gdc-sdk-node-ts 2.6.7 → 2.7.1

package/dist/device-activation.d.ts

@@ -1,3 +1,4 @@
+import type { ClinicalCreatorBinding } from 'gdc-common-utils-ts/utils/fhir-ips-creator-identity';
 import type { PollOptions, SubmitAndPollResult } from './orchestration/client-port.js';
 import type { RouteContext } from './individual-onboarding.js';
 export type EmployeeDeviceActivationInput = {
@@ -32,6 +33,7 @@ export type ProfileDeviceRegistrationInput = Readonly<{
     deviceName?: string;
     actorDid?: string;
     profileDid?: string;
+    clinicalCreatorBinding?: ClinicalCreatorBinding;
 }>;
 /** Advanced typed editor used by SDK runtimes that already own profile keys. */
 export interface ProfileDeviceActivationDraft {
@@ -43,6 +45,7 @@ export interface ProfileDeviceActivationDraft {
     setDeviceName(value: string): ProfileDeviceActivationDraft;
     setActorDid(value: string): ProfileDeviceActivationDraft;
     setProfileDid(value: string): ProfileDeviceActivationDraft;
+    setClinicalCreatorBinding(value: ClinicalCreatorBinding): ProfileDeviceActivationDraft;
     setTimeoutSeconds(value: number): ProfileDeviceActivationDraft;
     setIntervalSeconds(value: number): ProfileDeviceActivationDraft;
     build(): EmployeeDeviceActivationRequestInput & {

package/dist/device-activation.js

@@ -20,6 +20,7 @@ export function createProfileDeviceActivationRequest(input) {
     let deviceName = '';
     let actorDid = '';
     let profileDid = '';
+    let clinicalCreatorBinding;
     let timeoutSeconds;
     let intervalSeconds;
     const draft = {
@@ -31,6 +32,7 @@ export function createProfileDeviceActivationRequest(input) {
         setDeviceName(value) { deviceName = normalizedText(value); return draft; },
         setActorDid(value) { actorDid = normalizedText(value); return draft; },
         setProfileDid(value) { profileDid = normalizedText(value); return draft; },
+        setClinicalCreatorBinding(value) { clinicalCreatorBinding = stableClinicalCreatorBinding(value); return draft; },
         setTimeoutSeconds(value) { timeoutSeconds = positiveNumber(value, 'timeout seconds'); return draft; },
         setIntervalSeconds(value) { intervalSeconds = positiveNumber(value, 'interval seconds'); return draft; },
         build() {
@@ -43,6 +45,7 @@ export function createProfileDeviceActivationRequest(input) {
                 ...(deviceName ? { deviceName } : {}),
                 ...(actorDid ? { actorDid } : {}),
                 ...(profileDid ? { profileDid } : {}),
+                ...(clinicalCreatorBinding ? { clinicalCreatorBinding } : {}),
             };
             return {
                 ...input,
@@ -165,12 +168,24 @@ function resolveDcrPayload(input) {
             },
             ...(registration.actorDid ? { [IdentityDcrMetadataFields.ActorDid]: registration.actorDid } : {}),
             ...(registration.profileDid ? { [IdentityDcrMetadataFields.ProfileDid]: registration.profileDid } : {}),
+            ...(registration.clinicalCreatorBinding ? {
+                [IdentityDcrMetadataFields.ClinicalCreatorBinding]: stableClinicalCreatorBinding(registration.clinicalCreatorBinding),
+            } : {}),
         };
     }
     if (input.dcrPayload)
         return { ...input.dcrPayload };
     throw new Error('Device activation requires a device registration built by createProfileDeviceActivationRequest.');
 }
+function stableClinicalCreatorBinding(binding) {
+    return {
+        kind: binding.kind,
+        actorIdentifier: binding.actorIdentifier,
+        authorIdentifier: binding.authorIdentifier,
+        ownerIdentifier: binding.ownerIdentifier,
+        role: binding.role,
+    };
+}
 function responseBody(value) {
     if (typeof value === 'string') {
         try {

package/dist/organization-registration-authorization.d.ts

@@ -0,0 +1,16 @@
+import type { VerifiableCredentialV2 } from 'gdc-common-utils-ts/models/verifiable-credential';
+import type { IWallet, WalletExecutionContext, WalletKeySelection } from 'gdc-sdk-core-ts';
+/** Input required to add one human-authorizer proof to the out-of-band VC. */
+export type SignOrganizationRegistrationAuthorizationInput = Readonly<{
+    credential: VerifiableCredentialV2;
+    wallet: IWallet;
+    context: WalletExecutionContext;
+    key: WalletKeySelection;
+    verificationMethod: string;
+    createdAt?: string;
+}>;
+/**
+ * Adds one detached JWS proof made by the already-unlocked professional
+ * profile. The browser never receives the private key or clear wallet seed.
+ */
+export declare function signOrganizationRegistrationAuthorizationCredential(input: SignOrganizationRegistrationAuthorizationInput): Promise<VerifiableCredentialV2>;

package/dist/organization-registration-authorization.js

@@ -0,0 +1,34 @@
+import { canonicalizeOrganizationRegistrationAuthorizationCredential, } from 'gdc-common-utils-ts/utils/organization-registration-authorization';
+/**
+ * Adds one detached JWS proof made by the already-unlocked professional
+ * profile. The browser never receives the private key or clear wallet seed.
+ */
+export async function signOrganizationRegistrationAuthorizationCredential(input) {
+    if (!input.wallet.signDetachedJws) {
+        throw new Error('Wallet does not support detached organization authorization proofs.');
+    }
+    const verificationMethod = String(input.verificationMethod || '').trim();
+    if (!verificationMethod)
+        throw new Error('Organization authorization proof requires verificationMethod.');
+    const payload = canonicalizeOrganizationRegistrationAuthorizationCredential(input.credential);
+    const jws = await input.wallet.signDetachedJws(input.context, {
+        payload,
+        header: { typ: 'application/vc+ld+json' },
+        key: input.key,
+    });
+    const existingProofs = Array.isArray(input.credential.proof)
+        ? input.credential.proof
+        : input.credential.proof
+            ? [input.credential.proof]
+            : [];
+    return {
+        ...input.credential,
+        proof: [...existingProofs, {
+                type: 'JsonWebSignature2020',
+                created: input.createdAt || new Date().toISOString(),
+                proofPurpose: 'contractAgreement',
+                verificationMethod,
+                jws,
+            }],
+    };
+}

package/dist/server-profile-session.d.ts

@@ -1,7 +1,7 @@
 import type { JWK } from 'gdc-common-utils-ts/models/jwk';
 import type { ActorKind } from 'gdc-common-utils-ts/models/actor-session';
 import type { LegalOrganizationVerificationTransactionInput } from 'gdc-common-utils-ts/utils/legal-organization-verification-transaction';
-import { type AppInfo, type ConfidentialStorageProfile, type PollOptions, type SubmitAndPollResult } from 'gdc-sdk-core-ts';
+import { type AppInfo, type ConfidentialStorageProfile, type PollOptions, type SubmitAndPollResult, type ClinicalCreatorBinding, type ClinicalCreatorIpsExport } from 'gdc-sdk-core-ts';
 import { OrganizationControllerSdk } from './orchestration/organization-controller-sdk.js';
 import { ProfessionalSdk } from './orchestration/professional-sdk.js';
 import { DigitalTwinSdk } from './orchestration/digital-twin-sdk.js';
@@ -29,6 +29,8 @@ export type ServerProfileRecord = Readonly<{
     clientId: string;
     /** Stable non-secret id of the browser/app installation registered by DCR. */
     clientInstanceId?: string;
+    /** Stable FHIR creator/permission identity; channel and device values are aliases only. */
+    clinicalCreatorBinding?: ClinicalCreatorBinding;
     deviceDid: string;
     publicJwks: Record<string, unknown>[];
     /** Public recipient key for local confidential storage; not a DCR communication key. */
@@ -122,6 +124,12 @@ export type ServerProfileEnrollmentInput = Readonly<{
      * derives the identity from the wallet key it creates for this profile.
      */
     clientInstanceId?: string;
+    /**
+     * Server-authorized stable creator identity imported from FHIR or generated
+     * locally. Enrollment adds the operational actor DID and registered DCR
+     * client/key aliases; it never derives UUIDs from those aliases.
+     */
+    clinicalCreatorBinding?: ClinicalCreatorBinding;
     /**
      * Signed actor/controller VP protected for later SMART operations. Required
      * for organization/professional/member actors. Individual-controller
@@ -392,3 +400,8 @@ export declare class ServerProfileSessionManager {
     private requireSubject;
     private now;
 }
+/**
+ * Exports the stable FHIR IPS creator attached to a server profile. Direct
+ * writes continue to use `profile.actorDid`; this function is export-only.
+ */
+export declare function exportServerProfileClinicalCreatorIps(profile: ServerProfileRecord): ClinicalCreatorIpsExport;

package/dist/server-profile-session.js

@@ -3,7 +3,7 @@ import { randomBytes } from 'node:crypto';
 import { ActorKinds } from 'gdc-common-utils-ts/constants/actor-session';
 import { readLegalOrganizationVerificationCredentialPairFromResponseBody, readServiceControllerCredentialFromResponseBody, } from 'gdc-common-utils-ts/utils/legal-organization-verification-result';
 import { addLegalRepresentativeCredential, addOrganizationCredential, addServiceControllerCredential, createVP, } from 'gdc-common-utils-ts/utils/vp-token';
-import { TransportProfiles, } from 'gdc-sdk-core-ts';
+import { TransportProfiles, resolveClinicalCreatorIpsExport, } from 'gdc-sdk-core-ts';
 import { NodeManagedWallet } from './node-managed-wallet.js';
 import { NodeHttpClient } from './node-runtime-client.js';
 import { OrganizationControllerSdk } from './orchestration/organization-controller-sdk.js';
@@ -58,7 +58,7 @@ export class ServerProfileSessionManager {
         });
         const redirectUris = input.redirectUris || input.dcrRedirectUris || [];
         const clientName = String(input.clientName || input.dcrClientName || '').trim();
-        const activationRequest = createProfileDeviceActivationRequest({
+        const activationDraft = createProfileDeviceActivationRequest({
             activationCode: input.activationCode,
             idToken,
             ...input.routeContext,
@@ -69,8 +69,11 @@ export class ServerProfileSessionManager {
             .setRedirectUris(redirectUris)
             .setPublicJwks(publicKeys.filter((entry) => entry.purpose !== 'document-at-rest').map((entry) => entry.publicJwk))
             .setActorDid(input.actorDid)
-            .setProfileDid(input.profileDid)
-            .build();
+            .setProfileDid(input.profileDid);
+        if (input.clinicalCreatorBinding) {
+            activationDraft.setClinicalCreatorBinding(input.clinicalCreatorBinding);
+        }
+        const activationRequest = activationDraft.build();
         const activation = await client.activateProfileDeviceWithActivationRequest(activationRequest);
         const dcrBody = terminalBody(activation.dcr.poll.body);
         const clientId = findText(dcrBody, ['client_id', 'clientId']);
@@ -86,6 +89,16 @@ export class ServerProfileSessionManager {
                 ...input.professionalProof,
             })
             : undefined);
+        const clinicalCreatorBinding = input.clinicalCreatorBinding
+            ? bindClinicalCreatorChannels(input.clinicalCreatorBinding, {
+                actorDid: input.actorDid,
+                clientId,
+                clientInstanceId,
+                keyIds: publicKeys
+                    .map((entry) => String(entry.publicJwk?.kid || entry.kid || '').trim())
+                    .filter(Boolean),
+            })
+            : undefined;
         const record = {
             profileId: input.profileId,
             walletKeyDerivationId,
@@ -99,6 +112,7 @@ export class ServerProfileSessionManager {
             allowedSubjectDids: unique(input.allowedSubjectDids),
             clientId,
             clientInstanceId,
+            ...(clinicalCreatorBinding ? { clinicalCreatorBinding } : {}),
             deviceDid,
             publicJwks: publicKeys.filter((entry) => entry.purpose !== 'document-at-rest').map((entry) => entry.publicJwk),
             storagePublicJwk: storagePublicJwk,
@@ -157,6 +171,14 @@ export class ServerProfileSessionManager {
                 role: replacement.employeeRole,
                 sameAs: replacement.employeeActorIdentifier,
             },
+            ...(previous.clinicalCreatorBinding ? {
+                clinicalCreatorBinding: {
+                    ...previous.clinicalCreatorBinding,
+                    actorDids: [previous.actorDid],
+                    dcrClientIds: [],
+                    keyIds: [],
+                },
+            } : {}),
         });
         await this.options.store.deleteSessionsForProfile(profile.profileId);
         return profile;
@@ -769,6 +791,33 @@ function requireBase64UrlSeed32(seed) {
         throw new Error('Profile enrollment walletSeed must be a 32-byte base64url value.');
     }
 }
+/**
+ * Exports the stable FHIR IPS creator attached to a server profile. Direct
+ * writes continue to use `profile.actorDid`; this function is export-only.
+ */
+export function exportServerProfileClinicalCreatorIps(profile) {
+    if (!profile.clinicalCreatorBinding) {
+        throw new Error('Server profile has no clinical creator binding.');
+    }
+    return resolveClinicalCreatorIpsExport({
+        bindings: [profile.clinicalCreatorBinding],
+        evidence: { actorDid: profile.actorDid },
+    });
+}
+function bindClinicalCreatorChannels(binding, channel) {
+    const stored = {
+        ...binding,
+        actorDids: unique([...(binding.actorDids || []), channel.actorDid]),
+        dcrClientIds: unique([
+            ...(binding.dcrClientIds || []),
+            channel.clientId,
+            channel.clientInstanceId,
+        ]),
+        keyIds: unique([...(binding.keyIds || []), ...channel.keyIds]),
+    };
+    resolveClinicalCreatorIpsExport({ bindings: [stored], evidence: { actorDid: channel.actorDid } });
+    return stored;
+}
 function requireEnrollment(input) {
     for (const [name, value] of Object.entries({
         ownerId: input.ownerId,
@@ -789,6 +838,10 @@ function requireEnrollment(input) {
     if (input.professionalProof && !String(input.professionalProof.role || '').trim()) {
         throw new Error('Profile enrollment professionalProof requires role.');
     }
+    if (input.professionalProof && input.clinicalCreatorBinding
+        && String(input.professionalProof.role).trim() !== String(input.clinicalCreatorBinding.role).trim()) {
+        throw new Error('Clinical creator binding role must equal professionalProof.role.');
+    }
     if (!input.allowedSubjectDids.length)
         throw new Error('Profile enrollment requires an allowed subject.');
 }

package/dist/smart-token.js

@@ -137,16 +137,17 @@ async function resolveClientAssertion(input) {
     });
 }
 function resolveTokenExchangeResult(exchange, normalizedScopes, tokenCacheKey, setTokenCache) {
-    const pollBody = exchange.poll.body ?? {};
+    const pollResult = exchange.poll;
+    const pollPayload = pollResult.body ?? {};
     // Encrypted DIDComm returns the token in the authenticated message body;
     // plain compatibility transports may still expose the token at the root.
-    const exchangeBody = pollBody.body || pollBody;
+    const exchangeBody = pollPayload.body || pollPayload;
     const accessToken = String(exchangeBody.access_token || '').trim();
-    if (exchange.poll.status >= 400 || !accessToken) {
+    if (pollResult.status >= 400 || !accessToken) {
         return {
             status: 'failed',
-            statusCode: exchange.poll.status,
-            response: exchange.poll.body,
+            statusCode: pollResult.status,
+            response: exchangeBody,
         };
     }
     const tokenType = String(exchangeBody.token_type || 'Bearer');
@@ -164,8 +165,8 @@ function resolveTokenExchangeResult(exchange, normalizedScopes, tokenCacheKey, s
         accessToken,
         tokenType,
         scopes: resolvedScopes,
-        statusCode: exchange.poll.status,
-        response: exchange.poll.body,
+        statusCode: pollResult.status,
+        response: exchangeBody,
     };
 }
 function createRuntimeUuid() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-sdk-node-ts",
-  "version": "2.6.7",
+  "version": "2.7.1",
   "description": "Next-generation Node runtime package for the GDC SDK family",
   "license": "Apache-2.0",
   "author": "Antifraud Services Inc.",
@@ -38,8 +38,8 @@
     "test:e2e:live-gw:clean": "bash ./scripts/run-live-gw-clean.sh"
   },
   "dependencies": {
-    "gdc-common-utils-ts": "2.7.8",
-    "gdc-sdk-core-ts": "2.4.9"
+    "gdc-common-utils-ts": "2.8.1",
+    "gdc-sdk-core-ts": "2.5.2"
   },
   "devDependencies": {
     "@types/node": "^20.14.10",