uhc-portal-components-react 0.1.5 → 0.1.7

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.1.7 - 2026-07-30
+
+- Add controlled, actor-neutral invitation-acceptance and subject-access
+  request panels. The same scanner/manual locator can be hosted by an
+  individual-member or professional facade; authorization remains in the BFF
+  and GW.
+- Keep requested clinical sections as explicit `system|code` values supplied
+  by the host instead of deriving role or permission semantics in React.
+
+## 0.1.6 - 2026-07-30
+
+- Consume Common Utils 2.3.12 so the shared IPS viewer uses the complete
+  all-section claims and localized clinical-name contract.
+- Keep the official 16-section fixture and every declared IPS resource type as
+  the executable rendering contract consumed by portal Playwright flows.
+
 ## 0.1.5 - 2026-07-29
 
 - Allow advanced hosts to reuse the shared clinical card body while retaining

package/README.md

@@ -53,6 +53,12 @@ The package deliberately exposes modules instead of a cloned application:
 - `IpsBundleSummary`: receives one in-memory IPS document Bundle, obtains all
   `Composition.section` entries through Common Utils and renders every
   section's cards. It performs no ingestion or GW call.
+- `InvitationAcceptancePanel`: controlled invitation-code UI for a related
+  individual member; the host refreshes the authorized-subject list after its
+  BFF accepts the invitation.
+- `SubjectAccessRequestPanel`: controlled QR, numeric-code or `did:web`
+  resolver plus section selector. It deliberately has no scanner role: the
+  same component is reusable by an individual member or a professional.
 
 Clinical label semantics stay in `gdc-common-utils-ts` / the SDK reader. Hosts
 pass human titles to `ClinicalSectionSummary`: local `CodeableConcept.text`
@@ -73,6 +79,13 @@ The browser may render an optimistic in-memory Bundle while its authenticated
 BFF persists the command. Only backend code calls
 `ingestCommunicationAndUpdateIndex(...)`; the component never does.
 
+Access panels likewise contain no consent or SMART-token logic. A host first
+resolves the card locator, then asks its authenticated BFF to record the access
+request. If consent is already present, the BFF may obtain a narrowed SMART
+token immediately; otherwise it records a `Communication` request for the
+individual controller to review. The GW remains authoritative for the exact
+intersection of requested and consented sections.
+
 UHC Personal and VetChain Personal must compose the same personal route
 modules. UHC Professional and VetChain Professional must compose the same
 professional route modules. A brand adapter may change only tokens, logo,

package/dist/InvitationAcceptancePanel.d.ts

@@ -0,0 +1,25 @@
+export type InvitationAcceptanceStatus = 'idle' | 'submitting' | 'accepted' | 'error';
+export type InvitationAcceptancePanelCopy = Readonly<{
+    title: string;
+    description: string;
+    codeLabel: string;
+    submit: string;
+    submitting: string;
+    accepted: string;
+}>;
+export type InvitationAcceptancePanelProps = Readonly<{
+    copy: InvitationAcceptancePanelCopy;
+    code: string;
+    status: InvitationAcceptanceStatus;
+    error?: string;
+    onCodeChange: (code: string) => void;
+    onAccept: () => void | Promise<void>;
+}>;
+/**
+ * Controlled invitation-acceptance form reusable by any personal portal.
+ *
+ * The component owns no authorization semantics. The host BFF verifies the
+ * authenticated actor, accepts the invitation and refreshes related subjects.
+ */
+export declare function InvitationAcceptancePanel({ copy, code, status, error, onCodeChange, onAccept, }: InvitationAcceptancePanelProps): import("react").JSX.Element;
+//# sourceMappingURL=InvitationAcceptancePanel.d.ts.map

package/dist/InvitationAcceptancePanel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"InvitationAcceptancePanel.d.ts","sourceRoot":"","sources":["../src/InvitationAcceptancePanel.tsx"],"names":[],"mappings":"AAEA,MAAM,MAAM,0BAA0B,GAClC,MAAM,GACN,YAAY,GACZ,UAAU,GACV,OAAO,CAAA;AAEX,MAAM,MAAM,6BAA6B,GAAG,QAAQ,CAAC;IACnD,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;CACjB,CAAC,CAAA;AAEF,MAAM,MAAM,8BAA8B,GAAG,QAAQ,CAAC;IACpD,IAAI,EAAE,6BAA6B,CAAA;IACnC,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,0BAA0B,CAAA;IAClC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IACpC,QAAQ,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACrC,CAAC,CAAA;AAEF;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,EACxC,IAAI,EACJ,IAAI,EACJ,MAAM,EACN,KAAK,EACL,YAAY,EACZ,QAAQ,GACT,EAAE,8BAA8B,+BA+BhC"}

package/dist/InvitationAcceptancePanel.js

@@ -0,0 +1,16 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * Controlled invitation-acceptance form reusable by any personal portal.
+ *
+ * The component owns no authorization semantics. The host BFF verifies the
+ * authenticated actor, accepts the invitation and refreshes related subjects.
+ */
+export function InvitationAcceptancePanel({ copy, code, status, error, onCodeChange, onAccept, }) {
+    function submit(event) {
+        event.preventDefault();
+        void onAccept();
+    }
+    return (_jsxs("section", { className: "uhcp-access-panel", "aria-labelledby": "uhcp-invitation-title", children: [_jsx("h2", { id: "uhcp-invitation-title", children: copy.title }), _jsx("p", { children: copy.description }), status === 'accepted'
+                ? _jsx("p", { role: "status", children: copy.accepted })
+                : (_jsxs("form", { onSubmit: submit, children: [_jsxs("label", { children: [_jsx("span", { children: copy.codeLabel }), _jsx("input", { value: code, onChange: (event) => onCodeChange(event.currentTarget.value), required: true, disabled: status === 'submitting' })] }), error && _jsx("p", { role: "alert", children: error }), _jsx("button", { type: "submit", disabled: status === 'submitting' || !code.trim(), children: status === 'submitting' ? copy.submitting : copy.submit })] }))] }));
+}

package/dist/SubjectAccessRequestPanel.d.ts

@@ -0,0 +1,48 @@
+export type SubjectLocatorKind = 'qr' | 'numeric-code' | 'did-web';
+export type SubjectAccessRequestStatus = 'idle' | 'resolving' | 'resolved' | 'requesting' | 'requested' | 'granted' | 'error';
+export type SubjectAccessSectionOption = Readonly<{
+    code: string;
+    label: string;
+    selected: boolean;
+}>;
+export type ResolvedSubjectAccessTarget = Readonly<{
+    subjectId: string;
+    display: string;
+}>;
+export type SubjectAccessRequestPanelCopy = Readonly<{
+    title: string;
+    description: string;
+    locatorKindLabel: string;
+    locatorKinds: Record<SubjectLocatorKind, string>;
+    locatorLabel: string;
+    resolve: string;
+    resolving: string;
+    sectionsLabel: string;
+    request: string;
+    requesting: string;
+    requested: string;
+    granted: string;
+}>;
+export type SubjectAccessRequestPanelProps = Readonly<{
+    copy: SubjectAccessRequestPanelCopy;
+    locatorKind: SubjectLocatorKind;
+    locator: string;
+    status: SubjectAccessRequestStatus;
+    target?: ResolvedSubjectAccessTarget;
+    sections: readonly SubjectAccessSectionOption[];
+    error?: string;
+    onLocatorKindChange: (kind: SubjectLocatorKind) => void;
+    onLocatorChange: (locator: string) => void;
+    onResolve: () => void | Promise<void>;
+    onToggleSection: (code: string) => void;
+    onRequest: () => void | Promise<void>;
+}>;
+/**
+ * Controlled scanner/manual-locator and access-request surface.
+ *
+ * “Who scans” is intentionally absent from this contract. An individual
+ * member, professional or another later actor facade can reuse the same
+ * component; the authenticated BFF and GW decide identity and authorization.
+ */
+export declare function SubjectAccessRequestPanel({ copy, locatorKind, locator, status, target, sections, error, onLocatorKindChange, onLocatorChange, onResolve, onToggleSection, onRequest, }: SubjectAccessRequestPanelProps): import("react").JSX.Element;
+//# sourceMappingURL=SubjectAccessRequestPanel.d.ts.map

package/dist/SubjectAccessRequestPanel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SubjectAccessRequestPanel.d.ts","sourceRoot":"","sources":["../src/SubjectAccessRequestPanel.tsx"],"names":[],"mappings":"AAEA,MAAM,MAAM,kBAAkB,GAAG,IAAI,GAAG,cAAc,GAAG,SAAS,CAAA;AAClE,MAAM,MAAM,0BAA0B,GAClC,MAAM,GACN,WAAW,GACX,UAAU,GACV,YAAY,GACZ,WAAW,GACX,SAAS,GACT,OAAO,CAAA;AAEX,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAAC;IAChD,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,OAAO,CAAA;CAClB,CAAC,CAAA;AAEF,MAAM,MAAM,2BAA2B,GAAG,QAAQ,CAAC;IACjD,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;CAChB,CAAC,CAAA;AAEF,MAAM,MAAM,6BAA6B,GAAG,QAAQ,CAAC;IACnD,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,gBAAgB,EAAE,MAAM,CAAA;IACxB,YAAY,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAA;IAChD,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,EAAE,MAAM,CAAA;IACrB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;CAChB,CAAC,CAAA;AAEF,MAAM,MAAM,8BAA8B,GAAG,QAAQ,CAAC;IACpD,IAAI,EAAE,6BAA6B,CAAA;IACnC,WAAW,EAAE,kBAAkB,CAAA;IAC/B,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,0BAA0B,CAAA;IAClC,MAAM,CAAC,EAAE,2BAA2B,CAAA;IACpC,QAAQ,EAAE,SAAS,0BAA0B,EAAE,CAAA;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,mBAAmB,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,IAAI,CAAA;IACvD,eAAe,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IAC1C,SAAS,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IACvC,SAAS,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACtC,CAAC,CAAA;AAEF;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,EACxC,IAAI,EACJ,WAAW,EACX,OAAO,EACP,MAAM,EACN,MAAM,EACN,QAAQ,EACR,KAAK,EACL,mBAAmB,EACnB,eAAe,EACf,SAAS,EACT,eAAe,EACf,SAAS,GACV,EAAE,8BAA8B,+BA4EhC"}

package/dist/SubjectAccessRequestPanel.js

@@ -0,0 +1,21 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * Controlled scanner/manual-locator and access-request surface.
+ *
+ * “Who scans” is intentionally absent from this contract. An individual
+ * member, professional or another later actor facade can reuse the same
+ * component; the authenticated BFF and GW decide identity and authorization.
+ */
+export function SubjectAccessRequestPanel({ copy, locatorKind, locator, status, target, sections, error, onLocatorKindChange, onLocatorChange, onResolve, onToggleSection, onRequest, }) {
+    function resolve(event) {
+        event.preventDefault();
+        void onResolve();
+    }
+    function request(event) {
+        event.preventDefault();
+        void onRequest();
+    }
+    return (_jsxs("section", { className: "uhcp-access-panel", "aria-labelledby": "uhcp-access-request-title", children: [_jsx("h2", { id: "uhcp-access-request-title", children: copy.title }), _jsx("p", { children: copy.description }), _jsxs("form", { onSubmit: resolve, children: [_jsxs("label", { children: [_jsx("span", { children: copy.locatorKindLabel }), _jsx("select", { value: locatorKind, onChange: (event) => onLocatorKindChange(event.currentTarget.value), disabled: status === 'resolving', children: Object.entries(copy.locatorKinds).map(([kind, label]) => _jsx("option", { value: kind, children: label }, kind)) })] }), _jsxs("label", { children: [_jsx("span", { children: copy.locatorLabel }), _jsx("input", { value: locator, onChange: (event) => onLocatorChange(event.currentTarget.value), required: true, disabled: status === 'resolving' })] }), _jsx("button", { type: "submit", disabled: status === 'resolving' || !locator.trim(), children: status === 'resolving' ? copy.resolving : copy.resolve })] }), target && (_jsxs("form", { onSubmit: request, children: [_jsx("p", { children: _jsx("bdi", { children: target.display }) }), _jsxs("fieldset", { children: [_jsx("legend", { children: copy.sectionsLabel }), sections.map((section) => (_jsxs("label", { "data-section-code": section.code, children: [_jsx("input", { type: "checkbox", checked: section.selected, onChange: () => onToggleSection(section.code), disabled: status === 'requesting' || status === 'granted' }), _jsx("span", { children: section.label })] }, section.code)))] }), _jsx("button", { type: "submit", disabled: status === 'requesting'
+                            || status === 'granted'
+                            || !sections.some((section) => section.selected), children: status === 'requesting' ? copy.requesting : copy.request })] })), status === 'requested' && _jsx("p", { role: "status", children: copy.requested }), status === 'granted' && _jsx("p", { role: "status", children: copy.granted }), error && _jsx("p", { role: "alert", children: error })] }));
+}

package/dist/index.d.ts

@@ -7,4 +7,6 @@ export * from './PortalEntry.js';
 export * from './ProfileProtectionGate.js';
 export * from './ClinicalSectionSummary.js';
 export * from './IpsBundleSummary.js';
+export * from './InvitationAcceptancePanel.js';
+export * from './SubjectAccessRequestPanel.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAA;AAC9B,cAAc,kBAAkB,CAAA;AAChC,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,kBAAkB,CAAA;AAChC,cAAc,kBAAkB,CAAA;AAChC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,6BAA6B,CAAA;AAC3C,cAAc,uBAAuB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAA;AAC9B,cAAc,kBAAkB,CAAA;AAChC,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,kBAAkB,CAAA;AAChC,cAAc,kBAAkB,CAAA;AAChC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,6BAA6B,CAAA;AAC3C,cAAc,uBAAuB,CAAA;AACrC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,gCAAgC,CAAA"}

package/dist/index.js

@@ -7,3 +7,5 @@ export * from './PortalEntry.js';
 export * from './ProfileProtectionGate.js';
 export * from './ClinicalSectionSummary.js';
 export * from './IpsBundleSummary.js';
+export * from './InvitationAcceptancePanel.js';
+export * from './SubjectAccessRequestPanel.js';

package/dist/styles.css

@@ -184,6 +184,33 @@ html[data-theme='dark'] .uhcp-brand-artwork-dark { display: block !important; }
 .uhcp-clinical-title { font-weight: 800; margin: 0; }
 .uhcp-clinical-type { color: var(--uhcp-muted); font-size: .72rem; font-weight: 800; letter-spacing: .06em; margin: .35rem 0 0; text-transform: uppercase; }
 .uhcp-clinical-date, .uhcp-clinical-empty { color: var(--uhcp-muted); margin: .35rem 0 0; }
+.uhcp-access-panel { color: var(--uhcp-text); display: grid; gap: 1rem; }
+.uhcp-access-panel h2, .uhcp-access-panel p { margin: 0; }
+.uhcp-access-panel > p { color: var(--uhcp-muted); line-height: 1.5; }
+.uhcp-access-panel form { display: grid; gap: 1rem; }
+.uhcp-access-panel label { display: grid; font-weight: 700; gap: .4rem; }
+.uhcp-access-panel input, .uhcp-access-panel select {
+  background: var(--uhcp-panel);
+  border: 1px solid var(--uhcp-border);
+  border-radius: .75rem;
+  color: var(--uhcp-text);
+  font: inherit;
+  padding: .8rem;
+}
+.uhcp-access-panel fieldset { border: 1px solid var(--uhcp-border); border-radius: 1rem; display: grid; gap: .6rem; margin: 0; padding: 1rem; }
+.uhcp-access-panel fieldset label { align-items: center; display: flex; }
+.uhcp-access-panel button {
+  background: linear-gradient(135deg, var(--uhcp-action-start), var(--uhcp-action-end));
+  border: 0;
+  border-radius: .75rem;
+  color: #fff;
+  cursor: pointer;
+  font: inherit;
+  font-weight: 800;
+  padding: .8rem 1rem;
+}
+.uhcp-access-panel button:disabled { cursor: not-allowed; opacity: .55; }
+.uhcp-access-panel [role="alert"] { color: #c64747; font-weight: 700; }
 .uhcp-entry-hero {
   align-items: center;
   background:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "uhc-portal-components-react",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "Brand-neutral React portal shell, account preferences and protected-profile UI for UHC and VetChain portals.",
   "license": "Apache-2.0",
   "type": "module",
@@ -27,7 +27,7 @@
     "react-dom": ">=18.3.0"
   },
   "dependencies": {
-    "gdc-common-utils-ts": "^2.3.10"
+    "gdc-common-utils-ts": "^2.3.12"
   },
   "devDependencies": {
     "@types/react": "19.2.17",