sos-data-utils-ts 0.1.0 → 0.2.1

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.2.1
+
+- Add the shared product-neutral Task artifact schema backed by canonical flat
+  FHIR-like claims from `gdc-common-utils-ts`.
+- Require standard `Task.status` and `Task.intent` instead of making a UI
+  display label mandatory for machine-created jobs.
+
+## 0.2.0
+
+- Add the shared sector-and-country organization-verification policy for
+  Canadian and US veterinary and human-health organizations.
+- Keep veterinary official-marketplace-phone OTP confirmation distinct from
+  human-health authenticated-email plus postal-code verification.
+- Publish the canonical ConnectHealth production hostnames for animal, human
+  health and SOS runtimes.
+- Require legal organizations to use `Organization/_transaction` and keep any
+  later DCR activation code separate from verification challenges.
+
 ## 0.1.0
 
 - Add the dependency-free shared BFF API-layer contract.

package/README.md

@@ -1,8 +1,9 @@
 # sos-data-utils-ts
 
 Product-neutral contracts shared outward from SOS channel infrastructure into
-human-health and animal products. This package has no dependency on GW CORE,
-`gdc-*`, `uhc-*` or `vet-*` packages.
+human-health and animal products. It may reuse product-neutral canonical
+vocabulary from `gdc-common-utils-ts`, but has no dependency on GW CORE or any
+`uhc-*` or `vet-*` package.
 
 The first contract defines capability-based BFF route roots. Public products
 use `/api/assistant/*`; `/api/internal/*` is reserved for authenticated
@@ -16,6 +17,29 @@ Sector behavior remains in its owner:
 - `vet-*`: animal/veterinary extensions;
 - the terminology service: international terminology and regional catalogs.
 
+The shared Task authoring schema uses canonical flat FHIR-like claims from
+`gdc-common-utils-ts`. `Task.status` and `Task.intent` are mandatory; display,
+correlation and output claims remain optional so the same contract supports
+human work items and machine-created asynchronous jobs.
+
+The organization-verification contract resolves policy by business sector and
+ISO country. The governed CA/US profiles are:
+
+- `animal-care`: immutable form/PDF, existing marketplace organization,
+  outbound OTP to its official telephone, confirmation by web or telephone,
+  and marketplace primary-location evidence;
+- `health-care`: immutable form/PDF, existing marketplace organization,
+  authenticated representative/controller email, and a numeric code delivered
+  to the legal postal address and confirmed only in the authenticated portal.
+
+Both use `Organization/_transaction`. `Order/_batch` is used only when a new
+host Offer exists; the later licence/DCR activation code is a different secret.
+Ungoverned sector/country combinations fail closed.
+
+Canonical production operator hosts are `host-vet.connecthealth.info`,
+`host-uhc.connecthealth.info` and `host-sos.connecthealth.info`. Product aliases
+are not host identities or DID domains.
+
 ## Verify
 
 ```bash

package/dist/index.d.ts

@@ -1 +1,3 @@
 export * from './bff-api.js';
+export * from './organization-verification-policy.js';
+export * from './task-artifact-schema.js';

package/dist/index.js

@@ -1 +1,3 @@
 export * from './bff-api.js';
+export * from './organization-verification-policy.js';
+export * from './task-artifact-schema.js';

package/dist/organization-verification-policy.d.ts

@@ -0,0 +1,31 @@
+/** Shared production operator identities; product aliases are never host DIDs. */
+export declare const SharedProductionHostnames: Readonly<{
+    readonly animal: "host-vet.connecthealth.info";
+    readonly humanHealth: "host-uhc.connecthealth.info";
+    readonly sos: "host-sos.connecthealth.info";
+}>;
+export declare const OrganizationVerificationSectors: readonly ["animal-care", "health-care"];
+export declare const OrganizationVerificationCountryCodes: readonly ["CA", "US"];
+export type OrganizationVerificationSector = (typeof OrganizationVerificationSectors)[number];
+export type OrganizationVerificationCountryCode = (typeof OrganizationVerificationCountryCodes)[number];
+export type OrganizationVerificationContactProof = 'official-marketplace-phone-otp' | 'authenticated-representative-email';
+export type OrganizationVerificationLegalAddressProof = 'marketplace-primary-location' | 'postal-numeric-code';
+export type OrganizationVerificationConfirmationChannel = 'web' | 'telephone';
+export type OrganizationVerificationPolicy = Readonly<{
+    sector: OrganizationVerificationSector;
+    countryCode: OrganizationVerificationCountryCode;
+    marketplaceOrganizationRequired: true;
+    applicationEvidence: 'immutable-pdf-sha256';
+    contactProof: OrganizationVerificationContactProof;
+    legalAddressProof: OrganizationVerificationLegalAddressProof;
+    confirmationChannels: readonly OrganizationVerificationConfirmationChannel[];
+    telephoneLegalActivationAllowed: boolean;
+    legalOrganizationRoute: 'Organization/_transaction';
+    orderRule: 'only-when-new-host-offer';
+    dcrActivationCodeIsSeparate: true;
+}>;
+/** Resolves explicit sector/country policy and fails closed for ungoverned combinations. */
+export declare function resolveOrganizationVerificationPolicy(input: Readonly<{
+    sector: string;
+    countryCode: string;
+}>): OrganizationVerificationPolicy;

package/dist/organization-verification-policy.js

@@ -0,0 +1,53 @@
+/** Shared production operator identities; product aliases are never host DIDs. */
+export const SharedProductionHostnames = Object.freeze({
+    animal: 'host-vet.connecthealth.info',
+    humanHealth: 'host-uhc.connecthealth.info',
+    sos: 'host-sos.connecthealth.info',
+});
+export const OrganizationVerificationSectors = Object.freeze([
+    'animal-care',
+    'health-care',
+]);
+export const OrganizationVerificationCountryCodes = Object.freeze([
+    'CA',
+    'US',
+]);
+const POLICIES = new Map();
+for (const countryCode of OrganizationVerificationCountryCodes) {
+    POLICIES.set(key('animal-care', countryCode), Object.freeze({
+        sector: 'animal-care',
+        countryCode,
+        marketplaceOrganizationRequired: true,
+        applicationEvidence: 'immutable-pdf-sha256',
+        contactProof: 'official-marketplace-phone-otp',
+        legalAddressProof: 'marketplace-primary-location',
+        confirmationChannels: Object.freeze(['web', 'telephone']),
+        telephoneLegalActivationAllowed: true,
+        legalOrganizationRoute: 'Organization/_transaction',
+        orderRule: 'only-when-new-host-offer',
+        dcrActivationCodeIsSeparate: true,
+    }));
+    POLICIES.set(key('health-care', countryCode), Object.freeze({
+        sector: 'health-care',
+        countryCode,
+        marketplaceOrganizationRequired: true,
+        applicationEvidence: 'immutable-pdf-sha256',
+        contactProof: 'authenticated-representative-email',
+        legalAddressProof: 'postal-numeric-code',
+        confirmationChannels: Object.freeze(['web']),
+        telephoneLegalActivationAllowed: false,
+        legalOrganizationRoute: 'Organization/_transaction',
+        orderRule: 'only-when-new-host-offer',
+        dcrActivationCodeIsSeparate: true,
+    }));
+}
+/** Resolves explicit sector/country policy and fails closed for ungoverned combinations. */
+export function resolveOrganizationVerificationPolicy(input) {
+    const policy = POLICIES.get(key(input.sector, input.countryCode));
+    if (!policy)
+        throw new Error('organization_verification_policy_not_configured');
+    return policy;
+}
+function key(sector, countryCode) {
+    return `${String(sector || '').trim().toLowerCase()}|${String(countryCode || '').trim().toUpperCase()}`;
+}

package/dist/task-artifact-schema.d.ts

@@ -0,0 +1,13 @@
+export { TaskClaim } from 'gdc-common-utils-ts/models/interoperable-claims/task-claims';
+/** Product-neutral authoring contract for flat FHIR-like Task claims. */
+export type TaskArtifactSchemaContract = Readonly<{
+    resourceType: 'Task';
+    requiredClaims: readonly string[];
+    optionalClaims: readonly string[];
+}>;
+/**
+ * Shared Task contract used by human, animal, service and asynchronous-job
+ * channels. FHIR requires both status and intent; presentation fields remain
+ * optional because a machine-created job need not have a display title.
+ */
+export declare const TaskArtifactSchema: TaskArtifactSchemaContract;

package/dist/task-artifact-schema.js

@@ -0,0 +1,61 @@
+import { TaskClaim } from 'gdc-common-utils-ts/models/interoperable-claims/task-claims';
+export { TaskClaim } from 'gdc-common-utils-ts/models/interoperable-claims/task-claims';
+/**
+ * Shared Task contract used by human, animal, service and asynchronous-job
+ * channels. FHIR requires both status and intent; presentation fields remain
+ * optional because a machine-created job need not have a display title.
+ */
+export const TaskArtifactSchema = Object.freeze({
+    resourceType: 'Task',
+    requiredClaims: Object.freeze([
+        TaskClaim.Status,
+        TaskClaim.Intent,
+    ]),
+    optionalClaims: Object.freeze([
+        TaskClaim.Id,
+        TaskClaim.Identifier,
+        TaskClaim.GroupIdentifier,
+        TaskClaim.StatusReason,
+        TaskClaim.BusinessStatus,
+        TaskClaim.Code,
+        TaskClaim.Description,
+        TaskClaim.Subject,
+        TaskClaim.For,
+        TaskClaim.Requester,
+        TaskClaim.Owner,
+        TaskClaim.Focus,
+        TaskClaim.PartOf,
+        TaskClaim.BasedOn,
+        TaskClaim.BasedOnDisplay,
+        TaskClaim.Language,
+        TaskClaim.Channel,
+        TaskClaim.AuthoredOn,
+        TaskClaim.LastModified,
+        TaskClaim.ScheduledAt,
+        TaskClaim.RetryIntervalMinutes,
+        TaskClaim.MaxAttempts,
+        TaskClaim.TriggerType,
+        TaskClaim.Attempt,
+        TaskClaim.WindowStart,
+        TaskClaim.WindowEnd,
+        TaskClaim.AutoCloseAt,
+        TaskClaim.EscalationRecipient,
+        TaskClaim.Confirmed,
+        TaskClaim.ConfirmedAt,
+        TaskClaim.Repetitions,
+        TaskClaim.DaysOfWeek,
+        TaskClaim.RepeatCount,
+        TaskClaim.RepeatDurationValue,
+        TaskClaim.RepeatDurationUnit,
+        TaskClaim.Modified,
+        TaskClaim.Priority,
+        TaskClaim.RestrictionPeriodStart,
+        TaskClaim.RestrictionPeriodEnd,
+        TaskClaim.ExecutionPeriodStart,
+        TaskClaim.ExecutionPeriodEnd,
+        TaskClaim.OutputType,
+        TaskClaim.OutputValueReference,
+        TaskClaim.OutputValueString,
+        TaskClaim.UserSelected,
+    ]),
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sos-data-utils-ts",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "Product-neutral SOS channel and BFF contract utilities",
   "license": "Apache-2.0",
   "type": "module",
@@ -14,6 +14,14 @@
     "./bff-api": {
       "types": "./dist/bff-api.d.ts",
       "default": "./dist/bff-api.js"
+    },
+    "./organization-verification-policy": {
+      "types": "./dist/organization-verification-policy.d.ts",
+      "default": "./dist/organization-verification-policy.js"
+    },
+    "./task-artifact-schema": {
+      "types": "./dist/task-artifact-schema.d.ts",
+      "default": "./dist/task-artifact-schema.js"
     }
   },
   "files": [
@@ -37,6 +45,9 @@
     "node": ">=24"
   },
   "private": false,
+  "dependencies": {
+    "gdc-common-utils-ts": "2.9.21"
+  },
   "publishConfig": {
     "access": "public"
   }