gdc-sdk-node-ts 2.7.5 → 2.7.7

package/dist/node-managed-wallet.d.ts

@@ -20,6 +20,8 @@ export type NodeProfessionalIdentityVpInput = Readonly<{
     sameAs?: string | readonly string[];
     telephone?: string;
     credentialMaterial?: string;
+    /** Server-authorized credentials appended after the professional identity VC. */
+    additionalCredentials?: ReadonlyArray<object>;
 }>;
 export type NodeCommunicationWalletInitialization = {
     /**

package/dist/node-managed-wallet.js

@@ -4,7 +4,7 @@ import { CryptographyService } from 'gdc-common-utils-ts/CryptographyService';
 import { Content } from 'gdc-common-utils-ts/utils/content';
 import { createJwtSigner } from 'gdc-common-utils-ts/utils/jwt-signer';
 import { buildJwtCompact, prepareJwtForSignature } from 'gdc-common-utils-ts/utils/jwt';
-import { buildProfessionalIdentityVpPayload } from 'gdc-common-utils-ts/utils/professional-smart';
+import { buildProfessionalIdentityVpPayload, getProfessionalIdentityVC, } from 'gdc-common-utils-ts/utils/professional-smart';
 import { NodeCryptoHelper } from './node-crypto-helper.js';
 const DEFAULT_POLICY = {
     defaults: {
@@ -359,6 +359,19 @@ export class NodeManagedWallet {
             ...(input.sameAs ? { sameAs: input.sameAs } : {}),
             ...(input.telephone ? { telephone: input.telephone } : {}),
             ...(input.credentialMaterial ? { credentialMaterial: input.credentialMaterial } : {}),
+            ...(input.additionalCredentials?.length ? {
+                verifiableCredential: [
+                    getProfessionalIdentityVC({
+                        actorDid: input.actorDid,
+                        role: input.role,
+                        ...(input.email ? { email: input.email } : {}),
+                        ...(input.sameAs ? { sameAs: input.sameAs } : {}),
+                        ...(input.telephone ? { telephone: input.telephone } : {}),
+                        ...(input.credentialMaterial ? { credentialMaterial: input.credentialMaterial } : {}),
+                    }),
+                    ...input.additionalCredentials.map(credential => credential),
+                ],
+            } : {}),
         });
         return this.signCompactJws(context, {
             header: { typ: 'JWT', jwk: vpSigningKey.publicJwk },

package/dist/server-profile-session.d.ts

@@ -281,6 +281,13 @@ export type ServerProfessionalOpenInput = Readonly<{
     pin?: string;
     /** Server-only seed already authorized by a product passkey/session policy. */
     authorizedWalletSeed?: string;
+    /** Provider tenant selected by a server-authorized inter-tenant workflow. */
+    target?: Readonly<{
+        providerDid: string;
+        routeContext: RouteContext;
+    }>;
+    /** Verified access credentials appended to the managed professional VP. */
+    accessCredentials?: ReadonlyArray<object>;
 }>;
 /** Business authorization requested from SMART; OpenID/JWT fields stay SDK-owned. */
 export type ServerProfessionalSmartTokenInput = Readonly<{
@@ -329,6 +336,14 @@ export type ServerProfileSessionManagerOptions = Readonly<{
 export declare class ServerProfileSessionManager {
     private readonly options;
     constructor(options: ServerProfileSessionManagerOptions);
+    /**
+     * Resolves the canonical IPS author/attester projection from one owned
+     * profile without exposing its protected wallet material to the portal.
+     */
+    exportClinicalCreatorIps(input: Readonly<{
+        ownerId: string;
+        profileId: string;
+    }>): Promise<ClinicalCreatorIpsExport>;
     enroll(input: ServerProfileEnrollmentInput): Promise<ServerProfileRecord>;
     /**
      * Rotates an employee wallet after a fresh OTP-authenticated GW recovery.

package/dist/server-profile-session.js

@@ -25,6 +25,13 @@ export class ServerProfileSessionManager {
     constructor(options) {
         this.options = options;
     }
+    /**
+     * Resolves the canonical IPS author/attester projection from one owned
+     * profile without exposing its protected wallet material to the portal.
+     */
+    async exportClinicalCreatorIps(input) {
+        return exportServerProfileClinicalCreatorIps(await this.requireOwnedProfile(input.ownerId, input.profileId));
+    }
     async enroll(input) {
         requireEnrollment(input);
         const seed = input.walletSeed || randomBytes(32).toString('base64url');
@@ -582,13 +589,17 @@ export class ServerProfileSessionManager {
         const wallet = await this.createWallet(walletKeyDerivationId, seed);
         const context = walletContext(walletKeyDerivationId);
         await requireRegisteredProfileKeys(wallet, context, profile);
+        const targetProviderDid = String(input.target?.providerDid || profile.providerDid).trim();
+        const targetRouteContext = input.target?.routeContext || profile.routeContext;
+        if (!targetProviderDid)
+            throw new Error('Opening a professional requires a target provider DID.');
         const secureTransportAdapter = {
-            pack: (message) => wallet.packForRecipientWithContext(bindOrganizationControllerTransport(message, profile), profile.providerDid, { context }),
+            pack: (message) => wallet.packForRecipientWithContext(bindOrganizationControllerTransport(message, { ...profile, providerDid: targetProviderDid }), targetProviderDid, { context }),
             unpack: async (jwe) => (await wallet.unpackWithContext(jwe, { context })).content,
         };
         const operationalClient = new NodeHttpClient({
             baseUrl: this.options.gatewayBaseUrl,
-            ctx: profile.routeContext,
+            ctx: targetRouteContext,
             bearerToken: idToken,
             fetchImpl: this.options.fetchImpl,
             appInfo: this.options.appInfo,
@@ -608,7 +619,7 @@ export class ServerProfileSessionManager {
             const now = this.now();
             const audience = [
                 this.options.gatewayBaseUrl.replace(/\/+$/, ''),
-                buildIdentityOpenIdSmartTokenPath(profile.routeContext),
+                buildIdentityOpenIdSmartTokenPath(targetRouteContext),
             ].join('');
             const clientAssertion = await buildWalletClientAssertion(wallet, profile, audience, now);
             const vpToken = await buildManagedProfessionalVp(wallet, context, {
@@ -617,9 +628,10 @@ export class ServerProfileSessionManager {
                 profileDid: profile.profileDid,
                 ...input.professionalProof,
                 role,
+                additionalCredentials: input.accessCredentials,
             });
             return smartSdk.requestSmartToken({
-                ...profile.routeContext,
+                ...targetRouteContext,
                 actorDid: profile.actorDid,
                 subjectDid: String(smart.subjectDid || '').trim() || undefined,
                 clientId: profile.clientId,
@@ -654,7 +666,7 @@ export class ServerProfileSessionManager {
             searchDigitalTwins: (search) => {
                 if (!digitalTwinAccessToken)
                     throw new Error('Digital twin SMART token has not been granted.');
-                return digitalTwin.search(profile.routeContext, { ...search, accessToken: digitalTwinAccessToken });
+                return digitalTwin.search(targetRouteContext, { ...search, accessToken: digitalTwinAccessToken });
             },
         };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-sdk-node-ts",
-  "version": "2.7.5",
+  "version": "2.7.7",
   "description": "Next-generation Node runtime package for the GDC SDK family",
   "license": "Apache-2.0",
   "author": "Antifraud Services Inc.",
@@ -38,8 +38,8 @@
     "test:e2e:live-gw:clean": "bash ./scripts/run-live-gw-clean.sh"
   },
   "dependencies": {
-    "gdc-common-utils-ts": "2.8.5",
-    "gdc-sdk-core-ts": "2.5.4"
+    "gdc-common-utils-ts": "2.8.6",
+    "gdc-sdk-core-ts": "2.5.5"
   },
   "devDependencies": {
     "@types/node": "^20.14.10",