gdc-common-utils-ts 2.0.16 → 2.0.18

package/dist/utils/legal-organization-verification-result.d.ts

@@ -0,0 +1,37 @@
+export type LegalOrganizationVerificationCredential = Record<string, unknown>;
+export type LegalOrganizationVerificationCredentialPair = Readonly<{
+    verificationEntries: readonly unknown[];
+    organizationCredential: LegalOrganizationVerificationCredential;
+    legalRepresentativeCredential: LegalOrganizationVerificationCredential;
+}>;
+/**
+ * Returns the ICA verification entries currently projected by GW host
+ * legal-organization `_transaction`.
+ *
+ * Supported shapes:
+ * - direct `vc[]` projection on the first response entry
+ * - nested `resource.icaResponse.body.data[]`
+ * - direct ICA `_verify-response` bodies reused in tests/docs
+ */
+export declare function getLegalOrganizationVerificationEntriesFromResponseBody(responseBody: unknown): unknown[];
+/**
+ * Reads the organization and legal-representative credentials returned by the
+ * legal-organization verification flow.
+ */
+export declare function readLegalOrganizationVerificationCredentialPairFromResponseBody(responseBody: unknown): LegalOrganizationVerificationCredentialPair;
+/**
+ * Reads the canonical organization tax id from the verification credential
+ * pair and enforces agreement between organization and representative VC when
+ * both values are present.
+ */
+export declare function readLegalOrganizationVerificationTaxIdFromResponseBody(responseBody: unknown): string;
+/**
+ * Reads `credentialSubject.sameAs` from the legal-representative credential
+ * when present.
+ */
+export declare function readLegalRepresentativeSameAsFromResponseBody(responseBody: unknown): string | undefined;
+/**
+ * Reads `credentialSubject.hasCredential.material` continuity data from the
+ * legal-representative credential when present.
+ */
+export declare function readLegalRepresentativeBindingFromResponseBody(responseBody: unknown): string | undefined;

package/dist/utils/legal-organization-verification-result.js

@@ -0,0 +1,106 @@
+import { extractCredentialSubject, extractOrganizationTaxId, extractRepresentativeCredentialBinding, extractRepresentativeMemberOfTaxId, } from './activation-policy.js';
+function asObject(value) {
+    if (!value || typeof value !== 'object')
+        return undefined;
+    return value;
+}
+function asArray(value) {
+    return Array.isArray(value) ? value : [];
+}
+function findCredentialResource(entries, expectedTypeFragment, fallbackIndex) {
+    const byType = entries.find((entry) => {
+        const candidate = asObject(entry);
+        const typeValue = candidate?.type;
+        const tokens = Array.isArray(typeValue)
+            ? typeValue.map((token) => String(token || ''))
+            : [String(typeValue || '')];
+        return tokens.some((token) => token.includes(expectedTypeFragment));
+    });
+    const selected = asObject(byType) || asObject(entries[fallbackIndex]);
+    const resource = asObject(selected?.resource) || selected;
+    if (!resource) {
+        throw new Error(`Missing '${expectedTypeFragment}' verification credential in legal-organization verification response.`);
+    }
+    return resource;
+}
+/**
+ * Returns the ICA verification entries currently projected by GW host
+ * legal-organization `_transaction`.
+ *
+ * Supported shapes:
+ * - direct `vc[]` projection on the first response entry
+ * - nested `resource.icaResponse.body.data[]`
+ * - direct ICA `_verify-response` bodies reused in tests/docs
+ */
+export function getLegalOrganizationVerificationEntriesFromResponseBody(responseBody) {
+    const root = asObject(responseBody) || {};
+    const topLevelEntries = asArray(root.data);
+    const bodyEntries = asArray(asObject(root.body)?.data);
+    const firstEntry = asObject(bodyEntries[0]) || asObject(topLevelEntries[0]) || {};
+    const projectedCredentials = asArray(firstEntry.vc);
+    if (projectedCredentials.length >= 2) {
+        return projectedCredentials;
+    }
+    const nestedIcaResponse = asObject(asObject(firstEntry.resource)?.icaResponse) || {};
+    const nestedBodyEntries = asArray(asObject(nestedIcaResponse.body)?.data);
+    if (nestedBodyEntries.length >= 2) {
+        return nestedBodyEntries;
+    }
+    const nestedTopLevelEntries = asArray(nestedIcaResponse.data);
+    if (nestedTopLevelEntries.length >= 2) {
+        return nestedTopLevelEntries;
+    }
+    if (bodyEntries.length >= 2) {
+        return bodyEntries;
+    }
+    if (topLevelEntries.length >= 2) {
+        return topLevelEntries;
+    }
+    throw new Error('Legal-organization verification response is missing ICA verification credential entries.');
+}
+/**
+ * Reads the organization and legal-representative credentials returned by the
+ * legal-organization verification flow.
+ */
+export function readLegalOrganizationVerificationCredentialPairFromResponseBody(responseBody) {
+    const verificationEntries = getLegalOrganizationVerificationEntriesFromResponseBody(responseBody);
+    return {
+        verificationEntries,
+        organizationCredential: findCredentialResource(verificationEntries, 'Organization', 0),
+        legalRepresentativeCredential: findCredentialResource(verificationEntries, 'LegalRepresentative', 1),
+    };
+}
+/**
+ * Reads the canonical organization tax id from the verification credential
+ * pair and enforces agreement between organization and representative VC when
+ * both values are present.
+ */
+export function readLegalOrganizationVerificationTaxIdFromResponseBody(responseBody) {
+    const pair = readLegalOrganizationVerificationCredentialPairFromResponseBody(responseBody);
+    const organizationTaxId = extractOrganizationTaxId(pair.organizationCredential);
+    const representativeTaxId = extractRepresentativeMemberOfTaxId(pair.legalRepresentativeCredential);
+    const resolvedTaxId = organizationTaxId || representativeTaxId;
+    if (!resolvedTaxId) {
+        throw new Error('Legal-organization verification response is missing organization tax id in both organization and representative credentials.');
+    }
+    if (organizationTaxId && representativeTaxId && organizationTaxId !== representativeTaxId) {
+        throw new Error('Legal-organization verification response contains mismatched organization tax ids between organization and representative credentials.');
+    }
+    return resolvedTaxId;
+}
+/**
+ * Reads `credentialSubject.sameAs` from the legal-representative credential
+ * when present.
+ */
+export function readLegalRepresentativeSameAsFromResponseBody(responseBody) {
+    const pair = readLegalOrganizationVerificationCredentialPairFromResponseBody(responseBody);
+    return String(extractCredentialSubject(pair.legalRepresentativeCredential)?.sameAs || '').trim() || undefined;
+}
+/**
+ * Reads `credentialSubject.hasCredential.material` continuity data from the
+ * legal-representative credential when present.
+ */
+export function readLegalRepresentativeBindingFromResponseBody(responseBody) {
+    const pair = readLegalOrganizationVerificationCredentialPairFromResponseBody(responseBody);
+    return extractRepresentativeCredentialBinding(pair.legalRepresentativeCredential);
+}

package/dist/utils/organization-authorization-urn.d.ts

@@ -0,0 +1,43 @@
+import type { ClaimsRecord } from '../models/resource-document';
+export type OrganizationAuthorizationUrnInput = Readonly<{
+    identifierType: string;
+    identifierValue: string;
+}>;
+export type MemberAuthorizationUrnInput = Readonly<{
+    organizationUrn?: string;
+    identifierType?: string;
+    identifierValue?: string;
+    memberId: string;
+    /** Optional compatibility input. Role must be persisted separately, not inside the canonical member URN. */
+    roleCode?: string;
+}>;
+/**
+ * Canonical organization authorization identifier used by ledger, consent-like
+ * rules, and inter-tenant authorization persistence.
+ *
+ * Format:
+ * - `urn:org:<identifierType-lowercase>:<identifierValue-as-canonical-input>`
+ *
+ * Examples:
+ * - `urn:org:tax:VATES-B12345678`
+ * - `urn:org:tax:acme-id`
+ */
+export declare function buildOrganizationAuthorizationUrn(input: OrganizationAuthorizationUrnInput): string;
+/**
+ * Accepts either the legacy `TYPE|VALUE` input or an already-canonical
+ * `urn:org:...` identifier and always returns the canonical URN form.
+ */
+export declare function normalizeOrganizationAuthorizationUrn(input: string): string;
+export declare function buildOrganizationAuthorizationUrnFromClaims(claims?: ClaimsRecord): string;
+/**
+ * Canonical member authorization identifier rooted in one canonical
+ * `urn:org:...`.
+ *
+ * Format:
+ * - `urn:org:<type>:<value>:member:<memberId>`
+ *
+ * Important rule:
+ * - role must be stored as a separate claim, not inside the canonical member
+ *   identifier
+ */
+export declare function buildMemberAuthorizationUrn(input: MemberAuthorizationUrnInput): string;

package/dist/utils/organization-authorization-urn.js

@@ -0,0 +1,87 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+import { ClaimsOrganizationSchemaorg } from '../constants/schemaorg.js';
+const ORGANIZATION_URN_PREFIX = 'urn:org:';
+function normalizeTypeSegment(identifierType) {
+    return String(identifierType || '').trim().toLowerCase();
+}
+function normalizeValueSegment(identifierValue) {
+    return String(identifierValue || '').trim();
+}
+/**
+ * Canonical organization authorization identifier used by ledger, consent-like
+ * rules, and inter-tenant authorization persistence.
+ *
+ * Format:
+ * - `urn:org:<identifierType-lowercase>:<identifierValue-as-canonical-input>`
+ *
+ * Examples:
+ * - `urn:org:tax:VATES-B12345678`
+ * - `urn:org:tax:acme-id`
+ */
+export function buildOrganizationAuthorizationUrn(input) {
+    const identifierType = normalizeTypeSegment(input.identifierType);
+    const identifierValue = normalizeValueSegment(input.identifierValue);
+    if (!identifierType || !identifierValue) {
+        throw new Error('Organization authorization URN requires identifierType and identifierValue.');
+    }
+    return `${ORGANIZATION_URN_PREFIX}${identifierType}:${identifierValue}`;
+}
+/**
+ * Accepts either the legacy `TYPE|VALUE` input or an already-canonical
+ * `urn:org:...` identifier and always returns the canonical URN form.
+ */
+export function normalizeOrganizationAuthorizationUrn(input) {
+    const normalized = String(input || '').trim();
+    if (!normalized) {
+        throw new Error('Organization authorization identifier cannot be empty.');
+    }
+    if (normalized.toLowerCase().startsWith(ORGANIZATION_URN_PREFIX)) {
+        const parts = normalized.split(':');
+        const identifierType = String(parts[2] || '').trim();
+        const value = parts.slice(3).join(':').trim();
+        return buildOrganizationAuthorizationUrn({
+            identifierType,
+            identifierValue: value,
+        });
+    }
+    const legacyMatch = normalized.match(/^([^|:]+)\|(.+)$/);
+    if (legacyMatch) {
+        return buildOrganizationAuthorizationUrn({
+            identifierType: legacyMatch[1],
+            identifierValue: legacyMatch[2],
+        });
+    }
+    throw new Error(`Unsupported organization authorization identifier format: ${normalized}`);
+}
+export function buildOrganizationAuthorizationUrnFromClaims(claims) {
+    const identifierType = String(claims?.[ClaimsOrganizationSchemaorg.identifierType] || '').trim();
+    const identifierValue = String(claims?.[ClaimsOrganizationSchemaorg.identifierValue] || '').trim();
+    return buildOrganizationAuthorizationUrn({
+        identifierType,
+        identifierValue,
+    });
+}
+/**
+ * Canonical member authorization identifier rooted in one canonical
+ * `urn:org:...`.
+ *
+ * Format:
+ * - `urn:org:<type>:<value>:member:<memberId>`
+ *
+ * Important rule:
+ * - role must be stored as a separate claim, not inside the canonical member
+ *   identifier
+ */
+export function buildMemberAuthorizationUrn(input) {
+    const organizationUrn = input.organizationUrn
+        ? normalizeOrganizationAuthorizationUrn(input.organizationUrn)
+        : buildOrganizationAuthorizationUrn({
+            identifierType: String(input.identifierType || '').trim(),
+            identifierValue: String(input.identifierValue || '').trim(),
+        });
+    const memberId = String(input.memberId || '').trim();
+    if (!memberId) {
+        throw new Error('Member authorization URN requires memberId.');
+    }
+    return `${organizationUrn}:member:${memberId}`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-common-utils-ts",
-  "version": "2.0.16",
+  "version": "2.0.18",
   "publishConfig": {
     "access": "public"
   },