gdc-sdk-node-ts 2.4.37 → 2.4.39

package/README.md

@@ -72,40 +72,43 @@ If you are integrating this package for the first time, open these in order:
 3. [docs/101-PROFESSIONAL-CONSENT-SMART.md](./docs/101-PROFESSIONAL-CONSENT-SMART.md)
    Canonical professional DID, consent, VP and SMART flow without literal
    sections or caller-built audience URLs.
-4. [docs/101-SDK_INTEGRATION.md](./docs/101-SDK_INTEGRATION.md)
+4. [docs/101-AUTHORIZED_SUBJECT_DIRECTORY.md](./docs/101-AUTHORIZED_SUBJECT_DIRECTORY.md)
+   Signed OpenID account discovery of already-authorized subjects without
+   treating the account token as VP, SMART or wallet proof.
+5. [docs/101-SDK_INTEGRATION.md](./docs/101-SDK_INTEGRATION.md)
    Real backend setup plus the public runtime entrypoints:
    `HostOnboardingSdk`, `OrganizationControllerSdk`,
    `IndividualControllerSdk`, `ProfessionalSdk`, route-context usage, and the
    canonical `ProfileRuntime -> loadProfile(...) -> workspace/session -> actor facade -> submit/poll` shape.
-5. [tests/101-live-full-cycle-bff-runtime.e2e.test.mjs](./tests/101-live-full-cycle-bff-runtime.e2e.test.mjs)
+6. [tests/101-live-full-cycle-bff-runtime.e2e.test.mjs](./tests/101-live-full-cycle-bff-runtime.e2e.test.mjs)
    Canonical live backend/BFF walkthrough on a fresh local GW lifecycle:
    host/tenant activation, employee provisioning, individual bootstrap,
    consent grant, professional SMART token, clinical read, and final cleanup.
-6. [docs/101-LIVE_GW_LOCAL.md](./docs/101-LIVE_GW_LOCAL.md)
+7. [docs/101-LIVE_GW_LOCAL.md](./docs/101-LIVE_GW_LOCAL.md)
    Exact TTY/local/Docker commands for running the SDK against a real local GW
    CORE, including tenant bootstrap and employee-seat setup.
-7. [docs/101-DISCOVERY.md](./docs/101-DISCOVERY.md)
+8. [docs/101-DISCOVERY.md](./docs/101-DISCOVERY.md)
    Node/BFF dataspace discovery, hosting-operator resolution, provider
    resolution, and the correct integration boundary for fallback and cache.
-8. [gdc-sdk-core-ts/docs/101-SDK_FLOWS.md](https://github.com/Global-DataCare/gdc-sdk-core-ts/blob/main/docs/101-SDK_FLOWS.md)
+9. [gdc-sdk-core-ts/docs/101-SDK_FLOWS.md](https://github.com/Global-DataCare/gdc-sdk-core-ts/blob/main/docs/101-SDK_FLOWS.md)
    Actor split and business-flow map across organization, individual,
    permissions, invitation, import, and SMART flows.
-9. [gwtemplate-node-ts/docs/PORTAL_API_TO_GW_CORE.md](https://github.com/Global-DataCare/gwtemplate-node-ts/blob/main/docs/PORTAL_API_TO_GW_CORE.md)
+10. [gwtemplate-node-ts/docs/PORTAL_API_TO_GW_CORE.md](https://github.com/Global-DataCare/gwtemplate-node-ts/blob/main/docs/PORTAL_API_TO_GW_CORE.md)
    Canonical portal/BFF functional map over GW CORE, including the domain
    split between `employees`, `related persons`, `members`, and `consents`.
-10. [gdc-common-utils-ts/src/examples/](https://github.com/Global-DataCare/gdc-common-utils-ts/tree/main/src/examples)
+11. [gdc-common-utils-ts/src/examples/](https://github.com/Global-DataCare/gdc-common-utils-ts/tree/main/src/examples)
    Shared payload values used by the docs and tests.
-11. [gdc-common-utils-ts/docs/101-LIFECYCLE.md](https://github.com/Global-DataCare/gdc-common-utils-ts/blob/main/docs/101-LIFECYCLE.md)
+12. [gdc-common-utils-ts/docs/101-LIFECYCLE.md](https://github.com/Global-DataCare/gdc-common-utils-ts/blob/main/docs/101-LIFECYCLE.md)
    Canonical `enable/disable/delete` semantics and copy/paste placeholders.
-12. [tests/101-backend-profile-runtime.test.mjs](./tests/101-backend-profile-runtime.test.mjs)
+13. [tests/101-backend-profile-runtime.test.mjs](./tests/101-backend-profile-runtime.test.mjs)
    Technical runtime slice for profile/device/session orchestration internals.
    Read this after the public actor SDK guides, not before them.
-13. [tests/101-individual-controller-backend-runtime.test.mjs](./tests/101-individual-controller-backend-runtime.test.mjs)
+14. [tests/101-individual-controller-backend-runtime.test.mjs](./tests/101-individual-controller-backend-runtime.test.mjs)
    Technical wrapper slice around the generic profile runtime. This is not the
    main onboarding path for new integrators.
-14. [docs/V2_INDIVIDUAL_REGISTRATION_RECONCILIATION.md](./docs/V2_INDIVIDUAL_REGISTRATION_RECONCILIATION.md)
+15. [docs/V2_INDIVIDUAL_REGISTRATION_RECONCILIATION.md](./docs/V2_INDIVIDUAL_REGISTRATION_RECONCILIATION.md)
    Historical reconciliation note for the current CORE registration baseline.
-15. [docs/NEXT_STEPS.md](./docs/NEXT_STEPS.md)
+16. [docs/NEXT_STEPS.md](./docs/NEXT_STEPS.md)
    Follow-up scope after GW CORE live validation, including the future user job
    manager boundary.
 

package/dist/authorized-subject-directory.d.ts

@@ -0,0 +1,51 @@
+import type { SubmitAndPollResult } from 'gdc-sdk-core-ts';
+import type { RouteContext } from './individual-onboarding.js';
+/** Verified contact extracted by the BFF from a signed OpenID `id_token`. */
+export type AuthorizedSubjectVerifiedContact = Readonly<{
+    email?: string;
+    telephone?: string;
+}>;
+/**
+ * High-level input for listing subject grants already accepted by an
+ * individual index. The contact locates grants; it is not role or action proof.
+ */
+export type AuthorizedIndividualSubjectDirectoryInput = Readonly<{
+    verifiedContact: AuthorizedSubjectVerifiedContact;
+    requestThid?: string;
+    pollOptions?: Readonly<{
+        timeoutMs?: number;
+        intervalMs?: number;
+    }>;
+}>;
+/** One exact subject projection paired with its accepted grant metadata. */
+export type AuthorizedIndividualSubject = Readonly<{
+    subjectDid: string;
+    role?: string;
+    /** Accepted provider grant claims; descriptive metadata, never action authority. */
+    grantClaims: Readonly<Record<string, unknown>>;
+    authorizationEvidenceId?: string;
+    issuerDid?: string;
+    subjectClaims: Readonly<Record<string, unknown>>;
+}>;
+type DirectoryDeps = Readonly<{
+    individualLicenseSearchPath: (ctx: RouteContext) => string;
+    individualLicenseSearchPollPath: (ctx: RouteContext) => string;
+    individualOrganizationSearchPath: (ctx: RouteContext) => string;
+    individualOrganizationSearchPollPath: (ctx: RouteContext) => string;
+    submitAndPoll: (submitPath: string, pollPath: string, payload: {
+        thid?: string;
+    } & Record<string, unknown>, pollOptions?: {
+        timeoutMs?: number;
+        intervalMs?: number;
+    }) => Promise<SubmitAndPollResult>;
+}>;
+/**
+ * Lists already-authorized individual subjects without exposing GW plumbing.
+ *
+ * The caller supplies a verified contact taken from a signed OpenID token.
+ * That account/contact proof is intentionally insufficient for protected
+ * actions: professional role proof remains a separate `vp_token`, and SMART
+ * access remains bound to a registered wallet/device session.
+ */
+export declare function listAuthorizedIndividualSubjectsWithDeps(routeContext: RouteContext, input: AuthorizedIndividualSubjectDirectoryInput, deps: DirectoryDeps): Promise<AuthorizedIndividualSubject[]>;
+export {};

package/dist/authorized-subject-directory.js

@@ -0,0 +1,116 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+const SCHEMA_CONTEXT = 'org.schema';
+const INDIVIDUAL_AUDIENCE_TYPE = 'Individual';
+const ACCEPTED_ITEM_CONDITION = 'https://schema.org/UsedCondition';
+const CLAIM_AUDIENCE_TYPE = 'org.schema.IndividualProduct.audience.audienceType';
+const CLAIM_ITEM_CONDITION = 'org.schema.IndividualProduct.itemCondition';
+const CLAIM_PERSON_EMAIL = 'org.schema.Person.email';
+const CLAIM_PERSON_TELEPHONE = 'org.schema.Person.telephone';
+const CLAIM_ORGANIZATION_SAME_AS = 'org.schema.Organization.sameAs';
+const CLAIM_RELATED_PERSON_ROLE = 'RelatedPerson.role';
+const CLAIM_OCCUPATION_IDENTIFIER = 'org.schema.Person.hasOccupation.identifier.value';
+/**
+ * Lists already-authorized individual subjects without exposing GW plumbing.
+ *
+ * The caller supplies a verified contact taken from a signed OpenID token.
+ * That account/contact proof is intentionally insufficient for protected
+ * actions: professional role proof remains a separate `vp_token`, and SMART
+ * access remains bound to a registered wallet/device session.
+ */
+export async function listAuthorizedIndividualSubjectsWithDeps(routeContext, input, deps) {
+    const email = String(input.verifiedContact?.email || '').trim().toLowerCase();
+    const telephone = String(input.verifiedContact?.telephone || '').trim();
+    if (!email && !telephone) {
+        throw new Error('A verified email or telephone is required to list authorized subjects.');
+    }
+    const licenseClaims = {
+        '@context': SCHEMA_CONTEXT,
+        [CLAIM_AUDIENCE_TYPE]: INDIVIDUAL_AUDIENCE_TYPE,
+        [CLAIM_ITEM_CONDITION]: ACCEPTED_ITEM_CONDITION,
+        ...(email ? { [CLAIM_PERSON_EMAIL]: email } : {}),
+        ...(telephone ? { [CLAIM_PERSON_TELEPHONE]: telephone } : {}),
+    };
+    const licenseResult = await deps.submitAndPoll(deps.individualLicenseSearchPath(routeContext), deps.individualLicenseSearchPollPath(routeContext), {
+        thid: input.requestThid || createThreadId('authorized-subject-license'),
+        body: {
+            resourceType: 'Bundle',
+            type: 'batch',
+            data: [{
+                    request: { method: 'POST' },
+                    meta: { status: 'active', claims: licenseClaims },
+                }],
+        },
+    }, input.pollOptions);
+    const licenses = readAcceptedLicenses(licenseResult);
+    const resolved = await Promise.all(licenses.map(async (license) => {
+        const organizationClaims = {
+            '@context': SCHEMA_CONTEXT,
+            [CLAIM_ORGANIZATION_SAME_AS]: license.subjectDid,
+        };
+        const organizationResult = await deps.submitAndPoll(deps.individualOrganizationSearchPath(routeContext), deps.individualOrganizationSearchPollPath(routeContext), {
+            thid: createThreadId('authorized-subject-record'),
+            body: {
+                resourceType: 'Bundle',
+                type: 'batch',
+                data: [{
+                        type: 'Family-search-v1.0',
+                        request: { method: 'POST' },
+                        meta: { claims: organizationClaims },
+                    }],
+            },
+        }, input.pollOptions);
+        const subjectClaims = readFirstClaims(organizationResult);
+        if (String(subjectClaims[CLAIM_ORGANIZATION_SAME_AS] || '').trim() !== license.subjectDid) {
+            return undefined;
+        }
+        return {
+            subjectDid: license.subjectDid,
+            ...(license.role ? { role: license.role } : {}),
+            grantClaims: license.grantClaims,
+            ...(license.authorizationEvidenceId
+                ? { authorizationEvidenceId: license.authorizationEvidenceId }
+                : {}),
+            ...(license.issuerDid ? { issuerDid: license.issuerDid } : {}),
+            subjectClaims,
+        };
+    }));
+    return resolved.filter((value) => Boolean(value));
+}
+function readAcceptedLicenses(result) {
+    const rows = readData(result)[0]?.resource?.data;
+    if (!Array.isArray(rows))
+        return [];
+    return rows.flatMap((row) => {
+        const meta = row?.meta || row?.resource?.meta || {};
+        const subjectDid = String(meta.authorizedSubjectDid || '').trim();
+        if (!subjectDid)
+            return [];
+        const claims = (meta.claims || {});
+        const relatedRoles = String(claims[CLAIM_RELATED_PERSON_ROLE] || '')
+            .split(',')
+            .map((value) => value.trim().toUpperCase())
+            .filter(Boolean);
+        const occupation = String(claims[CLAIM_OCCUPATION_IDENTIFIER] || '').trim();
+        const role = relatedRoles.includes('CAREGIVER') ? 'CAREGIVER' : occupation;
+        return [{
+                subjectDid,
+                ...(role ? { role } : {}),
+                grantClaims: claims,
+                ...(meta.identifier ? { authorizationEvidenceId: String(meta.identifier) } : {}),
+                ...(meta.issuerDid ? { issuerDid: String(meta.issuerDid) } : {}),
+            }];
+    });
+}
+function readFirstClaims(result) {
+    const entry = readData(result)[0];
+    const claims = entry?.meta?.claims || entry?.resource?.meta?.claims;
+    return claims && typeof claims === 'object' ? claims : {};
+}
+function readData(result) {
+    const pollBody = (result?.poll?.body || {});
+    const root = pollBody?.body || pollBody;
+    return Array.isArray(root?.data) ? root.data : [];
+}
+function createThreadId(prefix) {
+    return `${prefix}-${globalThis.crypto?.randomUUID?.() || `${Date.now()}-${Math.random().toString(16).slice(2)}`}`;
+}

package/dist/index.d.ts

@@ -24,6 +24,7 @@ export * from './fhir-r5-subscription-runtime.js';
 export * from './order-offer-summary.js';
 export * from './organization-license-order.js';
 export * from './resource-operations.js';
+export * from './authorized-subject-directory.js';
 export * from './digital-twin.js';
 export * from './operational-actor-did.js';
 export * from './profile-workspace.js';

package/dist/index.js

@@ -25,6 +25,7 @@ export * from './fhir-r5-subscription-runtime.js';
 export * from './order-offer-summary.js';
 export * from './organization-license-order.js';
 export * from './resource-operations.js';
+export * from './authorized-subject-directory.js';
 export * from './digital-twin.js';
 export * from './operational-actor-did.js';
 export * from './profile-workspace.js';

package/dist/node-runtime-client.d.ts

@@ -21,6 +21,7 @@ import type { NodeRuntimeClient, PollOptions, PollResult, SubmitAndPollResult, S
 import { type FhirR5SubscriptionBatchInput } from './fhir-r5-subscription-runtime.js';
 import type { FhirR5SubscriptionTopic } from 'gdc-common-utils-ts/models/fhir-r5-subscription';
 import { type DigitalTwinMaterializationInput, type DigitalTwinSearchInput, type DigitalTwinSelectionInput } from './digital-twin.js';
+import { type AuthorizedIndividualSubject, type AuthorizedIndividualSubjectDirectoryInput } from './authorized-subject-directory.js';
 export type HttpRuntimeClientOptions = {
     baseUrl: string;
     bearerToken?: string;
@@ -414,6 +415,12 @@ export declare class HttpRuntimeClient implements NodeRuntimeClient {
      * with optional filters.
      */
     listIndividualLicenses(ctx: RouteContext, input?: LicenseListRuntimeSearchInput): Promise<SubmitAndPollResult>;
+    /**
+     * Resolves the complete high-level directory of subjects already authorized
+     * for a verified OpenID contact. The SDK owns both GW searches and polling;
+     * the result itself grants no professional role or SMART capability.
+     */
+    listAuthorizedIndividualSubjects(ctx: RouteContext, input: AuthorizedIndividualSubjectDirectoryInput): Promise<AuthorizedIndividualSubject[]>;
     /** Adds zero-cost seats to one individual organization's member pool. */
     addFreeIndividualMemberLicenses(ctx: RouteContext, input: IndividualMemberLicenseAddInput): Promise<SubmitAndPollResult>;
     /** Reserves one individual seat for an existing FHIR v3-role contact. */

package/dist/node-runtime-client.js

@@ -19,6 +19,7 @@ import { RuntimeClientPaths } from './runtime-client-paths.js';
 import { runtimeUuid, wrapBundleAsGatewayTransactionMessage } from './runtime-message.js';
 import { submitFhirR5SubscriptionBatchWithDeps, submitFhirR5SubscriptionTopicBatchWithDeps, } from './fhir-r5-subscription-runtime.js';
 import { materializeDigitalTwinWithDeps, saveDigitalTwinSelectionWithDeps, searchDigitalTwinsWithDeps, } from './digital-twin.js';
+import { listAuthorizedIndividualSubjectsWithDeps, } from './authorized-subject-directory.js';
 const bootstrapFacade = createBootstrapFacade();
 /**
  * Runtime-oriented HTTP client for Node backends, BFFs, and workers that need
@@ -751,6 +752,20 @@ export class HttpRuntimeClient {
             submitAndPoll: this.submitAndPoll.bind(this),
         });
     }
+    /**
+     * Resolves the complete high-level directory of subjects already authorized
+     * for a verified OpenID contact. The SDK owns both GW searches and polling;
+     * the result itself grants no professional role or SMART capability.
+     */
+    async listAuthorizedIndividualSubjects(ctx, input) {
+        return listAuthorizedIndividualSubjectsWithDeps(ctx, input, {
+            individualLicenseSearchPath: this.paths.individualLicenseSearchPath.bind(this.paths),
+            individualLicenseSearchPollPath: this.paths.individualLicenseSearchPollPath.bind(this.paths),
+            individualOrganizationSearchPath: this.paths.individualFamilyOrganizationSearchPath.bind(this.paths),
+            individualOrganizationSearchPollPath: this.paths.individualFamilyOrganizationSearchPollPath.bind(this.paths),
+            submitAndPoll: this.submitAndPoll.bind(this),
+        });
+    }
     /** Adds zero-cost seats to one individual organization's member pool. */
     async addFreeIndividualMemberLicenses(ctx, input) {
         return addFreeIndividualMemberLicensesWithDeps(ctx, input, {

package/dist/orchestration/client-port.d.ts

@@ -18,6 +18,7 @@ import type { EnsureFamilyOrganizationRegistrationInput, EnsureFamilyOrganizatio
 import type { OrganizationLicenseOrderConfirmInput } from '../organization-license-order.js';
 import type { SmartTokenExchangeResult, SmartTokenRequestInput } from '../smart-token.js';
 import type { DigitalTwinMaterializationInput, DigitalTwinSearchInput, DigitalTwinSelectionInput } from '../digital-twin.js';
+import type { AuthorizedIndividualSubject, AuthorizedIndividualSubjectDirectoryInput } from '../authorized-subject-directory.js';
 import type { CommunicationIngestionInput, BlockchainArtifactRegistrationInput, CommunicationParticipantRuntimeSearchInput, ClinicalBundleSearchInput, ClinicalSectionUpdateInput, ClinicalSummaryReadResult, ClinicalSummaryRequestInput, ClinicalSummaryUpdateInput, VitalSignBatchCommunicationFromSearchResponseInput, DigitalTwinGenerationInput, DigitalTwinSecondaryUseConsentInput, DigitalTwinSecondaryUseConsentResult, DigitalTwinSubjectLinkPurgeInput, DigitalTwinSubjectLinkPurgeResult, GrantProfessionalAccessInput, GrantProfessionalAccessResult, IndividualMemberLifecycleInput, IndividualMemberLicenseAddInput, IndividualMemberLicenseInvitationInput, IndividualMemberLicenseTransitionInput, IpsOrFhirImportInput, OrganizationEmployeeCreationInput, OrganizationEmployeeLicenseAddInput, OrganizationEmployeeLicenseOfferInput, OrganizationEmployeeLicenseInvitationInput, OrganizationEmployeeLifecycleInput, OrganizationEmployeeSearchInput, ProfessionalAccessRequestInput, ProfessionalAccessRequestResult, RevokeProfessionalAccessInput, RevokeProfessionalAccessResult, RelatedPersonUpsertInput } from '../resource-operations.js';
 /**
  * Shared node-runtime activation input.
@@ -124,6 +125,8 @@ export type RuntimeClient = {
     revokeProfessionalAccess?: (ctx: RouteContext, input: RevokeProfessionalAccessInput) => Promise<RevokeProfessionalAccessResult>;
     searchIndividualLicenses?: (ctx: RouteContext, input: LicenseListRuntimeSearchInput) => Promise<SubmitAndPollResult>;
     listIndividualLicenses?: (ctx: RouteContext, input?: LicenseListRuntimeSearchInput) => Promise<SubmitAndPollResult>;
+    /** Lists exact subjects already authorized for one verified OpenID contact. */
+    listAuthorizedIndividualSubjects?: (ctx: RouteContext, input: AuthorizedIndividualSubjectDirectoryInput) => Promise<AuthorizedIndividualSubject[]>;
     addFreeIndividualMemberLicenses?: (ctx: RouteContext, input: IndividualMemberLicenseAddInput) => Promise<SubmitAndPollResult>;
     issueIndividualMemberLicense?: (ctx: RouteContext, input: IndividualMemberLicenseInvitationInput) => Promise<SubmitAndPollResult>;
     transitionIndividualMemberLicense?: (ctx: RouteContext, action: '_accept' | '_deactivate' | '_release', input: IndividualMemberLicenseTransitionInput) => Promise<SubmitAndPollResult>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-sdk-node-ts",
-  "version": "2.4.37",
+  "version": "2.4.39",
   "description": "Next-generation Node runtime package for the GDC SDK family",
   "license": "Apache-2.0",
   "author": "Antifraud Services Inc.",