@tracepass/dpp-identifiers 0.9.0

package/dist/operator.js

@@ -0,0 +1,200 @@
+/**
+ * Operator and facility identifier validation per EN 18219.
+ *
+ * validateOperatorIdentifier — EN 18219 schemes 6–9:
+ *   iso6523:  icd 4 digits; special ICDs validated:
+ *     0199 (LEI)  — 20 chars [A-Z0-9]{18}[0-9]{2}, ISO 7064 MOD 97-10 check.
+ *     0088 (GLN)  — 13 digits, GS1 mod-10 check digit.
+ *     0060 (DUNS) — 9 digits (no check digit).
+ *     others      — non-empty value.
+ *   gln:      13 digits, GS1 mod-10 check digit (via gs1-utils).
+ *   did:      W3C DID Core syntax (method [a-z0-9]+, method-specific-id valid).
+ *   doi:      prefix 10.<registrant>/<suffix>, accepts doi:/https://doi.org/ prefixes.
+ *
+ * validateFacilityIdentifier — EN 18219 scheme 7 (GLN only; no other heading
+ * names facilities). The optional `extension` field identifies a sub-location
+ * (GS1 SGLN extension component).
+ */
+import { validateGln } from "@tracepass/gs1-utils";
+import { normalizeDoi } from "./product.js";
+// ── ISO 7064 MOD 97-10 check for LEI ─────────────────────────────────────────
+/**
+ * Verify an LEI's ISO 7064 MOD 97-10 check digits.
+ *
+ * LEI format: [A-Z0-9]{18}[0-9]{2}
+ * Conversion: each letter → its ordinal (A=10, B=11, …, Z=35); each digit stays.
+ * The concatenated number mod 97 must equal 1.
+ *
+ * Processing in digit-by-digit chunks avoids BigInt or a full string-to-number
+ * conversion (a 20-char LEI expands to up to 34 decimal digits).
+ */
+function verifyLeiCheckDigits(lei) {
+    // Build the full digit string (letters → 2-digit ordinals, digits → as-is)
+    const digits = lei
+        .split("")
+        .map((c) => {
+        const code = c.charCodeAt(0);
+        // A–Z (65–90) → 10–35; 0–9 (48–57) → 0–9
+        return code >= 65 ? String(code - 55) : c;
+    })
+        .join("");
+    // Compute the large number mod 97 by iterating one digit at a time
+    let remainder = 0;
+    for (let i = 0; i < digits.length; i++) {
+        remainder = (remainder * 10 + Number(digits[i])) % 97;
+    }
+    return remainder === 1;
+}
+// ── DID validation (shared with product.ts but not exported there) ────────────
+function isValidDidSegment(seg) {
+    if (!seg)
+        return false;
+    let i = 0;
+    while (i < seg.length) {
+        const c = seg[i];
+        if (/[A-Za-z0-9._\-]/.test(c)) {
+            i++;
+        }
+        else if (c === "%" &&
+            i + 2 < seg.length &&
+            /^[0-9A-Fa-f]{2}$/.test(seg.slice(i + 1, i + 3))) {
+            i += 3;
+        }
+        else {
+            return false;
+        }
+    }
+    return true;
+}
+function validateDidString(did) {
+    const errors = [];
+    if (!did.startsWith("did:")) {
+        errors.push("DID must start with 'did:'");
+        return errors;
+    }
+    const rest = did.slice(4);
+    const firstColon = rest.indexOf(":");
+    if (firstColon <= 0) {
+        errors.push("DID must have a method and a method-specific-id separated by ':'");
+        return errors;
+    }
+    const method = rest.slice(0, firstColon);
+    const methodSpecificId = rest.slice(firstColon + 1);
+    if (!/^[a-z0-9]+$/.test(method)) {
+        errors.push(`DID method '${method}' must match [a-z0-9]+`);
+    }
+    if (!methodSpecificId) {
+        errors.push("DID method-specific-id is empty");
+        return errors;
+    }
+    if (methodSpecificId.endsWith(":")) {
+        errors.push("DID method-specific-id must not end with ':'");
+    }
+    for (const seg of methodSpecificId.split(":")) {
+        if (!isValidDidSegment(seg)) {
+            errors.push(`DID method-specific-id segment '${seg}' contains invalid characters`);
+        }
+    }
+    return errors;
+}
+// ── iso6523 ───────────────────────────────────────────────────────────────────
+function validateIso6523(icd, value) {
+    const errors = [];
+    if (!/^\d{4}$/.test(icd)) {
+        errors.push("iso6523 icd must be exactly 4 digits");
+    }
+    if (!value) {
+        errors.push("iso6523 value must not be empty");
+        return { ok: false, errors };
+    }
+    // ICD-specific rules
+    if (icd === "0199") {
+        // LEI (ISO 17442): [A-Z0-9]{18}[0-9]{2}, ISO 7064 MOD 97-10 check
+        if (!/^[A-Z0-9]{18}[0-9]{2}$/.test(value)) {
+            errors.push("LEI (icd 0199) must be 20 characters: 18 upper-case alphanumerics followed by 2 digits");
+        }
+        else if (!verifyLeiCheckDigits(value)) {
+            errors.push("LEI (icd 0199) check digits fail ISO 7064 MOD 97-10 verification");
+        }
+    }
+    else if (icd === "0088") {
+        // GLN (ISO/IEC 15418 GS1 AI 414/417): 13 digits, mod-10 check
+        if (!validateGln(value)) {
+            errors.push("GLN (icd 0088) must be a valid 13-digit GLN with a correct mod-10 check digit");
+        }
+    }
+    else if (icd === "0060") {
+        // DUNS: 9 digits (no check digit defined in the public spec)
+        if (!/^\d{9}$/.test(value)) {
+            errors.push("DUNS (icd 0060) must be exactly 9 digits");
+        }
+    }
+    // All other ICDs: non-empty value is sufficient (already checked above).
+    if (errors.length > 0)
+        return { ok: false, errors };
+    return { ok: true, value: { scheme: "iso6523", icd, value } };
+}
+// ── Public API ────────────────────────────────────────────────────────────────
+/**
+ * Validate a `OperatorIdentifier` against EN 18219 rules.
+ * Returns the normalised identifier on success or an error list on failure.
+ */
+export function validateOperatorIdentifier(id) {
+    switch (id.scheme) {
+        case "iso6523":
+            return validateIso6523(id.icd, id.value);
+        case "gln": {
+            if (!validateGln(id.gln)) {
+                return {
+                    ok: false,
+                    errors: ["gln must be a valid 13-digit GLN with a correct mod-10 check digit"],
+                };
+            }
+            return { ok: true, value: id };
+        }
+        case "did": {
+            const didErrors = validateDidString(id.did);
+            if (didErrors.length > 0)
+                return { ok: false, errors: didErrors };
+            return { ok: true, value: id };
+        }
+        case "doi": {
+            const bare = normalizeDoi(id.doi);
+            if (!bare) {
+                return {
+                    ok: false,
+                    errors: [
+                        `doi '${id.doi}' must match 10.<4–9 registrant digits>/<suffix> per the DOI Handbook`,
+                    ],
+                };
+            }
+            return { ok: true, value: { ...id, doi: bare } };
+        }
+        default: {
+            // Exhaustiveness guard
+            const _exhaustive = id;
+            void _exhaustive;
+            return { ok: false, errors: ["unknown operator identifier scheme"] };
+        }
+    }
+}
+/**
+ * Validate a `FacilityIdentifier` against EN 18219 rules.
+ * EN 18219 scheme 7 names GLN as the only facility scheme.
+ *
+ * The optional `extension` field is a sub-location identifier following the
+ * GS1 SGLN extension component convention (non-empty when present).
+ */
+export function validateFacilityIdentifier(id) {
+    const errors = [];
+    if (!validateGln(id.gln)) {
+        errors.push("gln must be a valid 13-digit GLN with a correct mod-10 check digit");
+    }
+    if (id.extension !== undefined && !id.extension) {
+        errors.push("extension, when present, must not be empty");
+    }
+    if (errors.length > 0)
+        return { ok: false, errors };
+    return { ok: true, value: id };
+}
+//# sourceMappingURL=operator.js.map

package/dist/operator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operator.js","sourceRoot":"","sources":["../src/operator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,gFAAgF;AAEhF;;;;;;;;;GASG;AACH,SAAS,oBAAoB,CAAC,GAAW;IACvC,2EAA2E;IAC3E,MAAM,MAAM,GAAG,GAAG;SACf,KAAK,CAAC,EAAE,CAAC;SACT,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC7B,yCAAyC;QACzC,OAAO,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC;SACD,IAAI,CAAC,EAAE,CAAC,CAAC;IAEZ,mEAAmE;IACnE,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,SAAS,GAAG,CAAC,SAAS,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,SAAS,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,iFAAiF;AAEjF,SAAS,iBAAiB,CAAC,GAAW;IACpC,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9B,CAAC,EAAE,CAAC;QACN,CAAC;aAAM,IACL,CAAC,KAAK,GAAG;YACT,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM;YAClB,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAChD,CAAC;YACD,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;aAAM,CAAC;YACN,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACpC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAC1C,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;QAChF,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IACzC,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IAEpD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,eAAe,MAAM,wBAAwB,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QAC/C,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAC9D,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,mCAAmC,GAAG,+BAA+B,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,iFAAiF;AAEjF,SAAS,eAAe,CACtB,GAAW,EACX,KAAa;IAEb,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC/B,CAAC;IAED,qBAAqB;IACrB,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnB,kEAAkE;QAClE,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,MAAM,CAAC,IAAI,CACT,wFAAwF,CACzF,CAAC;QACJ,CAAC;aAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;SAAM,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QAC1B,8DAA8D;QAC9D,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;SAAM,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QAC1B,6DAA6D;QAC7D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,yEAAyE;IAEzE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACpD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;AAChE,CAAC;AAED,iFAAiF;AAEjF;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,EAAsB;IAEtB,QAAQ,EAAE,CAAC,MAAM,EAAE,CAAC;QAClB,KAAK,SAAS;YACZ,OAAO,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QAE3C,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,CAAC,oEAAoE,CAAC;iBAC/E,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QACjC,CAAC;QAED,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,SAAS,GAAG,iBAAiB,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;YAC5C,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAClE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QACjC,CAAC;QAED,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE;wBACN,QAAQ,EAAE,CAAC,GAAG,uEAAuE;qBACtF;iBACF,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC;QACnD,CAAC;QAED,OAAO,CAAC,CAAC,CAAC;YACR,uBAAuB;YACvB,MAAM,WAAW,GAAU,EAAE,CAAC;YAC9B,KAAK,WAAW,CAAC;YACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,oCAAoC,CAAC,EAAE,CAAC;QACvE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,EAAsB;IAEtB,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,EAAE,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACpD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AACjC,CAAC"}

package/dist/passport.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Helpers that operate on a Passport object and its identifier fields.
+ *
+ * `resolveProductIdentifier` — read the canonical product identifier from a
+ * passport, handling the `identifier`/`gs1` precedence without the caller
+ * having to repeat it. Precedence (highest first):
+ *   1. `passport.identifier` — the scheme-tagged EN 18219 field (new primary).
+ *   2. `passport.gs1` — the legacy GS1-only field, lifted into a `Gs1Identifier`.
+ *   3. `undefined` — no identifier is set.
+ */
+import type { Passport, ProductIdentifier } from "@tracepass/dpp-types";
+/**
+ * Return the canonical `ProductIdentifier` for a passport.
+ *
+ * Prefers the scheme-tagged `identifier` field (EN 18219). Falls back to
+ * lifting the deprecated `gs1` field into a `Gs1Identifier`. Returns
+ * `undefined` when neither is set.
+ *
+ * Use this instead of reading `passport.identifier ?? liftGs1(passport.gs1)`
+ * directly — it centralises the precedence rule so callers stay correct when
+ * new fallback logic is added.
+ *
+ * @example
+ * ```ts
+ * const id = resolveProductIdentifier(passport);
+ * if (!id) throw new Error("Passport has no product identifier");
+ * ```
+ */
+export declare function resolveProductIdentifier(passport: Passport): ProductIdentifier | undefined;
+//# sourceMappingURL=passport.d.ts.map

package/dist/passport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passport.d.ts","sourceRoot":"","sources":["../src/passport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,iBAAiB,EAAiB,MAAM,sBAAsB,CAAC;AAEvF;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,QAAQ,GAAG,iBAAiB,GAAG,SAAS,CAkB1F"}

package/dist/passport.js

@@ -0,0 +1,46 @@
+/**
+ * Helpers that operate on a Passport object and its identifier fields.
+ *
+ * `resolveProductIdentifier` — read the canonical product identifier from a
+ * passport, handling the `identifier`/`gs1` precedence without the caller
+ * having to repeat it. Precedence (highest first):
+ *   1. `passport.identifier` — the scheme-tagged EN 18219 field (new primary).
+ *   2. `passport.gs1` — the legacy GS1-only field, lifted into a `Gs1Identifier`.
+ *   3. `undefined` — no identifier is set.
+ */
+/**
+ * Return the canonical `ProductIdentifier` for a passport.
+ *
+ * Prefers the scheme-tagged `identifier` field (EN 18219). Falls back to
+ * lifting the deprecated `gs1` field into a `Gs1Identifier`. Returns
+ * `undefined` when neither is set.
+ *
+ * Use this instead of reading `passport.identifier ?? liftGs1(passport.gs1)`
+ * directly — it centralises the precedence rule so callers stay correct when
+ * new fallback logic is added.
+ *
+ * @example
+ * ```ts
+ * const id = resolveProductIdentifier(passport);
+ * if (!id) throw new Error("Passport has no product identifier");
+ * ```
+ */
+export function resolveProductIdentifier(passport) {
+    // 1. New scheme-tagged field (EN 18219) — always preferred.
+    if (passport.identifier)
+        return passport.identifier;
+    // 2. Legacy GS1-only field — lifted into the ProductIdentifier union.
+    if (passport.gs1) {
+        const lifted = {
+            scheme: "gs1",
+            gtin: passport.gs1.gtin,
+            serialNumber: passport.gs1.serialNumber,
+        };
+        if (passport.gs1.digitalLinkUri !== undefined) {
+            lifted.digitalLinkUri = passport.gs1.digitalLinkUri;
+        }
+        return lifted;
+    }
+    return undefined;
+}
+//# sourceMappingURL=passport.js.map

package/dist/passport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passport.js","sourceRoot":"","sources":["../src/passport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAkB;IACzD,4DAA4D;IAC5D,IAAI,QAAQ,CAAC,UAAU;QAAE,OAAO,QAAQ,CAAC,UAAU,CAAC;IAEpD,sEAAsE;IACtE,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC;QACjB,MAAM,MAAM,GAAkB;YAC5B,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI;YACvB,YAAY,EAAE,QAAQ,CAAC,GAAG,CAAC,YAAY;SACxC,CAAC;QACF,IAAI,QAAQ,CAAC,GAAG,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAC9C,MAAM,CAAC,cAAc,GAAG,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC;QACtD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/product.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Product identifier validation per EN 18219.
+ *
+ * `validateProductIdentifier` accepts any of the five product schemes and
+ * returns a normalised value on success or a list of errors on failure.
+ *
+ * Scheme constraints:
+ *   - gs1:      GTIN-8/12/13/14 + non-empty serial; GTIN normalised to 14 digits.
+ *   - iso15459: issuingAgencyCode 1–3 upper-case alphanumerics, first char a letter;
+ *               non-empty primaryId.
+ *   - iec61406: https URL, ASCII-only, RFC 3986-valid.
+ *   - did:      W3C DID Core ABNF — method [a-z0-9]+, method-specific-id valid chars.
+ *   - doi:      prefix 10.<registrant>/<suffix>; accepts doi:/https://doi.org/ prefixes
+ *               and normalises to bare form.
+ *
+ * Cross-cutting (EN 18219 clause 4.3.2): all identifier fields must use
+ * ISO/IEC 646 characters (printable ASCII, codepoints 0x20–0x7E only).
+ *
+ * Category restriction: `category: "battery"` allows only gs1 and iso15459
+ * (Battery Regulation Art. 77(3) requires ISO/IEC 15459 until a delegated
+ * act replaces it with EN 18219).
+ */
+import type { ProductIdentifier } from "@tracepass/dpp-types";
+/** Validation result — either a normalised identifier or an error list. */
+export type ValidationResult<T> = {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    errors: string[];
+};
+/** Options for {@link validateProductIdentifier}. */
+export interface ValidateProductOptions {
+    /**
+     * DPP category. Pass `"battery"` to restrict to ISO/IEC 15459-based schemes
+     * (gs1 and iso15459), which Battery Regulation Art. 77(3) requires.
+     */
+    category?: string;
+}
+/**
+ * Normalise a DOI to bare form (`10.<registrant>/<suffix>`).
+ *
+ * Accepts the following prefixes (case-insensitive):
+ *   - `doi:10.…`
+ *   - `https://doi.org/10.…`  (canonical resolver)
+ *   - `http://doi.org/10.…`   (legacy http form)
+ *   - `https://dx.doi.org/10.…` / `http://dx.doi.org/10.…` (legacy dx proxy)
+ *
+ * Returns `null` when:
+ *   - the input contains non-ASCII characters (EN 18219 clause 4.3.2 / ISO/IEC 646)
+ *   - the bare form does not match DOI Handbook syntax (`10.<4–9 digits>/<suffix>`)
+ */
+export declare function normalizeDoi(input: string): string | null;
+/**
+ * Validate a `ProductIdentifier` against EN 18219 rules.
+ *
+ * On success returns `{ ok: true, value }` with the normalised identifier
+ * (gtin padded to 14 digits; doi stripped of prefix and lowercased).
+ * On failure returns `{ ok: false, errors }` listing every problem found.
+ *
+ * Pass `{ category: "battery" }` to apply the additional Battery Regulation
+ * Art. 77(3) restriction: only `gs1` and `iso15459` are accepted, because
+ * DID, DOI and IEC 61406 are not ISO/IEC 15459 identifiers.
+ */
+export declare function validateProductIdentifier(id: ProductIdentifier, options?: ValidateProductOptions): ValidationResult<ProductIdentifier>;
+//# sourceMappingURL=product.d.ts.map

package/dist/product.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"product.d.ts","sourceRoot":"","sources":["../src/product.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EACV,iBAAiB,EAMlB,MAAM,sBAAsB,CAAC;AAG9B,2EAA2E;AAC3E,MAAM,MAAM,gBAAgB,CAAC,CAAC,IAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GACtB;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEpC,qDAAqD;AACrD,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAgGD;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAkBzD;AAgJD;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,EAAE,EAAE,iBAAiB,EACrB,OAAO,GAAE,sBAA2B,GACnC,gBAAgB,CAAC,iBAAiB,CAAC,CA2BrC"}

package/dist/product.js

@@ -0,0 +1,300 @@
+/**
+ * Product identifier validation per EN 18219.
+ *
+ * `validateProductIdentifier` accepts any of the five product schemes and
+ * returns a normalised value on success or a list of errors on failure.
+ *
+ * Scheme constraints:
+ *   - gs1:      GTIN-8/12/13/14 + non-empty serial; GTIN normalised to 14 digits.
+ *   - iso15459: issuingAgencyCode 1–3 upper-case alphanumerics, first char a letter;
+ *               non-empty primaryId.
+ *   - iec61406: https URL, ASCII-only, RFC 3986-valid.
+ *   - did:      W3C DID Core ABNF — method [a-z0-9]+, method-specific-id valid chars.
+ *   - doi:      prefix 10.<registrant>/<suffix>; accepts doi:/https://doi.org/ prefixes
+ *               and normalises to bare form.
+ *
+ * Cross-cutting (EN 18219 clause 4.3.2): all identifier fields must use
+ * ISO/IEC 646 characters (printable ASCII, codepoints 0x20–0x7E only).
+ *
+ * Category restriction: `category: "battery"` allows only gs1 and iso15459
+ * (Battery Regulation Art. 77(3) requires ISO/IEC 15459 until a delegated
+ * act replaces it with EN 18219).
+ */
+import { normalizeGtin } from "@tracepass/gs1-utils";
+// ── Shared helpers ────────────────────────────────────────────────────────────
+/**
+ * True when every character in `s` is a printable ASCII character (0x20–0x7E).
+ * EN 18219 clause 4.3.2 requires ISO/IEC 646 characters for all identifier fields.
+ */
+function isAsciiPrintable(s) {
+    for (let i = 0; i < s.length; i++) {
+        const code = s.charCodeAt(i);
+        if (code < 0x20 || code > 0x7e)
+            return false;
+    }
+    return true;
+}
+/**
+ * True when `s` is RFC 3986-valid. Uses the platform-global `URL` constructor
+ * (available in Node ≥ 18, browsers and Deno) as a lightweight proxy — it
+ * throws on obvious syntax errors. The check is intentionally permissive:
+ * percent-encoded bytes are accepted so long as the `URL` constructor accepts them.
+ */
+function isRfc3986Valid(s) {
+    try {
+        new URL(s);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+// ── DID validation ────────────────────────────────────────────────────────────
+/**
+ * True when `seg` is a valid DID method-specific-id segment.
+ * Per W3C DID Core: idchar = ALPHA / DIGIT / "." / "-" / "_" / pct-encoded.
+ */
+function isValidDidSegment(seg) {
+    if (!seg)
+        return false;
+    let i = 0;
+    while (i < seg.length) {
+        const c = seg[i];
+        if (/[A-Za-z0-9._\-]/.test(c)) {
+            i++;
+        }
+        else if (c === "%" &&
+            i + 2 < seg.length &&
+            /^[0-9A-Fa-f]{2}$/.test(seg.slice(i + 1, i + 3))) {
+            i += 3;
+        }
+        else {
+            return false;
+        }
+    }
+    return true;
+}
+function validateDidString(did) {
+    const errors = [];
+    if (!did.startsWith("did:")) {
+        errors.push("DID must start with 'did:'");
+        return errors;
+    }
+    const rest = did.slice(4);
+    const firstColon = rest.indexOf(":");
+    if (firstColon <= 0) {
+        errors.push("DID must have a method and a method-specific-id separated by ':'");
+        return errors;
+    }
+    const method = rest.slice(0, firstColon);
+    const methodSpecificId = rest.slice(firstColon + 1);
+    if (!/^[a-z0-9]+$/.test(method)) {
+        errors.push(`DID method '${method}' must match [a-z0-9]+ (all lower-case, no hyphens)`);
+    }
+    if (!methodSpecificId) {
+        errors.push("DID method-specific-id is empty");
+        return errors;
+    }
+    if (methodSpecificId.endsWith(":")) {
+        errors.push("DID method-specific-id must not end with ':'");
+    }
+    const segments = methodSpecificId.split(":");
+    for (const seg of segments) {
+        if (!isValidDidSegment(seg)) {
+            errors.push(`DID method-specific-id segment '${seg}' contains invalid characters ` +
+                "(allowed: ALPHA, DIGIT, '.', '-', '_', pct-encoded)");
+        }
+    }
+    return errors;
+}
+// ── DOI normalisation ─────────────────────────────────────────────────────────
+/**
+ * Normalise a DOI to bare form (`10.<registrant>/<suffix>`).
+ *
+ * Accepts the following prefixes (case-insensitive):
+ *   - `doi:10.…`
+ *   - `https://doi.org/10.…`  (canonical resolver)
+ *   - `http://doi.org/10.…`   (legacy http form)
+ *   - `https://dx.doi.org/10.…` / `http://dx.doi.org/10.…` (legacy dx proxy)
+ *
+ * Returns `null` when:
+ *   - the input contains non-ASCII characters (EN 18219 clause 4.3.2 / ISO/IEC 646)
+ *   - the bare form does not match DOI Handbook syntax (`10.<4–9 digits>/<suffix>`)
+ */
+export function normalizeDoi(input) {
+    // EN 18219 clause 4.3.2: all identifier content must be ISO/IEC 646 (printable ASCII)
+    if (!isAsciiPrintable(input))
+        return null;
+    let bare = input.trim();
+    // Strip known prefixes (case-insensitive per the DOI Handbook).
+    // The (dx.)? alternative covers the legacy dx.doi.org proxy.
+    if (/^https?:\/\/(dx\.)?doi\.org\//i.test(bare)) {
+        bare = bare.replace(/^https?:\/\/(dx\.)?doi\.org\//i, "");
+    }
+    else if (/^doi:/i.test(bare)) {
+        bare = bare.replace(/^doi:/i, "");
+    }
+    // DOI Handbook syntax: prefix = 10.<4-9 digits>, suffix = at least one non-space char.
+    // Case-insensitive per the DOI Handbook; stored as lower-case.
+    if (!/^10\.\d{4,9}\/\S+$/i.test(bare))
+        return null;
+    return bare.toLowerCase();
+}
+// ── Per-scheme validators ─────────────────────────────────────────────────────
+function validateGs1(id) {
+    const errors = [];
+    const gtin14 = normalizeGtin(id.gtin);
+    if (!gtin14) {
+        errors.push(`gtin '${id.gtin}' is not a valid GTIN-8/12/13/14 (must be all digits with a correct mod-10 check digit)`);
+    }
+    if (!id.serialNumber) {
+        errors.push("serialNumber must not be empty");
+    }
+    else if (!isAsciiPrintable(id.serialNumber)) {
+        errors.push("serialNumber must contain only printable ASCII characters (ISO/IEC 646)");
+    }
+    if (id.digitalLinkUri !== undefined && !isAsciiPrintable(id.digitalLinkUri)) {
+        errors.push("digitalLinkUri must contain only printable ASCII characters");
+    }
+    if (errors.length > 0)
+        return { ok: false, errors };
+    return {
+        ok: true,
+        value: {
+            ...id,
+            gtin: gtin14, // eslint-disable-line @typescript-eslint/no-non-null-assertion
+        },
+    };
+}
+function validateIso15459(id) {
+    const errors = [];
+    const code = id.issuingAgencyCode;
+    if (!code || code.length < 1 || code.length > 3) {
+        errors.push("issuingAgencyCode must be 1–3 characters");
+    }
+    else if (!/^[A-Z0-9]{1,3}$/.test(code)) {
+        errors.push("issuingAgencyCode must be upper-case letters and/or digits only");
+    }
+    else if (!/^[A-Z]/.test(code)) {
+        // GS1 holds the all-digit issuing agency code range (ISO/IEC 15459-2
+        // code allocation rule — unverified against the current register).
+        errors.push("issuingAgencyCode first character must be a letter " +
+            "(GS1 holds the all-digit range per the ISO/IEC 15459-2 code allocation)");
+    }
+    if (!id.primaryId) {
+        errors.push("primaryId must not be empty");
+    }
+    else if (!isAsciiPrintable(id.primaryId)) {
+        errors.push("primaryId must contain only printable ASCII characters (ISO/IEC 646)");
+    }
+    if (id.serial !== undefined) {
+        if (!id.serial) {
+            errors.push("serial, when present, must not be empty");
+        }
+        else if (!isAsciiPrintable(id.serial)) {
+            errors.push("serial must contain only printable ASCII characters (ISO/IEC 646)");
+        }
+    }
+    if (!id.raw) {
+        errors.push("raw must not be empty");
+    }
+    else if (!isAsciiPrintable(id.raw)) {
+        errors.push("raw must contain only printable ASCII characters (ISO/IEC 646)");
+    }
+    if (errors.length > 0)
+        return { ok: false, errors };
+    return { ok: true, value: id };
+}
+function validateIec61406(id) {
+    const errors = [];
+    if (!id.uri) {
+        errors.push("uri must not be empty");
+    }
+    else {
+        if (!id.uri.startsWith("https://")) {
+            errors.push("IEC 61406 uri must be an https URL");
+        }
+        if (!isAsciiPrintable(id.uri)) {
+            errors.push("uri must contain only printable ASCII characters (ISO/IEC 646)");
+        }
+        if (!isRfc3986Valid(id.uri)) {
+            errors.push("uri must be a valid RFC 3986 URL");
+        }
+    }
+    if (errors.length > 0)
+        return { ok: false, errors };
+    return { ok: true, value: id };
+}
+function validateDid(id) {
+    const errors = [];
+    if (!isAsciiPrintable(id.did)) {
+        errors.push("did must contain only printable ASCII characters (ISO/IEC 646)");
+    }
+    const didErrors = validateDidString(id.did);
+    errors.push(...didErrors);
+    // Verify method field matches the method in the DID string
+    if (didErrors.length === 0) {
+        const methodInDid = id.did.slice(4, id.did.indexOf(":", 4));
+        if (id.method !== methodInDid) {
+            errors.push(`method field '${id.method}' does not match the method in the did string '${methodInDid}'`);
+        }
+    }
+    if (errors.length > 0)
+        return { ok: false, errors };
+    return { ok: true, value: id };
+}
+function validateDoiId(id) {
+    const errors = [];
+    if (!isAsciiPrintable(id.doi)) {
+        errors.push("doi must contain only printable ASCII characters (ISO/IEC 646)");
+    }
+    const bare = normalizeDoi(id.doi);
+    if (!bare) {
+        errors.push(`doi '${id.doi}' must match 10.<4–9 registrant digits>/<suffix> per the DOI Handbook`);
+    }
+    if (errors.length > 0)
+        return { ok: false, errors };
+    return { ok: true, value: { ...id, doi: bare } }; // eslint-disable-line @typescript-eslint/no-non-null-assertion
+}
+// ── Battery category restriction ──────────────────────────────────────────────
+const BATTERY_ALLOWED_SCHEMES = new Set(["gs1", "iso15459"]);
+// ── Public API ────────────────────────────────────────────────────────────────
+/**
+ * Validate a `ProductIdentifier` against EN 18219 rules.
+ *
+ * On success returns `{ ok: true, value }` with the normalised identifier
+ * (gtin padded to 14 digits; doi stripped of prefix and lowercased).
+ * On failure returns `{ ok: false, errors }` listing every problem found.
+ *
+ * Pass `{ category: "battery" }` to apply the additional Battery Regulation
+ * Art. 77(3) restriction: only `gs1` and `iso15459` are accepted, because
+ * DID, DOI and IEC 61406 are not ISO/IEC 15459 identifiers.
+ */
+export function validateProductIdentifier(id, options = {}) {
+    // Battery Regulation Art. 77(3) restriction
+    if (options.category === "battery" && !BATTERY_ALLOWED_SCHEMES.has(id.scheme)) {
+        return {
+            ok: false,
+            errors: [
+                `scheme '${id.scheme}' is not permitted for battery passports — ` +
+                    "Battery Regulation Art. 77(3) requires an ISO/IEC 15459 identifier " +
+                    "(gs1 or iso15459); DID, DOI and IEC 61406 are not ISO/IEC 15459 identifiers.",
+            ],
+        };
+    }
+    switch (id.scheme) {
+        case "gs1": return validateGs1(id);
+        case "iso15459": return validateIso15459(id);
+        case "iec61406": return validateIec61406(id);
+        case "did": return validateDid(id);
+        case "doi": return validateDoiId(id);
+        default: {
+            // Exhaustiveness guard — a new scheme added to the union without a
+            // validator here becomes a compile error on the line below.
+            const _exhaustive = id;
+            void _exhaustive;
+            return { ok: false, errors: ["unknown scheme"] };
+        }
+    }
+}
+//# sourceMappingURL=product.js.map