gdc-sdk-node-ts 2.5.2 → 2.6.0

package/dist/device-activation.js

@@ -98,8 +98,10 @@ export async function activateEmployeeDeviceWithActivationCodeWithDeps(deps) {
         throw new Error('Device activation requires a stable device, software, redirect, or key identifier.');
     const exchangePayload = {
         thid: `exchange-${createRuntimeUuid()}`,
-        [IdentityAuthRequestFields.SubjectToken]: deps.input.activationCode,
-        [IdentityAuthRequestFields.ClientInstanceId]: clientInstanceId,
+        body: {
+            [IdentityAuthRequestFields.SubjectToken]: deps.input.activationCode,
+            [IdentityAuthRequestFields.ClientInstanceId]: clientInstanceId,
+        },
     };
     const exchange = await deps.submitAndPollWithBearerToken(deps.input.idToken, deps.identityTokenExchangePath(deps.routeCtx), deps.identityTokenExchangePollPath(deps.routeCtx), exchangePayload, deps.input.pollOptions);
     const exchangeDiagnostics = firstFailedOperationOutcomeDiagnostic(exchange.poll.body)
@@ -122,8 +124,10 @@ export async function activateEmployeeDeviceWithActivationCodeWithDeps(deps) {
     }
     const dcrPayload = {
         thid: `dcr-${createRuntimeUuid()}`,
-        [IdentityAuthRequestFields.Code]: deps.input.activationCode,
-        ...deps.input.dcrPayload,
+        body: {
+            [IdentityAuthRequestFields.Code]: deps.input.activationCode,
+            ...deps.input.dcrPayload,
+        },
     };
     const dcr = await deps.submitAndPollWithBearerToken(initialAccessToken, deps.identityDeviceDcrPath(deps.routeCtx), deps.identityDeviceDcrPollPath(deps.routeCtx), dcrPayload, deps.input.pollOptions);
     return {

package/dist/digital-twin.d.ts

@@ -37,9 +37,11 @@ export type DigitalTwinSearchInput = {
 /**
  * One public ResearchSubject digital twin returned by search.
  *
- * `composition` is the canonical Composition GW uses as the aggregate's
- * internal index document. It joins the ResearchSubject to the projected
- * clinical resources later returned by `ResearchSubject/$summary`.
+ * `composition` is an SDK-only normalized view of the canonical Composition:
+ * it comes from mixed `meta.claims` in claims-first API responses or from
+ * `ResearchSubject.contained[]` in strict FHIR R4/R5. GW never emits an
+ * ad-hoc `ResearchSubject.composition` wire property. The canonical index joins
+ * the ResearchSubject to resources later returned by `$summary`.
  */
 export type DigitalTwinSearchMatch = Record<string, unknown> & {
     resourceType?: 'ResearchSubject';

package/dist/digital-twin.js

@@ -2,6 +2,7 @@
 import { randomUUID } from 'node:crypto';
 import { HealthcareDocumentTypes } from 'gdc-common-utils-ts/constants';
 import { CompositionClaim } from 'gdc-common-utils-ts/models';
+import { extractBundleSearchResources } from 'gdc-common-utils-ts/utils/organization-employee-lifecycle';
 const DIGITAL_TWIN_SUBJECT_URN_UUID = /^urn:uuid:[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 /** Returns whether a value can be used as a pseudonymous digital-twin subject. */
 export function isDigitalTwinSubjectId(value) {
@@ -38,6 +39,62 @@ export function buildDigitalTwinSelectionIdentifier(input) {
         compositionId: selectionId,
     });
 }
+function asRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+/**
+ * Normalizes the public aggregate without leaking its wire representation.
+ * Claims-first responses mix ResearchSubject and Composition flat claims in
+ * `meta.claims`; versioned FHIR responses carry the translated Composition in
+ * `contained[]`. The ad-hoc `composition` property remains read-only legacy.
+ */
+function normalizeDigitalTwinSearchMatch(resource) {
+    const metaClaims = asRecord(asRecord(resource.meta)?.claims);
+    const containedComposition = Array.isArray(resource.contained)
+        ? resource.contained.map(asRecord).find((candidate) => candidate?.resourceType === 'Composition')
+        : undefined;
+    const legacyComposition = asRecord(resource.composition);
+    const legacyCompositionClaims = asRecord(asRecord(legacyComposition?.meta)?.claims);
+    const containedSubject = asRecord(containedComposition?.subject)?.reference;
+    const subject = resource[CompositionClaim.Subject]
+        ?? metaClaims?.[CompositionClaim.Subject]
+        ?? containedSubject
+        ?? legacyComposition?.[CompositionClaim.Subject]
+        ?? legacyCompositionClaims?.[CompositionClaim.Subject];
+    assertDigitalTwinSubjectId(subject);
+    const composition = containedComposition
+        ?? legacyComposition
+        ?? (metaClaims ? { resourceType: 'Composition', meta: { claims: metaClaims } } : undefined);
+    return {
+        ...resource,
+        [CompositionClaim.Subject]: subject,
+        ...(composition ? { composition } : {}),
+    };
+}
+/** Finds the primary-document Bundle inside a direct or decoded DIDComm response. */
+function findDigitalTwinSearchBundle(value) {
+    const pending = [value];
+    const visited = new Set();
+    while (pending.length > 0) {
+        const candidate = pending.shift();
+        if (!candidate || typeof candidate !== 'object' || visited.has(candidate))
+            continue;
+        visited.add(candidate);
+        if (Array.isArray(candidate)) {
+            pending.push(...candidate);
+            continue;
+        }
+        const record = candidate;
+        const hasEntries = Array.isArray(record.data) || Array.isArray(record.entry);
+        if (hasEntries && (record.resourceType === 'Bundle' || candidate === value)) {
+            return record;
+        }
+        pending.push(...Object.values(record));
+    }
+    return undefined;
+}
 function normalizeResearchTags(tags) {
     if (!Array.isArray(tags) || tags.length === 0)
         throw new Error('At least one research tag is required.');
@@ -61,24 +118,21 @@ function normalizeResearchTags(tags) {
 }
 /** Opens the GW async response and exposes the matched ResearchSubjects directly. */
 export function readDigitalTwinSearchResult(operation) {
-    const body = operation?.poll?.body;
-    const responseEntries = Array.isArray(body?.data)
-        ? body.data
-        : Array.isArray(body?.entry)
-            ? body.entry
-            : [];
-    const responseEntry = responseEntries.find((entry) => {
-        const resource = entry?.resource;
-        return Boolean(resource && typeof resource === 'object' && Array.isArray(resource.data));
-    });
-    if (!responseEntry?.resource || !Array.isArray(responseEntry.resource.data)) {
-        throw new Error('Digital twin search did not return a Composition result set.');
-    }
-    const matches = responseEntry.resource.data;
-    for (const match of matches) {
-        assertDigitalTwinSubjectId(match?.[CompositionClaim.Subject]);
+    const bundle = findDigitalTwinSearchBundle(operation?.poll?.body);
+    const entries = Array.isArray(bundle?.data)
+        ? bundle.data
+        : Array.isArray(bundle?.entry)
+            ? bundle.entry
+            : undefined;
+    if (!bundle || !entries) {
+        throw new Error('Digital twin search did not return a ResearchSubject result set.');
     }
-    const parsedTotal = Number(responseEntry.resource.total);
+    const matches = extractBundleSearchResources({ ...bundle, data: entries })
+        .map(normalizeDigitalTwinSearchMatch);
+    const legacyAggregate = entries
+        .map((entry) => entry?.resource)
+        .find((resource) => resource && typeof resource === 'object' && Array.isArray(resource.data));
+    const parsedTotal = Number(legacyAggregate?.total ?? bundle.total);
     return {
         total: Number.isFinite(parsedTotal) ? parsedTotal : matches.length,
         matches,

package/dist/orchestration/digital-twin-sdk.d.ts

@@ -12,8 +12,9 @@ export declare class DigitalTwinSdk {
     requestSmartToken(input: SmartTokenRequestInput): Promise<SmartTokenExchangeResult>;
     /**
      * Searches the public `ResearchSubject/_search` aggregate with FHIR
-     * Parameters. Each match includes the canonical Composition GW uses
-     * internally to index that ResearchSubject and connect its resources.
+     * Parameters. The high-level match normalizes either mixed claims-first
+     * `meta.claims` or a versioned FHIR `contained[]` Composition. Callers never
+     * need to navigate either transport representation.
      *
      * MVP basic search supplies `sections`, `dateFrom`, optional `dateTo`, and
      * `text`. GW resolves an omitted `dateTo` to its current time, applies OR

package/dist/orchestration/digital-twin-sdk.js

@@ -37,8 +37,9 @@ export class DigitalTwinSdk {
     }
     /**
      * Searches the public `ResearchSubject/_search` aggregate with FHIR
-     * Parameters. Each match includes the canonical Composition GW uses
-     * internally to index that ResearchSubject and connect its resources.
+     * Parameters. The high-level match normalizes either mixed claims-first
+     * `meta.claims` or a versioned FHIR `contained[]` Composition. Callers never
+     * need to navigate either transport representation.
      *
      * MVP basic search supplies `sections`, `dateFrom`, optional `dateTo`, and
      * `text`. GW resolves an omitted `dateTo` to its current time, applies OR

package/dist/organization-employee-lifecycle.d.ts

@@ -72,7 +72,11 @@ export type EmployeeActivationGrantInput = Readonly<{
 export declare function createEmployeeActivationGrant(input: EmployeeActivationGrantInput): EmployeeActivationGrant;
 /** Verifies that a stored routing grant belongs to the authenticated email. */
 export declare function employeeActivationGrantMatchesEmail(grant: EmployeeActivationGrant, email: string): boolean;
-/** Stable profile id derived from account, employee and provider identities. */
+/**
+ * Stable profile id derived from account, employee, provider and portal
+ * installation identities. The portal installation id only separates local
+ * profiles; it is not a cryptographic DCR key identifier.
+ */
 export declare function buildOrganizationEmployeeProfileId(input: Readonly<{
     ownerId: string;
     employeeDid: string;

package/dist/organization-employee-lifecycle.js

@@ -187,7 +187,11 @@ export function createEmployeeActivationGrant(input) {
 export function employeeActivationGrantMatchesEmail(grant, email) {
     return grant.employeeActorIdentifier === buildStableActorIdentifier({ contactKind: 'email', contact: email });
 }
-/** Stable profile id derived from account, employee and provider identities. */
+/**
+ * Stable profile id derived from account, employee, provider and portal
+ * installation identities. The portal installation id only separates local
+ * profiles; it is not a cryptographic DCR key identifier.
+ */
 export function buildOrganizationEmployeeProfileId(input) {
     const digest = createHash('sha256')
         .update([input.ownerId, input.employeeDid, input.providerDid, input.clientInstanceId].join('\u0000'))
@@ -215,7 +219,6 @@ export async function enrollInvitedOrganizationEmployeeWithDeps(input, deps) {
         pin: input.pin,
         idToken: input.idToken,
         activationCode: input.activationCode,
-        clientInstanceId: input.clientInstanceId,
         dcrRedirectUris: input.dcrRedirectUris,
         dcrClientName: input.dcrClientName,
         // The grant contains the server-verified stable actor alias and role. The

package/dist/server-profile-session.js

@@ -548,7 +548,11 @@ export class ServerProfileSessionManager {
         });
         // SMART/OpenID uses its own JSON/form protocol and must not be wrapped in
         // the encrypted resource transport selected for later business actions.
-        const sdk = new ProfessionalSdk(this.createClient(profile.routeContext, idToken));
+        // Professional business operations are authored by the registered employee
+        // wallet and therefore use the encrypted DIDComm client. SMART/OpenID below
+        // remains an independent JSON/form exchange through its dedicated method.
+        const sdk = new ProfessionalSdk(operationalClient);
+        const smartSdk = new ProfessionalSdk(this.createClient(profile.routeContext, idToken));
         const digitalTwin = new DigitalTwinSdk(operationalClient, profile.actorDid);
         let digitalTwinAccessToken;
         const request = async (smart) => {
@@ -567,7 +571,7 @@ export class ServerProfileSessionManager {
                 ...input.professionalProof,
                 role,
             });
-            return sdk.requestSmartToken({
+            return smartSdk.requestSmartToken({
                 ...profile.routeContext,
                 actorDid: profile.actorDid,
                 subjectDid: String(smart.subjectDid || '').trim() || undefined,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-sdk-node-ts",
-  "version": "2.5.2",
+  "version": "2.6.0",
   "description": "Next-generation Node runtime package for the GDC SDK family",
   "license": "Apache-2.0",
   "author": "Antifraud Services Inc.",
@@ -38,8 +38,8 @@
     "test:e2e:live-gw:clean": "bash ./scripts/run-live-gw-clean.sh"
   },
   "dependencies": {
-    "gdc-common-utils-ts": "2.6.2",
-    "gdc-sdk-core-ts": "2.4.0"
+    "gdc-common-utils-ts": "2.7.0",
+    "gdc-sdk-core-ts": "2.4.1"
   },
   "devDependencies": {
     "@types/node": "^20.14.10",

package/dist/organization-registration-authorization.d.ts

@@ -1,16 +0,0 @@
-import type { VerifiableCredentialV2 } from 'gdc-common-utils-ts/models/verifiable-credential';
-import type { IWallet, WalletExecutionContext, WalletKeySelection } from 'gdc-sdk-core-ts';
-/** Input required to add one human-authorizer proof to the out-of-band VC. */
-export type SignOrganizationRegistrationAuthorizationInput = Readonly<{
-    credential: VerifiableCredentialV2;
-    wallet: IWallet;
-    context: WalletExecutionContext;
-    key: WalletKeySelection;
-    verificationMethod: string;
-    createdAt?: string;
-}>;
-/**
- * Adds one detached JWS proof made by the already-unlocked professional
- * profile. The browser never receives the private key or clear wallet seed.
- */
-export declare function signOrganizationRegistrationAuthorizationCredential(input: SignOrganizationRegistrationAuthorizationInput): Promise<VerifiableCredentialV2>;

package/dist/organization-registration-authorization.js

@@ -1,34 +0,0 @@
-import { canonicalizeOrganizationRegistrationAuthorizationCredential, } from 'gdc-common-utils-ts/utils/organization-registration-authorization';
-/**
- * Adds one detached JWS proof made by the already-unlocked professional
- * profile. The browser never receives the private key or clear wallet seed.
- */
-export async function signOrganizationRegistrationAuthorizationCredential(input) {
-    if (!input.wallet.signDetachedJws) {
-        throw new Error('Wallet does not support detached organization authorization proofs.');
-    }
-    const verificationMethod = String(input.verificationMethod || '').trim();
-    if (!verificationMethod)
-        throw new Error('Organization authorization proof requires verificationMethod.');
-    const payload = canonicalizeOrganizationRegistrationAuthorizationCredential(input.credential);
-    const jws = await input.wallet.signDetachedJws(input.context, {
-        payload,
-        header: { typ: 'application/vc+ld+json' },
-        key: input.key,
-    });
-    const existingProofs = Array.isArray(input.credential.proof)
-        ? input.credential.proof
-        : input.credential.proof
-            ? [input.credential.proof]
-            : [];
-    return {
-        ...input.credential,
-        proof: [...existingProofs, {
-                type: 'JsonWebSignature2020',
-                created: input.createdAt || new Date().toISOString(),
-                proofPurpose: 'contractAgreement',
-                verificationMethod,
-                jws,
-            }],
-    };
-}