vet-sdk-core-ts 0.4.20 → 0.4.22

package/README.md

@@ -9,6 +9,20 @@ UHC SDK packages and must not import them.
 The SDK consumes governed browser-safe values from `vet-data-utils-ts` and
 owns gateway request construction. GW VET remains the policy authority.
 
+## Veterinary health-card issuance
+
+`issueVeterinaryHealthCardCredential(...)` accepts only an authoritative
+readback Bundle, creates the standard ES256 SHC signing input, and asks each
+attester for an independent RFC 7797 ML-DSA proof over the exact uncompressed
+payload. `pqcQr.qrCount` configures the number of numeric companion labels; it
+defaults to two and never copies the payload into those labels.
+
+The result contains printable vaccination data plus both
+`payloadReferences.multihashUrn` for an exact blockchain-index lookup and
+`payloadReferences.cidV1` for content-addressed retrieval. The issuer supplies
+the validity interval explicitly; FHIR `Immunization.expirationDate` remains
+the vaccine-batch expiry.
+
 ## USDC payment quotes
 
 `vet-sdk-core-ts/payment` separates the payment provider, asset and EVM network

package/dist/health-card-issuance.d.ts

@@ -0,0 +1,69 @@
+import { type PostQuantumCompanionProofQrOptions, type SmartHealthCardPayloadReferences } from 'vet-data-utils-ts/shc';
+import { type InternationalHealthCardPrintData } from 'vet-data-utils-ts/international-health-card';
+import { type ClinicalBundleReaderOptions } from 'vet-data-utils-ts/clinical-bundle-reader';
+import type { SmartHealthCardPayload } from 'vet-data-utils-ts/shc';
+export type VeterinaryHealthCardAttester = Readonly<{
+    /** Signs the exact uncompressed, deterministic SHC payload as RFC 7797 JWS. */
+    signDetachedPqc(payloadBytes: Uint8Array): Promise<string>;
+}>;
+export type IssuedVeterinaryHealthCardCredential = Readonly<{
+    compactJws: string;
+    shcQr: readonly string[];
+    pqcCompanionProofs: readonly string[];
+    pqcQr: readonly (readonly string[])[];
+    payloadBytes: Uint8Array;
+    payloadReferences: SmartHealthCardPayloadReferences;
+    printData: InternationalHealthCardPrintData;
+}>;
+/**
+ * Issues transport values only after the caller supplies GW's authoritative
+ * readback Bundle. The tenant issuer owns the standard ES256 signature. Every
+ * authenticated attester independently owns one detached ML-DSA signature.
+ */
+export declare function issueVeterinaryHealthCardCredential(input: Readonly<{
+    authoritativeBundle: Record<string, unknown>;
+    issuer: string;
+    notBefore: number;
+    keyId: string;
+    fhirVersion: string;
+    signEs256(signingBytes: Uint8Array): Promise<string>;
+    attesters: readonly VeterinaryHealthCardAttester[];
+    print: Readonly<{
+        validFrom: string;
+        validUntil: string;
+        authorOrganizationUrn: string;
+    }>;
+    pqcQr?: PostQuantumCompanionProofQrOptions;
+}>): Promise<IssuedVeterinaryHealthCardCredential>;
+/** Verifies the standard credential and all scanned companion proofs offline through caller-owned trust resolvers. */
+export declare function verifyVeterinaryHealthCardCredential(input: Readonly<{
+    shcQr: readonly string[];
+    pqcQr: readonly (readonly string[])[];
+    verifyEs256(compactJws: string): Promise<boolean>;
+    verifyDetachedPqc(payloadBytes: Uint8Array, detachedJws: string): Promise<boolean>;
+}>): Promise<Readonly<{
+    shc: boolean;
+    pqcCompanionProofs: readonly boolean[];
+    valid: boolean;
+}>>;
+/**
+ * Verifies every scanned proof before exposing the SHC Bundle to the shared
+ * IPS reader. Terminology enrichment runs only on a presentation copy after
+ * verification, so neither signature bytes nor payload hashes can change.
+ */
+export declare function readVerifiedVeterinaryHealthCardCredential(input: Readonly<{
+    shcQr: readonly string[];
+    pqcQr: readonly (readonly string[])[];
+    language: string;
+    verifyEs256(compactJws: string): Promise<boolean>;
+    verifyDetachedPqc(payloadBytes: Uint8Array, detachedJws: string): Promise<boolean>;
+    resolveTerminology: ClinicalBundleReaderOptions['resolveTerminology'];
+}>): Promise<Readonly<{
+    verification: Readonly<{
+        shc: boolean;
+        pqcCompanionProofs: readonly boolean[];
+        valid: boolean;
+    }>;
+    payload: SmartHealthCardPayload;
+    bundle: Record<string, unknown>;
+}>>;

package/dist/health-card-issuance.js

@@ -0,0 +1,78 @@
+import { assembleSmartHealthCardJws, buildSmartHealthCardPayloadReferences, decodePostQuantumCompanionProofQr, decodeSmartHealthCardPayloadBytes, decodeSmartHealthCardQr, encodePostQuantumCompanionProofUri, encodePostQuantumCompanionProofQr, encodeSmartHealthCardQr, prepareSmartHealthCard, } from 'vet-data-utils-ts/shc';
+import { buildInternationalHealthCardPrintData, } from 'vet-data-utils-ts/international-health-card';
+import { projectClinicalBundleForReading, } from 'vet-data-utils-ts/clinical-bundle-reader';
+/**
+ * Issues transport values only after the caller supplies GW's authoritative
+ * readback Bundle. The tenant issuer owns the standard ES256 signature. Every
+ * authenticated attester independently owns one detached ML-DSA signature.
+ */
+export async function issueVeterinaryHealthCardCredential(input) {
+    if (input.authoritativeBundle?.resourceType !== 'Bundle'
+        || !Array.isArray(input.authoritativeBundle.entry)
+        || input.authoritativeBundle.entry.length === 0) {
+        throw new TypeError('veterinary_health_card_authoritative_bundle_required');
+    }
+    if (!Array.isArray(input.attesters) || input.attesters.length === 0) {
+        throw new TypeError('veterinary_health_card_attester_required');
+    }
+    const prepared = prepareSmartHealthCard({
+        issuer: input.issuer,
+        notBefore: input.notBefore,
+        kid: input.keyId,
+        fhirVersion: input.fhirVersion,
+        fhirBundle: input.authoritativeBundle,
+        additionalTypes: ['https://smarthealth.cards#immunization'],
+    });
+    const signature = await input.signEs256(prepared.signingBytes);
+    const compactJws = assembleSmartHealthCardJws(prepared, signature);
+    const detached = await Promise.all(input.attesters.map(attester => attester.signDetachedPqc(prepared.payloadBytes)));
+    const payloadReferences = buildSmartHealthCardPayloadReferences(prepared.payloadBytes);
+    return {
+        compactJws,
+        shcQr: encodeSmartHealthCardQr(compactJws),
+        pqcCompanionProofs: detached.map(encodePostQuantumCompanionProofUri),
+        pqcQr: detached.map(proof => encodePostQuantumCompanionProofQr(proof, input.pqcQr)),
+        payloadBytes: prepared.payloadBytes,
+        payloadReferences,
+        printData: buildInternationalHealthCardPrintData({
+            authoritativeBundle: input.authoritativeBundle,
+            validFrom: input.print.validFrom,
+            validUntil: input.print.validUntil,
+            authorOrganizationUrn: input.print.authorOrganizationUrn,
+            payloadBytes: prepared.payloadBytes,
+        }),
+    };
+}
+/** Verifies the standard credential and all scanned companion proofs offline through caller-owned trust resolvers. */
+export async function verifyVeterinaryHealthCardCredential(input) {
+    const compactJws = decodeSmartHealthCardQr(input.shcQr);
+    const payloadBytes = decodeSmartHealthCardPayloadBytes(compactJws);
+    const shc = await input.verifyEs256(compactJws);
+    const pqcCompanionProofs = await Promise.all(input.pqcQr.map(qrSet => (input.verifyDetachedPqc(payloadBytes, decodePostQuantumCompanionProofQr(qrSet)))));
+    return {
+        shc,
+        pqcCompanionProofs,
+        valid: shc && pqcCompanionProofs.length > 0 && pqcCompanionProofs.every(Boolean),
+    };
+}
+/**
+ * Verifies every scanned proof before exposing the SHC Bundle to the shared
+ * IPS reader. Terminology enrichment runs only on a presentation copy after
+ * verification, so neither signature bytes nor payload hashes can change.
+ */
+export async function readVerifiedVeterinaryHealthCardCredential(input) {
+    const compactJws = decodeSmartHealthCardQr(input.shcQr);
+    const payloadBytes = decodeSmartHealthCardPayloadBytes(compactJws);
+    const shc = await input.verifyEs256(compactJws);
+    const pqcCompanionProofs = await Promise.all(input.pqcQr.map(qrSet => (input.verifyDetachedPqc(payloadBytes, decodePostQuantumCompanionProofQr(qrSet)))));
+    const verification = {
+        shc,
+        pqcCompanionProofs,
+        valid: shc && pqcCompanionProofs.length > 0 && pqcCompanionProofs.every(Boolean),
+    };
+    if (!verification.valid)
+        throw new TypeError('veterinary_health_card_proof_invalid');
+    const payload = JSON.parse(new TextDecoder().decode(payloadBytes));
+    const bundle = await projectClinicalBundleForReading(payload.vc.credentialSubject.fhirBundle, { language: input.language, resolveTerminology: input.resolveTerminology });
+    return { verification, payload, bundle };
+}

package/dist/index.d.ts

@@ -6,4 +6,5 @@ export * from "./animal-onboarding.js";
 export * from "./reusable-bff.js";
 export * from "./research-study.js";
 export * from "./payment.js";
+export * from "./health-card-issuance.js";
 export * from "vet-data-utils-ts";

package/dist/index.js

@@ -6,4 +6,5 @@ export * from "./animal-onboarding.js";
 export * from "./reusable-bff.js";
 export * from "./research-study.js";
 export * from "./payment.js";
+export * from "./health-card-issuance.js";
 export * from "vet-data-utils-ts";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vet-sdk-core-ts",
-  "version": "0.4.20",
+  "version": "0.4.22",
   "description": "Browser-safe VetChain core contracts and governed animal species identifiers",
   "license": "Apache-2.0",
   "author": "Connecting Solution & Applications Ltd",
@@ -43,6 +43,10 @@
     "./payment": {
       "types": "./dist/payment.d.ts",
       "default": "./dist/payment.js"
+    },
+    "./health-card-issuance": {
+      "types": "./dist/health-card-issuance.d.ts",
+      "default": "./dist/health-card-issuance.js"
     }
   },
   "files": [
@@ -68,6 +72,6 @@
   "dependencies": {
     "@noble/hashes": "^2.2.0",
     "gdc-common-utils-ts": "2.9.10",
-    "vet-data-utils-ts": "0.5.6"
+    "vet-data-utils-ts": "0.5.9"
   }
 }