gdc-sdk-node-ts 2.4.0 → 2.4.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +8 -2
- package/dist/fhir-r5-subscription-runtime.d.ts +26 -0
- package/dist/fhir-r5-subscription-runtime.js +28 -0
- package/dist/index.d.ts +2 -0
- package/dist/index.js +2 -0
- package/dist/node-runtime-client.d.ts +15 -2
- package/dist/node-runtime-client.js +28 -2
- package/dist/orchestration/client-port.d.ts +6 -0
- package/dist/orchestration/host-onboarding-sdk.d.ts +7 -1
- package/dist/orchestration/host-onboarding-sdk.js +7 -1
- package/dist/orchestration/organization-controller-sdk.js +2 -4
- package/dist/organization-controller-recovery.d.ts +7 -4
- package/dist/organization-controller-recovery.js +11 -6
- package/dist/organization-registration-authorization.d.ts +16 -0
- package/dist/organization-registration-authorization.js +34 -0
- package/dist/runtime-client-paths.d.ts +8 -0
- package/dist/runtime-client-paths.js +8 -0
- package/package.json +2 -2
package/README.md
CHANGED
|
@@ -729,8 +729,14 @@ Existing-tenant recovery/reverification:
|
|
|
729
729
|
- use `OrganizationControllerSdk.submitLegalOrganizationCredentialReissuance(...)` or
|
|
730
730
|
`NodeHttpClient.submitLegalOrganizationCredentialReissuance(...)` to refresh the ICA-backed
|
|
731
731
|
verification for an already registered tenant without creating a new Offer
|
|
732
|
-
-
|
|
733
|
-
`
|
|
732
|
+
- inside the terminal decoded GW Bundle, the canonical polled response keeps
|
|
733
|
+
all deduplicated ICA-issued credentials in `body.data[0].vc[]` and the
|
|
734
|
+
complete ICA payload in `body.data[0].resource.icaResponse`; SDK callers
|
|
735
|
+
receive that terminal HTTP payload as `SubmitAndPollResult.poll.body`
|
|
736
|
+
- separately, GW returns the controller License activation code in
|
|
737
|
+
`body.data[0].meta.claims['org.schema.IndividualProduct.serialNumber']`
|
|
738
|
+
- `Organization/_issue` is not `License/_issue`: the activation code is not a
|
|
739
|
+
VC and `License:Issued` is not the canonical response entry type for this route
|
|
734
740
|
- then continue with the existing helper chain:
|
|
735
741
|
`recoverOrganizationControllerWithCredentialReissuanceWithDeps(...)`
|
|
736
742
|
or directly `_exchange -> _dcr`
|
|
@@ -0,0 +1,26 @@
|
|
|
1
|
+
import { type FhirR5Subscription, type FhirR5SubscriptionScope, type FhirR5SubscriptionTopic } from 'gdc-common-utils-ts/models/fhir-r5-subscription';
|
|
2
|
+
import type { RouteContext } from './individual-onboarding.js';
|
|
3
|
+
import type { PollOptions, SubmitAndPollResult, SubmitPayload } from './orchestration/client-port.js';
|
|
4
|
+
export interface FhirR5SubscriptionBatchInput {
|
|
5
|
+
subscription: FhirR5Subscription;
|
|
6
|
+
scope: FhirR5SubscriptionScope;
|
|
7
|
+
}
|
|
8
|
+
type SubmitAndPoll = (submitPath: string, pollPath: string, payload: SubmitPayload, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
|
|
9
|
+
type SubscriptionRuntimeDeps = {
|
|
10
|
+
createRuntimeUuid: () => string;
|
|
11
|
+
submitPath: (ctx: RouteContext, section: 'entity' | 'individual') => string;
|
|
12
|
+
pollPath: (ctx: RouteContext, section: 'entity' | 'individual') => string;
|
|
13
|
+
submitAndPoll: SubmitAndPoll;
|
|
14
|
+
};
|
|
15
|
+
/** Registers one active topic definition in GW CORE's neutral tenant catalog. */
|
|
16
|
+
export declare function submitFhirR5SubscriptionTopicBatchWithDeps(ctx: RouteContext, topic: FhirR5SubscriptionTopic, pollOptions: PollOptions | undefined, deps: Omit<SubscriptionRuntimeDeps, 'submitPath' | 'pollPath'> & {
|
|
17
|
+
submitPath: (ctx: RouteContext) => string;
|
|
18
|
+
pollPath: (ctx: RouteContext) => string;
|
|
19
|
+
}): Promise<SubmitAndPollResult>;
|
|
20
|
+
/**
|
|
21
|
+
* Registers one neutral rest-hook Subscription. Individual scope maps to the
|
|
22
|
+
* individual section and retains the exact patient/subject validation owned by
|
|
23
|
+
* Common Utils and GW CORE; tenant scope maps to entity.
|
|
24
|
+
*/
|
|
25
|
+
export declare function submitFhirR5SubscriptionBatchWithDeps(ctx: RouteContext, input: FhirR5SubscriptionBatchInput, pollOptions: PollOptions | undefined, deps: SubscriptionRuntimeDeps): Promise<SubmitAndPollResult>;
|
|
26
|
+
export {};
|
|
@@ -0,0 +1,28 @@
|
|
|
1
|
+
// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
|
|
2
|
+
import { FhirR5SubscriptionScopes, buildFhirR5SubscriptionBatch, } from 'gdc-common-utils-ts/models/fhir-r5-subscription';
|
|
3
|
+
function gatewayPayload(createRuntimeUuid, body) {
|
|
4
|
+
return {
|
|
5
|
+
jti: `fhir-r5-subscription-jti-${createRuntimeUuid()}`,
|
|
6
|
+
thid: `fhir-r5-subscription-${createRuntimeUuid()}`,
|
|
7
|
+
type: 'application/fhir+json',
|
|
8
|
+
body,
|
|
9
|
+
};
|
|
10
|
+
}
|
|
11
|
+
/** Registers one active topic definition in GW CORE's neutral tenant catalog. */
|
|
12
|
+
export function submitFhirR5SubscriptionTopicBatchWithDeps(ctx, topic, pollOptions, deps) {
|
|
13
|
+
const body = {
|
|
14
|
+
resourceType: 'Bundle', type: 'batch',
|
|
15
|
+
entry: [{ request: { method: 'POST', url: 'SubscriptionTopic' }, resource: topic }],
|
|
16
|
+
};
|
|
17
|
+
return deps.submitAndPoll(deps.submitPath(ctx), deps.pollPath(ctx), gatewayPayload(deps.createRuntimeUuid, body), pollOptions);
|
|
18
|
+
}
|
|
19
|
+
/**
|
|
20
|
+
* Registers one neutral rest-hook Subscription. Individual scope maps to the
|
|
21
|
+
* individual section and retains the exact patient/subject validation owned by
|
|
22
|
+
* Common Utils and GW CORE; tenant scope maps to entity.
|
|
23
|
+
*/
|
|
24
|
+
export function submitFhirR5SubscriptionBatchWithDeps(ctx, input, pollOptions, deps) {
|
|
25
|
+
const section = input.scope === FhirR5SubscriptionScopes.Individual ? 'individual' : 'entity';
|
|
26
|
+
const batch = buildFhirR5SubscriptionBatch(input.subscription, input.scope);
|
|
27
|
+
return deps.submitAndPoll(deps.submitPath(ctx, section), deps.pollPath(ctx, section), gatewayPayload(deps.createRuntimeUuid, batch.body), pollOptions);
|
|
28
|
+
}
|
package/dist/index.d.ts
CHANGED
|
@@ -17,7 +17,9 @@ export * from './family-organization-registration.js';
|
|
|
17
17
|
export * from './individual-onboarding.js';
|
|
18
18
|
export * from './device-activation.js';
|
|
19
19
|
export * from './organization-controller-recovery.js';
|
|
20
|
+
export * from './organization-registration-authorization.js';
|
|
20
21
|
export * from './smart-token.js';
|
|
22
|
+
export * from './fhir-r5-subscription-runtime.js';
|
|
21
23
|
export * from './order-offer-summary.js';
|
|
22
24
|
export * from './organization-license-order.js';
|
|
23
25
|
export * from './resource-operations.js';
|
package/dist/index.js
CHANGED
|
@@ -18,7 +18,9 @@ export * from './family-organization-registration.js';
|
|
|
18
18
|
export * from './individual-onboarding.js';
|
|
19
19
|
export * from './device-activation.js';
|
|
20
20
|
export * from './organization-controller-recovery.js';
|
|
21
|
+
export * from './organization-registration-authorization.js';
|
|
21
22
|
export * from './smart-token.js';
|
|
23
|
+
export * from './fhir-r5-subscription-runtime.js';
|
|
22
24
|
export * from './order-offer-summary.js';
|
|
23
25
|
export * from './organization-license-order.js';
|
|
24
26
|
export * from './resource-operations.js';
|
|
@@ -15,6 +15,8 @@ import { type CommunicationIngestionInput, type BlockchainArtifactRegistrationIn
|
|
|
15
15
|
import type { LegalOrganizationOrderInput } from './host-onboarding.js';
|
|
16
16
|
import type { SmartTokenExchangeResult } from './smart-token.js';
|
|
17
17
|
import type { NodeRuntimeClient, PollOptions, PollResult, SubmitAndPollResult, SubmitPayload, SubmitResponse } from './orchestration/client-port.js';
|
|
18
|
+
import { type FhirR5SubscriptionBatchInput } from './fhir-r5-subscription-runtime.js';
|
|
19
|
+
import type { FhirR5SubscriptionTopic } from 'gdc-common-utils-ts/models/fhir-r5-subscription';
|
|
18
20
|
export type HttpRuntimeClientOptions = {
|
|
19
21
|
baseUrl: string;
|
|
20
22
|
bearerToken?: string;
|
|
@@ -135,6 +137,10 @@ export declare class HttpRuntimeClient implements NodeRuntimeClient {
|
|
|
135
137
|
* Convenience wrapper that performs submit and poll in sequence.
|
|
136
138
|
*/
|
|
137
139
|
submitAndPoll(submitPath: string, pollPath: string, payload: SubmitPayload, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
|
|
140
|
+
/** Registers one neutral FHIR R5 topic in the tenant-owned CORE catalog. */
|
|
141
|
+
submitFhirR5SubscriptionTopicBatch(ctx: RouteContext, topic: FhirR5SubscriptionTopic, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
|
|
142
|
+
/** Registers one tenant or exact-subject FHIR R5 rest-hook Subscription. */
|
|
143
|
+
submitFhirR5SubscriptionBatch(ctx: RouteContext, input: FhirR5SubscriptionBatchInput, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
|
|
138
144
|
private submitAndPollWithBearerToken;
|
|
139
145
|
/**
|
|
140
146
|
* Starts the host-side legal-organization verification transaction that GW
|
|
@@ -152,7 +158,7 @@ export declare class HttpRuntimeClient implements NodeRuntimeClient {
|
|
|
152
158
|
*
|
|
153
159
|
* Commercial contract:
|
|
154
160
|
* - the final poll response is expected to mint
|
|
155
|
-
* `meta.claims['org.schema.Offer.identifier']`
|
|
161
|
+
* `resource.meta.claims['org.schema.Offer.identifier']`
|
|
156
162
|
* - callers should then pass that exact value to
|
|
157
163
|
* `confirmLegalOrganizationOrder(...)`
|
|
158
164
|
*/
|
|
@@ -200,9 +206,16 @@ export declare class HttpRuntimeClient implements NodeRuntimeClient {
|
|
|
200
206
|
* - this mirrored metadata is transport fallback only; the canonical
|
|
201
207
|
* activation contract remains `body.vp_token` plus `body.controller.*`
|
|
202
208
|
*
|
|
209
|
+
* Credential compatibility:
|
|
210
|
+
* - canonical VP: organization + legal-representative + organization-controller VCs
|
|
211
|
+
* - legacy two-VC VP: accepted only when the old representative VC itself
|
|
212
|
+
* carries both `RESPRSN` and matching `hasCredential` key material
|
|
213
|
+
* - a representative VC containing only `ISCO-08|1120` is not controller
|
|
214
|
+
* evidence and will be rejected
|
|
215
|
+
*
|
|
203
216
|
* Commercial contract:
|
|
204
217
|
* - legacy `_activate` is still expected to mint
|
|
205
|
-
* `meta.claims['org.schema.Offer.identifier']`
|
|
218
|
+
* `resource.meta.claims['org.schema.Offer.identifier']`
|
|
206
219
|
* - callers should then pass that exact value to
|
|
207
220
|
* `confirmLegalOrganizationOrder(...)`
|
|
208
221
|
*/
|
|
@@ -19,6 +19,7 @@ import { activateOrganizationInGatewayFromIcaProofWithDeps, submitLegalOrganizat
|
|
|
19
19
|
import { buildGrantProfessionalAccessClaimsWithCid } from './runtime-consent.js';
|
|
20
20
|
import { RuntimeClientPaths } from './runtime-client-paths.js';
|
|
21
21
|
import { runtimeUuid, wrapBundleAsGatewayTransactionMessage } from './runtime-message.js';
|
|
22
|
+
import { submitFhirR5SubscriptionBatchWithDeps, submitFhirR5SubscriptionTopicBatchWithDeps, } from './fhir-r5-subscription-runtime.js';
|
|
22
23
|
const bootstrapFacade = createBootstrapFacade();
|
|
23
24
|
/**
|
|
24
25
|
* Runtime-oriented HTTP client for Node backends, BFFs, and workers that need
|
|
@@ -116,6 +117,24 @@ export class HttpRuntimeClient {
|
|
|
116
117
|
async submitAndPoll(submitPath, pollPath, payload, pollOptions) {
|
|
117
118
|
return submitAndPollWithMethods(this, submitPath, pollPath, payload, pollOptions);
|
|
118
119
|
}
|
|
120
|
+
/** Registers one neutral FHIR R5 topic in the tenant-owned CORE catalog. */
|
|
121
|
+
submitFhirR5SubscriptionTopicBatch(ctx, topic, pollOptions) {
|
|
122
|
+
return submitFhirR5SubscriptionTopicBatchWithDeps(ctx, topic, pollOptions, {
|
|
123
|
+
createRuntimeUuid: runtimeUuid,
|
|
124
|
+
submitPath: this.paths.fhirR5SubscriptionTopicBatchPath.bind(this.paths),
|
|
125
|
+
pollPath: this.paths.fhirR5SubscriptionTopicPollPath.bind(this.paths),
|
|
126
|
+
submitAndPoll: this.submitAndPoll.bind(this),
|
|
127
|
+
});
|
|
128
|
+
}
|
|
129
|
+
/** Registers one tenant or exact-subject FHIR R5 rest-hook Subscription. */
|
|
130
|
+
submitFhirR5SubscriptionBatch(ctx, input, pollOptions) {
|
|
131
|
+
return submitFhirR5SubscriptionBatchWithDeps(ctx, input, pollOptions, {
|
|
132
|
+
createRuntimeUuid: runtimeUuid,
|
|
133
|
+
submitPath: this.paths.fhirR5SubscriptionBatchPath.bind(this.paths),
|
|
134
|
+
pollPath: this.paths.fhirR5SubscriptionPollPath.bind(this.paths),
|
|
135
|
+
submitAndPoll: this.submitAndPoll.bind(this),
|
|
136
|
+
});
|
|
137
|
+
}
|
|
119
138
|
async submitAndPollWithBearerToken(bearerToken, submitPath, pollPath, payload, pollOptions) {
|
|
120
139
|
const config = { ...this.transportConfig, bearerToken };
|
|
121
140
|
const submitted = await postJsonWithRuntimeConfig(config, submitPath, payload, DIDCOMM_PLAINTEXT_JSON_MEDIA_TYPE);
|
|
@@ -141,7 +160,7 @@ export class HttpRuntimeClient {
|
|
|
141
160
|
*
|
|
142
161
|
* Commercial contract:
|
|
143
162
|
* - the final poll response is expected to mint
|
|
144
|
-
* `meta.claims['org.schema.Offer.identifier']`
|
|
163
|
+
* `resource.meta.claims['org.schema.Offer.identifier']`
|
|
145
164
|
* - callers should then pass that exact value to
|
|
146
165
|
* `confirmLegalOrganizationOrder(...)`
|
|
147
166
|
*/
|
|
@@ -227,9 +246,16 @@ export class HttpRuntimeClient {
|
|
|
227
246
|
* - this mirrored metadata is transport fallback only; the canonical
|
|
228
247
|
* activation contract remains `body.vp_token` plus `body.controller.*`
|
|
229
248
|
*
|
|
249
|
+
* Credential compatibility:
|
|
250
|
+
* - canonical VP: organization + legal-representative + organization-controller VCs
|
|
251
|
+
* - legacy two-VC VP: accepted only when the old representative VC itself
|
|
252
|
+
* carries both `RESPRSN` and matching `hasCredential` key material
|
|
253
|
+
* - a representative VC containing only `ISCO-08|1120` is not controller
|
|
254
|
+
* evidence and will be rejected
|
|
255
|
+
*
|
|
230
256
|
* Commercial contract:
|
|
231
257
|
* - legacy `_activate` is still expected to mint
|
|
232
|
-
* `meta.claims['org.schema.Offer.identifier']`
|
|
258
|
+
* `resource.meta.claims['org.schema.Offer.identifier']`
|
|
233
259
|
* - callers should then pass that exact value to
|
|
234
260
|
* `confirmLegalOrganizationOrder(...)`
|
|
235
261
|
*/
|
|
@@ -10,6 +10,8 @@ import type { HostRouteContext, HostedTenantLifecycleInput, LegalOrganizationOrd
|
|
|
10
10
|
import type { IndividualOrganizationConfirmOrderInput, RouteContext } from '../individual-onboarding.js';
|
|
11
11
|
import type { IndividualOrganizationBootstrapInput, IndividualOrganizationStartResult } from '../individual-start.js';
|
|
12
12
|
import type { FamilyOrganizationSearchInput } from '../family-organization-search.js';
|
|
13
|
+
import type { FhirR5SubscriptionTopic } from 'gdc-common-utils-ts/models/fhir-r5-subscription';
|
|
14
|
+
import type { FhirR5SubscriptionBatchInput } from '../fhir-r5-subscription-runtime.js';
|
|
13
15
|
import type { EnsureFamilyOrganizationRegistrationInput, EnsureFamilyOrganizationRegistrationResult } from '../family-organization-registration.js';
|
|
14
16
|
import type { OrganizationLicenseOrderConfirmInput } from '../organization-license-order.js';
|
|
15
17
|
import type { SmartTokenExchangeResult, SmartTokenRequestInput } from '../smart-token.js';
|
|
@@ -53,6 +55,10 @@ export type NodeOrganizationDidBindingInput = OrganizationDidBindingInput;
|
|
|
53
55
|
* converge across runtimes.
|
|
54
56
|
*/
|
|
55
57
|
export type RuntimeClient = {
|
|
58
|
+
/** Registers a neutral FHIR R5 topic in GW CORE's tenant-owned catalog. */
|
|
59
|
+
submitFhirR5SubscriptionTopicBatch?: (ctx: RouteContext, topic: FhirR5SubscriptionTopic, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
|
|
60
|
+
/** Registers a tenant-wide or exact-subject FHIR R5 rest-hook Subscription. */
|
|
61
|
+
submitFhirR5SubscriptionBatch?: (ctx: RouteContext, input: FhirR5SubscriptionBatchInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
|
|
56
62
|
submitLegalOrganizationVerificationTransaction?: (hostCtx: HostRouteContext, input: NodeLegalOrganizationVerificationTransactionInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
|
|
57
63
|
submitLegalOrganizationCredentialReissuance?: (hostCtx: HostRouteContext, input: NodeLegalOrganizationVerificationTransactionInput, pollOptions?: PollOptions) => Promise<SubmitAndPollResult>;
|
|
58
64
|
/** @deprecated Use `submitLegalOrganizationCredentialReissuance`. */
|
|
@@ -11,9 +11,15 @@ export declare class HostOnboardingSdk implements HostingControllerFacade {
|
|
|
11
11
|
*
|
|
12
12
|
* Commercial contract:
|
|
13
13
|
* - this legacy `_activate` facade must return one canonical Offer in
|
|
14
|
-
* `meta.claims['org.schema.Offer.identifier']`
|
|
14
|
+
* `resource.meta.claims['org.schema.Offer.identifier']`
|
|
15
15
|
* - callers are expected to pass that Offer to
|
|
16
16
|
* `confirmLegalOrganizationOrder(...)`
|
|
17
|
+
*
|
|
18
|
+
* The canonical `vpToken` contains OrganizationCredential,
|
|
19
|
+
* LegalRepresentativeCredential and ServiceControllerCredential. A
|
|
20
|
+
* legacy two-credential token is accepted only when its old representative
|
|
21
|
+
* credential combines `RESPRSN` authority with matching `hasCredential`
|
|
22
|
+
* binding material. `ISCO-08|1120` alone never grants tenant control.
|
|
17
23
|
*/
|
|
18
24
|
activateOrganizationInGatewayFromIcaProof(hostCtx: HostRouteContext, input: NodeOrganizationActivationInput, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
|
|
19
25
|
confirmLegalOrganizationOrder(hostCtx: HostRouteContext, input: LegalOrganizationOrderInput, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
|
|
@@ -14,9 +14,15 @@ export class HostOnboardingSdk {
|
|
|
14
14
|
*
|
|
15
15
|
* Commercial contract:
|
|
16
16
|
* - this legacy `_activate` facade must return one canonical Offer in
|
|
17
|
-
* `meta.claims['org.schema.Offer.identifier']`
|
|
17
|
+
* `resource.meta.claims['org.schema.Offer.identifier']`
|
|
18
18
|
* - callers are expected to pass that Offer to
|
|
19
19
|
* `confirmLegalOrganizationOrder(...)`
|
|
20
|
+
*
|
|
21
|
+
* The canonical `vpToken` contains OrganizationCredential,
|
|
22
|
+
* LegalRepresentativeCredential and ServiceControllerCredential. A
|
|
23
|
+
* legacy two-credential token is accepted only when its old representative
|
|
24
|
+
* credential combines `RESPRSN` authority with matching `hasCredential`
|
|
25
|
+
* binding material. `ISCO-08|1120` alone never grants tenant control.
|
|
20
26
|
*/
|
|
21
27
|
activateOrganizationInGatewayFromIcaProof(hostCtx, input, pollOptions) {
|
|
22
28
|
assertFacadeCapability(this.capabilities, ActorCapabilities.HostingActivateOrganization, ActorKinds.HostOnboarding, 'activateOrganizationInGatewayFromIcaProof');
|
|
@@ -33,12 +33,10 @@ export class OrganizationControllerSdk {
|
|
|
33
33
|
* refreshes verification and reissues one controller activation code.
|
|
34
34
|
*/
|
|
35
35
|
submitLegalOrganizationCredentialReissuance(hostCtx, input, pollOptions) {
|
|
36
|
-
|
|
37
|
-
|| this.client.submitLegalOrganizationIssue;
|
|
38
|
-
if (!method) {
|
|
36
|
+
if (this.client.submitLegalOrganizationCredentialReissuance) {
|
|
39
37
|
return requireClientMethod(this.client, 'submitLegalOrganizationCredentialReissuance')(hostCtx, input, pollOptions);
|
|
40
38
|
}
|
|
41
|
-
return
|
|
39
|
+
return requireClientMethod(this.client, 'submitLegalOrganizationIssue')(hostCtx, input, pollOptions);
|
|
42
40
|
}
|
|
43
41
|
/**
|
|
44
42
|
* @deprecated Use `submitLegalOrganizationCredentialReissuance`.
|
|
@@ -42,10 +42,13 @@ export declare const recoverOrganizationControllerWithIssueWithDeps: typeof reco
|
|
|
42
42
|
* Reads the opaque activation code from a successful Organization/_issue poll result.
|
|
43
43
|
*
|
|
44
44
|
* Gateway deployments may retain one or more transport/job envelopes around
|
|
45
|
-
* the terminal batch response.
|
|
46
|
-
* serial-number claim
|
|
47
|
-
*
|
|
48
|
-
*
|
|
45
|
+
* the terminal batch response. The canonical `Organization/_issue` shape
|
|
46
|
+
* carries the serial-number claim in `data[].resource.meta.claims`, while the
|
|
47
|
+
* ICA credential projection remains in sibling `data[].vc[]`. An explicitly
|
|
48
|
+
* typed `License:Issued` entry is accepted
|
|
49
|
+
* only as a legacy `License/_issue` compatibility fallback. Unrelated
|
|
50
|
+
* identifiers and ICA credentials are never interpreted as activation
|
|
51
|
+
* material.
|
|
49
52
|
*/
|
|
50
53
|
export declare function readLegalOrganizationCredentialReissuanceActivationCode(result: SubmitAndPollResult): string;
|
|
51
54
|
/** @deprecated Use `readLegalOrganizationCredentialReissuanceActivationCode`. */
|
|
@@ -3,8 +3,10 @@ import { activateEmployeeDeviceWithActivationCodeWithDeps } from './device-activ
|
|
|
3
3
|
export async function recoverOrganizationControllerWithCredentialReissuanceWithDeps(deps) {
|
|
4
4
|
/**
|
|
5
5
|
* Existing-tenant controller recovery contract:
|
|
6
|
-
* - `Organization/_issue`
|
|
7
|
-
*
|
|
6
|
+
* - `Organization/_issue` reverifies/reissues organization credentials and
|
|
7
|
+
* exposes the existing controller License activation code separately in
|
|
8
|
+
* response claims
|
|
9
|
+
* - `Token/_exchange -> Device/_dcr` performs the device activation/rebind
|
|
8
10
|
* - this flow must not depend on a new commercial Offer or Order step
|
|
9
11
|
*/
|
|
10
12
|
const submitCredentialReissuance = deps.submitLegalOrganizationCredentialReissuance
|
|
@@ -49,10 +51,13 @@ export const recoverOrganizationControllerWithIssueWithDeps = recoverOrganizatio
|
|
|
49
51
|
* Reads the opaque activation code from a successful Organization/_issue poll result.
|
|
50
52
|
*
|
|
51
53
|
* Gateway deployments may retain one or more transport/job envelopes around
|
|
52
|
-
* the terminal batch response.
|
|
53
|
-
* serial-number claim
|
|
54
|
-
*
|
|
55
|
-
*
|
|
54
|
+
* the terminal batch response. The canonical `Organization/_issue` shape
|
|
55
|
+
* carries the serial-number claim in `data[].resource.meta.claims`, while the
|
|
56
|
+
* ICA credential projection remains in sibling `data[].vc[]`. An explicitly
|
|
57
|
+
* typed `License:Issued` entry is accepted
|
|
58
|
+
* only as a legacy `License/_issue` compatibility fallback. Unrelated
|
|
59
|
+
* identifiers and ICA credentials are never interpreted as activation
|
|
60
|
+
* material.
|
|
56
61
|
*/
|
|
57
62
|
export function readLegalOrganizationCredentialReissuanceActivationCode(result) {
|
|
58
63
|
const pollBody = (result?.poll?.body || {});
|
|
@@ -0,0 +1,16 @@
|
|
|
1
|
+
import type { VerifiableCredentialV2 } from 'gdc-common-utils-ts/models/verifiable-credential';
|
|
2
|
+
import type { IWallet, WalletExecutionContext, WalletKeySelection } from 'gdc-sdk-core-ts';
|
|
3
|
+
/** Input required to add one human-authorizer proof to the out-of-band VC. */
|
|
4
|
+
export type SignOrganizationRegistrationAuthorizationInput = Readonly<{
|
|
5
|
+
credential: VerifiableCredentialV2;
|
|
6
|
+
wallet: IWallet;
|
|
7
|
+
context: WalletExecutionContext;
|
|
8
|
+
key: WalletKeySelection;
|
|
9
|
+
verificationMethod: string;
|
|
10
|
+
createdAt?: string;
|
|
11
|
+
}>;
|
|
12
|
+
/**
|
|
13
|
+
* Adds one detached JWS proof made by the already-unlocked professional
|
|
14
|
+
* profile. The browser never receives the private key or clear wallet seed.
|
|
15
|
+
*/
|
|
16
|
+
export declare function signOrganizationRegistrationAuthorizationCredential(input: SignOrganizationRegistrationAuthorizationInput): Promise<VerifiableCredentialV2>;
|
|
@@ -0,0 +1,34 @@
|
|
|
1
|
+
import { canonicalizeOrganizationRegistrationAuthorizationCredential, } from 'gdc-common-utils-ts/utils/organization-registration-authorization';
|
|
2
|
+
/**
|
|
3
|
+
* Adds one detached JWS proof made by the already-unlocked professional
|
|
4
|
+
* profile. The browser never receives the private key or clear wallet seed.
|
|
5
|
+
*/
|
|
6
|
+
export async function signOrganizationRegistrationAuthorizationCredential(input) {
|
|
7
|
+
if (!input.wallet.signDetachedJws) {
|
|
8
|
+
throw new Error('Wallet does not support detached organization authorization proofs.');
|
|
9
|
+
}
|
|
10
|
+
const verificationMethod = String(input.verificationMethod || '').trim();
|
|
11
|
+
if (!verificationMethod)
|
|
12
|
+
throw new Error('Organization authorization proof requires verificationMethod.');
|
|
13
|
+
const payload = canonicalizeOrganizationRegistrationAuthorizationCredential(input.credential);
|
|
14
|
+
const jws = await input.wallet.signDetachedJws(input.context, {
|
|
15
|
+
payload,
|
|
16
|
+
header: { typ: 'application/vc+ld+json' },
|
|
17
|
+
key: input.key,
|
|
18
|
+
});
|
|
19
|
+
const existingProofs = Array.isArray(input.credential.proof)
|
|
20
|
+
? input.credential.proof
|
|
21
|
+
: input.credential.proof
|
|
22
|
+
? [input.credential.proof]
|
|
23
|
+
: [];
|
|
24
|
+
return {
|
|
25
|
+
...input.credential,
|
|
26
|
+
proof: [...existingProofs, {
|
|
27
|
+
type: 'JsonWebSignature2020',
|
|
28
|
+
created: input.createdAt || new Date().toISOString(),
|
|
29
|
+
proofPurpose: 'contractAgreement',
|
|
30
|
+
verificationMethod,
|
|
31
|
+
jws,
|
|
32
|
+
}],
|
|
33
|
+
};
|
|
34
|
+
}
|
|
@@ -74,6 +74,14 @@ export declare class RuntimeClientPaths {
|
|
|
74
74
|
individualCommunicationSearchPollPath(ctx: RouteContext): string;
|
|
75
75
|
individualDocumentReferenceBatchPath(ctx: RouteContext): string;
|
|
76
76
|
individualDocumentReferencePollPath(ctx: RouteContext): string;
|
|
77
|
+
/** Builds the tenant-owned FHIR R5 SubscriptionTopic registration path. */
|
|
78
|
+
fhirR5SubscriptionTopicBatchPath(ctx: RouteContext): string;
|
|
79
|
+
/** Builds the poll path paired with SubscriptionTopic registration. */
|
|
80
|
+
fhirR5SubscriptionTopicPollPath(ctx: RouteContext): string;
|
|
81
|
+
/** Builds one tenant or exact-subject FHIR R5 Subscription registration path. */
|
|
82
|
+
fhirR5SubscriptionBatchPath(ctx: RouteContext, section: 'entity' | 'individual'): string;
|
|
83
|
+
/** Builds the poll path paired with Subscription registration. */
|
|
84
|
+
fhirR5SubscriptionPollPath(ctx: RouteContext, section: 'entity' | 'individual'): string;
|
|
77
85
|
individualBundleSearchPath(ctx: RouteContext): string;
|
|
78
86
|
individualBundleSearchPollPath(ctx: RouteContext): string;
|
|
79
87
|
identityTokenExchangePath(ctx: RouteContext): string;
|
|
@@ -88,6 +88,14 @@ export class RuntimeClientPaths {
|
|
|
88
88
|
individualCommunicationSearchPollPath(ctx) { return this.v1Path(ctx, 'individual', 'org.hl7.fhir.r4', 'Communication', '_search-response'); }
|
|
89
89
|
individualDocumentReferenceBatchPath(ctx) { return this.v1Path(ctx, 'individual', 'org.hl7.fhir.r4', 'DocumentReference', '_batch'); }
|
|
90
90
|
individualDocumentReferencePollPath(ctx) { return this.v1Path(ctx, 'individual', 'org.hl7.fhir.r4', 'DocumentReference', '_batch-response'); }
|
|
91
|
+
/** Builds the tenant-owned FHIR R5 SubscriptionTopic registration path. */
|
|
92
|
+
fhirR5SubscriptionTopicBatchPath(ctx) { return this.v1Path(ctx, 'entity', 'org.hl7.fhir.r5', 'SubscriptionTopic', '_batch'); }
|
|
93
|
+
/** Builds the poll path paired with SubscriptionTopic registration. */
|
|
94
|
+
fhirR5SubscriptionTopicPollPath(ctx) { return this.v1Path(ctx, 'entity', 'org.hl7.fhir.r5', 'SubscriptionTopic', '_batch-response'); }
|
|
95
|
+
/** Builds one tenant or exact-subject FHIR R5 Subscription registration path. */
|
|
96
|
+
fhirR5SubscriptionBatchPath(ctx, section) { return this.v1Path(ctx, section, 'org.hl7.fhir.r5', 'Subscription', '_batch'); }
|
|
97
|
+
/** Builds the poll path paired with Subscription registration. */
|
|
98
|
+
fhirR5SubscriptionPollPath(ctx, section) { return this.v1Path(ctx, section, 'org.hl7.fhir.r5', 'Subscription', '_batch-response'); }
|
|
91
99
|
individualBundleSearchPath(ctx) { return this.v1Path(ctx, 'individual', 'org.hl7.fhir.r4', 'Bundle', '_search'); }
|
|
92
100
|
individualBundleSearchPollPath(ctx) { return this.v1Path(ctx, 'individual', 'org.hl7.fhir.r4', 'Bundle', '_search-response'); }
|
|
93
101
|
identityTokenExchangePath(ctx) { return buildIdentityTokenExchangePath(ctx); }
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "gdc-sdk-node-ts",
|
|
3
|
-
"version": "2.4.
|
|
3
|
+
"version": "2.4.2",
|
|
4
4
|
"description": "Next-generation Node runtime package for the GDC SDK family",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"author": "Antifraud Services Inc.",
|
|
@@ -37,7 +37,7 @@
|
|
|
37
37
|
"test:e2e:live-gw:clean": "bash ./scripts/run-live-gw-clean.sh"
|
|
38
38
|
},
|
|
39
39
|
"dependencies": {
|
|
40
|
-
"gdc-common-utils-ts": "
|
|
40
|
+
"gdc-common-utils-ts": "2.5.3",
|
|
41
41
|
"gdc-sdk-core-ts": "~2.3.18"
|
|
42
42
|
},
|
|
43
43
|
"devDependencies": {
|