gdc-common-utils-ts 2.0.16 → 2.0.18

package/dist/utils/bundle-reader.js

@@ -2,6 +2,38 @@ import { getHighestIssueSeverity, isIssueSeverityCode, IssueSeverity, } from '..
 function cloneEntry(value) {
     return JSON.parse(JSON.stringify(value));
 }
+function asRecord(value) {
+    return value && typeof value === 'object' ? value : {};
+}
+/**
+ * Returns the canonical claims view for one bundle entry array index.
+ *
+ * The helper accepts the full bundle-like object plus the entry position to
+ * inspect inside `bundle.data[]` or `bundle.entry[]`.
+ */
+export function getClaimsInBundleEntryAt(bundle, index) {
+    const bundleRecord = asRecord(bundle);
+    const entries = Array.isArray(bundleRecord.data)
+        ? bundleRecord.data
+        : (Array.isArray(bundleRecord.entry) ? bundleRecord.entry : []);
+    if (!Number.isInteger(index) || index < 0 || index >= entries.length) {
+        return {};
+    }
+    const entryRecord = asRecord(entries[index]);
+    const resource = asRecord(entryRecord.resource);
+    const resourceMeta = asRecord(resource.meta);
+    return asRecord(resourceMeta.claims);
+}
+/**
+ * Returns the merged claims view for the first `data[]` or `entry[]` item in a
+ * bundle-like body.
+ *
+ * Use this for the common "one operation, one returned entry" flows when the
+ * caller does not want to manually navigate `body.data[0]`.
+ */
+export function getClaimsInFirstDataEntry(bundle) {
+    return getClaimsInBundleEntryAt(bundle, 0);
+}
 /**
  * Runtime-neutral reader for built or received FHIR-like bundles.
  *
@@ -48,6 +80,17 @@ export class BundleReader {
         }
         return this.resolveEntryIdentifier(entries[index]);
     }
+    /** Returns merged claims for one entry array index. */
+    getEntryClaimsByArrayIndex(index) {
+        return getClaimsInBundleEntryAt(this.bundle, index);
+    }
+    /** Returns merged claims for the currently opened entry. */
+    getActiveEntryClaims() {
+        if (this.activeEntryIndex === null) {
+            throw new Error('BundleReader does not have one active entry. Call openEntry(index) first.');
+        }
+        return this.getEntryClaimsByArrayIndex(this.activeEntryIndex);
+    }
     /** Returns the first entry array index whose resolved identifier matches the requested value. */
     getEntryIndexByIdentifier(identifier) {
         const normalizedIdentifier = normalizeOptionalString(identifier);

package/dist/utils/evidence-blockchain-references.d.ts

@@ -4,6 +4,8 @@ import type { EvidenceObjectDLT } from '../models/oidc4ida.evidence.model.js';
  *
  * Current shared rule:
  * - `z...` multibase base58 references are already public and stable
+ * - `sha3-384:...` references are already blockchain-safe and must pass
+ *   through unchanged
  * - any other identifier-like value is SHA3-384 hashed before persistence
  */
 export declare function sanitizeBlockchainReference(value: unknown): string | undefined;

package/dist/utils/evidence-blockchain-references.js

@@ -5,6 +5,8 @@ const SHA3_384_PREFIX = 'sha3-384:';
  *
  * Current shared rule:
  * - `z...` multibase base58 references are already public and stable
+ * - `sha3-384:...` references are already blockchain-safe and must pass
+ *   through unchanged
  * - any other identifier-like value is SHA3-384 hashed before persistence
  */
 export function sanitizeBlockchainReference(value) {
@@ -13,6 +15,8 @@ export function sanitizeBlockchainReference(value) {
         return undefined;
     if (/^z[1-9A-HJ-NP-Za-km-z]+$/.test(normalized))
         return normalized;
+    if (/^sha3-384:[a-f0-9]{96}$/i.test(normalized))
+        return normalized;
     return `${SHA3_384_PREFIX}${createHash('sha3-384').update(normalized, 'utf8').digest('hex')}`;
 }
 /**

package/dist/utils/gw-core-commercial-contract.d.ts

@@ -0,0 +1,41 @@
+import { ClaimsOfferSchemaorg, ClaimsOrderSchemaorg } from '../constants/schemaorg';
+/**
+ * Canonical GW CORE onboarding/reissue flow identifiers for commercial
+ * expectations.
+ *
+ * These identifiers are intentionally flow-level, not transport-level:
+ * - they describe whether one GW response is expected to mint a commercial
+ *   Offer and whether a follow-up `Order/_batch` step is part of the contract
+ * - they do not describe how the caller reached the flow (PDF, ICA proof,
+ *   signed bundle, SDK facade, etc.)
+ */
+export declare const GwCoreCommercialFlow: Readonly<{
+    readonly LegalOrganizationTransaction: "legal-organization-transaction";
+    readonly LegalOrganizationActivateLegacy: "legal-organization-activate-legacy";
+    readonly LegalOrganizationIssueReissue: "legal-organization-issue-reissue";
+    readonly IndividualOrganizationCommercial: "individual-organization-commercial";
+    readonly IndividualOrganizationEmbeddedRegistration: "individual-organization-embedded-registration";
+}>;
+export type GwCoreCommercialFlow = typeof GwCoreCommercialFlow[keyof typeof GwCoreCommercialFlow];
+export type GwCoreCommercialContract = Readonly<{
+    flow: GwCoreCommercialFlow;
+    mintsOffer: boolean;
+    requiresOrderConfirmation: boolean;
+    offerClaim?: typeof ClaimsOfferSchemaorg.identifier;
+    orderClaim?: typeof ClaimsOrderSchemaorg.acceptedOfferIdentifier;
+    programmingHint: string;
+}>;
+/**
+ * Shared commercial contract table for the GW CORE onboarding/reissue flows
+ * that currently matter to SDKs, BFFs and route-level tests.
+ *
+ * Reading guide:
+ * - `mintsOffer=true` means the response is expected to expose the canonical
+ *   commercial claim in `meta.claims['org.schema.Offer.identifier']`
+ * - `requiresOrderConfirmation=true` means the caller must later submit
+ *   `Order.acceptedOffer.identifier` through `Order/_batch`
+ * - `mintsOffer=false` means the flow is not expected to create a new
+ *   commercial Offer, even if it returns activation material or other claims
+ */
+export declare const GW_CORE_COMMERCIAL_CONTRACTS: Readonly<Record<GwCoreCommercialFlow, GwCoreCommercialContract>>;
+export declare function readGwCoreCommercialContract(flow: GwCoreCommercialFlow): GwCoreCommercialContract;

package/dist/utils/gw-core-commercial-contract.js

@@ -0,0 +1,71 @@
+import { ClaimsOfferSchemaorg, ClaimsOrderSchemaorg } from '../constants/schemaorg.js';
+/**
+ * Canonical GW CORE onboarding/reissue flow identifiers for commercial
+ * expectations.
+ *
+ * These identifiers are intentionally flow-level, not transport-level:
+ * - they describe whether one GW response is expected to mint a commercial
+ *   Offer and whether a follow-up `Order/_batch` step is part of the contract
+ * - they do not describe how the caller reached the flow (PDF, ICA proof,
+ *   signed bundle, SDK facade, etc.)
+ */
+export const GwCoreCommercialFlow = Object.freeze({
+    LegalOrganizationTransaction: 'legal-organization-transaction',
+    LegalOrganizationActivateLegacy: 'legal-organization-activate-legacy',
+    LegalOrganizationIssueReissue: 'legal-organization-issue-reissue',
+    IndividualOrganizationCommercial: 'individual-organization-commercial',
+    IndividualOrganizationEmbeddedRegistration: 'individual-organization-embedded-registration',
+});
+/**
+ * Shared commercial contract table for the GW CORE onboarding/reissue flows
+ * that currently matter to SDKs, BFFs and route-level tests.
+ *
+ * Reading guide:
+ * - `mintsOffer=true` means the response is expected to expose the canonical
+ *   commercial claim in `meta.claims['org.schema.Offer.identifier']`
+ * - `requiresOrderConfirmation=true` means the caller must later submit
+ *   `Order.acceptedOffer.identifier` through `Order/_batch`
+ * - `mintsOffer=false` means the flow is not expected to create a new
+ *   commercial Offer, even if it returns activation material or other claims
+ */
+export const GW_CORE_COMMERCIAL_CONTRACTS = Object.freeze({
+    [GwCoreCommercialFlow.LegalOrganizationTransaction]: {
+        flow: GwCoreCommercialFlow.LegalOrganizationTransaction,
+        mintsOffer: true,
+        requiresOrderConfirmation: true,
+        offerClaim: ClaimsOfferSchemaorg.identifier,
+        orderClaim: ClaimsOrderSchemaorg.acceptedOfferIdentifier,
+        programmingHint: 'Use this for first-time legal organization onboarding; read meta.claims[org.schema.Offer.identifier] and then confirm Order/_batch.',
+    },
+    [GwCoreCommercialFlow.LegalOrganizationActivateLegacy]: {
+        flow: GwCoreCommercialFlow.LegalOrganizationActivateLegacy,
+        mintsOffer: true,
+        requiresOrderConfirmation: true,
+        offerClaim: ClaimsOfferSchemaorg.identifier,
+        orderClaim: ClaimsOrderSchemaorg.acceptedOfferIdentifier,
+        programmingHint: 'Legacy ICA-proof activation still mints one commercial Offer and still requires Order/_batch confirmation.',
+    },
+    [GwCoreCommercialFlow.LegalOrganizationIssueReissue]: {
+        flow: GwCoreCommercialFlow.LegalOrganizationIssueReissue,
+        mintsOffer: false,
+        requiresOrderConfirmation: false,
+        programmingHint: 'Use this only to reissue controller activation material for an already existing tenant; do not expect a new Offer or Order step.',
+    },
+    [GwCoreCommercialFlow.IndividualOrganizationCommercial]: {
+        flow: GwCoreCommercialFlow.IndividualOrganizationCommercial,
+        mintsOffer: true,
+        requiresOrderConfirmation: true,
+        offerClaim: ClaimsOfferSchemaorg.identifier,
+        orderClaim: ClaimsOrderSchemaorg.acceptedOfferIdentifier,
+        programmingHint: 'Use this for the family/individual commercial bootstrap facade that returns one Offer and then requires Order/_batch.',
+    },
+    [GwCoreCommercialFlow.IndividualOrganizationEmbeddedRegistration]: {
+        flow: GwCoreCommercialFlow.IndividualOrganizationEmbeddedRegistration,
+        mintsOffer: false,
+        requiresOrderConfirmation: false,
+        programmingHint: 'Use this only for embedded legacy subject registration inside an already active tenant; it signals status but does not mint a commercial Offer.',
+    },
+});
+export function readGwCoreCommercialContract(flow) {
+    return GW_CORE_COMMERCIAL_CONTRACTS[flow];
+}

package/dist/utils/index.d.ts

@@ -31,6 +31,8 @@ export * from './fhir-cid';
 export * from './fhir-search';
 export * from './family-organization-summary';
 export * from './gw-core-path';
+export * from './gw-core-commercial-contract';
+export * from './legal-organization-verification-result';
 export * from './communication-fhir-r4';
 export * from './communication-document-reference';
 export * from './communication-bundle-document-request';
@@ -52,9 +54,11 @@ export * from './fhir-validator';
 export * from './family-registration-test-data';
 export * from './individual-form-pdf';
 export * from './individual-organization-claims';
+export * from './inter-tenant-access-contract';
 export * from './legal-organization-onboarding-editor';
 export * from './organization-lifecycle';
 export * from './organization-did-binding';
+export * from './organization-authorization-urn';
 export * from './individual-organization-lifecycle';
 export * from './individual-onboarding-editor';
 export * from './individual-onboarding-document-reference';

package/dist/utils/index.js

@@ -31,6 +31,8 @@ export * from './fhir-cid.js';
 export * from './fhir-search.js';
 export * from './family-organization-summary.js';
 export * from './gw-core-path.js';
+export * from './gw-core-commercial-contract.js';
+export * from './legal-organization-verification-result.js';
 export * from './communication-fhir-r4.js';
 export * from './communication-document-reference.js';
 export * from './communication-bundle-document-request.js';
@@ -52,9 +54,11 @@ export * from './fhir-validator.js';
 export * from './family-registration-test-data.js';
 export * from './individual-form-pdf.js';
 export * from './individual-organization-claims.js';
+export * from './inter-tenant-access-contract.js';
 export * from './legal-organization-onboarding-editor.js';
 export * from './organization-lifecycle.js';
 export * from './organization-did-binding.js';
+export * from './organization-authorization-urn.js';
 export * from './individual-organization-lifecycle.js';
 export * from './individual-onboarding-editor.js';
 export * from './individual-onboarding-document-reference.js';

package/dist/utils/inter-tenant-access-contract.d.ts

@@ -0,0 +1,44 @@
+import type { InterTenantAccessContractClaims, InterTenantContractAuthorizationConsentCriteria, InterTenantAccessContractMatchCriteria, InterTenantAccessContractSummary } from '../models/inter-tenant-access-contract';
+import type { VerifiableCredentialV2 } from '../models/verifiable-credential';
+type ContractLike = Record<string, any>;
+export declare function buildInterTenantAccessContractResource(claims: InterTenantAccessContractClaims): ContractLike;
+export declare function buildInterTenantAccessContractCredential(input: Readonly<{
+    claims: InterTenantAccessContractClaims;
+    issuer: string;
+    validFrom: string;
+    validUntil?: string;
+    additionalCredential?: Record<string, unknown>;
+}>): VerifiableCredentialV2;
+export declare function summarizeInterTenantAccessContract(credential: unknown): InterTenantAccessContractSummary | undefined;
+export declare function isInterTenantAccessContractActive(summary: InterTenantAccessContractSummary | undefined, options?: Readonly<{
+    now?: string | Date;
+}>): boolean;
+export declare function matchesInterTenantAccessContract(summary: InterTenantAccessContractSummary | undefined, criteria: InterTenantAccessContractMatchCriteria): boolean;
+export declare function getMatchingInterTenantAccessContractFromVpToken(vpToken: string, criteria: InterTenantAccessContractMatchCriteria): Record<string, unknown> | undefined;
+/**
+ * Returns the public blockchain-safe reference that a reused consent-style
+ * authorization rule should store under `Consent.source-reference` when it
+ * delegates use of one inter-tenant contract VC to an employee/researcher.
+ *
+ * Source-of-truth order:
+ * - VC `id`
+ * - FHIR `Contract.identifier`
+ *
+ * In both cases the reference is normalized through the same blockchain-safe
+ * sanitization rule already used by consent-access assets.
+ */
+export declare function getInterTenantAccessContractBlockchainReference(credential: unknown): string | undefined;
+/**
+ * Evaluates one consent-style rule reused as an organization-to-employee
+ * delegation for inter-tenant contract usage.
+ *
+ * Shared semantic contract:
+ * - `Consent.subject` = consumer organization DID
+ * - `Consent.actor-identifier` = delegated employee/researcher identifier
+ * - `Consent.action` = allowed capabilities/scopes
+ * - `Consent.purpose` = allowed purpose
+ * - `Consent.source-reference` = blockchain-safe hash/reference of the
+ *   underlying contract VC
+ */
+export declare function matchesInterTenantContractAuthorizationConsentRule(rule: Record<string, unknown>, contractCredential: unknown, criteria: InterTenantContractAuthorizationConsentCriteria): boolean;
+export {};

package/dist/utils/inter-tenant-access-contract.js

@@ -0,0 +1,358 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+import { ContractCredentialTypes, W3cCredentialContexts, W3cCredentialTypes } from '../constants/verifiable-credentials.js';
+import { ClaimConsent } from '../models/consent-rule.js';
+import { ClaimInterTenantAccessContract } from '../models/inter-tenant-access-contract.js';
+import { sanitizeBlockchainReference } from './evidence-blockchain-references.js';
+import { getVpCredentials } from './vp-token.js';
+const ACTIVE_CONTRACT_STATUSES = new Set(['executed', 'amended', 'appended']);
+const PROVIDER_ROLE = 'provider';
+const CONSUMER_ROLE = 'consumer';
+const PROVIDER_CONTROLLER_ROLE = 'provider-controller';
+const CONSUMER_CONTROLLER_ROLE = 'consumer-controller';
+function splitCsv(value) {
+    return Array.from(new Set(String(value || '')
+        .split(',')
+        .map((item) => item.trim())
+        .filter(Boolean)));
+}
+function readClaimWithAliases(claims, canonicalKey, aliases = []) {
+    const direct = String(claims[canonicalKey] || '').trim();
+    if (direct)
+        return direct;
+    for (const alias of aliases) {
+        const value = String(claims[alias] || '').trim();
+        if (value)
+            return value;
+    }
+    return undefined;
+}
+function firstIdentifierValue(input) {
+    if (Array.isArray(input)) {
+        for (const candidate of input) {
+            const found = firstIdentifierValue(candidate);
+            if (found)
+                return found;
+        }
+        return undefined;
+    }
+    if (!input || typeof input !== 'object')
+        return undefined;
+    const direct = String(input.value || input.id || '').trim();
+    return direct || undefined;
+}
+function extractRoleTexts(input) {
+    const items = Array.isArray(input) ? input : input ? [input] : [];
+    return items
+        .flatMap((item) => {
+        if (!item || typeof item !== 'object')
+            return [];
+        const text = String(item.text || '').trim();
+        const codingItems = Array.isArray(item.coding) ? item.coding : item.coding ? [item.coding] : [];
+        const codingValues = codingItems
+            .map((coding) => String(coding?.code || coding?.display || '').trim())
+            .filter(Boolean);
+        return [text, ...codingValues].filter(Boolean);
+    });
+}
+function extractCapabilityValues(input) {
+    const items = Array.isArray(input) ? input : input ? [input] : [];
+    return Array.from(new Set(items.flatMap((item) => {
+        if (!item || typeof item !== 'object')
+            return [];
+        const text = String(item.text || '').trim();
+        const codingItems = Array.isArray(item.coding) ? item.coding : item.coding ? [item.coding] : [];
+        const codingValues = codingItems
+            .map((coding) => String(coding?.code || coding?.display || '').trim())
+            .filter(Boolean);
+        return [text, ...codingValues].flatMap((value) => splitCsv(value));
+    })));
+}
+function extractOfferPartyReference(contract, expectedRole) {
+    const terms = Array.isArray(contract.term) ? contract.term : contract.term ? [contract.term] : [];
+    for (const term of terms) {
+        const parties = Array.isArray(term?.offer?.party) ? term.offer.party : term?.offer?.party ? [term.offer.party] : [];
+        for (const party of parties) {
+            const roleTexts = extractRoleTexts(party?.role).map((value) => value.toLowerCase());
+            if (!roleTexts.includes(expectedRole))
+                continue;
+            const reference = String(party?.reference?.reference || party?.reference || '').trim();
+            if (reference)
+                return reference;
+        }
+    }
+    return undefined;
+}
+function extractSignerReference(contract, expectedRole) {
+    const signers = Array.isArray(contract.signer) ? contract.signer : contract.signer ? [contract.signer] : [];
+    for (const signer of signers) {
+        const roleTexts = extractRoleTexts(signer?.type).map((value) => value.toLowerCase());
+        if (!roleTexts.includes(expectedRole))
+            continue;
+        const reference = String(signer?.party?.reference || signer?.party?.identifier?.value || '').trim();
+        if (reference)
+            return reference;
+    }
+    return undefined;
+}
+function extractPurposes(contract) {
+    const terms = Array.isArray(contract.term) ? contract.term : contract.term ? [contract.term] : [];
+    return Array.from(new Set(terms.flatMap((term) => {
+        const typeItems = Array.isArray(term?.type) ? term.type : term?.type ? [term.type] : [];
+        return typeItems.flatMap((item) => {
+            if (!item || typeof item !== 'object')
+                return [];
+            const text = String(item.text || '').trim();
+            const codingItems = Array.isArray(item.coding) ? item.coding : item.coding ? [item.coding] : [];
+            const codingValues = codingItems
+                .map((coding) => String(coding?.code || coding?.display || '').trim())
+                .filter(Boolean);
+            return [text, ...codingValues].flatMap((value) => splitCsv(value));
+        });
+    })));
+}
+function extractCapabilities(contract) {
+    const terms = Array.isArray(contract.term) ? contract.term : contract.term ? [contract.term] : [];
+    return Array.from(new Set(terms.flatMap((term) => extractCapabilityValues(term?.offer?.securityLabel))));
+}
+function normalizeNow(input) {
+    if (input instanceof Date)
+        return input.getTime();
+    if (input)
+        return new Date(input).getTime();
+    return Date.now();
+}
+export function buildInterTenantAccessContractResource(claims) {
+    const identifier = readClaimWithAliases(claims, ClaimInterTenantAccessContract.identifier) || '';
+    const status = readClaimWithAliases(claims, ClaimInterTenantAccessContract.status) || 'executed';
+    const issued = readClaimWithAliases(claims, ClaimInterTenantAccessContract.issued) || '';
+    const appliesStart = readClaimWithAliases(claims, ClaimInterTenantAccessContract.appliesStart, ['Contract.applies.start']) || '';
+    const appliesEnd = readClaimWithAliases(claims, ClaimInterTenantAccessContract.appliesEnd, ['Contract.applies.end']) || '';
+    const providerOrganization = readClaimWithAliases(claims, ClaimInterTenantAccessContract.providerOrganization, ['Contract.term.offer.party.provider']) || '';
+    const consumerOrganization = readClaimWithAliases(claims, ClaimInterTenantAccessContract.consumerOrganization, ['Contract.term.offer.party.consumer']) || '';
+    const providerController = readClaimWithAliases(claims, ClaimInterTenantAccessContract.providerController, ['Contract.signer.provider']) || '';
+    const consumerController = readClaimWithAliases(claims, ClaimInterTenantAccessContract.consumerController, ['Contract.signer.consumer']) || '';
+    const instantiatesUri = readClaimWithAliases(claims, ClaimInterTenantAccessContract.instantiatesUri, ['Contract.instantiatesUri']) || '';
+    const capabilities = splitCsv(readClaimWithAliases(claims, ClaimInterTenantAccessContract.capability, ['Contract.term.offer.securityLabel']));
+    const purposes = splitCsv(readClaimWithAliases(claims, ClaimInterTenantAccessContract.purpose, ['Contract.term.type']));
+    return {
+        resourceType: 'Contract',
+        id: identifier || undefined,
+        identifier: identifier ? [{ value: identifier }] : undefined,
+        status,
+        issued: issued || undefined,
+        instantiatesUri: instantiatesUri || undefined,
+        applies: {
+            ...(appliesStart ? { start: appliesStart } : {}),
+            ...(appliesEnd ? { end: appliesEnd } : {}),
+        },
+        signer: [
+            providerController
+                ? {
+                    type: [{ text: PROVIDER_CONTROLLER_ROLE }],
+                    party: { reference: providerController },
+                }
+                : undefined,
+            consumerController
+                ? {
+                    type: [{ text: CONSUMER_CONTROLLER_ROLE }],
+                    party: { reference: consumerController },
+                }
+                : undefined,
+        ].filter(Boolean),
+        term: [{
+                type: purposes.map((purpose) => ({ text: purpose })),
+                offer: {
+                    party: [
+                        providerOrganization
+                            ? {
+                                reference: { reference: providerOrganization },
+                                role: [{ text: PROVIDER_ROLE }],
+                            }
+                            : undefined,
+                        consumerOrganization
+                            ? {
+                                reference: { reference: consumerOrganization },
+                                role: [{ text: CONSUMER_ROLE }],
+                            }
+                            : undefined,
+                    ].filter(Boolean),
+                    securityLabel: capabilities.map((capability) => ({ text: capability })),
+                },
+            }],
+    };
+}
+export function buildInterTenantAccessContractCredential(input) {
+    return {
+        '@context': [W3cCredentialContexts.V2],
+        type: [
+            W3cCredentialTypes.VerifiableCredential,
+            ContractCredentialTypes.InterTenantAccessContractCredential,
+        ],
+        issuer: String(input.issuer || '').trim(),
+        validFrom: String(input.validFrom || '').trim(),
+        ...(input.validUntil ? { validUntil: String(input.validUntil).trim() } : {}),
+        credentialSubject: buildInterTenantAccessContractResource(input.claims),
+        ...(input.additionalCredential || {}),
+    };
+}
+export function summarizeInterTenantAccessContract(credential) {
+    if (!credential || typeof credential !== 'object')
+        return undefined;
+    const typeRaw = Array.isArray(credential.type) ? credential.type : [credential.type].filter(Boolean);
+    if (!typeRaw.includes(ContractCredentialTypes.InterTenantAccessContractCredential))
+        return undefined;
+    const subject = (credential.credentialSubject || {});
+    if (String(subject.resourceType || '').trim() !== 'Contract')
+        return undefined;
+    return {
+        identifier: firstIdentifierValue(subject.identifier) || String(subject.id || '').trim() || undefined,
+        status: String(subject.status || '').trim() || undefined,
+        issued: String(subject.issued || '').trim() || undefined,
+        appliesStart: String(subject.applies?.start || '').trim() || undefined,
+        appliesEnd: String(subject.applies?.end || '').trim() || undefined,
+        providerOrganizationDid: extractOfferPartyReference(subject, PROVIDER_ROLE),
+        consumerOrganizationDid: extractOfferPartyReference(subject, CONSUMER_ROLE),
+        providerControllerDid: extractSignerReference(subject, PROVIDER_CONTROLLER_ROLE),
+        consumerControllerDid: extractSignerReference(subject, CONSUMER_CONTROLLER_ROLE),
+        capabilities: extractCapabilities(subject),
+        purposes: extractPurposes(subject),
+    };
+}
+export function isInterTenantAccessContractActive(summary, options = {}) {
+    if (!summary)
+        return false;
+    const status = String(summary.status || '').trim().toLowerCase();
+    if (!ACTIVE_CONTRACT_STATUSES.has(status))
+        return false;
+    const nowMs = normalizeNow(options.now);
+    const startMs = summary.appliesStart ? Date.parse(summary.appliesStart) : NaN;
+    const endMs = summary.appliesEnd ? Date.parse(summary.appliesEnd) : NaN;
+    if (!Number.isNaN(startMs) && startMs > nowMs)
+        return false;
+    if (!Number.isNaN(endMs) && endMs < nowMs)
+        return false;
+    return true;
+}
+export function matchesInterTenantAccessContract(summary, criteria) {
+    if (!isInterTenantAccessContractActive(summary, { now: criteria.now }))
+        return false;
+    if (String(summary?.providerOrganizationDid || '').trim() !== String(criteria.providerOrganizationDid || '').trim())
+        return false;
+    if (String(summary?.consumerOrganizationDid || '').trim() !== String(criteria.consumerOrganizationDid || '').trim())
+        return false;
+    const requiredCapabilities = Array.from(new Set((criteria.requiredCapabilities || []).map((value) => String(value || '').trim()).filter(Boolean)));
+    if (requiredCapabilities.length > 0) {
+        const contractCapabilities = new Set((summary?.capabilities || []).map((value) => String(value || '').trim()));
+        if (!requiredCapabilities.every((value) => contractCapabilities.has(value)))
+            return false;
+    }
+    const purpose = String(criteria.purpose || '').trim();
+    if (purpose) {
+        const contractPurposes = new Set((summary?.purposes || []).map((value) => String(value || '').trim()));
+        if (contractPurposes.size > 0 && !contractPurposes.has(purpose))
+            return false;
+    }
+    return true;
+}
+export function getMatchingInterTenantAccessContractFromVpToken(vpToken, criteria) {
+    const credentials = getVpCredentials(vpToken);
+    return credentials.find((credential) => matchesInterTenantAccessContract(summarizeInterTenantAccessContract(credential), criteria));
+}
+function splitClaimCsv(value) {
+    return Array.from(new Set(String(value || '')
+        .split(',')
+        .map((item) => item.trim())
+        .filter(Boolean)));
+}
+function isConsentLikeRuleActive(rule, now) {
+    const nowMs = normalizeNow(now);
+    const startMs = Date.parse(String(rule[ClaimConsent.periodStart] || '').trim());
+    const endMs = Date.parse(String(rule[ClaimConsent.periodEnd] || '').trim());
+    if (!Number.isNaN(startMs) && startMs > nowMs)
+        return false;
+    if (!Number.isNaN(endMs) && endMs < nowMs)
+        return false;
+    return true;
+}
+/**
+ * Returns the public blockchain-safe reference that a reused consent-style
+ * authorization rule should store under `Consent.source-reference` when it
+ * delegates use of one inter-tenant contract VC to an employee/researcher.
+ *
+ * Source-of-truth order:
+ * - VC `id`
+ * - FHIR `Contract.identifier`
+ *
+ * In both cases the reference is normalized through the same blockchain-safe
+ * sanitization rule already used by consent-access assets.
+ */
+export function getInterTenantAccessContractBlockchainReference(credential) {
+    if (!credential || typeof credential !== 'object')
+        return undefined;
+    const vcId = sanitizeBlockchainReference(credential.id);
+    if (vcId)
+        return vcId;
+    const summary = summarizeInterTenantAccessContract(credential);
+    return sanitizeBlockchainReference(summary?.identifier);
+}
+/**
+ * Evaluates one consent-style rule reused as an organization-to-employee
+ * delegation for inter-tenant contract usage.
+ *
+ * Shared semantic contract:
+ * - `Consent.subject` = consumer organization DID
+ * - `Consent.actor-identifier` = delegated employee/researcher identifier
+ * - `Consent.action` = allowed capabilities/scopes
+ * - `Consent.purpose` = allowed purpose
+ * - `Consent.source-reference` = blockchain-safe hash/reference of the
+ *   underlying contract VC
+ */
+export function matchesInterTenantContractAuthorizationConsentRule(rule, contractCredential, criteria) {
+    const summary = summarizeInterTenantAccessContract(contractCredential);
+    if (!isInterTenantAccessContractActive(summary, { now: criteria.now })) {
+        return false;
+    }
+    if (String(rule[ClaimConsent.decision] || '').trim() !== 'permit')
+        return false;
+    if (!isConsentLikeRuleActive(rule, criteria.now))
+        return false;
+    if (String(rule[ClaimConsent.subject] || '').trim() !== String(criteria.consumerOrganizationDid || '').trim())
+        return false;
+    if (String(rule[ClaimConsent.actorIdentifier] || '').trim() !== String(criteria.actorIdentifier || '').trim())
+        return false;
+    const expectedReference = getInterTenantAccessContractBlockchainReference(contractCredential);
+    const ruleReference = String(rule[ClaimConsent.sourceReference]
+        || rule[ClaimConsent.eventBasedOn]
+        || '').trim();
+    if (!expectedReference || ruleReference !== expectedReference)
+        return false;
+    const purpose = String(criteria.purpose || '').trim();
+    if (purpose) {
+        const rulePurpose = String(rule[ClaimConsent.purpose] || '').trim();
+        if (rulePurpose && rulePurpose !== purpose)
+            return false;
+    }
+    const actorRole = String(criteria.actorRole || '').trim();
+    if (actorRole) {
+        const allowedRoles = splitClaimCsv(rule[ClaimConsent.actorRole]);
+        if (allowedRoles.length > 0 && !allowedRoles.includes(actorRole))
+            return false;
+    }
+    const requiredCapabilities = Array.from(new Set((criteria.requiredCapabilities || []).map((value) => String(value || '').trim()).filter(Boolean)));
+    if (requiredCapabilities.length > 0) {
+        const allowedCapabilities = new Set(splitClaimCsv(rule[ClaimConsent.action]));
+        if (!requiredCapabilities.every((value) => allowedCapabilities.has(value) || allowedCapabilities.has('*')))
+            return false;
+    }
+    if (requiredCapabilities.length > 0) {
+        const contractCapabilities = new Set((summary?.capabilities || []).map((value) => String(value || '').trim()));
+        if (!requiredCapabilities.every((value) => contractCapabilities.has(value)))
+            return false;
+    }
+    if (purpose) {
+        const contractPurposes = new Set((summary?.purposes || []).map((value) => String(value || '').trim()));
+        if (contractPurposes.size > 0 && !contractPurposes.has(purpose))
+            return false;
+    }
+    return true;
+}