gdc-sdk-node-ts 2.5.0 → 2.5.2

package/dist/authorized-subject-directory.js

@@ -7,6 +7,9 @@ const CLAIM_ITEM_CONDITION = 'org.schema.IndividualProduct.itemCondition';
 const CLAIM_PERSON_EMAIL = 'org.schema.Person.email';
 const CLAIM_PERSON_TELEPHONE = 'org.schema.Person.telephone';
 const CLAIM_ORGANIZATION_SAME_AS = 'org.schema.Organization.sameAs';
+const CLAIM_ORGANIZATION_OWNER_EMAIL = 'org.schema.Organization.owner.email';
+const CLAIM_ORGANIZATION_OWNER_TELEPHONE = 'org.schema.Organization.owner.telephone';
+const CLAIM_ORGANIZATION_MEMBER_ROLE = 'org.schema.Organization.member.role';
 const CLAIM_RELATED_PERSON_ROLE = 'RelatedPerson.role';
 const CLAIM_OCCUPATION_IDENTIFIER = 'org.schema.Person.hasOccupation.identifier.value';
 /**
@@ -23,6 +26,24 @@ export async function listAuthorizedIndividualSubjectsWithDeps(routeContext, inp
     if (!email && !telephone) {
         throw new Error('A verified email or telephone is required to list authorized subjects.');
     }
+    const ownerResult = await deps.submitAndPoll(deps.individualOrganizationSearchPath(routeContext), deps.individualOrganizationSearchPollPath(routeContext), {
+        thid: input.requestThid || createThreadId('authorized-subject-owner'),
+        body: {
+            resourceType: 'Bundle',
+            type: 'batch',
+            data: [{
+                    type: 'Family-search-v1.0',
+                    request: { method: 'POST' },
+                    meta: { claims: {
+                            '@context': SCHEMA_CONTEXT,
+                            ...(email ? { [CLAIM_ORGANIZATION_OWNER_EMAIL]: email } : {}),
+                            ...(telephone ? { [CLAIM_ORGANIZATION_OWNER_TELEPHONE]: telephone } : {}),
+                        } },
+                }],
+        },
+    }, input.pollOptions);
+    const ownedSubjects = readOwnedSubjects(ownerResult, { email, telephone });
+    const subjectsByDid = new Map(ownedSubjects.map((subject) => [subject.subjectDid, subject]));
     const licenseClaims = {
         '@context': SCHEMA_CONTEXT,
         [CLAIM_AUDIENCE_TYPE]: INDIVIDUAL_AUDIENCE_TYPE,
@@ -42,7 +63,7 @@ export async function listAuthorizedIndividualSubjectsWithDeps(routeContext, inp
         },
     }, input.pollOptions);
     const licenses = readAcceptedLicenses(licenseResult);
-    const resolved = await Promise.all(licenses.map(async (license) => {
+    const resolved = await Promise.all(licenses.filter((license) => !subjectsByDid.has(license.subjectDid)).map(async (license) => {
         const organizationClaims = {
             '@context': SCHEMA_CONTEXT,
             [CLAIM_ORGANIZATION_SAME_AS]: license.subjectDid,
@@ -74,7 +95,38 @@ export async function listAuthorizedIndividualSubjectsWithDeps(routeContext, inp
             subjectClaims,
         };
     }));
-    return resolved.filter((value) => Boolean(value));
+    for (const subject of resolved.filter((value) => Boolean(value))) {
+        subjectsByDid.set(subject.subjectDid, subject);
+    }
+    return [...subjectsByDid.values()];
+}
+function readOwnedSubjects(result, verified) {
+    const resources = readData(result).flatMap((entry) => {
+        if (entry?.resource?.resourceType === 'Bundle' && Array.isArray(entry.resource.entry)) {
+            return entry.resource.entry.map((item) => item?.resource).filter(Boolean);
+        }
+        return [];
+    });
+    return resources.flatMap((resource) => {
+        const claims = resource?.meta?.claims;
+        if (!claims || typeof claims !== 'object')
+            return [];
+        const ownerEmail = String(claims[CLAIM_ORGANIZATION_OWNER_EMAIL] || '').trim().toLowerCase();
+        const ownerTelephone = String(claims[CLAIM_ORGANIZATION_OWNER_TELEPHONE] || '').trim();
+        if (!((verified.email && ownerEmail === verified.email) || (verified.telephone && ownerTelephone === verified.telephone))) {
+            return [];
+        }
+        const subjectDid = String(claims[CLAIM_ORGANIZATION_SAME_AS] || '').trim();
+        if (!subjectDid)
+            return [];
+        const role = String(claims[CLAIM_ORGANIZATION_MEMBER_ROLE] || '').trim();
+        return [{
+                subjectDid,
+                ...(role ? { role } : {}),
+                grantClaims: {},
+                subjectClaims: claims,
+            }];
+    });
 }
 function readAcceptedLicenses(result) {
     const rows = readData(result)[0]?.resource?.data;

package/dist/node-managed-wallet.d.ts

@@ -180,6 +180,16 @@ export declare class NodeManagedWallet implements IWallet {
      * Packs one payload into a transport envelope signed and encrypted by the runtime.
      */
     packForRecipientWithContext(content: any, recipientDidOrJwk: string | JWK, options: WalletPackOptions): Promise<string>;
+    /**
+     * Packs the first activation/DCR requests before GW can resolve this
+     * installation's communication keys from a registered DID document.
+     *
+     * The embedded public keys are bootstrap response and signature material;
+     * callers must still authenticate the HTTP request with the trusted OIDC
+     * token and one server-authorized activation code. Post-DCR operations must
+     * use `packForRecipientWithContext` so registered key custody is resolved.
+     */
+    packProfileBootstrapForRecipientWithContext(content: any, recipientDidOrJwk: string | JWK, options: WalletPackOptions): Promise<string>;
     /**
      * Legacy unpack shape retained for app compatibility.
      */

package/dist/node-managed-wallet.js

@@ -467,6 +467,46 @@ export class NodeManagedWallet {
             key: encryptionKey,
         });
     }
+    /**
+     * Packs the first activation/DCR requests before GW can resolve this
+     * installation's communication keys from a registered DID document.
+     *
+     * The embedded public keys are bootstrap response and signature material;
+     * callers must still authenticate the HTTP request with the trusted OIDC
+     * token and one server-authorized activation code. Post-DCR operations must
+     * use `packForRecipientWithContext` so registered key custody is resolved.
+     */
+    async packProfileBootstrapForRecipientWithContext(content, recipientDidOrJwk, options) {
+        const recipientJwk = typeof recipientDidOrJwk === 'string'
+            ? await this.resolveRecipientPublicJwk(recipientDidOrJwk)
+            : recipientDidOrJwk;
+        const signingKey = this.requireManagedKey(options.context, {
+            ownerScope: 'runtime',
+            purpose: 'comm-signing',
+        }, 'sig');
+        const encryptionKey = this.requireManagedKey(options.context, {
+            ownerScope: 'runtime',
+            purpose: 'comm-encryption',
+        }, 'enc');
+        const compactJws = await this.signCompactJws(options.context, {
+            header: {
+                typ: 'JWS',
+                jwk: signingKey.descriptor.publicJwk,
+            },
+            claims: content,
+            key: { keyId: signingKey.descriptor.kid },
+        });
+        const senderEncryptionKey = {
+            ...encryptionKey.descriptor.publicJwk,
+            dBytes: encryptionKey.privateMaterial,
+        };
+        return this.cryptography.encryptJweToCompact(compactJws, {
+            enc: 'A256GCM',
+            skid: encryptionKey.descriptor.kid,
+            jwk: encryptionKey.descriptor.publicJwk,
+            cty: 'JWS',
+        }, senderEncryptionKey, recipientJwk);
+    }
     /**
      * Legacy unpack shape retained for app compatibility.
      */

package/dist/node-runtime-client.d.ts

@@ -86,6 +86,7 @@ export type NodeHttpClientOptions = HttpRuntimeClientOptions;
 export declare class HttpRuntimeClient implements NodeRuntimeClient {
     private readonly baseUrl;
     private readonly bearerToken?;
+    private activeSmartBearerToken?;
     private readonly runtimeVpToken?;
     private readonly resolvedAppInfo?;
     private readonly ctx?;
@@ -461,6 +462,10 @@ export declare class HttpRuntimeClient implements NodeRuntimeClient {
      * Route details are resolved either from `input` compatibility fields
      * (`tenantId` / `jurisdiction` / `sector`) or from
      * the default client route context configured in the constructor.
+     * A fetched actor-scoped access token is retained by this runtime for later
+     * clinical operations. Token acquisition and renewal continue to use the
+     * original account bearer, so applications must not reconstruct the SDK or
+     * manually replace its transport after this method returns.
      */
     requestSmartToken(input: SmartTokenRequestInput): Promise<SmartTokenExchangeResult>;
     /**

package/dist/node-runtime-client.js

@@ -33,7 +33,7 @@ export class HttpRuntimeClient {
     get transportConfig() {
         return {
             baseUrl: this.baseUrl,
-            bearerToken: this.bearerToken,
+            bearerToken: this.activeSmartBearerToken || this.bearerToken,
             defaultHeaders: this.defaultHeaders,
             requestTimeoutMs: this.requestTimeoutMs,
             httpTraceFile: this.httpTraceFile,
@@ -886,10 +886,14 @@ export class HttpRuntimeClient {
      * Route details are resolved either from `input` compatibility fields
      * (`tenantId` / `jurisdiction` / `sector`) or from
      * the default client route context configured in the constructor.
+     * A fetched actor-scoped access token is retained by this runtime for later
+     * clinical operations. Token acquisition and renewal continue to use the
+     * original account bearer, so applications must not reconstruct the SDK or
+     * manually replace its transport after this method returns.
      */
     async requestSmartToken(input) {
         const routeCtx = this.paths.routeCtxFromInput(input);
-        return requestSmartTokenWithDeps({
+        const result = await requestSmartTokenWithDeps({
             input,
             routeCtx,
             baseUrl: this.baseUrl,
@@ -900,9 +904,16 @@ export class HttpRuntimeClient {
             identityOpenIdSmartTokenPath: this.paths.identityOpenIdSmartTokenPath.bind(this.paths),
             identityOpenIdSmartTokenPollPath: this.paths.identityOpenIdSmartTokenPollPath.bind(this.paths),
             resolveSmartTokenEndpoint: this.smartTokenEndpointResolver,
-            submitAndPoll: this.submitAndPoll.bind(this),
+            // Token acquisition and refresh remain authenticated by the original
+            // account bearer. A previously granted SMART token must not replace the
+            // OIDC proof used to request the next actor-scoped token.
+            submitAndPoll: this.submitAndPollWithBearerToken.bind(this, this.bearerToken),
             setTokenCache: (tokenCacheKey, token) => this.tokenCache.set(tokenCacheKey, token),
         });
+        if (result.status === 'fetched' && result.accessToken) {
+            this.activeSmartBearerToken = result.accessToken;
+        }
+        return result;
     }
     /**
      * Registers any actor profile device through activation-code exchange plus

package/dist/orchestration/individual-controller-sdk.d.ts

@@ -80,6 +80,12 @@ export declare class IndividualControllerSdk {
     revokeProfessionalAccess(ctx: RouteContext, input: RevokeProfessionalAccessInput): Promise<RevokeProfessionalAccessResult>;
     /**
      * Imports a FHIR/IPS payload and waits until it is indexed.
+     *
+     * The source `Composition.author` is provenance, not delegated authority.
+     * A controller that imports an IPS authored by an external URN does not gain
+     * permission to rewrite or delete it. A correction requires independently
+     * verified source provenance; merely resubmitting the same URN is
+     * insufficient and unsigned/demo imports remain locally immutable.
      */
     importIpsOrFhirAndUpdateIndex(ctx: RouteContext, input: IpsOrFhirImportInput): Promise<SubmitAndPollResult>;
     /**

package/dist/orchestration/individual-controller-sdk.js

@@ -119,6 +119,12 @@ export class IndividualControllerSdk {
     }
     /**
      * Imports a FHIR/IPS payload and waits until it is indexed.
+     *
+     * The source `Composition.author` is provenance, not delegated authority.
+     * A controller that imports an IPS authored by an external URN does not gain
+     * permission to rewrite or delete it. A correction requires independently
+     * verified source provenance; merely resubmitting the same URN is
+     * insufficient and unsigned/demo imports remain locally immutable.
      */
     importIpsOrFhirAndUpdateIndex(ctx, input) {
         assertFacadeCapability(this.capabilities, ActorCapabilities.IndividualImportIps, ActorKinds.IndividualController, 'importIpsOrFhirAndUpdateIndex');

package/dist/organization-registration-authorization.d.ts

@@ -0,0 +1,16 @@
+import type { VerifiableCredentialV2 } from 'gdc-common-utils-ts/models/verifiable-credential';
+import type { IWallet, WalletExecutionContext, WalletKeySelection } from 'gdc-sdk-core-ts';
+/** Input required to add one human-authorizer proof to the out-of-band VC. */
+export type SignOrganizationRegistrationAuthorizationInput = Readonly<{
+    credential: VerifiableCredentialV2;
+    wallet: IWallet;
+    context: WalletExecutionContext;
+    key: WalletKeySelection;
+    verificationMethod: string;
+    createdAt?: string;
+}>;
+/**
+ * Adds one detached JWS proof made by the already-unlocked professional
+ * profile. The browser never receives the private key or clear wallet seed.
+ */
+export declare function signOrganizationRegistrationAuthorizationCredential(input: SignOrganizationRegistrationAuthorizationInput): Promise<VerifiableCredentialV2>;

package/dist/organization-registration-authorization.js

@@ -0,0 +1,34 @@
+import { canonicalizeOrganizationRegistrationAuthorizationCredential, } from 'gdc-common-utils-ts/utils/organization-registration-authorization';
+/**
+ * Adds one detached JWS proof made by the already-unlocked professional
+ * profile. The browser never receives the private key or clear wallet seed.
+ */
+export async function signOrganizationRegistrationAuthorizationCredential(input) {
+    if (!input.wallet.signDetachedJws) {
+        throw new Error('Wallet does not support detached organization authorization proofs.');
+    }
+    const verificationMethod = String(input.verificationMethod || '').trim();
+    if (!verificationMethod)
+        throw new Error('Organization authorization proof requires verificationMethod.');
+    const payload = canonicalizeOrganizationRegistrationAuthorizationCredential(input.credential);
+    const jws = await input.wallet.signDetachedJws(input.context, {
+        payload,
+        header: { typ: 'application/vc+ld+json' },
+        key: input.key,
+    });
+    const existingProofs = Array.isArray(input.credential.proof)
+        ? input.credential.proof
+        : input.credential.proof
+            ? [input.credential.proof]
+            : [];
+    return {
+        ...input.credential,
+        proof: [...existingProofs, {
+                type: 'JsonWebSignature2020',
+                created: input.createdAt || new Date().toISOString(),
+                proofPurpose: 'contractAgreement',
+                verificationMethod,
+                jws,
+            }],
+    };
+}

package/dist/resource-operations.d.ts

@@ -208,6 +208,14 @@ export type IndividualMemberLifecycleInput = {
     dataType?: string;
 };
 export type IpsOrFhirImportInput = {
+    /**
+     * Server-built IPS/FHIR payload whose original Composition author is
+     * preserved as provenance. Importing an external `urn:*` author never makes
+     * the authenticated controller that author and does not grant local update
+     * or delete authority. Repeating the same author URN is not proof that a
+     * correction came from the same source; unsigned/demo imports therefore
+     * remain locally immutable under the strict audit contract.
+     */
     compositionPayload: {
         thid?: string;
     } & Record<string, unknown>;
@@ -298,6 +306,8 @@ type ClinicalUpdateRuntimeOptions = Readonly<{
  * `ifMatch` for optimistic concurrency. GW authorizes it against the creator
  * DID plus the caller's linked verified login identity; contact identifiers
  * are never written into the clinical resource.
+ * An externally authored `urn:*` may be preserved on first import, but a local
+ * controller cannot subsequently update or delete that source-authored fact.
  */
 export type ClinicalSectionUpdateInput = ClinicalSectionUpdateCommunicationInput & ClinicalUpdateRuntimeOptions;
 /** Updates one complete multi-section clinical summary document. */

package/dist/server-profile-session.js

@@ -44,7 +44,18 @@ export class ServerProfileSessionManager {
         const idToken = String(input.idToken || '').trim();
         if (!idToken)
             throw new Error('Profile enrollment requires a signed OIDC idToken for account/email binding.');
-        const client = this.createClient(input.routeContext, idToken);
+        const client = new NodeHttpClient({
+            baseUrl: this.options.gatewayBaseUrl,
+            ctx: input.routeContext,
+            bearerToken: idToken,
+            appInfo: this.options.appInfo,
+            fetchImpl: this.options.fetchImpl,
+            transportProfile: TransportProfiles.DidcommEncryptedForm,
+            secureTransportAdapter: {
+                pack: (message) => wallet.packProfileBootstrapForRecipientWithContext({ ...message, iss: input.actorDid }, input.providerDid, { context }),
+                unpack: async (jwe) => (await wallet.unpackWithContext(jwe, { context })).content,
+            },
+        });
         const redirectUris = input.redirectUris || input.dcrRedirectUris || [];
         const clientName = String(input.clientName || input.dcrClientName || '').trim();
         const activationRequest = createProfileDeviceActivationRequest({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-sdk-node-ts",
-  "version": "2.5.0",
+  "version": "2.5.2",
   "description": "Next-generation Node runtime package for the GDC SDK family",
   "license": "Apache-2.0",
   "author": "Antifraud Services Inc.",
@@ -38,7 +38,7 @@
     "test:e2e:live-gw:clean": "bash ./scripts/run-live-gw-clean.sh"
   },
   "dependencies": {
-    "gdc-common-utils-ts": "2.6.0",
+    "gdc-common-utils-ts": "2.6.2",
     "gdc-sdk-core-ts": "2.4.0"
   },
   "devDependencies": {