: string;
     requiredScope?: string;
     format?: 'org.hl7.fhir.r4' | 'org.hl7.fhir.api';
 };
@@ -118,11 +124,23 @@ export type FrontRelatedPersonUpsertInput = {
     relatedPersonPayload: object;
 };
 export type FrontCommunicationIngestionInput = {
-    communicationPayload: CommunicationInput & Record<string, unknown>;
+    /** Preferred claims-first job created by `createCommunicationOutboxJobFromCommMsgExtendedDraft(...)`. */
+    communicationJob?: CommunicationOutboxJob | CommMsgExtendedCommunicationOutboxJob;
+    /** Compatibility escape hatch for an already-rendered channel payload. */
+    communicationPayload?: CommunicationInput & Record<string, unknown>;
+    /** Claims-first representation rendered before transport. */
+    clinicalFormat?: string;
+    /** @deprecated Use `clinicalFormat`. */
     pathFormatSegment?: 'org.hl7.fhir.r4' | 'org.hl7.fhir.api';
+    transportProfile?: TransportProfile;
+    pollOptions?: PollOptions;
 };
-export type FrontClinicalBundleSearchInput = BundleSearchQuery & {
+export type FrontClinicalBundleSearchInput = Omit<BundleSearchQuery, 'section' | 'searchParams'> & {
+    section?: string | string[];
+    extraSearchParams?: BundleSearchQuery['searchParams'];
     requestThid?: string;
+    transportProfile?: TransportProfile;
+    pollOptions?: PollOptions;
 };
 export type FrontGrantProfessionalAccessInput = {
     subjectDid?: string;

package/dist/orchestration/individual-member-sdk.d.ts

@@ -1,8 +1,18 @@
 import type { SubmitAndPollResult } from 'gdc-sdk-core-ts';
-import { type FrontRelatedPersonUpsertInput, type FrontRouteContext, type FrontRuntimeClient, type FrontSmartTokenExchangeResult, type FrontSmartTokenRequestInput } from './client-port.js';
+import { type FrontClinicalBundleSearchInput, type FrontCommunicationIngestionInput, type FrontRelatedPersonUpsertInput, type FrontRouteContext, type FrontRuntimeClient, type FrontSmartTokenExchangeResult, type FrontSmartTokenRequestInput } from './client-port.js';
 export declare class IndividualMemberSdk {
     private readonly client;
     constructor(client: FrontRuntimeClient);
     upsertRelatedPersonAndPoll(ctx: FrontRouteContext, input: FrontRelatedPersonUpsertInput): Promise<SubmitAndPollResult>;
     requestSmartToken(input: FrontSmartTokenRequestInput): Promise<FrontSmartTokenExchangeResult>;
+    /** Delegates a permitted member write to the same canonical clinical outbox. */
+    ingestCommunicationAndUpdateIndex(ctx: FrontRouteContext, input: FrontCommunicationIngestionInput): Promise<SubmitAndPollResult>;
+    /** Reads clinical documents under the member's accepted consent and SMART scopes. */
+    searchClinicalBundle(ctx: FrontRouteContext, input: FrontClinicalBundleSearchInput): Promise<{
+        thid: string;
+    }>;
+    /** Reads the latest IPS permitted for this member and subject. */
+    getLatestIps(ctx: FrontRouteContext, subject: string): Promise<{
+        thid: string;
+    }>;
 }

package/dist/orchestration/individual-member-sdk.js

@@ -10,4 +10,16 @@ export class IndividualMemberSdk {
     requestSmartToken(input) {
         return requireClientMethod(this.client, 'requestSmartToken')(input);
     }
+    /** Delegates a permitted member write to the same canonical clinical outbox. */
+    ingestCommunicationAndUpdateIndex(ctx, input) {
+        return requireClientMethod(this.client, 'ingestCommunicationAndUpdateIndex')(ctx, input);
+    }
+    /** Reads clinical documents under the member's accepted consent and SMART scopes. */
+    searchClinicalBundle(ctx, input) {
+        return requireClientMethod(this.client, 'searchClinicalBundle')(ctx, input);
+    }
+    /** Reads the latest IPS permitted for this member and subject. */
+    getLatestIps(ctx, subject) {
+        return requireClientMethod(this.client, 'getLatestIps')(ctx, subject);
+    }
 }

package/dist/orchestration/professional-sdk.d.ts

@@ -1,6 +1,6 @@
 import { type ProfessionalEmployeeCredentialInput, type ProfessionalSmartVpPayloadInput } from 'gdc-common-utils-ts';
 import type { PollOptions, SubmitAndPollResult, SubmitPayload } from 'gdc-sdk-core-ts';
-import { type FrontCommunicationIngestionInput, type FrontGrantProfessionalAccessInput, type FrontGrantProfessionalAccessResult, type FrontRouteContext, type FrontRuntimeClient, type FrontSmartTokenExchangeResult, type FrontSmartTokenRequestInput } from './client-port.js';
+import { type FrontClinicalBundleSearchInput, type FrontCommunicationIngestionInput, type FrontGrantProfessionalAccessInput, type FrontGrantProfessionalAccessResult, type FrontRouteContext, type FrontRuntimeClient, type FrontSmartTokenExchangeResult, type FrontSmartTokenRequestInput } from './client-port.js';
 export declare class ProfessionalSdk {
     private readonly client;
     constructor(client: FrontRuntimeClient);
@@ -31,5 +31,11 @@ export declare class ProfessionalSdk {
     }>): string;
     ingestCommunicationAndUpdateIndex(ctx: FrontRouteContext, input: FrontCommunicationIngestionInput): Promise<SubmitAndPollResult>;
     grantProfessionalAccess(ctx: FrontRouteContext, input: FrontGrantProfessionalAccessInput): Promise<FrontGrantProfessionalAccessResult>;
+    searchClinicalBundle(ctx: FrontRouteContext, input: FrontClinicalBundleSearchInput): Promise<{
+        thid: string;
+    }>;
+    getLatestIps(ctx: FrontRouteContext, subject: string): Promise<{
+        thid: string;
+    }>;
     submitAndPoll(submitPath: string, pollPath: string, payload: SubmitPayload, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
 }

package/dist/orchestration/professional-sdk.js

@@ -42,6 +42,12 @@ export class ProfessionalSdk {
     grantProfessionalAccess(ctx, input) {
         return requireClientMethod(this.client, 'grantProfessionalAccess')(ctx, input);
     }
+    searchClinicalBundle(ctx, input) {
+        return requireClientMethod(this.client, 'searchClinicalBundle')(ctx, input);
+    }
+    getLatestIps(ctx, subject) {
+        return requireClientMethod(this.client, 'getLatestIps')(ctx, subject);
+    }
     submitAndPoll(submitPath, pollPath, payload, pollOptions) {
         return requireClientMethod(this.client, 'submitAndPoll')(submitPath, pollPath, payload, pollOptions);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-sdk-front-ts",
-  "version": "2.1.2",
+  "version": "2.3.0",
   "description": "Next-generation frontend runtime package for the GDC SDK family",
   "license": "Apache-2.0",
   "author": "Antifraud Services Inc.",
@@ -17,8 +17,8 @@
   },
   "dependencies": {
     "@babel/runtime": "^7.28.4",
-    "gdc-common-utils-ts": "^2.1.2",
-    "gdc-sdk-core-ts": "~2.1.2"
+    "gdc-common-utils-ts": "^2.3.0",
+    "gdc-sdk-core-ts": "~2.3.0"
   },
   "devDependencies": {
     "@types/node": "^20.14.10",

package/dist/discovery/HttpDataspaceDiscoveryClient.d.ts

@@ -1,34 +0,0 @@
-import type { DataspaceDiscoveryClient } from './DataspaceDiscoveryClient.js';
-import type { ListPublishedProvidersInput, ListPublishedProvidersResult } from './types.js';
-type DiscoveryFetchResponse = Readonly<{
-    ok: boolean;
-    status: number;
-    json(): Promise<unknown>;
-}>;
-export type FrontendDiscoveryFetch = (input: string, init?: Readonly<{
-    method?: string;
-    headers?: Record<string, string>;
-    body?: string;
-}>) => Promise<DiscoveryFetchResponse>;
-export type HttpDataspaceDiscoveryClientOptions = Readonly<{
-    baseUrl: string;
-    fetcher?: FrontendDiscoveryFetch;
-    endpointPath?: string;
-    headers?: Record<string, string>;
-}>;
-/**
- * HTTP/BFF-first frontend discovery client.
- */
-export declare class HttpDataspaceDiscoveryClient implements DataspaceDiscoveryClient {
-    private readonly baseUrl;
-    private readonly fetcher;
-    private readonly endpointPath;
-    private readonly headers;
-    constructor(options: HttpDataspaceDiscoveryClientOptions);
-    /**
-     * Calls the configured backend/BFF endpoint and maps normalized discovery
-     * DTOs into UI-facing cards.
-     */
-    listPublishedProviders(input: ListPublishedProvidersInput): Promise<ListPublishedProvidersResult>;
-}
-export {};

package/dist/discovery/HttpDataspaceDiscoveryClient.js

@@ -1,47 +0,0 @@
-// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
-import { mapHostingOperatorRecordToCard, mapPublishedProviderRecordToCard } from './mappers.js';
-function defaultFetch(input, init) {
-    return fetch(input, init);
-}
-/**
- * HTTP/BFF-first frontend discovery client.
- */
-export class HttpDataspaceDiscoveryClient {
-    constructor(options) {
-        this.baseUrl = new URL(options.baseUrl.endsWith('/') ? options.baseUrl : `${options.baseUrl}/`);
-        this.fetcher = options.fetcher || defaultFetch;
-        this.endpointPath = options.endpointPath || '/api/dataspace-discovery/providers';
-        this.headers = { ...(options.headers || {}) };
-    }
-    /**
-     * Calls the configured backend/BFF endpoint and maps normalized discovery
-     * DTOs into UI-facing cards.
-     */
-    async listPublishedProviders(input) {
-        const response = await this.fetcher(new URL(this.endpointPath.replace(/^\//, ''), this.baseUrl).href, {
-            method: 'POST',
-            headers: {
-                'content-type': 'application/json',
-                ...this.headers,
-            },
-            body: JSON.stringify(input),
-        });
-        if (!response.ok) {
-            throw new Error(`Failed to load dataspace discovery results (${response.status}).`);
-        }
-        const body = await response.json();
-        const providers = Array.isArray(body.providers)
-            ? body.providers.map((record) => mapPublishedProviderRecordToCard(record))
-            : [];
-        const hostingOperators = Array.isArray(body.hostingOperators)
-            ? body.hostingOperators.map((entry) => mapHostingOperatorRecordToCard(entry.record, {
-                catalogUrl: entry.catalogUrl,
-                title: entry.title,
-            }))
-            : [];
-        return {
-            providers,
-            ...(hostingOperators.length ? { hostingOperators } : {}),
-        };
-    }
-}

package/dist/gdc-common-utils-ts/src/AesManager.d.ts

@@ -1,27 +0,0 @@
-import { ProtectedDataAES } from './models/aes';
-/**
- * Manages AES-GCM encryption and decryption using Node's native crypto module.
- * This class handles the core cryptography and the base64url serialization required for JWE.
- */
-export declare class AesManager {
-    private readonly ALGORITHM;
-    private readonly KEY_SIZE;
-    private readonly IV_GENERATION_SIZE;
-    private readonly TAG_SIZE_BYTES;
-    /**
-     * Encrypts a plaintext string and returns the components as base64url strings.
-     * @param plaintext The stringified data to encrypt (e.g. a stringified object or ASCII string from raw bytes)
-     * @param cekBytes The 32-byte Content Encryption Key.
-     * @param aad The Additional Authenticated Data string for integrity protection.
-     * @returns A promise resolving to the JWE-compatible encrypted components.
-     */
-    encrypt(plaintext: string, cekBytes: Uint8Array, aad: string): Promise<ProtectedDataAES>;
-    /**
-     * Decrypts JWE-compatible encrypted components back to a plaintext string.
-     * @param encryptedData The object containing the base64url-encoded ciphertext, iv, and tag.
-     * @param cekBytes The 32-byte Content Encryption Key.
-     * @param aad The Additional Authenticated Data for integrity verification.
-     * @returns A promise resolving to the decrypted plaintext string.
-     */
-    decrypt(encryptedData: ProtectedDataAES, cekBytes: Uint8Array, aad: string): Promise<string>;
-}

package/dist/gdc-common-utils-ts/src/AesManager.js

@@ -1,64 +0,0 @@
-// Copyright 2025 Antifraud Services Inc. under the Apache License, Version 2.0.
-// File: crypto-ts/AesManager.ts
-import { createCipheriv, createDecipheriv, randomBytes } from 'crypto';
-import { Content } from './utils/content';
-/**
- * Manages AES-GCM encryption and decryption using Node's native crypto module.
- * This class handles the core cryptography and the base64url serialization required for JWE.
- */
-export class AesManager {
-    constructor() {
-        this.ALGORITHM = 'aes-256-gcm';
-        this.KEY_SIZE = 32; // 256-bit key
-        this.IV_GENERATION_SIZE = 12; // 96-bit IV, recommended by NIST for GCM
-        this.TAG_SIZE_BYTES = 16; // 128-bit authentication tag
-    }
-    /**
-     * Encrypts a plaintext string and returns the components as base64url strings.
-     * @param plaintext The stringified data to encrypt (e.g. a stringified object or ASCII string from raw bytes)
-     * @param cekBytes The 32-byte Content Encryption Key.
-     * @param aad The Additional Authenticated Data string for integrity protection.
-     * @returns A promise resolving to the JWE-compatible encrypted components.
-     */
-    async encrypt(plaintext, cekBytes, aad) {
-        if (cekBytes.length !== this.KEY_SIZE) {
-            throw new Error(`Invalid key length: a ${this.KEY_SIZE}-byte key is required.`);
-        }
-        const iv = randomBytes(this.IV_GENERATION_SIZE);
-        const aadBytes = Content.stringToBytesUTF8(aad);
-        const cipher = createCipheriv(this.ALGORITHM, cekBytes, iv, {
-            authTagLength: this.TAG_SIZE_BYTES
-        });
-        cipher.setAAD(aadBytes);
-        const ciphertext = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
-        const tag = cipher.getAuthTag();
-        return {
-            ciphertext: Content.bytesToRawBase64UrlSafe(ciphertext),
-            iv: Content.bytesToRawBase64UrlSafe(iv),
-            tag: Content.bytesToRawBase64UrlSafe(tag),
-        };
-    }
-    /**
-     * Decrypts JWE-compatible encrypted components back to a plaintext string.
-     * @param encryptedData The object containing the base64url-encoded ciphertext, iv, and tag.
-     * @param cekBytes The 32-byte Content Encryption Key.
-     * @param aad The Additional Authenticated Data for integrity verification.
-     * @returns A promise resolving to the decrypted plaintext string.
-     */
-    async decrypt(encryptedData, cekBytes, aad) {
-        if (cekBytes.length !== this.KEY_SIZE) {
-            throw new Error(`Invalid key length: a ${this.KEY_SIZE}-byte key is required.`);
-        }
-        const ciphertextBytes = Content.base64ToBytes(encryptedData.ciphertext);
-        const tagBytes = Content.base64ToBytes(encryptedData.tag);
-        const ivBytes = Content.base64ToBytes(encryptedData.iv);
-        const aadBytes = Content.stringToBytesUTF8(aad);
-        const decipher = createDecipheriv(this.ALGORITHM, cekBytes, ivBytes, {
-            authTagLength: this.TAG_SIZE_BYTES
-        });
-        decipher.setAuthTag(tagBytes);
-        decipher.setAAD(aadBytes);
-        const decryptedBytes = Buffer.concat([decipher.update(ciphertextBytes), decipher.final()]);
-        return Content.bytesToStringUTF8(decryptedBytes);
-    }
-}

package/dist/gdc-common-utils-ts/src/CryptographyService.d.ts

@@ -1,76 +0,0 @@
-import { ICryptoHelper } from './interfaces/ICryptoHelper';
-import { ICryptography } from './interfaces/ICryptography';
-import { DataCompactJWT, JwtCompactParts } from './models/jwt';
-import { JweObject } from './models/jwe';
-import { MlkemPublicJwk, MldsaPublicJwk, PublicJwk, MlkemPrivateJwk, MldsaAlg, MlkemCurve } from './interfaces/Cryptography.types';
-import { ProtectedDataAES } from './models/aes';
-/**
- * Implements the ICryptography interface, providing a complete suite of low-level,
- * stateless cryptographic functions. This service is the "engine" of the security layer,
- * orchestrating Post-Quantum and AES primitives.
- */
-export declare class CryptographyService implements ICryptography {
-    private aesManager;
-    private cryptoHelper;
-    private mlDsaModule;
-    private mlKemModule;
-    private readonly ML_KEM_SEED_SIZE;
-    private readonly ML_DSA_SEED_SIZE;
-    constructor(cryptoHelper: ICryptoHelper);
-    private loadMlDsa;
-    private loadMlKem;
-    digestString(data: string, algorithm: string): Promise<string>;
-    generateKeyPairMlKem(seedBytes?: Uint8Array, crv?: MlkemCurve): Promise<{
-        publicJWKey: MlkemPublicJwk & {
-            kid: string;
-        };
-        secretKeyBytes: Uint8Array;
-    }>;
-    generateKeyPairMlDsa(seedBytes?: Uint8Array, alg?: MldsaAlg): Promise<{
-        publicJWKey: MldsaPublicJwk & {
-            kid: string;
-        };
-        secretKeyBytes: Uint8Array;
-    }>;
-    encryptJwe(payload: object, protectedHeader: object, secretJWKey: MlkemPrivateJwk, recipientsJWKeys: MlkemPublicJwk[]): Promise<JweObject>;
-    encryptJweToCompact(payload: object | string, protectedHeader: object, secretJWKey: MlkemPrivateJwk, recipientJWKey: MlkemPublicJwk): Promise<string>;
-    decryptJwe(jwe: JweObject | string, secretKeyJwk: MlkemPrivateJwk): Promise<{
-        decryptedBytes: Uint8Array;
-        protectedHeader: object;
-    }>;
-    getRecipientKidsFromJwe(jwe: JweObject | string): string[];
-    signDataJws(payload: object, protectedHeader: object, secretKeyBytes: Uint8Array): Promise<JwtCompactParts>;
-    verifyJws(jws: JwtCompactParts | string, publicJwk: PublicJwk): Promise<boolean>;
-    verifyDetachedJws(payloadBytes: Uint8Array, detachedJws: string, publicJWKey: PublicJwk): Promise<boolean>;
-    encrypt(plaintext: string, cekBytes: Uint8Array, aad: string): Promise<ProtectedDataAES>;
-    decrypt(encryptedData: ProtectedDataAES, cekBytes: Uint8Array, aad: string): Promise<string>;
-    encapsulate(cekSeedBytes: Uint8Array, secretKeyBytes: Uint8Array, recipientPublicKeyBytes: Uint8Array): Promise<{
-        encapsulatedCekBytes: Uint8Array;
-        derivedCekBytes: Uint8Array;
-    }>;
-    decapsulate(encapsulatedBytes: Uint8Array, secretKeyBytes: Uint8Array): Promise<Uint8Array>;
-    signBytes(payloadBytes: Uint8Array, secretKeyBytes: Uint8Array, alg: MldsaAlg): Promise<Uint8Array>;
-    verifyBytes(signatureBytes: Uint8Array, dataBytes: Uint8Array, publicKey: PublicJwk): Promise<boolean>;
-    jwsToCompact(jws: DataCompactJWT): string;
-    parseCompactJws(jwsString: string): DataCompactJWT;
-    parseCompactJwe(jweString: string): JweObject;
-    /**
-     * Computes a JWK thumbprint using a specified hash algorithm.
-     * This implementation is platform-agnostic by using the injected ICryptoHelper.
-     */
-    private _computeJwkThumbprint;
-    /**
-     * Creates a canonical string from a simple, flat JSON object as required by
-     * RFC 7638 for JWK thumbprints.
-     */
-    private _canonicalizeForJwkThumbprint;
-    /**
-     * Extracts the Base JWK for thumbprint calculation per RFC 7638.
-     * This handles both Post-Quantum (OKP, AKP) and legacy (EC) key types.
-     */
-    private _toBaseJwk;
-    /**
-     * Utility to convert a hex string to a Uint8Array.
-     */
-    private _hexToBytes;
-}