gdc-sdk-node-ts 2.5.1 → 2.6.0

package/dist/device-activation.js

@@ -98,8 +98,10 @@ export async function activateEmployeeDeviceWithActivationCodeWithDeps(deps) {
         throw new Error('Device activation requires a stable device, software, redirect, or key identifier.');
     const exchangePayload = {
         thid: `exchange-${createRuntimeUuid()}`,
-        [IdentityAuthRequestFields.SubjectToken]: deps.input.activationCode,
-        [IdentityAuthRequestFields.ClientInstanceId]: clientInstanceId,
+        body: {
+            [IdentityAuthRequestFields.SubjectToken]: deps.input.activationCode,
+            [IdentityAuthRequestFields.ClientInstanceId]: clientInstanceId,
+        },
     };
     const exchange = await deps.submitAndPollWithBearerToken(deps.input.idToken, deps.identityTokenExchangePath(deps.routeCtx), deps.identityTokenExchangePollPath(deps.routeCtx), exchangePayload, deps.input.pollOptions);
     const exchangeDiagnostics = firstFailedOperationOutcomeDiagnostic(exchange.poll.body)
@@ -122,8 +124,10 @@ export async function activateEmployeeDeviceWithActivationCodeWithDeps(deps) {
     }
     const dcrPayload = {
         thid: `dcr-${createRuntimeUuid()}`,
-        [IdentityAuthRequestFields.Code]: deps.input.activationCode,
-        ...deps.input.dcrPayload,
+        body: {
+            [IdentityAuthRequestFields.Code]: deps.input.activationCode,
+            ...deps.input.dcrPayload,
+        },
     };
     const dcr = await deps.submitAndPollWithBearerToken(initialAccessToken, deps.identityDeviceDcrPath(deps.routeCtx), deps.identityDeviceDcrPollPath(deps.routeCtx), dcrPayload, deps.input.pollOptions);
     return {

package/dist/digital-twin.d.ts

@@ -37,9 +37,11 @@ export type DigitalTwinSearchInput = {
 /**
  * One public ResearchSubject digital twin returned by search.
  *
- * `composition` is the canonical Composition GW uses as the aggregate's
- * internal index document. It joins the ResearchSubject to the projected
- * clinical resources later returned by `ResearchSubject/$summary`.
+ * `composition` is an SDK-only normalized view of the canonical Composition:
+ * it comes from mixed `meta.claims` in claims-first API responses or from
+ * `ResearchSubject.contained[]` in strict FHIR R4/R5. GW never emits an
+ * ad-hoc `ResearchSubject.composition` wire property. The canonical index joins
+ * the ResearchSubject to resources later returned by `$summary`.
  */
 export type DigitalTwinSearchMatch = Record<string, unknown> & {
     resourceType?: 'ResearchSubject';

package/dist/digital-twin.js

@@ -2,6 +2,7 @@
 import { randomUUID } from 'node:crypto';
 import { HealthcareDocumentTypes } from 'gdc-common-utils-ts/constants';
 import { CompositionClaim } from 'gdc-common-utils-ts/models';
+import { extractBundleSearchResources } from 'gdc-common-utils-ts/utils/organization-employee-lifecycle';
 const DIGITAL_TWIN_SUBJECT_URN_UUID = /^urn:uuid:[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 /** Returns whether a value can be used as a pseudonymous digital-twin subject. */
 export function isDigitalTwinSubjectId(value) {
@@ -38,6 +39,62 @@ export function buildDigitalTwinSelectionIdentifier(input) {
         compositionId: selectionId,
     });
 }
+function asRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+/**
+ * Normalizes the public aggregate without leaking its wire representation.
+ * Claims-first responses mix ResearchSubject and Composition flat claims in
+ * `meta.claims`; versioned FHIR responses carry the translated Composition in
+ * `contained[]`. The ad-hoc `composition` property remains read-only legacy.
+ */
+function normalizeDigitalTwinSearchMatch(resource) {
+    const metaClaims = asRecord(asRecord(resource.meta)?.claims);
+    const containedComposition = Array.isArray(resource.contained)
+        ? resource.contained.map(asRecord).find((candidate) => candidate?.resourceType === 'Composition')
+        : undefined;
+    const legacyComposition = asRecord(resource.composition);
+    const legacyCompositionClaims = asRecord(asRecord(legacyComposition?.meta)?.claims);
+    const containedSubject = asRecord(containedComposition?.subject)?.reference;
+    const subject = resource[CompositionClaim.Subject]
+        ?? metaClaims?.[CompositionClaim.Subject]
+        ?? containedSubject
+        ?? legacyComposition?.[CompositionClaim.Subject]
+        ?? legacyCompositionClaims?.[CompositionClaim.Subject];
+    assertDigitalTwinSubjectId(subject);
+    const composition = containedComposition
+        ?? legacyComposition
+        ?? (metaClaims ? { resourceType: 'Composition', meta: { claims: metaClaims } } : undefined);
+    return {
+        ...resource,
+        [CompositionClaim.Subject]: subject,
+        ...(composition ? { composition } : {}),
+    };
+}
+/** Finds the primary-document Bundle inside a direct or decoded DIDComm response. */
+function findDigitalTwinSearchBundle(value) {
+    const pending = [value];
+    const visited = new Set();
+    while (pending.length > 0) {
+        const candidate = pending.shift();
+        if (!candidate || typeof candidate !== 'object' || visited.has(candidate))
+            continue;
+        visited.add(candidate);
+        if (Array.isArray(candidate)) {
+            pending.push(...candidate);
+            continue;
+        }
+        const record = candidate;
+        const hasEntries = Array.isArray(record.data) || Array.isArray(record.entry);
+        if (hasEntries && (record.resourceType === 'Bundle' || candidate === value)) {
+            return record;
+        }
+        pending.push(...Object.values(record));
+    }
+    return undefined;
+}
 function normalizeResearchTags(tags) {
     if (!Array.isArray(tags) || tags.length === 0)
         throw new Error('At least one research tag is required.');
@@ -61,24 +118,21 @@ function normalizeResearchTags(tags) {
 }
 /** Opens the GW async response and exposes the matched ResearchSubjects directly. */
 export function readDigitalTwinSearchResult(operation) {
-    const body = operation?.poll?.body;
-    const responseEntries = Array.isArray(body?.data)
-        ? body.data
-        : Array.isArray(body?.entry)
-            ? body.entry
-            : [];
-    const responseEntry = responseEntries.find((entry) => {
-        const resource = entry?.resource;
-        return Boolean(resource && typeof resource === 'object' && Array.isArray(resource.data));
-    });
-    if (!responseEntry?.resource || !Array.isArray(responseEntry.resource.data)) {
-        throw new Error('Digital twin search did not return a Composition result set.');
-    }
-    const matches = responseEntry.resource.data;
-    for (const match of matches) {
-        assertDigitalTwinSubjectId(match?.[CompositionClaim.Subject]);
+    const bundle = findDigitalTwinSearchBundle(operation?.poll?.body);
+    const entries = Array.isArray(bundle?.data)
+        ? bundle.data
+        : Array.isArray(bundle?.entry)
+            ? bundle.entry
+            : undefined;
+    if (!bundle || !entries) {
+        throw new Error('Digital twin search did not return a ResearchSubject result set.');
     }
-    const parsedTotal = Number(responseEntry.resource.total);
+    const matches = extractBundleSearchResources({ ...bundle, data: entries })
+        .map(normalizeDigitalTwinSearchMatch);
+    const legacyAggregate = entries
+        .map((entry) => entry?.resource)
+        .find((resource) => resource && typeof resource === 'object' && Array.isArray(resource.data));
+    const parsedTotal = Number(legacyAggregate?.total ?? bundle.total);
     return {
         total: Number.isFinite(parsedTotal) ? parsedTotal : matches.length,
         matches,

package/dist/node-runtime-client.d.ts

@@ -86,6 +86,7 @@ export type NodeHttpClientOptions = HttpRuntimeClientOptions;
 export declare class HttpRuntimeClient implements NodeRuntimeClient {
     private readonly baseUrl;
     private readonly bearerToken?;
+    private activeSmartBearerToken?;
     private readonly runtimeVpToken?;
     private readonly resolvedAppInfo?;
     private readonly ctx?;
@@ -461,6 +462,10 @@ export declare class HttpRuntimeClient implements NodeRuntimeClient {
      * Route details are resolved either from `input` compatibility fields
      * (`tenantId` / `jurisdiction` / `sector`) or from
      * the default client route context configured in the constructor.
+     * A fetched actor-scoped access token is retained by this runtime for later
+     * clinical operations. Token acquisition and renewal continue to use the
+     * original account bearer, so applications must not reconstruct the SDK or
+     * manually replace its transport after this method returns.
      */
     requestSmartToken(input: SmartTokenRequestInput): Promise<SmartTokenExchangeResult>;
     /**

package/dist/node-runtime-client.js

@@ -33,7 +33,7 @@ export class HttpRuntimeClient {
     get transportConfig() {
         return {
             baseUrl: this.baseUrl,
-            bearerToken: this.bearerToken,
+            bearerToken: this.activeSmartBearerToken || this.bearerToken,
             defaultHeaders: this.defaultHeaders,
             requestTimeoutMs: this.requestTimeoutMs,
             httpTraceFile: this.httpTraceFile,
@@ -886,10 +886,14 @@ export class HttpRuntimeClient {
      * Route details are resolved either from `input` compatibility fields
      * (`tenantId` / `jurisdiction` / `sector`) or from
      * the default client route context configured in the constructor.
+     * A fetched actor-scoped access token is retained by this runtime for later
+     * clinical operations. Token acquisition and renewal continue to use the
+     * original account bearer, so applications must not reconstruct the SDK or
+     * manually replace its transport after this method returns.
      */
     async requestSmartToken(input) {
         const routeCtx = this.paths.routeCtxFromInput(input);
-        return requestSmartTokenWithDeps({
+        const result = await requestSmartTokenWithDeps({
             input,
             routeCtx,
             baseUrl: this.baseUrl,
@@ -900,9 +904,16 @@ export class HttpRuntimeClient {
             identityOpenIdSmartTokenPath: this.paths.identityOpenIdSmartTokenPath.bind(this.paths),
             identityOpenIdSmartTokenPollPath: this.paths.identityOpenIdSmartTokenPollPath.bind(this.paths),
             resolveSmartTokenEndpoint: this.smartTokenEndpointResolver,
-            submitAndPoll: this.submitAndPoll.bind(this),
+            // Token acquisition and refresh remain authenticated by the original
+            // account bearer. A previously granted SMART token must not replace the
+            // OIDC proof used to request the next actor-scoped token.
+            submitAndPoll: this.submitAndPollWithBearerToken.bind(this, this.bearerToken),
             setTokenCache: (tokenCacheKey, token) => this.tokenCache.set(tokenCacheKey, token),
         });
+        if (result.status === 'fetched' && result.accessToken) {
+            this.activeSmartBearerToken = result.accessToken;
+        }
+        return result;
     }
     /**
      * Registers any actor profile device through activation-code exchange plus

package/dist/orchestration/digital-twin-sdk.d.ts

@@ -12,8 +12,9 @@ export declare class DigitalTwinSdk {
     requestSmartToken(input: SmartTokenRequestInput): Promise<SmartTokenExchangeResult>;
     /**
      * Searches the public `ResearchSubject/_search` aggregate with FHIR
-     * Parameters. Each match includes the canonical Composition GW uses
-     * internally to index that ResearchSubject and connect its resources.
+     * Parameters. The high-level match normalizes either mixed claims-first
+     * `meta.claims` or a versioned FHIR `contained[]` Composition. Callers never
+     * need to navigate either transport representation.
      *
      * MVP basic search supplies `sections`, `dateFrom`, optional `dateTo`, and
      * `text`. GW resolves an omitted `dateTo` to its current time, applies OR

package/dist/orchestration/digital-twin-sdk.js

@@ -37,8 +37,9 @@ export class DigitalTwinSdk {
     }
     /**
      * Searches the public `ResearchSubject/_search` aggregate with FHIR
-     * Parameters. Each match includes the canonical Composition GW uses
-     * internally to index that ResearchSubject and connect its resources.
+     * Parameters. The high-level match normalizes either mixed claims-first
+     * `meta.claims` or a versioned FHIR `contained[]` Composition. Callers never
+     * need to navigate either transport representation.
      *
      * MVP basic search supplies `sections`, `dateFrom`, optional `dateTo`, and
      * `text`. GW resolves an omitted `dateTo` to its current time, applies OR

package/dist/orchestration/individual-controller-sdk.d.ts

@@ -80,6 +80,12 @@ export declare class IndividualControllerSdk {
     revokeProfessionalAccess(ctx: RouteContext, input: RevokeProfessionalAccessInput): Promise<RevokeProfessionalAccessResult>;
     /**
      * Imports a FHIR/IPS payload and waits until it is indexed.
+     *
+     * The source `Composition.author` is provenance, not delegated authority.
+     * A controller that imports an IPS authored by an external URN does not gain
+     * permission to rewrite or delete it. A correction requires independently
+     * verified source provenance; merely resubmitting the same URN is
+     * insufficient and unsigned/demo imports remain locally immutable.
      */
     importIpsOrFhirAndUpdateIndex(ctx: RouteContext, input: IpsOrFhirImportInput): Promise<SubmitAndPollResult>;
     /**

package/dist/orchestration/individual-controller-sdk.js

@@ -119,6 +119,12 @@ export class IndividualControllerSdk {
     }
     /**
      * Imports a FHIR/IPS payload and waits until it is indexed.
+     *
+     * The source `Composition.author` is provenance, not delegated authority.
+     * A controller that imports an IPS authored by an external URN does not gain
+     * permission to rewrite or delete it. A correction requires independently
+     * verified source provenance; merely resubmitting the same URN is
+     * insufficient and unsigned/demo imports remain locally immutable.
      */
     importIpsOrFhirAndUpdateIndex(ctx, input) {
         assertFacadeCapability(this.capabilities, ActorCapabilities.IndividualImportIps, ActorKinds.IndividualController, 'importIpsOrFhirAndUpdateIndex');

package/dist/organization-employee-lifecycle.d.ts

@@ -72,7 +72,11 @@ export type EmployeeActivationGrantInput = Readonly<{
 export declare function createEmployeeActivationGrant(input: EmployeeActivationGrantInput): EmployeeActivationGrant;
 /** Verifies that a stored routing grant belongs to the authenticated email. */
 export declare function employeeActivationGrantMatchesEmail(grant: EmployeeActivationGrant, email: string): boolean;
-/** Stable profile id derived from account, employee and provider identities. */
+/**
+ * Stable profile id derived from account, employee, provider and portal
+ * installation identities. The portal installation id only separates local
+ * profiles; it is not a cryptographic DCR key identifier.
+ */
 export declare function buildOrganizationEmployeeProfileId(input: Readonly<{
     ownerId: string;
     employeeDid: string;

package/dist/organization-employee-lifecycle.js

@@ -187,7 +187,11 @@ export function createEmployeeActivationGrant(input) {
 export function employeeActivationGrantMatchesEmail(grant, email) {
     return grant.employeeActorIdentifier === buildStableActorIdentifier({ contactKind: 'email', contact: email });
 }
-/** Stable profile id derived from account, employee and provider identities. */
+/**
+ * Stable profile id derived from account, employee, provider and portal
+ * installation identities. The portal installation id only separates local
+ * profiles; it is not a cryptographic DCR key identifier.
+ */
 export function buildOrganizationEmployeeProfileId(input) {
     const digest = createHash('sha256')
         .update([input.ownerId, input.employeeDid, input.providerDid, input.clientInstanceId].join('\u0000'))
@@ -215,7 +219,6 @@ export async function enrollInvitedOrganizationEmployeeWithDeps(input, deps) {
         pin: input.pin,
         idToken: input.idToken,
         activationCode: input.activationCode,
-        clientInstanceId: input.clientInstanceId,
         dcrRedirectUris: input.dcrRedirectUris,
         dcrClientName: input.dcrClientName,
         // The grant contains the server-verified stable actor alias and role. The

package/dist/resource-operations.d.ts

@@ -208,6 +208,14 @@ export type IndividualMemberLifecycleInput = {
     dataType?: string;
 };
 export type IpsOrFhirImportInput = {
+    /**
+     * Server-built IPS/FHIR payload whose original Composition author is
+     * preserved as provenance. Importing an external `urn:*` author never makes
+     * the authenticated controller that author and does not grant local update
+     * or delete authority. Repeating the same author URN is not proof that a
+     * correction came from the same source; unsigned/demo imports therefore
+     * remain locally immutable under the strict audit contract.
+     */
     compositionPayload: {
         thid?: string;
     } & Record<string, unknown>;
@@ -298,6 +306,8 @@ type ClinicalUpdateRuntimeOptions = Readonly<{
  * `ifMatch` for optimistic concurrency. GW authorizes it against the creator
  * DID plus the caller's linked verified login identity; contact identifiers
  * are never written into the clinical resource.
+ * An externally authored `urn:*` may be preserved on first import, but a local
+ * controller cannot subsequently update or delete that source-authored fact.
  */
 export type ClinicalSectionUpdateInput = ClinicalSectionUpdateCommunicationInput & ClinicalUpdateRuntimeOptions;
 /** Updates one complete multi-section clinical summary document. */

package/dist/server-profile-session.js

@@ -548,7 +548,11 @@ export class ServerProfileSessionManager {
         });
         // SMART/OpenID uses its own JSON/form protocol and must not be wrapped in
         // the encrypted resource transport selected for later business actions.
-        const sdk = new ProfessionalSdk(this.createClient(profile.routeContext, idToken));
+        // Professional business operations are authored by the registered employee
+        // wallet and therefore use the encrypted DIDComm client. SMART/OpenID below
+        // remains an independent JSON/form exchange through its dedicated method.
+        const sdk = new ProfessionalSdk(operationalClient);
+        const smartSdk = new ProfessionalSdk(this.createClient(profile.routeContext, idToken));
         const digitalTwin = new DigitalTwinSdk(operationalClient, profile.actorDid);
         let digitalTwinAccessToken;
         const request = async (smart) => {
@@ -567,7 +571,7 @@ export class ServerProfileSessionManager {
                 ...input.professionalProof,
                 role,
             });
-            return sdk.requestSmartToken({
+            return smartSdk.requestSmartToken({
                 ...profile.routeContext,
                 actorDid: profile.actorDid,
                 subjectDid: String(smart.subjectDid || '').trim() || undefined,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-sdk-node-ts",
-  "version": "2.5.1",
+  "version": "2.6.0",
   "description": "Next-generation Node runtime package for the GDC SDK family",
   "license": "Apache-2.0",
   "author": "Antifraud Services Inc.",
@@ -38,8 +38,8 @@
     "test:e2e:live-gw:clean": "bash ./scripts/run-live-gw-clean.sh"
   },
   "dependencies": {
-    "gdc-common-utils-ts": "2.6.0",
-    "gdc-sdk-core-ts": "2.4.0"
+    "gdc-common-utils-ts": "2.7.0",
+    "gdc-sdk-core-ts": "2.4.1"
   },
   "devDependencies": {
     "@types/node": "^20.14.10",

package/dist/organization-registration-authorization.d.ts

@@ -1,16 +0,0 @@
-import type { VerifiableCredentialV2 } from 'gdc-common-utils-ts/models/verifiable-credential';
-import type { IWallet, WalletExecutionContext, WalletKeySelection } from 'gdc-sdk-core-ts';
-/** Input required to add one human-authorizer proof to the out-of-band VC. */
-export type SignOrganizationRegistrationAuthorizationInput = Readonly<{
-    credential: VerifiableCredentialV2;
-    wallet: IWallet;
-    context: WalletExecutionContext;
-    key: WalletKeySelection;
-    verificationMethod: string;
-    createdAt?: string;
-}>;
-/**
- * Adds one detached JWS proof made by the already-unlocked professional
- * profile. The browser never receives the private key or clear wallet seed.
- */
-export declare function signOrganizationRegistrationAuthorizationCredential(input: SignOrganizationRegistrationAuthorizationInput): Promise<VerifiableCredentialV2>;

package/dist/organization-registration-authorization.js

@@ -1,34 +0,0 @@
-import { canonicalizeOrganizationRegistrationAuthorizationCredential, } from 'gdc-common-utils-ts/utils/organization-registration-authorization';
-/**
- * Adds one detached JWS proof made by the already-unlocked professional
- * profile. The browser never receives the private key or clear wallet seed.
- */
-export async function signOrganizationRegistrationAuthorizationCredential(input) {
-    if (!input.wallet.signDetachedJws) {
-        throw new Error('Wallet does not support detached organization authorization proofs.');
-    }
-    const verificationMethod = String(input.verificationMethod || '').trim();
-    if (!verificationMethod)
-        throw new Error('Organization authorization proof requires verificationMethod.');
-    const payload = canonicalizeOrganizationRegistrationAuthorizationCredential(input.credential);
-    const jws = await input.wallet.signDetachedJws(input.context, {
-        payload,
-        header: { typ: 'application/vc+ld+json' },
-        key: input.key,
-    });
-    const existingProofs = Array.isArray(input.credential.proof)
-        ? input.credential.proof
-        : input.credential.proof
-            ? [input.credential.proof]
-            : [];
-    return {
-        ...input.credential,
-        proof: [...existingProofs, {
-                type: 'JsonWebSignature2020',
-                created: input.createdAt || new Date().toISOString(),
-                proofPurpose: 'contractAgreement',
-                verificationMethod,
-                jws,
-            }],
-    };
-}