Healthcare: emergency medical dispatch

// A minimal client for the wede REST API, used by the snippets below
export class WedeError extends Error {
  constructor(public status: number, public code: string, message: string) {
    super(message)
  }
}

export type Credential = { apiKey: string } | { token: string }

export async function wede(cred: Credential, method: string, path: string, body?: unknown) {
  const res = await fetch(`https://api.wede.pt${path}`, {
    method,
    headers: {
      ...('apiKey' in cred ? { 'x-wede-api-key': cred.apiKey } : { authorization: `Bearer ${cred.token}` }),
      ...(body !== undefined ? { 'content-type': 'application/json' } : {}),
    },
    body: body !== undefined ? JSON.stringify(body) : undefined,
  })
  const data = res.status === 204 ? null : await res.json().catch(() => null)
  if (!res.ok) throw new WedeError(res.status, data?.error ?? 'api_error', data?.message ?? `HTTP ${res.status}`)
  return data
}

export async function login(email: string, password: string): Promise<string> {
  const res = await fetch('https://api.wede.pt/v1/auth/login', {
    method: 'POST',
    headers: { 'content-type': 'application/json' },
    body: JSON.stringify({ email, password }),
  })
  const data = await res.json().catch(() => null)
  if (!res.ok) throw new WedeError(res.status, data?.error ?? 'api_error', data?.message ?? `HTTP ${res.status}`)
  return data.token
}

// Captures an operation for offline sync, with the capture time and the integrity checksum:
// SHA-256 of JSON.stringify(payload) + idempotency_key + offline_generated_at (see Sync)
export async function capture<T extends { idempotency_key: string; payload: Record<string, unknown> }>(event: T) {
  const offline_generated_at = new Date().toISOString()
  const bytes = new TextEncoder().encode(JSON.stringify(event.payload) + event.idempotency_key + offline_generated_at)
  const digest = new Uint8Array(await crypto.subtle.digest('SHA-256', bytes))
  const integrity_hash = [...digest].map(b => b.toString(16).padStart(2, '0')).join('')
  return { ...event, offline_generated_at, integrity_hash }
}

import { login, wede, WedeError } from './lib/wede'

const admin = { token: await login(process.env.WEDE_ADMIN_EMAIL!, process.env.WEDE_ADMIN_PASSWORD!) }

// Categories of the healthcare vertical, with the id each type needs
const { data } = await wede(admin, 'GET', '/v1/catalog?vertical=healthcare')
const category = (code: string) => data[0].categories.find((c: any) => c.code === code).id

const types = [
  { code: 'road_trauma', name: 'Road trauma', category_id: category('pre'), requires_teams: true, required_equipment: ['ambulance', 'trauma_kit'], default_priority: 'high' },
  { code: 'patient_handover', name: 'Patient handover at hospital', category_id: category('hos'), requires_teams: false },
]

for (const t of types) {
  try {
    await wede(admin, 'POST', '/v1/catalog/types', { vertical: 'healthcare', ...t })
  } catch (err) {
    // 409 conflict: the code already exists for this vertical, so the script is safe to rerun
    if (!(err instanceof WedeError && err.status === 409)) throw err
  }
}

import { createCipheriv, randomBytes } from 'node:crypto'
import { wede } from '../lib/wede'

const server = { apiKey: process.env.WEDE_API_KEY! }

// Your own key: wede never receives it.
const PHI_KEY = Buffer.from(process.env.PHI_KEY_HEX!, 'hex') // 32 bytes

function seal(value: string): string {
  const iv = randomBytes(12)
  const cipher = createCipheriv('aes-256-gcm', PHI_KEY, iv)
  const data = Buffer.concat([cipher.update(value, 'utf8'), cipher.final()])
  return [iv, cipher.getAuthTag(), data].map(b => b.toString('base64')).join('.')
}

export async function reportCardiacArrest(callId: string) {
  const res = await wede(server, 'POST', '/v1/events', {
    type: 'cardiac_arrest',
    vertical: 'healthcare',
    priority: 'critical',
    idempotency_key: `call-${callId}`,
    payload: {
      call_ref: callId,
      location: { lat: 38.7369, lng: -9.1395 },
      bystander_cpr: true,
      patient: seal(JSON.stringify({ name: 'Maria Silva', age: 67 })),
    },
    metadata: { zone_id: 'LIS-NORTE' },
  })

  return res.event_id // keep it: the dispatch uses it
}

import { login, wede } from '../lib/wede'

const dispatcher = { token: await login(dispatcherEmail, dispatcherPassword) }

const eventId = '9d2f6c1e-4b7a-4e3d-8c5f-1a2b3c4d5e6f' // event_id from step 2
const incident = { lat: 38.7369, lng: -9.1395 }

const { scored, count, excluded } = await wede(dispatcher, 'POST', '/v1/teams/dispatch/score', {
  ...incident,
  event_id: eventId,
})

if (count === 0) throw new Error(`No candidate team (${excluded.map((x: any) => `${x.team_name}: ${x.reason}`).join(', ')})`)

const best = scored.find((t: any) => t.recommended) ?? scored[0]
console.log(`${best.team_name}: ${best.distance_km} km, ETA ${best.eta_min} min, score ${best.score}, missing ${best.missing_equipment.join(', ') || 'nothing'}`)

await wede(dispatcher, 'POST', '/v1/teams/dispatch', {
  event_id: eventId,
  team_id: best.team_id,
  event_lat: incident.lat,
  event_lng: incident.lng,
  notes: 'Bystander CPR in progress',
})

const { data } = await wede(dispatcher, 'GET', `/v1/missions?team_id=${best.team_id}&status=CREATED`)
const mission = data.find((m: any) => m.event_id === eventId)
if (!mission) throw new Error('Mission not found')

await pushToCrewApp(best.team_id, { mission_id: mission.id, event_id: eventId }) // your code
await wede(dispatcher, 'PATCH', `/v1/missions/${mission.id}/status`, { status: 'SENT' })

import { login, wede } from './lib/wede'

export const crew = { token: await login(crewEmail, crewPassword) }

const { data: missions } = await wede(crew, 'GET', '/v1/missions/my')
const open = missions.filter((m: any) => !['COMPLETED', 'FAILED'].includes(m.status))

import { wede, WedeError } from './lib/wede'
import { crew } from './inbox'

type MissionStatus = 'CREATED' | 'SENT' | 'ACK' | 'ON_ROUTE' | 'ON_SITE' | 'COMPLETED' | 'FAILED'

export async function setStatus(
  missionId: string,
  status: MissionStatus,
  feedback?: Record<string, unknown>,
) {
  try {
    await wede(crew, 'PATCH', `/v1/missions/${missionId}/status`, { status, ...(feedback ? { feedback } : {}) })
  } catch (err) {
    if (!(err instanceof WedeError)) {
      // no answer from the network: keep it and retry when online
      await pendingUpdates.add({ missionId, status, feedback }) // your local store
      return
    }
    throw err
  }
}

await setStatus(missionId, 'ACK')
await setStatus(missionId, 'ON_ROUTE')
await setStatus(missionId, 'ON_SITE')
await setStatus(missionId, 'COMPLETED', {
  patient_stable: true,
  intervention: 'defibrillation',
  destination_hospital: 'HSM',
})

import { capture, wede } from './lib/wede'
import { crew } from './inbox'

const captured = await capture({
  type: 'patient_handover',
  vertical: 'healthcare',
  priority: 'high',
  idempotency_key: `handover-${missionId}`,
  payload: { mission_id: missionId, hospital: 'HSM', handed_over_to: 'ER triage' },
})
await offlineQueue.push(captured) // your local store; keep the object unchanged

// When connectivity returns
const queued = await offlineQueue.all()
const result = await wede(crew, 'POST', '/v1/sync/batch', { events: queued }) // up to 500 per call
for (const r of result.results) {
  if (r.result !== 'rejected') await offlineQueue.remove(r.idempotency_key) // review rejected ones: r.error_code
}

import { wede } from '../lib/wede'

await wede({ apiKey: process.env.WEDE_API_KEY! }, 'POST', '/v1/webhooks', {
  url: 'https://ems.example.org/webhooks/wede',
  events: ['team.dispatched', 'mission.status_updated', 'event.status_changed', 'event.delivered'],
  secret: process.env.WEDE_WEBHOOK_SECRET!,
  description: 'EMS dispatch backend',
})

{
  "id": "0b7f5a52-3c1e-4d0f-9d6a-51c2a8e4f9a1",
  "event": "mission.status_updated",
  "created_at": "2026-09-14T09:31:07.412Z",
  "tenant_id": "4e1d2c3b-9a8f-4b7c-8d6e-2f1a0b9c8d7e",
  "environment": "production",
  "data": {
    "mission_id": "a3c9e0d4-6f2b-4e8a-9b1c-7d5e3f2a1b0c",
    "status": "COMPLETED",
    "feedback": { "patient_stable": true, "intervention": "defibrillation", "destination_hospital": "HSM" }
  }
}

import express from 'express'
import { createHmac, timingSafeEqual } from 'node:crypto'

const SECRET = process.env.WEDE_WEBHOOK_SECRET!
const TOLERANCE_SECONDS = 300 // your choice

function verify(header: string | undefined, rawBody: Buffer): boolean {
  if (!header) return false
  const parts = Object.fromEntries(header.split(',').map(p => p.split('=', 2) as [string, string]))
  const t = Number(parts.t)
  if (!parts.v1 || !Number.isFinite(t)) return false
  if (Math.abs(Date.now() / 1000 - t) > TOLERANCE_SECONDS) return false
  const expected = createHmac('sha256', SECRET).update(`${parts.t}.${rawBody.toString('utf8')}`).digest()
  const received = Buffer.from(parts.v1, 'hex')
  return received.length === expected.length && timingSafeEqual(received, expected)
}

const app = express()

app.post('/webhooks/wede', express.raw({ type: 'application/json' }), async (req, res) => {
  if (!verify(req.header('x-wede-signature'), req.body)) return res.status(401).end()

  const delivery = JSON.parse(req.body.toString('utf8'))
  if (await alreadyProcessed(delivery.id)) return res.status(200).end() // retries reuse the same id

  if (delivery.event === 'mission.status_updated') {
    await updateIncidentBoard(delivery.data.mission_id, delivery.data.status, delivery.data.feedback)
  }
  await markProcessed(delivery.id)
  res.status(200).end()
})

app.listen(3000)