vet-sdk-core-ts 0.4.19 → 0.4.21

package/README.md

@@ -9,6 +9,20 @@ UHC SDK packages and must not import them.
 The SDK consumes governed browser-safe values from `vet-data-utils-ts` and
 owns gateway request construction. GW VET remains the policy authority.
 
+## Veterinary health-card issuance
+
+`issueVeterinaryHealthCardCredential(...)` accepts only an authoritative
+readback Bundle, creates the standard ES256 SHC signing input, and asks each
+attester for an independent RFC 7797 ML-DSA proof over the exact uncompressed
+payload. `pqcQr.qrCount` configures the number of numeric companion labels; it
+defaults to two and never copies the payload into those labels.
+
+The result contains printable vaccination data plus both
+`payloadReferences.multihashUrn` for an exact blockchain-index lookup and
+`payloadReferences.cidV1` for content-addressed retrieval. The issuer supplies
+the validity interval explicitly; FHIR `Immunization.expirationDate` remains
+the vaccine-batch expiry.
+
 ## USDC payment quotes
 
 `vet-sdk-core-ts/payment` separates the payment provider, asset and EVM network

package/dist/health-card-issuance.d.ts

@@ -0,0 +1,46 @@
+import { type PostQuantumCompanionProofQrOptions, type SmartHealthCardPayloadReferences } from 'vet-data-utils-ts/shc';
+import { type InternationalHealthCardPrintData } from 'vet-data-utils-ts/international-health-card';
+export type VeterinaryHealthCardAttester = Readonly<{
+    /** Signs the exact uncompressed, deterministic SHC payload as RFC 7797 JWS. */
+    signDetachedPqc(payloadBytes: Uint8Array): Promise<string>;
+}>;
+export type IssuedVeterinaryHealthCardCredential = Readonly<{
+    compactJws: string;
+    shcQr: readonly string[];
+    pqcCompanionProofs: readonly string[];
+    pqcQr: readonly (readonly string[])[];
+    payloadBytes: Uint8Array;
+    payloadReferences: SmartHealthCardPayloadReferences;
+    printData: InternationalHealthCardPrintData;
+}>;
+/**
+ * Issues transport values only after the caller supplies GW's authoritative
+ * readback Bundle. The tenant issuer owns the standard ES256 signature. Every
+ * authenticated attester independently owns one detached ML-DSA signature.
+ */
+export declare function issueVeterinaryHealthCardCredential(input: Readonly<{
+    authoritativeBundle: Record<string, unknown>;
+    issuer: string;
+    notBefore: number;
+    keyId: string;
+    fhirVersion: string;
+    signEs256(signingBytes: Uint8Array): Promise<string>;
+    attesters: readonly VeterinaryHealthCardAttester[];
+    print: Readonly<{
+        validFrom: string;
+        validUntil: string;
+        authorOrganizationUrn: string;
+    }>;
+    pqcQr?: PostQuantumCompanionProofQrOptions;
+}>): Promise<IssuedVeterinaryHealthCardCredential>;
+/** Verifies the standard credential and all scanned companion proofs offline through caller-owned trust resolvers. */
+export declare function verifyVeterinaryHealthCardCredential(input: Readonly<{
+    shcQr: readonly string[];
+    pqcQr: readonly (readonly string[])[];
+    verifyEs256(compactJws: string): Promise<boolean>;
+    verifyDetachedPqc(payloadBytes: Uint8Array, detachedJws: string): Promise<boolean>;
+}>): Promise<Readonly<{
+    shc: boolean;
+    pqcCompanionProofs: readonly boolean[];
+    valid: boolean;
+}>>;

package/dist/health-card-issuance.js

@@ -0,0 +1,56 @@
+import { assembleSmartHealthCardJws, buildSmartHealthCardPayloadReferences, decodePostQuantumCompanionProofQr, decodeSmartHealthCardPayloadBytes, decodeSmartHealthCardQr, encodePostQuantumCompanionProofUri, encodePostQuantumCompanionProofQr, encodeSmartHealthCardQr, prepareSmartHealthCard, } from 'vet-data-utils-ts/shc';
+import { buildInternationalHealthCardPrintData, } from 'vet-data-utils-ts/international-health-card';
+/**
+ * Issues transport values only after the caller supplies GW's authoritative
+ * readback Bundle. The tenant issuer owns the standard ES256 signature. Every
+ * authenticated attester independently owns one detached ML-DSA signature.
+ */
+export async function issueVeterinaryHealthCardCredential(input) {
+    if (input.authoritativeBundle?.resourceType !== 'Bundle'
+        || !Array.isArray(input.authoritativeBundle.entry)
+        || input.authoritativeBundle.entry.length === 0) {
+        throw new TypeError('veterinary_health_card_authoritative_bundle_required');
+    }
+    if (!Array.isArray(input.attesters) || input.attesters.length === 0) {
+        throw new TypeError('veterinary_health_card_attester_required');
+    }
+    const prepared = prepareSmartHealthCard({
+        issuer: input.issuer,
+        notBefore: input.notBefore,
+        kid: input.keyId,
+        fhirVersion: input.fhirVersion,
+        fhirBundle: input.authoritativeBundle,
+        additionalTypes: ['https://smarthealth.cards#immunization'],
+    });
+    const signature = await input.signEs256(prepared.signingBytes);
+    const compactJws = assembleSmartHealthCardJws(prepared, signature);
+    const detached = await Promise.all(input.attesters.map(attester => attester.signDetachedPqc(prepared.payloadBytes)));
+    const payloadReferences = buildSmartHealthCardPayloadReferences(prepared.payloadBytes);
+    return {
+        compactJws,
+        shcQr: encodeSmartHealthCardQr(compactJws),
+        pqcCompanionProofs: detached.map(encodePostQuantumCompanionProofUri),
+        pqcQr: detached.map(proof => encodePostQuantumCompanionProofQr(proof, input.pqcQr)),
+        payloadBytes: prepared.payloadBytes,
+        payloadReferences,
+        printData: buildInternationalHealthCardPrintData({
+            authoritativeBundle: input.authoritativeBundle,
+            validFrom: input.print.validFrom,
+            validUntil: input.print.validUntil,
+            authorOrganizationUrn: input.print.authorOrganizationUrn,
+            payloadBytes: prepared.payloadBytes,
+        }),
+    };
+}
+/** Verifies the standard credential and all scanned companion proofs offline through caller-owned trust resolvers. */
+export async function verifyVeterinaryHealthCardCredential(input) {
+    const compactJws = decodeSmartHealthCardQr(input.shcQr);
+    const payloadBytes = decodeSmartHealthCardPayloadBytes(compactJws);
+    const shc = await input.verifyEs256(compactJws);
+    const pqcCompanionProofs = await Promise.all(input.pqcQr.map(qrSet => (input.verifyDetachedPqc(payloadBytes, decodePostQuantumCompanionProofQr(qrSet)))));
+    return {
+        shc,
+        pqcCompanionProofs,
+        valid: shc && pqcCompanionProofs.length > 0 && pqcCompanionProofs.every(Boolean),
+    };
+}

package/dist/index.d.ts

@@ -6,4 +6,5 @@ export * from "./animal-onboarding.js";
 export * from "./reusable-bff.js";
 export * from "./research-study.js";
 export * from "./payment.js";
+export * from "./health-card-issuance.js";
 export * from "vet-data-utils-ts";

package/dist/index.js

@@ -6,4 +6,5 @@ export * from "./animal-onboarding.js";
 export * from "./reusable-bff.js";
 export * from "./research-study.js";
 export * from "./payment.js";
+export * from "./health-card-issuance.js";
 export * from "vet-data-utils-ts";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vet-sdk-core-ts",
-  "version": "0.4.19",
+  "version": "0.4.21",
   "description": "Browser-safe VetChain core contracts and governed animal species identifiers",
   "license": "Apache-2.0",
   "author": "Connecting Solution & Applications Ltd",
@@ -43,6 +43,10 @@
     "./payment": {
       "types": "./dist/payment.d.ts",
       "default": "./dist/payment.js"
+    },
+    "./health-card-issuance": {
+      "types": "./dist/health-card-issuance.d.ts",
+      "default": "./dist/health-card-issuance.js"
     }
   },
   "files": [
@@ -67,7 +71,7 @@
   },
   "dependencies": {
     "@noble/hashes": "^2.2.0",
-    "gdc-common-utils-ts": "2.9.4",
-    "vet-data-utils-ts": "0.5.5"
+    "gdc-common-utils-ts": "2.9.10",
+    "vet-data-utils-ts": "0.5.8"
   }
 }