vet-sdk-core-ts 0.4.28 → 0.4.31

package/dist/secure-clinic-channel.js

@@ -1,5 +1,6 @@
 import { ml_dsa44 } from '@noble/post-quantum/ml-dsa.js';
 import { ml_kem768 } from '@noble/post-quantum/ml-kem.js';
+import { prepareVeterinaryIndexTaggedBundle } from 'vet-data-utils-ts/index-projection-tags';
 const encoder = new TextEncoder();
 const decoder = new TextDecoder();
 const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
@@ -80,33 +81,6 @@ function extractIndexProjection(bundle, policy) {
         const resource = entry.resource;
         if (!resource || typeof resource.resourceType !== 'string' || typeof resource.id !== 'string')
             continue;
-        if (typeof entry.fullUrl !== 'string')
-            throw new Error('Each indexed resource requires an absolute HTTPS fullUrl');
-        const relative = /^([A-Z][A-Za-z0-9]+)\/([0-9a-f-]+)$/i.exec(entry.fullUrl);
-        let urlResourceType;
-        let urlId;
-        if (relative) {
-            ;
-            [, urlResourceType, urlId] = relative;
-        }
-        else {
-            let parsed;
-            try {
-                parsed = new URL(entry.fullUrl);
-            }
-            catch {
-                throw new Error('The index fullUrl must contain /<ResourceType>/<UUID>');
-            }
-            if (parsed.protocol !== 'https:')
-                throw new Error('The index fullUrl must contain /<ResourceType>/<UUID>');
-            const segments = parsed.pathname.split('/').filter(Boolean);
-            urlResourceType = segments.at(-2);
-            urlId = segments.at(-1);
-        }
-        if (urlResourceType !== resource.resourceType
-            || urlId !== resource.id || !UUID_PATTERN.test(resource.id)) {
-            throw new Error('The fullUrl must end in /<ResourceType>/<UUID> matching the resource');
-        }
         if (resource.resourceType === 'Binary' && resource.contentType === 'application/pdf') {
             throw new Error('PDF content must be an Attachment inside DocumentReference');
         }
@@ -127,8 +101,44 @@ function extractIndexProjection(bundle, policy) {
             (grouped[_a = tag.system] ?? (grouped[_a] = [])).push(tag.code);
         }
         const claims = Object.fromEntries(Object.entries(grouped).map(([key, values]) => [key, values.join(',')]));
-        if (Object.keys(claims).length)
-            entries.push({ fullUrl: entry.fullUrl, claims });
+        if (!Object.keys(claims).length)
+            continue;
+        // A private FHIR document can legitimately contain contained-only or
+        // human-readable entry identities. They remain in the encrypted payload,
+        // but only independently retrievable UUID resources enter the index.
+        if (typeof entry.fullUrl !== 'string' || !UUID_PATTERN.test(resource.id))
+            continue;
+        const relative = /^([A-Z][A-Za-z0-9]+)\/([0-9a-f-]+)$/i.exec(entry.fullUrl);
+        const documentUrn = /^urn:uuid:([0-9a-f-]+)$/i.exec(entry.fullUrl);
+        let urlResourceType;
+        let urlId;
+        let indexFullUrl = entry.fullUrl;
+        if (relative) {
+            ;
+            [, urlResourceType, urlId] = relative;
+        }
+        else if (documentUrn) {
+            urlResourceType = resource.resourceType;
+            [, urlId] = documentUrn;
+            indexFullUrl = `${resource.resourceType}/${resource.id}`;
+        }
+        else {
+            let parsed;
+            try {
+                parsed = new URL(entry.fullUrl);
+            }
+            catch {
+                continue;
+            }
+            if (parsed.protocol !== 'https:')
+                continue;
+            const segments = parsed.pathname.split('/').filter(Boolean);
+            urlResourceType = segments.at(-2);
+            urlId = segments.at(-1);
+        }
+        if (urlResourceType !== resource.resourceType || urlId !== resource.id)
+            continue;
+        entries.push({ fullUrl: indexFullUrl, claims });
     }
     return { entries };
 }
@@ -138,12 +148,15 @@ function sign(sender, plaintext) {
     return `${header}.${payload}.${base64Url(ml_dsa44.sign(encoder.encode(`${header}.${payload}`), sender.signingSecretKey))}`;
 }
 export async function sealVeterinarySecureClinicMessage(input) {
-    const indexProjection = extractIndexProjection(input.bundle, input.indexPolicy);
+    const taggedBundle = prepareVeterinaryIndexTaggedBundle(input.bundle, {
+        allowedTagSystems: input.indexPolicy.allowedTagSystems,
+    });
+    const indexProjection = extractIndexProjection(taggedBundle, input.indexPolicy);
     const signed = sign(input.sender, {
         id: input.messageId, thid: input.threadId,
         type: 'https://vetchain.app/protocols/private-fhir-document/1.0/ips',
         from: input.from, to: [input.to], created_time: Math.floor(Date.now() / 1000),
-        body: { mediaType: 'application/fhir+json', bundle: input.bundle },
+        body: { mediaType: 'application/fhir+json', bundle: taggedBundle },
     });
     const cek = crypto.getRandomValues(new Uint8Array(32));
     const header = base64Url(canonicalize({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vet-sdk-core-ts",
-  "version": "0.4.28",
+  "version": "0.4.31",
   "description": "Browser-safe VetChain core contracts and governed animal species identifiers",
   "license": "Apache-2.0",
   "author": "Connecting Solution & Applications Ltd",
@@ -81,6 +81,6 @@
     "@noble/hashes": "^2.2.0",
     "@noble/post-quantum": "0.5.4",
     "gdc-common-utils-ts": "2.9.10",
-    "vet-data-utils-ts": "0.5.17"
+    "vet-data-utils-ts": "0.5.20"
   }
 }