gdc-sdk-node-ts 2.4.45 → 2.5.1

package/README.md

@@ -702,7 +702,8 @@ modules below.
 - [`NodeHttpClient.submitCommunicationAndPoll(...)`](src/node-runtime-client.ts)
 - [`NodeHttpClient.searchClinicalBundle(...)`](src/node-runtime-client.ts)
 - [`NodeHttpClient.updateClinicalSection(...)`](src/node-runtime-client.ts) for
-  one explicit section carried by a batch/collection Communication
+  one explicit section carried by a batch Communication; its typed entries may
+  mix `.create()`, `.update()` and exact authored `.delete()` operations
 - [`NodeHttpClient.updateClinicalSummary(...)`](src/node-runtime-client.ts) for
   a Composition-first multi-section document
 - [`NodeHttpClient.searchLatestIps(...)`](src/node-runtime-client.ts)

package/dist/authorized-subject-directory.js

@@ -7,6 +7,9 @@ const CLAIM_ITEM_CONDITION = 'org.schema.IndividualProduct.itemCondition';
 const CLAIM_PERSON_EMAIL = 'org.schema.Person.email';
 const CLAIM_PERSON_TELEPHONE = 'org.schema.Person.telephone';
 const CLAIM_ORGANIZATION_SAME_AS = 'org.schema.Organization.sameAs';
+const CLAIM_ORGANIZATION_OWNER_EMAIL = 'org.schema.Organization.owner.email';
+const CLAIM_ORGANIZATION_OWNER_TELEPHONE = 'org.schema.Organization.owner.telephone';
+const CLAIM_ORGANIZATION_MEMBER_ROLE = 'org.schema.Organization.member.role';
 const CLAIM_RELATED_PERSON_ROLE = 'RelatedPerson.role';
 const CLAIM_OCCUPATION_IDENTIFIER = 'org.schema.Person.hasOccupation.identifier.value';
 /**
@@ -23,6 +26,24 @@ export async function listAuthorizedIndividualSubjectsWithDeps(routeContext, inp
     if (!email && !telephone) {
         throw new Error('A verified email or telephone is required to list authorized subjects.');
     }
+    const ownerResult = await deps.submitAndPoll(deps.individualOrganizationSearchPath(routeContext), deps.individualOrganizationSearchPollPath(routeContext), {
+        thid: input.requestThid || createThreadId('authorized-subject-owner'),
+        body: {
+            resourceType: 'Bundle',
+            type: 'batch',
+            data: [{
+                    type: 'Family-search-v1.0',
+                    request: { method: 'POST' },
+                    meta: { claims: {
+                            '@context': SCHEMA_CONTEXT,
+                            ...(email ? { [CLAIM_ORGANIZATION_OWNER_EMAIL]: email } : {}),
+                            ...(telephone ? { [CLAIM_ORGANIZATION_OWNER_TELEPHONE]: telephone } : {}),
+                        } },
+                }],
+        },
+    }, input.pollOptions);
+    const ownedSubjects = readOwnedSubjects(ownerResult, { email, telephone });
+    const subjectsByDid = new Map(ownedSubjects.map((subject) => [subject.subjectDid, subject]));
     const licenseClaims = {
         '@context': SCHEMA_CONTEXT,
         [CLAIM_AUDIENCE_TYPE]: INDIVIDUAL_AUDIENCE_TYPE,
@@ -42,7 +63,7 @@ export async function listAuthorizedIndividualSubjectsWithDeps(routeContext, inp
         },
     }, input.pollOptions);
     const licenses = readAcceptedLicenses(licenseResult);
-    const resolved = await Promise.all(licenses.map(async (license) => {
+    const resolved = await Promise.all(licenses.filter((license) => !subjectsByDid.has(license.subjectDid)).map(async (license) => {
         const organizationClaims = {
             '@context': SCHEMA_CONTEXT,
             [CLAIM_ORGANIZATION_SAME_AS]: license.subjectDid,
@@ -74,7 +95,38 @@ export async function listAuthorizedIndividualSubjectsWithDeps(routeContext, inp
             subjectClaims,
         };
     }));
-    return resolved.filter((value) => Boolean(value));
+    for (const subject of resolved.filter((value) => Boolean(value))) {
+        subjectsByDid.set(subject.subjectDid, subject);
+    }
+    return [...subjectsByDid.values()];
+}
+function readOwnedSubjects(result, verified) {
+    const resources = readData(result).flatMap((entry) => {
+        if (entry?.resource?.resourceType === 'Bundle' && Array.isArray(entry.resource.entry)) {
+            return entry.resource.entry.map((item) => item?.resource).filter(Boolean);
+        }
+        return [];
+    });
+    return resources.flatMap((resource) => {
+        const claims = resource?.meta?.claims;
+        if (!claims || typeof claims !== 'object')
+            return [];
+        const ownerEmail = String(claims[CLAIM_ORGANIZATION_OWNER_EMAIL] || '').trim().toLowerCase();
+        const ownerTelephone = String(claims[CLAIM_ORGANIZATION_OWNER_TELEPHONE] || '').trim();
+        if (!((verified.email && ownerEmail === verified.email) || (verified.telephone && ownerTelephone === verified.telephone))) {
+            return [];
+        }
+        const subjectDid = String(claims[CLAIM_ORGANIZATION_SAME_AS] || '').trim();
+        if (!subjectDid)
+            return [];
+        const role = String(claims[CLAIM_ORGANIZATION_MEMBER_ROLE] || '').trim();
+        return [{
+                subjectDid,
+                ...(role ? { role } : {}),
+                grantClaims: {},
+                subjectClaims: claims,
+            }];
+    });
 }
 function readAcceptedLicenses(result) {
     const rows = readData(result)[0]?.resource?.data;

package/dist/node-managed-wallet.d.ts

@@ -180,6 +180,16 @@ export declare class NodeManagedWallet implements IWallet {
      * Packs one payload into a transport envelope signed and encrypted by the runtime.
      */
     packForRecipientWithContext(content: any, recipientDidOrJwk: string | JWK, options: WalletPackOptions): Promise<string>;
+    /**
+     * Packs the first activation/DCR requests before GW can resolve this
+     * installation's communication keys from a registered DID document.
+     *
+     * The embedded public keys are bootstrap response and signature material;
+     * callers must still authenticate the HTTP request with the trusted OIDC
+     * token and one server-authorized activation code. Post-DCR operations must
+     * use `packForRecipientWithContext` so registered key custody is resolved.
+     */
+    packProfileBootstrapForRecipientWithContext(content: any, recipientDidOrJwk: string | JWK, options: WalletPackOptions): Promise<string>;
     /**
      * Legacy unpack shape retained for app compatibility.
      */

package/dist/node-managed-wallet.js

@@ -467,6 +467,46 @@ export class NodeManagedWallet {
             key: encryptionKey,
         });
     }
+    /**
+     * Packs the first activation/DCR requests before GW can resolve this
+     * installation's communication keys from a registered DID document.
+     *
+     * The embedded public keys are bootstrap response and signature material;
+     * callers must still authenticate the HTTP request with the trusted OIDC
+     * token and one server-authorized activation code. Post-DCR operations must
+     * use `packForRecipientWithContext` so registered key custody is resolved.
+     */
+    async packProfileBootstrapForRecipientWithContext(content, recipientDidOrJwk, options) {
+        const recipientJwk = typeof recipientDidOrJwk === 'string'
+            ? await this.resolveRecipientPublicJwk(recipientDidOrJwk)
+            : recipientDidOrJwk;
+        const signingKey = this.requireManagedKey(options.context, {
+            ownerScope: 'runtime',
+            purpose: 'comm-signing',
+        }, 'sig');
+        const encryptionKey = this.requireManagedKey(options.context, {
+            ownerScope: 'runtime',
+            purpose: 'comm-encryption',
+        }, 'enc');
+        const compactJws = await this.signCompactJws(options.context, {
+            header: {
+                typ: 'JWS',
+                jwk: signingKey.descriptor.publicJwk,
+            },
+            claims: content,
+            key: { keyId: signingKey.descriptor.kid },
+        });
+        const senderEncryptionKey = {
+            ...encryptionKey.descriptor.publicJwk,
+            dBytes: encryptionKey.privateMaterial,
+        };
+        return this.cryptography.encryptJweToCompact(compactJws, {
+            enc: 'A256GCM',
+            skid: encryptionKey.descriptor.kid,
+            jwk: encryptionKey.descriptor.publicJwk,
+            cty: 'JWS',
+        }, senderEncryptionKey, recipientJwk);
+    }
     /**
      * Legacy unpack shape retained for app compatibility.
      */

package/dist/orchestration/individual-controller-sdk.d.ts

@@ -94,7 +94,12 @@ export declare class IndividualControllerSdk {
      * Ingests a FHIR `Communication` and waits for indexing.
      */
     ingestCommunicationAndUpdateIndex(ctx: RouteContext, input: CommunicationIngestionInput): Promise<SubmitAndPollResult>;
-    /** Updates one exact clinical section through a section-scoped batch/collection. */
+    /**
+     * Updates one exact clinical section through a section-scoped batch.
+     * Entries choose their own operation, so one call may create one resource
+     * and delete another with `.delete()` and optional `.ifMatch(versionId)`.
+     * DELETE entries contain no resource body.
+     */
     updateClinicalSection(ctx: RouteContext, input: ClinicalSectionUpdateInput): Promise<SubmitAndPollResult>;
     /** Updates the multi-section summary through a Composition-first document. */
     updateClinicalSummary(ctx: RouteContext, input: ClinicalSummaryUpdateInput): Promise<SubmitAndPollResult>;

package/dist/orchestration/individual-controller-sdk.js

@@ -142,7 +142,12 @@ export class IndividualControllerSdk {
         assertFacadeCapability(this.capabilities, ActorCapabilities.IndividualIngestCommunication, ActorKinds.IndividualController, 'ingestCommunicationAndUpdateIndex');
         return requireClientMethod(this.client, 'ingestCommunicationAndUpdateIndex')(ctx, input);
     }
-    /** Updates one exact clinical section through a section-scoped batch/collection. */
+    /**
+     * Updates one exact clinical section through a section-scoped batch.
+     * Entries choose their own operation, so one call may create one resource
+     * and delete another with `.delete()` and optional `.ifMatch(versionId)`.
+     * DELETE entries contain no resource body.
+     */
     updateClinicalSection(ctx, input) {
         assertFacadeCapability(this.capabilities, ActorCapabilities.IndividualIngestCommunication, ActorKinds.IndividualController, 'updateClinicalSection');
         return requireClientMethod(this.client, 'updateClinicalSection')(ctx, input);

package/dist/resource-operations.d.ts

@@ -291,7 +291,14 @@ type ClinicalUpdateRuntimeOptions = Readonly<{
         intervalMs?: number;
     };
 }>;
-/** Updates exactly one clinical section through a scoped batch/collection. */
+/**
+ * Updates exactly one clinical section through a scoped batch/collection.
+ * A `Bundle.type = batch` may mix typed create, update, and delete entries.
+ * A delete targets `ResourceType/id`, carries no resource body, and may use
+ * `ifMatch` for optimistic concurrency. GW authorizes it against the creator
+ * DID plus the caller's linked verified login identity; contact identifiers
+ * are never written into the clinical resource.
+ */
 export type ClinicalSectionUpdateInput = ClinicalSectionUpdateCommunicationInput & ClinicalUpdateRuntimeOptions;
 /** Updates one complete multi-section clinical summary document. */
 export type ClinicalSummaryUpdateInput = ClinicalUpdateCommunicationInput & ClinicalUpdateRuntimeOptions;

package/dist/server-profile-session.js

@@ -44,7 +44,18 @@ export class ServerProfileSessionManager {
         const idToken = String(input.idToken || '').trim();
         if (!idToken)
             throw new Error('Profile enrollment requires a signed OIDC idToken for account/email binding.');
-        const client = this.createClient(input.routeContext, idToken);
+        const client = new NodeHttpClient({
+            baseUrl: this.options.gatewayBaseUrl,
+            ctx: input.routeContext,
+            bearerToken: idToken,
+            appInfo: this.options.appInfo,
+            fetchImpl: this.options.fetchImpl,
+            transportProfile: TransportProfiles.DidcommEncryptedForm,
+            secureTransportAdapter: {
+                pack: (message) => wallet.packProfileBootstrapForRecipientWithContext({ ...message, iss: input.actorDid }, input.providerDid, { context }),
+                unpack: async (jwe) => (await wallet.unpackWithContext(jwe, { context })).content,
+            },
+        });
         const redirectUris = input.redirectUris || input.dcrRedirectUris || [];
         const clientName = String(input.clientName || input.dcrClientName || '').trim();
         const activationRequest = createProfileDeviceActivationRequest({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-sdk-node-ts",
-  "version": "2.4.45",
+  "version": "2.5.1",
   "description": "Next-generation Node runtime package for the GDC SDK family",
   "license": "Apache-2.0",
   "author": "Antifraud Services Inc.",
@@ -38,8 +38,8 @@
     "test:e2e:live-gw:clean": "bash ./scripts/run-live-gw-clean.sh"
   },
   "dependencies": {
-    "gdc-common-utils-ts": "2.5.20",
-    "gdc-sdk-core-ts": "~2.3.18"
+    "gdc-common-utils-ts": "2.6.0",
+    "gdc-sdk-core-ts": "2.4.0"
   },
   "devDependencies": {
     "@types/node": "^20.14.10",