sos-sdk-node-ts 0.1.4 → 0.1.5

package/dist/confidential-channel-cache.d.ts

@@ -0,0 +1,73 @@
+export type ConfidentialChannelSourceMessage<TEnvelope = unknown> = Readonly<{
+    id: string;
+    channelId: string;
+    sender: string;
+    recipients: readonly string[];
+    sent?: string;
+    envelope: TEnvelope;
+}>;
+export type ConfidentialChannelMessage = Readonly<{
+    id: string;
+    channelId: string;
+    sender: string;
+    recipients: readonly string[];
+    sent?: string;
+    messageKind: 'clinical-document' | 'text' | 'audio';
+    text?: string;
+    bundle?: unknown;
+    audioBase64?: string;
+    audioContentType?: string;
+}>;
+export type ConfidentialChannelDocument = Readonly<{
+    version: 1;
+    cursor?: string;
+    messages: readonly ConfidentialChannelMessage[];
+}>;
+export type ConfidentialChannelVault = Readonly<{
+    get(collection: string, id: string): Promise<unknown>;
+    put(collection: string, record: Readonly<Record<string, unknown> & {
+        id: string;
+    }>): Promise<unknown>;
+    query(collection: string, where: readonly Readonly<{
+        attribute: string;
+        equals: string;
+    }>[]): Promise<readonly unknown[]>;
+}>;
+export type ConfidentialChannelStorageAdapter = Readonly<{
+    protect(document: Readonly<{
+        id?: string;
+        content: unknown;
+    }>): Promise<unknown>;
+    unprotect(document: Readonly<{
+        id?: string;
+        jwe: unknown;
+    }>): Promise<unknown>;
+}>;
+/** Rebuildable encrypted materialization; canonical messages remain in their governed source. */
+export declare class ConfidentialChannelCache {
+    private readonly vault;
+    constructor(vault: ConfidentialChannelVault);
+    synchronize<TEnvelope>(input: Readonly<{
+        profileId: string;
+        subjectId: string;
+        channelId: string;
+        adapter: ConfidentialChannelStorageAdapter;
+        messages: readonly ConfidentialChannelSourceMessage<TEnvelope>[];
+        open(envelope: TEnvelope): Promise<Readonly<{
+            contentType: string;
+            plaintext: Uint8Array;
+        }>>;
+    }>): Promise<ConfidentialChannelDocument>;
+    read(input: Readonly<{
+        profileId: string;
+        subjectId: string;
+        channelId: string;
+        adapter: ConfidentialChannelStorageAdapter;
+    }>): Promise<ConfidentialChannelDocument | undefined>;
+    listSubject(input: Readonly<{
+        profileId: string;
+        subjectId: string;
+        adapter: ConfidentialChannelStorageAdapter;
+    }>): Promise<ConfidentialChannelDocument[]>;
+    private stored;
+}

package/dist/confidential-channel-cache.js

@@ -0,0 +1,109 @@
+import { createHash } from 'node:crypto';
+const COLLECTION = 'channel_communication_cache';
+/** Rebuildable encrypted materialization; canonical messages remain in their governed source. */
+export class ConfidentialChannelCache {
+    vault;
+    constructor(vault) {
+        this.vault = vault;
+    }
+    async synchronize(input) {
+        const identity = cacheIdentity(input);
+        const current = await this.read(input) ?? emptyChannel();
+        const knownIds = new Set(current.messages.map(message => message.id));
+        const additions = [];
+        for (const source of input.messages) {
+            if (source.channelId !== input.channelId || knownIds.has(source.id))
+                continue;
+            additions.push(materialize(source, await input.open(source.envelope)));
+        }
+        const messages = [...current.messages, ...additions].sort(compareMessages);
+        const cursor = messages.reduce((latest, message) => {
+            if (!message.sent)
+                return latest;
+            return !latest || message.sent > latest ? message.sent : latest;
+        }, current.cursor);
+        const content = { version: 1, cursor, messages };
+        const protectedDocument = protectedResult(await input.adapter.protect({ id: identity.id, content }));
+        await this.vault.put(COLLECTION, {
+            id: identity.id,
+            profileHash: identity.profileHash,
+            subjectHash: identity.subjectHash,
+            updatedAt: new Date().toISOString(),
+            jwe: protectedDocument.jwe,
+        });
+        return content;
+    }
+    async read(input) {
+        const identity = cacheIdentity(input);
+        const stored = this.stored(await this.vault.get(COLLECTION, identity.id));
+        if (!stored || stored.profileHash !== identity.profileHash || stored.subjectHash !== identity.subjectHash)
+            return undefined;
+        return channelContent(openedResult(await input.adapter.unprotect({ id: identity.id, jwe: stored.jwe })).content);
+    }
+    async listSubject(input) {
+        const profileHash = digest(required(input.profileId, 'channel_cache_profile_required'));
+        const subjectHash = digest(required(input.subjectId, 'channel_cache_subject_required'));
+        const rows = await this.vault.query(COLLECTION, [
+            { attribute: 'profileHash', equals: profileHash },
+            { attribute: 'subjectHash', equals: subjectHash },
+        ]);
+        return Promise.all(rows.map(async (row) => {
+            const stored = this.stored(row);
+            if (!stored)
+                throw new Error('channel_cache_record_invalid');
+            return channelContent(openedResult(await input.adapter.unprotect({ id: stored.id, jwe: stored.jwe })).content);
+        }));
+    }
+    stored(value) {
+        if (!value || typeof value !== 'object' || !('id' in value) || !('jwe' in value))
+            return undefined;
+        return value;
+    }
+}
+function materialize(source, opened) {
+    const contentType = String(opened.contentType || '').trim().toLowerCase();
+    const common = {
+        id: source.id, channelId: source.channelId, sender: source.sender,
+        recipients: [...source.recipients], sent: source.sent,
+    };
+    if (contentType.startsWith('text/plain')) {
+        return { ...common, messageKind: 'text', text: Buffer.from(opened.plaintext).toString('utf8') };
+    }
+    if (contentType.startsWith('audio/')) {
+        return { ...common, messageKind: 'audio', audioBase64: Buffer.from(opened.plaintext).toString('base64'), audioContentType: contentType };
+    }
+    if (contentType === 'application/fhir+json') {
+        const bundle = JSON.parse(Buffer.from(opened.plaintext).toString('utf8'));
+        if (bundle?.resourceType !== 'Bundle')
+            throw new Error('channel_cache_bundle_required');
+        return { ...common, messageKind: 'clinical-document', bundle };
+    }
+    throw new Error('channel_cache_content_type_unsupported');
+}
+function cacheIdentity(input) {
+    const profileHash = digest(required(input.profileId, 'channel_cache_profile_required'));
+    const subjectHash = digest(required(input.subjectId, 'channel_cache_subject_required'));
+    const channelHash = digest(required(input.channelId, 'channel_cache_channel_required'));
+    return { id: digest(`${profileHash}\u0000${subjectHash}\u0000${channelHash}`), profileHash, subjectHash };
+}
+function digest(value) { return createHash('sha256').update(value, 'utf8').digest('hex'); }
+function required(value, error) { const normalized = String(value || '').trim(); if (!normalized)
+    throw new Error(error); return normalized; }
+function emptyChannel() { return { version: 1, messages: [] }; }
+function compareMessages(left, right) { return String(left.sent || left.id).localeCompare(String(right.sent || right.id)); }
+function protectedResult(value) {
+    if (!value || typeof value !== 'object' || !('jwe' in value))
+        throw new Error('channel_cache_protection_failed');
+    return value;
+}
+function openedResult(value) {
+    if (!value || typeof value !== 'object' || !('content' in value))
+        throw new Error('channel_cache_open_failed');
+    return value;
+}
+function channelContent(value) {
+    const candidate = value;
+    if (candidate?.version !== 1 || !Array.isArray(candidate.messages))
+        throw new Error('channel_cache_document_invalid');
+    return candidate;
+}

package/dist/index.d.ts

@@ -2,4 +2,5 @@
 export * from './emergency-dispatch.js';
 export * from './prompt-audio-runtime.js';
 export * from './secure-message-crypto.js';
+export * from './confidential-channel-cache.js';
 export * from './bundle-sync-service.js';

package/dist/index.js

@@ -2,4 +2,5 @@
 export * from './emergency-dispatch.js';
 export * from './prompt-audio-runtime.js';
 export * from './secure-message-crypto.js';
+export * from './confidential-channel-cache.js';
 export * from './bundle-sync-service.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sos-sdk-node-ts",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Product-neutral Node adapters shared by SOSChain, Vet and UHC runtimes",
   "license": "Apache-2.0",
   "author": "Connecting Solution & Applications Ltd",
@@ -31,6 +31,10 @@
     "./bundle-sync-service": {
       "types": "./dist/bundle-sync-service.d.ts",
       "default": "./dist/bundle-sync-service.js"
+    },
+    "./confidential-channel-cache": {
+      "types": "./dist/confidential-channel-cache.d.ts",
+      "default": "./dist/confidential-channel-cache.js"
     }
   },
   "files": [