antifraud-sdk-core-ts 0.0.0-stage → 0.1.1

package/CHANGELOG.md

@@ -0,0 +1,23 @@
+# Changelog
+
+## Unreleased
+
+## 0.1.1 - 2026-10-17
+
+- Add runtime-neutral authoritative credential issuance orchestration using
+  canonical data-utils contracts, opaque polling continuity and terminal-state
+  enforcement.
+
+- Add runtime-neutral employer qualification-evidence orchestration, issuer
+  discovery, privacy-minimized confirmation requests, issuer-owned decisions
+  and reverse decision notifications.
+- Document canonical Schema.org `MediaObject` evidence, its OpenID Identity
+  Assurance attachment projection, SHA3-384 CID anchoring, tenant-to-tenant
+  delivery, ledger recovery and W3C credential rendering.
+
+- Add runtime-neutral OpenID4VP DCQL profiles, opaque presentation-session storage and presentation orchestration.
+- Document reusable workforce authorization as active group membership plus a
+  controller-managed group authorization, with optional subject authorization
+  kept separate and no employee-specific Consent.
+- Keep awarding-organization resolution, employer attestation, and
+  source-issued qualification proof as distinct orchestration states.

package/LICENSE

@@ -0,0 +1,167 @@
+Copyright 2026 Antifraud Services Inc.
+
+Apache License
+Version 2.0, January 2004
+http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+"License" shall mean the terms and conditions for use, reproduction, and
+distribution as defined by Sections 1 through 9 of this document.
+
+"Licensor" shall mean the copyright owner or entity authorized by the
+copyright owner that is granting the License.
+
+"Legal Entity" shall mean the union of the acting entity and all other
+entities that control, are controlled by, or are under common control with
+that entity. For the purposes of this definition, "control" means (i) the
+power, direct or indirect, to cause the direction or management of such
+entity, whether by contract or otherwise, or (ii) ownership of fifty percent
+(50%) or more of the outstanding shares, or (iii) beneficial ownership of
+such entity.
+
+"You" (or "Your") shall mean an individual or Legal Entity exercising
+permissions granted by this License.
+
+"Source" form shall mean the preferred form for making modifications,
+including but not limited to software source code, documentation source,
+and configuration files.
+
+"Object" form shall mean any form resulting from mechanical transformation
+or translation of a Source form, including but not limited to compiled
+object code, generated documentation, and conversions to other media types.
+
+"Work" shall mean the work of authorship, whether in Source or Object form,
+made available under the License, as indicated by a copyright notice that is
+included in or attached to the work (an example is provided in the Appendix
+below).
+
+"Derivative Works" shall mean any work, whether in Source or Object form,
+that is based on (or derived from) the Work and for which the editorial
+revisions, annotations, elaborations, or other modifications represent, as
+a whole, an original work of authorship. For the purposes of this License,
+Derivative Works shall not include works that remain separable from, or
+merely link (or bind by name) to the interfaces of, the Work and Derivative
+Works thereof.
+
+"Contribution" shall mean any work of authorship, including the original
+version of the Work and any modifications or additions to that Work or
+Derivative Works thereof, that is intentionally submitted to Licensor for
+inclusion in the Work by the copyright owner or by an individual or Legal
+Entity authorized to submit on behalf of the copyright owner. For the
+purposes of this definition, "submitted" means any form of electronic,
+verbal, or written communication sent to the Licensor or its representatives,
+including but not limited to communication on electronic mailing lists,
+source code control systems, and issue tracking systems that are managed by,
+or on behalf of, the Licensor for the purpose of discussing and improving
+the Work, but excluding communication that is conspicuously marked or
+otherwise designated in writing by the copyright owner as "Not a
+Contribution."
+
+"Contributor" shall mean Licensor and any individual or Legal Entity on
+behalf of whom a Contribution has been received by Licensor and subsequently
+incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of this
+License, each Contributor hereby grants to You a perpetual, worldwide,
+non-exclusive, no-charge, royalty-free, irrevocable copyright license to
+reproduce, prepare Derivative Works of, publicly display, publicly perform,
+sublicense, and distribute the Work and such Derivative Works in Source or
+Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of this
+License, each Contributor hereby grants to You a perpetual, worldwide,
+non-exclusive, no-charge, royalty-free, irrevocable (except as stated in
+this section) patent license to make, have made, use, offer to sell, sell,
+import, and otherwise transfer the Work, where such license applies only to
+those patent claims licensable by such Contributor that are necessarily
+infringed by their Contribution(s) alone or by combination of their
+Contribution(s) with the Work to which such Contribution(s) was submitted.
+If You institute patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that the Work or a
+Contribution incorporated within the Work constitutes direct or
+contributory patent infringement, then any patent licenses granted to You
+under this License for that Work shall terminate as of the date such
+litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the Work or
+Derivative Works thereof in any medium, with or without modifications, and
+in Source or Object form, provided that You meet the following conditions:
+
+(a) You must give any other recipients of the Work or Derivative Works a copy
+of this License; and
+
+(b) You must cause any modified files to carry prominent notices stating that
+You changed the files; and
+
+(c) You must retain, in the Source form of any Derivative Works that You
+distribute, all copyright, patent, trademark, and attribution notices from
+the Source form of the Work, excluding those notices that do not pertain to
+any part of the Derivative Works; and
+
+(d) If the Work includes a "NOTICE" text file as part of its distribution,
+then any Derivative Works that You distribute must include a readable copy of
+the attribution notices contained within such NOTICE file, excluding those
+notices that do not pertain to any part of the Derivative Works, in at least
+one of the following places: within a NOTICE text file distributed as part
+of the Derivative Works; within the Source form or documentation, if provided
+along with the Derivative Works; or, within a display generated by the
+Derivative Works, if and wherever such third-party notices normally appear.
+The contents of the NOTICE file are for informational purposes only and do
+not modify the License. You may add Your own attribution notices within
+Derivative Works that You distribute, alongside or as an addendum to the
+NOTICE text from the Work, provided that such additional attribution notices
+cannot be construed as modifying the License.
+
+You may add Your own copyright statement to Your modifications and may
+provide additional or different license terms and conditions for use,
+reproduction, or distribution of Your modifications, or for any such
+Derivative Works as a whole, provided Your use, reproduction, and
+distribution of the Work otherwise complies with the conditions stated in
+this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise, any
+Contribution intentionally submitted for inclusion in the Work by You to the
+Licensor shall be under the terms and conditions of this License, without
+any additional terms or conditions. Notwithstanding the above, nothing
+herein shall supersede or modify the terms of any separate license agreement
+you may have executed with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade names,
+trademarks, service marks, or product names of the Licensor, except as
+required for reasonable and customary use in describing the origin of the
+Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or agreed to in
+writing, Licensor provides the Work (and each Contributor provides its
+Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied, including, without limitation, any
+warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or
+FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining
+the appropriateness of using or redistributing the Work and assume any risks
+associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory, whether
+in tort (including negligence), contract, or otherwise, unless required by
+applicable law (such as deliberate and grossly negligent acts) or agreed to
+in writing, shall any Contributor be liable to You for damages, including any
+direct, indirect, special, incidental, or consequential damages of any
+character arising as a result of this License or out of the use or inability
+to use the Work (including but not limited to damages for loss of goodwill,
+work stoppage, computer failure or malfunction, or any and all other
+commercial damages or losses), even if such Contributor has been advised of
+the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing the Work
+or Derivative Works thereof, You may choose to offer, and charge a fee for,
+acceptance of support, warranty, indemnity, or other liability obligations
+and/or rights consistent with this License. However, in accepting such
+obligations, You may act only on Your own behalf and on Your sole
+responsibility, not on behalf of any other Contributor, and only if You agree
+to indemnify, defend, and hold each Contributor harmless for any liability
+incurred by, or claims asserted against, such Contributor by reason of your
+accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS

package/README.md

@@ -1,3 +1,92 @@
-# Temporary Holding Version
+# Antifraud SDK Core
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Runtime-neutral orchestration contracts for identity verification, subject and relationship attestation, and provider-issued credentials.
+
+## Status
+
+Public implementation foundation. No package has been published and no production readiness is claimed yet.
+
+## Responsibility
+
+This package will coordinate application flows without depending on Node.js, React, a database, a ledger, a tenant, or a product.
+
+It will reuse the canonical claims, JSON Schemas, mappings, and capability identifiers from [antifraud-data-utils-ts](https://github.com/antifraudservices/antifraud-data-utils-ts). It must not duplicate those literals.
+
+The intended flow is:
+
+1. A user interface or backend for frontend starts an identity presentation.
+2. A trusted verifier validates the presentation and returns an opaque transaction result.
+3. An authorized index provider reads the subject or relationship again from its authoritative source.
+4. The index provider issues and signs the resulting credential.
+5. The caller receives the credential or a stable reference, but never the provider signing key.
+
+OpenID for Verifiable Presentations starts and verifies a wallet presentation. Credential issuance is a separate provider operation and may use OpenID for Verifiable Credential Issuance or another explicit issuer protocol. The two operations must never be described as one.
+
+## Planned public API
+
+- verification and attestation use-case ports;
+- wallet-presentation session orchestration;
+- authoritative-readback request and result types;
+- credential-issuance request orchestration;
+- deterministic flow states and errors;
+- no transport, storage, framework, or signing implementation.
+
+## Security boundary
+
+No secrets, tenant configuration, trust anchors, personal data, signing keys, or operational endpoints belong in this repository.
+
+The browser and a generic backend for frontend are untrusted for credential signing. Only the configured credential provider may sign after an authoritative readback and authorization check.
+
+## Workforce group authorization
+
+An employee does not receive a separate Consent merely by joining an
+operational group. Orchestration must receive and keep distinct:
+
+1. the employee's active assignment and active membership in the exact group;
+2. the controller-managed authorization for that group and its exact
+   capabilities;
+3. when the use case requires it, a separate authorization from the subject or
+   lawful representative.
+
+Adding or removing one employee changes membership only. It must not recreate
+or revoke the group authorization for the remaining members. Invitation,
+acceptance, department or group reassignment, suspension, and reactivation are
+separate assignment events that applications notify through Communication.
+Those notifications are not authorization records.
+
+The same orchestration contract can serve education, insurance, human health,
+animal care, or other domains. Product applications select their own group
+purposes and subject-authorization rules; this package must not embed them.
+
+For employee qualification evidence, orchestration keeps organization
+resolution, employer attestation, and source-issued credential proof as
+separate states. An awarding organization is selected by legal identifier and
+jurisdiction. If no source credential exists, the employer may sign its own
+attestation but must not be represented as the awarding organization's issuer.
+
+The implemented qualification-evidence controller records the employer's proof
+through a trusted port, resolves the claimed issuer by legal identifier and
+jurisdiction, anchors only opaque continuity, and queues a tenant-to-tenant
+confirmation request. See [Qualification evidence confirmation prototype](docs/QUALIFICATION_EVIDENCE_CONFIRMATION.md)
+for attachment, issuer notification, ledger recovery and credential-rendering
+boundaries.
+
+## Dependency direction
+
+```text
+antifraud-data-utils-ts
+          ↓
+antifraud-sdk-core-ts
+          ↓
+antifraud-sdk-node-ts / antifraud-portal-components-react
+          ↓
+applications and services
+```
+
+## Implementation gate
+
+Implementation begins with executable contract tests and proceeds in dependency order. A repository, type name, mock, or successful HTTP response is not evidence that a credential was verified or issued.
+
+## License
+
+Apache-2.0.

package/dist/credential-issuance-controller.d.ts

@@ -0,0 +1,18 @@
+import { type CredentialIssuanceReceipt, type CredentialIssuanceRequest } from 'antifraud-data-utils-ts';
+export interface CredentialIssuanceProviderPort {
+    requestIssuance(request: CredentialIssuanceRequest): Promise<CredentialIssuanceReceipt>;
+    getIssuance(issuanceId: string): Promise<CredentialIssuanceReceipt>;
+}
+export interface CredentialIssuanceControllerOptions {
+    provider: CredentialIssuanceProviderPort;
+    wait(milliseconds: number): Promise<void>;
+}
+export interface CredentialIssuancePollingOptions {
+    maxPollAttempts?: number;
+    pollIntervalMilliseconds?: number;
+}
+export interface CredentialIssuanceController {
+    issue(request: CredentialIssuanceRequest & Record<string, unknown>, polling?: CredentialIssuancePollingOptions): Promise<CredentialIssuanceReceipt>;
+}
+export declare function createCredentialIssuanceController(options: CredentialIssuanceControllerOptions): CredentialIssuanceController;
+//# sourceMappingURL=credential-issuance-controller.d.ts.map

package/dist/credential-issuance-controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-issuance-controller.d.ts","sourceRoot":"","sources":["../src/credential-issuance-controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC/B,MAAM,yBAAyB,CAAA;AAEhC,MAAM,WAAW,8BAA8B;IAC7C,eAAe,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAA;IACvF,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAA;CACpE;AAED,MAAM,WAAW,mCAAmC;IAClD,QAAQ,EAAE,8BAA8B,CAAA;IACxC,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1C;AAED,MAAM,WAAW,gCAAgC;IAC/C,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,wBAAwB,CAAC,EAAE,MAAM,CAAA;CAClC;AAED,MAAM,WAAW,4BAA4B;IAC3C,KAAK,CACH,OAAO,EAAE,yBAAyB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5D,OAAO,CAAC,EAAE,gCAAgC,GACzC,OAAO,CAAC,yBAAyB,CAAC,CAAA;CACtC;AAwBD,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,mCAAmC,GAC3C,4BAA4B,CAgC9B"}

package/dist/credential-issuance-controller.js

@@ -0,0 +1,42 @@
+import { CredentialIssuanceStatus, defineCredentialIssuanceRequest, } from 'antifraud-data-utils-ts';
+function isTerminal(receipt) {
+    return receipt.status === CredentialIssuanceStatus.Issued
+        || receipt.status === CredentialIssuanceStatus.Denied
+        || receipt.status === CredentialIssuanceStatus.Failed;
+}
+function positiveInteger(value, fallback, name) {
+    const resolved = value ?? fallback;
+    if (!Number.isSafeInteger(resolved) || resolved <= 0) {
+        throw new TypeError(`${name} must be a positive safe integer`);
+    }
+    return resolved;
+}
+function nonNegativeInteger(value, fallback) {
+    const resolved = value ?? fallback;
+    if (!Number.isSafeInteger(resolved) || resolved < 0) {
+        throw new TypeError('pollIntervalMilliseconds must be a non-negative safe integer');
+    }
+    return resolved;
+}
+export function createCredentialIssuanceController(options) {
+    return Object.freeze({
+        async issue(request, polling = {}) {
+            const canonicalRequest = defineCredentialIssuanceRequest(request);
+            const initial = await options.provider.requestIssuance(canonicalRequest);
+            if (isTerminal(initial))
+                return initial;
+            const maxPollAttempts = positiveInteger(polling.maxPollAttempts, 8, 'maxPollAttempts');
+            const pollIntervalMilliseconds = nonNegativeInteger(polling.pollIntervalMilliseconds, 1_000);
+            for (let attempt = 0; attempt < maxPollAttempts; attempt += 1) {
+                await options.wait(pollIntervalMilliseconds);
+                const current = await options.provider.getIssuance(initial.issuanceId);
+                if (current.issuanceId !== initial.issuanceId) {
+                    throw new Error('Credential provider changed issuance identifier during polling');
+                }
+                if (isTerminal(current))
+                    return current;
+            }
+            throw new Error('Credential issuance remained pending after the configured poll limit');
+        },
+    });
+}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export * from './openid4vp.js';
+export * from './credential-issuance-controller.js';
+export * from './presentation-controller.js';
+export * from './presentation-session.js';
+export * from './qualification-evidence-controller.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAA;AAC9B,cAAc,qCAAqC,CAAA;AACnD,cAAc,8BAA8B,CAAA;AAC5C,cAAc,2BAA2B,CAAA;AACzC,cAAc,wCAAwC,CAAA"}

package/dist/index.js

@@ -0,0 +1,5 @@
+export * from './openid4vp.js';
+export * from './credential-issuance-controller.js';
+export * from './presentation-controller.js';
+export * from './presentation-session.js';
+export * from './qualification-evidence-controller.js';

package/dist/openid4vp.d.ts

@@ -0,0 +1,58 @@
+export declare const OPENID4VP_FORMAT: {
+    readonly msoMdoc: "mso_mdoc";
+    readonly sdJwtVc: "dc+sd-jwt";
+};
+export declare const EUDI_PID: {
+    readonly mdocType: "eu.europa.ec.eudi.pid.1";
+    readonly sdJwtVcType: "urn:eudi:pid:1";
+    readonly givenName: "given_name";
+    readonly familyName: "family_name";
+    readonly birthDate: "birth_date";
+};
+export declare const ISO_MDL: {
+    readonly documentType: "org.iso.18013.5.1.mDL";
+    readonly namespace: "org.iso.18013.5.1";
+    readonly givenName: "given_name";
+    readonly familyName: "family_name";
+    readonly birthDate: "birth_date";
+};
+export type OpenId4VpProfileId = 'eudi-pid' | 'mdl';
+export interface OpenId4VpProfile {
+    id: OpenId4VpProfileId;
+    label: string;
+    claimLabels: readonly string[];
+}
+export declare const OPENID4VP_PROFILES: {
+    readonly eudiPid: {
+        readonly id: "eudi-pid";
+        readonly label: "EUDI Personal Identification Data";
+        readonly claimLabels: readonly ["Given name", "Family name", "Date of birth"];
+    };
+    readonly mobileDrivingLicence: {
+        readonly id: "mdl";
+        readonly label: "Mobile Driving Licence";
+        readonly claimLabels: readonly ["Given name", "Family name", "Date of birth"];
+    };
+};
+export interface DcqlClaim {
+    path: readonly string[];
+    intent_to_retain?: false;
+}
+export interface DcqlCredential {
+    id: string;
+    format: (typeof OPENID4VP_FORMAT)[keyof typeof OPENID4VP_FORMAT];
+    meta: {
+        doctype_value: string;
+    } | {
+        vct_values: readonly string[];
+    };
+    claims: readonly DcqlClaim[];
+}
+export interface DcqlQuery {
+    credentials: readonly DcqlCredential[];
+    credential_sets?: readonly {
+        options: readonly (readonly string[])[];
+    }[];
+}
+export declare function buildDcqlQuery(profile: OpenId4VpProfile): DcqlQuery;
+//# sourceMappingURL=openid4vp.d.ts.map

package/dist/openid4vp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openid4vp.d.ts","sourceRoot":"","sources":["../src/openid4vp.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gBAAgB;;;CAGnB,CAAA;AAEV,eAAO,MAAM,QAAQ;;;;;;CAMX,CAAA;AAEV,eAAO,MAAM,OAAO;;;;;;CAMV,CAAA;AAEV,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,KAAK,CAAA;AAEnD,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,kBAAkB,CAAA;IACtB,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;CAC/B;AAED,eAAO,MAAM,kBAAkB;;;;;;;;;;;CAWsB,CAAA;AAErD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IACvB,gBAAgB,CAAC,EAAE,KAAK,CAAA;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,OAAO,gBAAgB,CAAC,CAAA;IAChE,IAAI,EAAE;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAA;IACnE,MAAM,EAAE,SAAS,SAAS,EAAE,CAAA;CAC7B;AAED,MAAM,WAAW,SAAS;IACxB,WAAW,EAAE,SAAS,cAAc,EAAE,CAAA;IACtC,eAAe,CAAC,EAAE,SAAS;QAAE,OAAO,EAAE,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,CAAA;KAAE,EAAE,CAAA;CACzE;AAMD,wBAAgB,cAAc,CAAC,OAAO,EAAE,gBAAgB,GAAG,SAAS,CA2CnE"}

package/dist/openid4vp.js

@@ -0,0 +1,76 @@
+export const OPENID4VP_FORMAT = {
+    msoMdoc: 'mso_mdoc',
+    sdJwtVc: 'dc+sd-jwt',
+};
+export const EUDI_PID = {
+    mdocType: 'eu.europa.ec.eudi.pid.1',
+    sdJwtVcType: 'urn:eudi:pid:1',
+    givenName: 'given_name',
+    familyName: 'family_name',
+    birthDate: 'birth_date',
+};
+export const ISO_MDL = {
+    documentType: 'org.iso.18013.5.1.mDL',
+    namespace: 'org.iso.18013.5.1',
+    givenName: 'given_name',
+    familyName: 'family_name',
+    birthDate: 'birth_date',
+};
+export const OPENID4VP_PROFILES = {
+    eudiPid: {
+        id: 'eudi-pid',
+        label: 'EUDI Personal Identification Data',
+        claimLabels: ['Given name', 'Family name', 'Date of birth'],
+    },
+    mobileDrivingLicence: {
+        id: 'mdl',
+        label: 'Mobile Driving Licence',
+        claimLabels: ['Given name', 'Family name', 'Date of birth'],
+    },
+};
+function mdocClaim(namespace, claim) {
+    return { path: [namespace, claim], intent_to_retain: false };
+}
+export function buildDcqlQuery(profile) {
+    if (profile.id === 'eudi-pid') {
+        return {
+            credentials: [
+                {
+                    id: 'pid_mdoc',
+                    format: OPENID4VP_FORMAT.msoMdoc,
+                    meta: { doctype_value: EUDI_PID.mdocType },
+                    claims: [
+                        mdocClaim(EUDI_PID.mdocType, EUDI_PID.givenName),
+                        mdocClaim(EUDI_PID.mdocType, EUDI_PID.familyName),
+                        mdocClaim(EUDI_PID.mdocType, EUDI_PID.birthDate),
+                    ],
+                },
+                {
+                    id: 'pid_sd_jwt',
+                    format: OPENID4VP_FORMAT.sdJwtVc,
+                    meta: { vct_values: [EUDI_PID.sdJwtVcType] },
+                    claims: [
+                        { path: [EUDI_PID.givenName] },
+                        { path: [EUDI_PID.familyName] },
+                        { path: [EUDI_PID.birthDate] },
+                    ],
+                },
+            ],
+            credential_sets: [{ options: [['pid_mdoc'], ['pid_sd_jwt']] }],
+        };
+    }
+    return {
+        credentials: [
+            {
+                id: 'mdl',
+                format: OPENID4VP_FORMAT.msoMdoc,
+                meta: { doctype_value: ISO_MDL.documentType },
+                claims: [
+                    mdocClaim(ISO_MDL.namespace, ISO_MDL.givenName),
+                    mdocClaim(ISO_MDL.namespace, ISO_MDL.familyName),
+                    mdocClaim(ISO_MDL.namespace, ISO_MDL.birthDate),
+                ],
+            },
+        ],
+    };
+}

package/dist/presentation-controller.d.ts

@@ -0,0 +1,57 @@
+import type { OpenId4VpProfile } from './openid4vp.js';
+import type { PresentationSession } from './presentation-session.js';
+export interface PresentationTransaction {
+    transaction_id: string;
+    client_id: string;
+    request_uri: string;
+    request_uri_method: 'get' | 'post' | 'post_get';
+}
+export type PresentationResult = {
+    outcome: 'pending';
+} | {
+    outcome: 'verified';
+} | {
+    outcome: 'denied';
+    reason?: string;
+} | {
+    outcome: 'failed';
+    reason?: string;
+};
+interface PresentationVerifier {
+    initialize(profile: OpenId4VpProfile): Promise<PresentationTransaction>;
+    getResult(transactionId: string): Promise<PresentationResult>;
+}
+interface SessionRepository {
+    save(session: PresentationSession): Promise<void>;
+    clear(): Promise<void>;
+}
+interface PresentationControllerOptions {
+    verifier: PresentationVerifier;
+    sessionRepository: SessionRepository;
+    openWallet(uri: string): Promise<void>;
+    now(): string;
+}
+export type PresentationState = {
+    phase: 'idle';
+} | {
+    phase: 'waiting';
+    transactionId: string;
+} | {
+    phase: 'verified';
+    transactionId: string;
+} | {
+    phase: 'denied';
+    transactionId: string;
+    reason?: string;
+} | {
+    phase: 'failed';
+    transactionId: string;
+    reason?: string;
+};
+export declare function buildHaipAuthorizationUri(transaction: PresentationTransaction): string;
+export declare function createPresentationController(options: PresentationControllerOptions): {
+    start(profile: OpenId4VpProfile): Promise<PresentationState>;
+    refresh(transactionId: string): Promise<PresentationState>;
+};
+export {};
+//# sourceMappingURL=presentation-controller.d.ts.map

package/dist/presentation-controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"presentation-controller.d.ts","sourceRoot":"","sources":["../src/presentation-controller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAEpE,MAAM,WAAW,uBAAuB;IACtC,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,kBAAkB,EAAE,KAAK,GAAG,MAAM,GAAG,UAAU,CAAA;CAChD;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,OAAO,EAAE,SAAS,CAAA;CAAE,GACtB;IAAE,OAAO,EAAE,UAAU,CAAA;CAAE,GACvB;IAAE,OAAO,EAAE,QAAQ,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,OAAO,EAAE,QAAQ,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAE1C,UAAU,oBAAoB;IAC5B,UAAU,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAA;IACvE,SAAS,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;CAC9D;AAED,UAAU,iBAAiB;IACzB,IAAI,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB;AAED,UAAU,6BAA6B;IACrC,QAAQ,EAAE,oBAAoB,CAAA;IAC9B,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACtC,GAAG,IAAI,MAAM,CAAA;CACd;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GACjB;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,KAAK,EAAE,QAAQ,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,KAAK,EAAE,QAAQ,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAE/D,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,uBAAuB,GAAG,MAAM,CAOtF;AAED,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,6BAA6B;mBAE1D,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC;2BAWrC,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;EAiBnE"}

package/dist/presentation-controller.js

@@ -0,0 +1,37 @@
+export function buildHaipAuthorizationUri(transaction) {
+    const parameters = new URLSearchParams({
+        client_id: transaction.client_id,
+        request_uri: transaction.request_uri,
+        request_uri_method: transaction.request_uri_method,
+    });
+    return `haip-vp://?${parameters.toString()}`;
+}
+export function createPresentationController(options) {
+    return {
+        async start(profile) {
+            const transaction = await options.verifier.initialize(profile);
+            await options.sessionRepository.save({
+                transactionId: transaction.transaction_id,
+                requestUri: transaction.request_uri,
+                createdAt: options.now(),
+            });
+            await options.openWallet(buildHaipAuthorizationUri(transaction));
+            return { phase: 'waiting', transactionId: transaction.transaction_id };
+        },
+        async refresh(transactionId) {
+            const result = await options.verifier.getResult(transactionId);
+            if (result.outcome === 'pending') {
+                return { phase: 'waiting', transactionId };
+            }
+            await options.sessionRepository.clear();
+            if (result.outcome === 'verified') {
+                return { phase: 'verified', transactionId };
+            }
+            return {
+                phase: result.outcome,
+                transactionId,
+                ...(result.reason === undefined ? {} : { reason: result.reason }),
+            };
+        },
+    };
+}

package/dist/presentation-session.d.ts

@@ -0,0 +1,16 @@
+export interface PresentationSessionStorage {
+    getItem(key: string): Promise<string | null>;
+    setItem(key: string, value: string): Promise<void>;
+    removeItem(key: string): Promise<void>;
+}
+export interface PresentationSession {
+    transactionId: string;
+    requestUri: string;
+    createdAt: string;
+}
+export declare function createPresentationSessionRepository(storage: PresentationSessionStorage): {
+    load(): Promise<PresentationSession | null>;
+    save(session: PresentationSession): Promise<void>;
+    clear(): Promise<void>;
+};
+//# sourceMappingURL=presentation-session.d.ts.map

package/dist/presentation-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"presentation-session.d.ts","sourceRoot":"","sources":["../src/presentation-session.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,0BAA0B;IACzC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAC5C,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClD,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACvC;AAED,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;CAClB;AAeD,wBAAgB,mCAAmC,CAAC,OAAO,EAAE,0BAA0B;YAErE,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;kBAU7B,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;aAGxC,OAAO,CAAC,IAAI,CAAC;EAI/B"}

package/dist/presentation-session.js

@@ -0,0 +1,32 @@
+const SESSION_KEY = 'openid4vp.presentation.session';
+function isPresentationSession(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const candidate = value;
+    return typeof candidate.transactionId === 'string'
+        && typeof candidate.requestUri === 'string'
+        && typeof candidate.createdAt === 'string'
+        && Object.keys(candidate).every((key) => (key === 'transactionId' || key === 'requestUri' || key === 'createdAt'));
+}
+export function createPresentationSessionRepository(storage) {
+    return {
+        async load() {
+            const serialized = await storage.getItem(SESSION_KEY);
+            if (!serialized)
+                return null;
+            try {
+                const value = JSON.parse(serialized);
+                return isPresentationSession(value) ? value : null;
+            }
+            catch {
+                return null;
+            }
+        },
+        async save(session) {
+            await storage.setItem(SESSION_KEY, JSON.stringify(session));
+        },
+        async clear() {
+            await storage.removeItem(SESSION_KEY);
+        },
+    };
+}

package/dist/qualification-evidence-controller.d.ts

@@ -0,0 +1,121 @@
+export type QualificationIssuerQuery = Readonly<{
+    legalIdentifier: string;
+    jurisdiction: string;
+}>;
+export type ResolvedQualificationIssuer = QualificationIssuerQuery & Readonly<{
+    issuerTenantReference: string;
+    issuerOrganizationReference: string;
+    confirmationServiceReference: string;
+}>;
+export type QualificationEvidenceRequest = Readonly<{
+    trustedContext: Readonly<{
+        controllerAuthorizationReference: string;
+        employerTenantReference: string;
+        employerOrganizationReference: string;
+        employeeReference: string;
+        groupAuthorizationReference: string;
+    }>;
+    qualificationClaimReference: string;
+    claimedIssuer: QualificationIssuerQuery;
+    evidence: Readonly<{
+        reference: string;
+        contentId: string;
+        mediaType: 'application/pdf' | 'image/png' | 'image/jpeg' | 'image/tiff';
+        fileName: string;
+    }>;
+}>;
+export type QualificationConfirmationRequestMessage = Readonly<{
+    messageType: 'qualification-evidence-confirmation-request';
+    messageId: string;
+    fromTenantReference: string;
+    toTenantReference: string;
+    serviceReference: string;
+    evidenceReference: string;
+    qualificationClaimReference: string;
+    employerOrganizationReference: string;
+    claimedIssuerOrganizationReference: string;
+    evidenceContentId: string;
+    evidenceMediaType: QualificationEvidenceRequest['evidence']['mediaType'];
+    createdAt: string;
+}>;
+export type QualificationEvidenceControllerPorts = Readonly<{
+    issuerDirectory: Readonly<{
+        resolve(query: QualificationIssuerQuery): Promise<ResolvedQualificationIssuer | null>;
+    }>;
+    evidenceRecorder: Readonly<{
+        recordEmployerAttestation(request: QualificationEvidenceRequest): Promise<Readonly<{
+            evidenceReference: string;
+            employerProofReference: string;
+            anchor: Readonly<{
+                anchorReference: string;
+                contentHash: string;
+            }>;
+        }>>;
+    }>;
+    ledger: Readonly<{
+        recordAnchor(anchor: Readonly<{
+            anchorReference: string;
+            evidenceReference: string;
+            contentHash: string;
+            issuerTenantReference: string;
+            lifecycleStatus: 'awaiting-issuer-confirmation';
+        }>): Promise<void>;
+    }>;
+    outbox: Readonly<{
+        queue(message: QualificationConfirmationRequestMessage): Promise<Readonly<{
+            messageReference: string;
+        }>>;
+    }>;
+    now(): string;
+}>;
+export declare function createQualificationEvidenceController(ports: QualificationEvidenceControllerPorts): {
+    submit(request: QualificationEvidenceRequest): Promise<Readonly<{
+        phase: "issuer-not-resolved";
+    }> | Readonly<{
+        phase: "issuer-confirmation-queued";
+        evidenceReference: string;
+        employerProofReference: string;
+        ledgerAnchorReference: string;
+        issuerTenantReference: string;
+        issuerOrganizationReference: string;
+        requestMessageReference: string;
+    }>>;
+};
+export type QualificationIssuerDecision = Readonly<{
+    evidenceReference: string;
+    issuerTenantReference: string;
+    issuerOrganizationReference: string;
+    decision: 'confirmed' | 'rejected' | 'revoked';
+    issuerProofReference: string;
+    decidedAt: string;
+}>;
+export type QualificationIssuerOutcome = Readonly<{
+    evidenceReference: string;
+    status: 'issuer-confirmed' | 'issuer-rejected' | 'issuer-revoked';
+    issuerProofReference: string;
+    decidedAt: string;
+}>;
+export declare function applyQualificationIssuerDecision(current: Readonly<{
+    evidenceReference: string;
+    expectedIssuerTenantReference: string;
+    expectedIssuerOrganizationReference: string;
+}>, decision: QualificationIssuerDecision): QualificationIssuerOutcome;
+export type QualificationIssuerDecisionNotice = Readonly<{
+    messageType: 'qualification-evidence-issuer-decision';
+    messageId: string;
+    fromTenantReference: string;
+    toTenantReference: string;
+    serviceReference: string;
+    evidenceReference: string;
+    status: QualificationIssuerOutcome['status'];
+    issuerProofReference: string;
+    createdAt: string;
+}>;
+export declare function buildQualificationIssuerDecisionNotice(input: Readonly<{
+    outcome: QualificationIssuerOutcome;
+    employerTenantReference: string;
+    issuerTenantReference: string;
+    employerNotificationServiceReference: string;
+    createdAt: string;
+}>): QualificationIssuerDecisionNotice;
+//# sourceMappingURL=qualification-evidence-controller.d.ts.map

package/dist/qualification-evidence-controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"qualification-evidence-controller.d.ts","sourceRoot":"","sources":["../src/qualification-evidence-controller.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,wBAAwB,GAAG,QAAQ,CAAC;IAC9C,eAAe,EAAE,MAAM,CAAA;IACvB,YAAY,EAAE,MAAM,CAAA;CACrB,CAAC,CAAA;AAEF,MAAM,MAAM,2BAA2B,GAAG,wBAAwB,GAAG,QAAQ,CAAC;IAC5E,qBAAqB,EAAE,MAAM,CAAA;IAC7B,2BAA2B,EAAE,MAAM,CAAA;IACnC,4BAA4B,EAAE,MAAM,CAAA;CACrC,CAAC,CAAA;AAEF,MAAM,MAAM,4BAA4B,GAAG,QAAQ,CAAC;IAClD,cAAc,EAAE,QAAQ,CAAC;QACvB,gCAAgC,EAAE,MAAM,CAAA;QACxC,uBAAuB,EAAE,MAAM,CAAA;QAC/B,6BAA6B,EAAE,MAAM,CAAA;QACrC,iBAAiB,EAAE,MAAM,CAAA;QACzB,2BAA2B,EAAE,MAAM,CAAA;KACpC,CAAC,CAAA;IACF,2BAA2B,EAAE,MAAM,CAAA;IACnC,aAAa,EAAE,wBAAwB,CAAA;IACvC,QAAQ,EAAE,QAAQ,CAAC;QACjB,SAAS,EAAE,MAAM,CAAA;QACjB,SAAS,EAAE,MAAM,CAAA;QACjB,SAAS,EAAE,iBAAiB,GAAG,WAAW,GAAG,YAAY,GAAG,YAAY,CAAA;QACxE,QAAQ,EAAE,MAAM,CAAA;KACjB,CAAC,CAAA;CACH,CAAC,CAAA;AAEF,MAAM,MAAM,uCAAuC,GAAG,QAAQ,CAAC;IAC7D,WAAW,EAAE,6CAA6C,CAAA;IAC1D,SAAS,EAAE,MAAM,CAAA;IACjB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,iBAAiB,EAAE,MAAM,CAAA;IACzB,gBAAgB,EAAE,MAAM,CAAA;IACxB,iBAAiB,EAAE,MAAM,CAAA;IACzB,2BAA2B,EAAE,MAAM,CAAA;IACnC,6BAA6B,EAAE,MAAM,CAAA;IACrC,kCAAkC,EAAE,MAAM,CAAA;IAC1C,iBAAiB,EAAE,MAAM,CAAA;IACzB,iBAAiB,EAAE,4BAA4B,CAAC,UAAU,CAAC,CAAC,WAAW,CAAC,CAAA;IACxE,SAAS,EAAE,MAAM,CAAA;CAClB,CAAC,CAAA;AAEF,MAAM,MAAM,oCAAoC,GAAG,QAAQ,CAAC;IAC1D,eAAe,EAAE,QAAQ,CAAC;QACxB,OAAO,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,2BAA2B,GAAG,IAAI,CAAC,CAAA;KACtF,CAAC,CAAA;IACF,gBAAgB,EAAE,QAAQ,CAAC;QACzB,yBAAyB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,QAAQ,CAAC;YACjF,iBAAiB,EAAE,MAAM,CAAA;YACzB,sBAAsB,EAAE,MAAM,CAAA;YAC9B,MAAM,EAAE,QAAQ,CAAC;gBACf,eAAe,EAAE,MAAM,CAAA;gBACvB,WAAW,EAAE,MAAM,CAAA;aACpB,CAAC,CAAA;SACH,CAAC,CAAC,CAAA;KACJ,CAAC,CAAA;IACF,MAAM,EAAE,QAAQ,CAAC;QACf,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC;YAC5B,eAAe,EAAE,MAAM,CAAA;YACvB,iBAAiB,EAAE,MAAM,CAAA;YACzB,WAAW,EAAE,MAAM,CAAA;YACnB,qBAAqB,EAAE,MAAM,CAAA;YAC7B,eAAe,EAAE,8BAA8B,CAAA;SAChD,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;KACnB,CAAC,CAAA;IACF,MAAM,EAAE,QAAQ,CAAC;QACf,KAAK,CAAC,OAAO,EAAE,uCAAuC,GAAG,OAAO,CAAC,QAAQ,CAAC;YACxE,gBAAgB,EAAE,MAAM,CAAA;SACzB,CAAC,CAAC,CAAA;KACJ,CAAC,CAAA;IACF,GAAG,IAAI,MAAM,CAAA;CACd,CAAC,CAAA;AAwDF,wBAAgB,qCAAqC,CACnD,KAAK,EAAE,oCAAoC;oBAGnB,4BAA4B;;;;;;;;;;;EA2CrD;AAED,MAAM,MAAM,2BAA2B,GAAG,QAAQ,CAAC;IACjD,iBAAiB,EAAE,MAAM,CAAA;IACzB,qBAAqB,EAAE,MAAM,CAAA;IAC7B,2BAA2B,EAAE,MAAM,CAAA;IACnC,QAAQ,EAAE,WAAW,GAAG,UAAU,GAAG,SAAS,CAAA;IAC9C,oBAAoB,EAAE,MAAM,CAAA;IAC5B,SAAS,EAAE,MAAM,CAAA;CAClB,CAAC,CAAA;AAEF,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAAC;IAChD,iBAAiB,EAAE,MAAM,CAAA;IACzB,MAAM,EAAE,kBAAkB,GAAG,iBAAiB,GAAG,gBAAgB,CAAA;IACjE,oBAAoB,EAAE,MAAM,CAAA;IAC5B,SAAS,EAAE,MAAM,CAAA;CAClB,CAAC,CAAA;AAEF,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,QAAQ,CAAC;IAChB,iBAAiB,EAAE,MAAM,CAAA;IACzB,6BAA6B,EAAE,MAAM,CAAA;IACrC,mCAAmC,EAAE,MAAM,CAAA;CAC5C,CAAC,EACF,QAAQ,EAAE,2BAA2B,GACpC,0BAA0B,CAkB5B;AAED,MAAM,MAAM,iCAAiC,GAAG,QAAQ,CAAC;IACvD,WAAW,EAAE,wCAAwC,CAAA;IACrD,SAAS,EAAE,MAAM,CAAA;IACjB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,iBAAiB,EAAE,MAAM,CAAA;IACzB,gBAAgB,EAAE,MAAM,CAAA;IACxB,iBAAiB,EAAE,MAAM,CAAA;IACzB,MAAM,EAAE,0BAA0B,CAAC,QAAQ,CAAC,CAAA;IAC5C,oBAAoB,EAAE,MAAM,CAAA;IAC5B,SAAS,EAAE,MAAM,CAAA;CAClB,CAAC,CAAA;AAEF,wBAAgB,sCAAsC,CAAC,KAAK,EAAE,QAAQ,CAAC;IACrE,OAAO,EAAE,0BAA0B,CAAA;IACnC,uBAAuB,EAAE,MAAM,CAAA;IAC/B,qBAAqB,EAAE,MAAM,CAAA;IAC7B,oCAAoC,EAAE,MAAM,CAAA;IAC5C,SAAS,EAAE,MAAM,CAAA;CAClB,CAAC,GAAG,iCAAiC,CAarC"}

package/dist/qualification-evidence-controller.js

@@ -0,0 +1,126 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+function requireReference(value, path) {
+    if (value.trim().length === 0)
+        throw new TypeError(`${path} must not be empty`);
+}
+const BASE58BTC_ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
+function decodeBase58btc(value) {
+    let decoded = 0n;
+    for (const character of value) {
+        const index = BASE58BTC_ALPHABET.indexOf(character);
+        if (index < 0)
+            throw new TypeError('Invalid base58btc character');
+        decoded = decoded * 58n + BigInt(index);
+    }
+    const bytes = [];
+    while (decoded > 0n) {
+        bytes.unshift(Number(decoded & 0xffn));
+        decoded >>= 8n;
+    }
+    for (const character of value) {
+        if (character !== '1')
+            break;
+        bytes.unshift(0);
+    }
+    return Uint8Array.from(bytes);
+}
+function assertRawSha3_384CidV1(contentId) {
+    if (!/^z[1-9A-HJ-NP-Za-km-z]+$/u.test(contentId)) {
+        throw new TypeError('evidence.contentId must be a base58btc multibase CID');
+    }
+    const bytes = decodeBase58btc(contentId.slice(1));
+    if (bytes.length !== 52
+        || bytes[0] !== 0x01
+        || bytes[1] !== 0x55
+        || bytes[2] !== 0x15
+        || bytes[3] !== 0x30) {
+        throw new TypeError('evidence.contentId must be CIDv1 raw with a SHA3-384 multihash');
+    }
+}
+function validateRequest(request) {
+    requireReference(request.trustedContext.controllerAuthorizationReference, 'controllerAuthorizationReference');
+    requireReference(request.trustedContext.employerTenantReference, 'employerTenantReference');
+    requireReference(request.trustedContext.employerOrganizationReference, 'employerOrganizationReference');
+    requireReference(request.trustedContext.employeeReference, 'employeeReference');
+    requireReference(request.trustedContext.groupAuthorizationReference, 'groupAuthorizationReference');
+    requireReference(request.qualificationClaimReference, 'qualificationClaimReference');
+    requireReference(request.claimedIssuer.legalIdentifier, 'claimedIssuer.legalIdentifier');
+    requireReference(request.claimedIssuer.jurisdiction, 'claimedIssuer.jurisdiction');
+    requireReference(request.evidence.reference, 'evidence.reference');
+    assertRawSha3_384CidV1(request.evidence.contentId);
+}
+export function createQualificationEvidenceController(ports) {
+    return {
+        async submit(request) {
+            validateRequest(request);
+            const issuer = await ports.issuerDirectory.resolve(request.claimedIssuer);
+            if (!issuer) {
+                return Object.freeze({ phase: 'issuer-not-resolved' });
+            }
+            const recorded = await ports.evidenceRecorder.recordEmployerAttestation(request);
+            await ports.ledger.recordAnchor({
+                anchorReference: recorded.anchor.anchorReference,
+                evidenceReference: recorded.evidenceReference,
+                contentHash: recorded.anchor.contentHash,
+                issuerTenantReference: issuer.issuerTenantReference,
+                lifecycleStatus: 'awaiting-issuer-confirmation',
+            });
+            const message = Object.freeze({
+                messageType: 'qualification-evidence-confirmation-request',
+                messageId: `urn:message:qualification-evidence:${recorded.evidenceReference}`,
+                fromTenantReference: request.trustedContext.employerTenantReference,
+                toTenantReference: issuer.issuerTenantReference,
+                serviceReference: issuer.confirmationServiceReference,
+                evidenceReference: recorded.evidenceReference,
+                qualificationClaimReference: request.qualificationClaimReference,
+                employerOrganizationReference: request.trustedContext.employerOrganizationReference,
+                claimedIssuerOrganizationReference: issuer.issuerOrganizationReference,
+                evidenceContentId: request.evidence.contentId,
+                evidenceMediaType: request.evidence.mediaType,
+                createdAt: ports.now(),
+            });
+            const delivery = await ports.outbox.queue(message);
+            return Object.freeze({
+                phase: 'issuer-confirmation-queued',
+                evidenceReference: recorded.evidenceReference,
+                employerProofReference: recorded.employerProofReference,
+                ledgerAnchorReference: recorded.anchor.anchorReference,
+                issuerTenantReference: issuer.issuerTenantReference,
+                issuerOrganizationReference: issuer.issuerOrganizationReference,
+                requestMessageReference: delivery.messageReference,
+            });
+        },
+    };
+}
+export function applyQualificationIssuerDecision(current, decision) {
+    if (decision.evidenceReference !== current.evidenceReference) {
+        throw new TypeError('Issuer decision evidence does not match');
+    }
+    if (decision.issuerTenantReference !== current.expectedIssuerTenantReference) {
+        throw new TypeError('Issuer tenant does not match');
+    }
+    if (decision.issuerOrganizationReference !== current.expectedIssuerOrganizationReference) {
+        throw new TypeError('Issuer organization does not match');
+    }
+    requireReference(decision.issuerProofReference, 'issuerProofReference');
+    requireReference(decision.decidedAt, 'decidedAt');
+    return Object.freeze({
+        evidenceReference: decision.evidenceReference,
+        status: `issuer-${decision.decision}`,
+        issuerProofReference: decision.issuerProofReference,
+        decidedAt: decision.decidedAt,
+    });
+}
+export function buildQualificationIssuerDecisionNotice(input) {
+    return Object.freeze({
+        messageType: 'qualification-evidence-issuer-decision',
+        messageId: `urn:message:qualification-evidence-decision:${input.outcome.evidenceReference}:${input.outcome.status}`,
+        fromTenantReference: input.issuerTenantReference,
+        toTenantReference: input.employerTenantReference,
+        serviceReference: input.employerNotificationServiceReference,
+        evidenceReference: input.outcome.evidenceReference,
+        status: input.outcome.status,
+        issuerProofReference: input.outcome.issuerProofReference,
+        createdAt: input.createdAt,
+    });
+}

package/package.json

@@ -1,6 +1,39 @@
 {
   "name": "antifraud-sdk-core-ts",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.1",
+  "description": "Runtime-neutral orchestration for identity verification and provider-issued credentials",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "npm run build && node --test test/*.test.mjs",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  },
+  "engines": {
+    "node": ">=24.0.0"
+  },
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/antifraudservices/antifraud-sdk-core-ts.git"
+  },
+  "devDependencies": {
+    "typescript": "^5.9.3"
+  },
+  "dependencies": {
+    "antifraud-data-utils-ts": "0.1.1"
+  }
+}