gdc-common-utils-ts 2.0.17 → 2.0.18

package/dist/constants/verifiable-credentials.d.ts

@@ -36,5 +36,12 @@ export declare const ActivationCredentialTypes: Readonly<{
 export declare const ProfessionalCredentialTypes: Readonly<{
     EmployeeCredential: "EmployeeCredential";
 }>;
+/**
+ * Canonical credential subtype names used by inter-tenant authorization
+ * contracts for cross-organization access.
+ */
+export declare const ContractCredentialTypes: Readonly<{
+    InterTenantAccessContractCredential: "InterTenantAccessContractCredential";
+}>;
 export declare const ORGANIZATION_ACTIVATION_VC_TYPES: readonly ("OrganizationCredential" | "LegalOrganizationCredential")[];
 export declare const REPRESENTATIVE_ACTIVATION_VC_TYPES: readonly ("LegalRepresentativeCredential" | "PersonCredential")[];

package/dist/constants/verifiable-credentials.js

@@ -38,6 +38,13 @@ export const ActivationCredentialTypes = Object.freeze({
 export const ProfessionalCredentialTypes = Object.freeze({
     EmployeeCredential: 'EmployeeCredential',
 });
+/**
+ * Canonical credential subtype names used by inter-tenant authorization
+ * contracts for cross-organization access.
+ */
+export const ContractCredentialTypes = Object.freeze({
+    InterTenantAccessContractCredential: 'InterTenantAccessContractCredential',
+});
 export const ORGANIZATION_ACTIVATION_VC_TYPES = Object.freeze([
     ActivationCredentialTypes.OrganizationCredential,
     ActivationCredentialTypes.LegalOrganizationCredential,

package/dist/examples/contract-examples.d.ts

@@ -8,6 +8,7 @@
 export * from './shared';
 export * from './ica-activation-proof';
 export * from './organization-controller';
+export * from './inter-tenant-access-contract';
 export * from './individual-controller';
 export * from './professional';
 export * from './related-person';

package/dist/examples/contract-examples.js

@@ -9,6 +9,7 @@
 export * from './shared.js';
 export * from './ica-activation-proof.js';
 export * from './organization-controller.js';
+export * from './inter-tenant-access-contract.js';
 export * from './individual-controller.js';
 export * from './professional.js';
 export * from './related-person.js';

package/dist/examples/index.d.ts

@@ -10,6 +10,7 @@ export * from './professional';
 export * from './employee';
 export * from './license';
 export * from './invoice';
+export * from './inter-tenant-access-contract';
 export * from './related-person';
 export * from './consent-access';
 export * from './relationship-access';

package/dist/examples/index.js

@@ -10,6 +10,7 @@ export * from './professional.js';
 export * from './employee.js';
 export * from './license.js';
 export * from './invoice.js';
+export * from './inter-tenant-access-contract.js';
 export * from './related-person.js';
 export * from './consent-access.js';
 export * from './relationship-access.js';

package/dist/examples/inter-tenant-access-contract.d.ts

@@ -0,0 +1,124 @@
+/**
+ * Shared synthetic inter-tenant contract fixtures reused by GW and SDK tests.
+ *
+ * Scenario:
+ * - `acme-id` is the clinical provider tenant in `health-care`
+ * - `lab-id` is the research tenant in `health-research`
+ * - both are assumed to be hosted by the same operator for the current scope
+ *
+ * Programmer hints:
+ * - provider = the tenant that owns/exposes the data
+ * - consumer = the foreign tenant asking for access
+ * - capability = the allowed technical scope, for example
+ *   `organization/Composition.rs`
+ * - purpose = the allowed business/legal reason, for example `RESEARCH`
+ * - instantiates-uri = primary agreement artifact URL/CID, typically the
+ *   signed PDF of the contract itself
+ * - invoice/payment evidence is intentionally not modeled as a mandatory core
+ *   field in this first inter-tenant fixture
+ */
+export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_ID: "urn:uuid:inter-tenant-access-contract-001";
+export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_VALID_FROM: "2026-06-29T00:00:00.000Z";
+export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_VALID_UNTIL: "2027-06-29T00:00:00.000Z";
+export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_PURPOSE: "RESEARCH";
+export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_SCOPE: "organization/Composition.rs";
+export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_SUBJECT_DID: "did:web:api.acme.org:individual:123";
+export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_SECTION: "LOINC|48765-2";
+export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_AGREEMENT_PDF_URL: "https://portal.example.org/files/contracts/inter-tenant-contract-acme-lab-001.pdf";
+export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CONSUMER_PROFESSIONAL_DID: "did:web:api.lab.org:employee:researcher1@lab.org:ISCO-08|2211";
+export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_SMART_SCOPE: "organization/Composition.rs?subject=did:web:api.acme.org:individual:123&section=LOINC|48765-2";
+export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CLAIMS: Readonly<{
+    readonly "Contract.identifier": "urn:uuid:inter-tenant-access-contract-001";
+    readonly "Contract.status": "executed";
+    readonly "Contract.issued": "2026-06-29T00:00:00.000Z";
+    readonly "Contract.applies-start": "2026-06-29T00:00:00.000Z";
+    readonly "Contract.applies-end": "2027-06-29T00:00:00.000Z";
+    readonly "Contract.provider-organization": "did:web:api.acme.org";
+    readonly "Contract.consumer-organization": "did:web:api.lab.org";
+    readonly "Contract.provider-controller": "did:web:people.acme.org:controllers:primary";
+    readonly "Contract.consumer-controller": "did:web:people.lab.org:controllers:primary";
+    readonly "Contract.security-label": "organization/Composition.rs";
+    readonly "Contract.term-type": "RESEARCH";
+    readonly "Contract.instantiates-uri": "https://portal.example.org/files/contracts/inter-tenant-contract-acme-lab-001.pdf";
+}>;
+export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_RESOURCE: Readonly<{
+    [x: string]: any;
+}>;
+export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CREDENTIAL: Readonly<import("..").VerifiableCredentialV2>;
+export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CONTEXT: Readonly<{
+    readonly providerTenantId: "acme-id";
+    readonly providerSector: "health-care";
+    readonly providerOrganizationDid: "did:web:api.acme.org";
+    readonly consumerTenantId: "lab-id";
+    readonly consumerSector: "health-research";
+    readonly consumerOrganizationDid: "did:web:api.lab.org";
+    readonly jurisdiction: "ES";
+    readonly actorRole: "ISCO-08|2211";
+    readonly subjectDid: "did:web:api.acme.org:individual:123";
+    readonly consumerProfessionalDid: "did:web:api.lab.org:employee:researcher1@lab.org:ISCO-08|2211";
+    readonly requestedScope: "organization/Composition.rs";
+    readonly requestedSection: "LOINC|48765-2";
+    readonly smartScope: "organization/Composition.rs?subject=did:web:api.acme.org:individual:123&section=LOINC|48765-2";
+    readonly purpose: "RESEARCH";
+}>;
+export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_PROVIDER_ORGANIZATION_URN: string;
+export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CONSUMER_ORGANIZATION_URN: string;
+export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CONSUMER_MEMBER_URN: string;
+export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CONTEXT_WITH_URNS: Readonly<{
+    readonly providerOrganizationUrn: string;
+    readonly consumerOrganizationUrn: string;
+    readonly consumerMemberUrn: string;
+    readonly providerTenantId: "acme-id";
+    readonly providerSector: "health-care";
+    readonly providerOrganizationDid: "did:web:api.acme.org";
+    readonly consumerTenantId: "lab-id";
+    readonly consumerSector: "health-research";
+    readonly consumerOrganizationDid: "did:web:api.lab.org";
+    readonly jurisdiction: "ES";
+    readonly actorRole: "ISCO-08|2211";
+    readonly subjectDid: "did:web:api.acme.org:individual:123";
+    readonly consumerProfessionalDid: "did:web:api.lab.org:employee:researcher1@lab.org:ISCO-08|2211";
+    readonly requestedScope: "organization/Composition.rs";
+    readonly requestedSection: "LOINC|48765-2";
+    readonly smartScope: "organization/Composition.rs?subject=did:web:api.acme.org:individual:123&section=LOINC|48765-2";
+    readonly purpose: "RESEARCH";
+}>;
+/**
+ * Consent-style organization-to-employee delegation rule reused for the
+ * consumer tenant side.
+ *
+ * This intentionally reuses the existing `Consent.*` rule pattern:
+ * - `Consent.subject` is the consumer organization URN
+ * - `Consent.actor-identifier` is the delegated member URN
+ * - `Consent.actor-role` carries the role separately
+ * - `Consent.source-reference` points to the blockchain-safe contract VC
+ *   reference that was or will be anchored on-chain
+ */
+export declare const EXAMPLE_INTER_TENANT_EMPLOYEE_CONTRACT_AUTHORIZATION_CONSENT: Readonly<{
+    readonly '@context': "org.hl7.fhir.api";
+    readonly "Consent.identifier": "urn:uuid:employee-contract-authorization-001";
+    readonly "Consent.subject": string;
+    readonly "Consent.actor-identifier": string;
+    readonly "Consent.actor-role": "ISCO-08|2211";
+    readonly "Consent.decision": "permit";
+    readonly "Consent.purpose": "RESEARCH";
+    readonly "Consent.action": "organization/Composition.rs";
+    readonly "Consent.source-reference": string | undefined;
+    readonly "Consent.date": "2026-06-29T00:00:00.000Z";
+    readonly "Consent.period-start": "2026-06-29T00:00:00.000Z";
+    readonly "Consent.period-end": "2027-06-29T00:00:00.000Z";
+}>;
+export declare const EXAMPLE_INTER_TENANT_PROVIDER_CONTRACT_AUTHORIZATION_CONSENT: Readonly<{
+    readonly '@context': "org.hl7.fhir.api";
+    readonly "Consent.identifier": "urn:uuid:provider-contract-authorization-001";
+    readonly "Consent.subject": string;
+    readonly "Consent.actor-identifier": string;
+    readonly "Consent.actor-role": "organization";
+    readonly "Consent.decision": "permit";
+    readonly "Consent.purpose": "RESEARCH";
+    readonly "Consent.action": "organization/Composition.rs";
+    readonly "Consent.source-reference": string | undefined;
+    readonly "Consent.date": "2026-06-29T00:00:00.000Z";
+    readonly "Consent.period-start": "2026-06-29T00:00:00.000Z";
+    readonly "Consent.period-end": "2027-06-29T00:00:00.000Z";
+}>;

package/dist/examples/inter-tenant-access-contract.js

@@ -0,0 +1,134 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+import { ServiceCapability } from '../constants/service-capabilities.js';
+import { DataspaceSectors } from '../constants/sectors.js';
+import { ClaimConsent } from '../models/consent-rule.js';
+import { ClaimInterTenantAccessContract } from '../models/inter-tenant-access-contract.js';
+import { buildInterTenantAccessContractCredential, buildInterTenantAccessContractResource, getInterTenantAccessContractBlockchainReference, } from '../utils/inter-tenant-access-contract.js';
+import { buildMemberAuthorizationUrn, buildOrganizationAuthorizationUrn, } from '../utils/organization-authorization-urn.js';
+import { EXAMPLE_API_ORGANIZATION_DID, EXAMPLE_CONTROLLER_DID, EXAMPLE_HEALTHCARE_ACTOR_ROLE_PHYSICIAN, EXAMPLE_JURISDICTION, EXAMPLE_RESEARCH_API_ORGANIZATION_DID, EXAMPLE_RESEARCH_CONTROLLER_DID, EXAMPLE_RESEARCH_TENANT_IDENTIFIER, EXAMPLE_SECTOR, EXAMPLE_TENANT_IDENTIFIER, } from './shared.js';
+/**
+ * Shared synthetic inter-tenant contract fixtures reused by GW and SDK tests.
+ *
+ * Scenario:
+ * - `acme-id` is the clinical provider tenant in `health-care`
+ * - `lab-id` is the research tenant in `health-research`
+ * - both are assumed to be hosted by the same operator for the current scope
+ *
+ * Programmer hints:
+ * - provider = the tenant that owns/exposes the data
+ * - consumer = the foreign tenant asking for access
+ * - capability = the allowed technical scope, for example
+ *   `organization/Composition.rs`
+ * - purpose = the allowed business/legal reason, for example `RESEARCH`
+ * - instantiates-uri = primary agreement artifact URL/CID, typically the
+ *   signed PDF of the contract itself
+ * - invoice/payment evidence is intentionally not modeled as a mandatory core
+ *   field in this first inter-tenant fixture
+ */
+export const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_ID = 'urn:uuid:inter-tenant-access-contract-001';
+export const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_VALID_FROM = '2026-06-29T00:00:00.000Z';
+export const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_VALID_UNTIL = '2027-06-29T00:00:00.000Z';
+export const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_PURPOSE = 'RESEARCH';
+export const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_SCOPE = ServiceCapability.IndexReader;
+export const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_SUBJECT_DID = 'did:web:api.acme.org:individual:123';
+export const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_SECTION = 'LOINC|48765-2';
+export const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_AGREEMENT_PDF_URL = 'https://portal.example.org/files/contracts/inter-tenant-contract-acme-lab-001.pdf';
+export const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CONSUMER_PROFESSIONAL_DID = `${EXAMPLE_RESEARCH_API_ORGANIZATION_DID}:employee:researcher1@lab.org:${EXAMPLE_HEALTHCARE_ACTOR_ROLE_PHYSICIAN}`;
+export const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_SMART_SCOPE = `${EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_SCOPE}?subject=${EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_SUBJECT_DID}&section=${EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_SECTION}`;
+export const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CLAIMS = Object.freeze({
+    [ClaimInterTenantAccessContract.identifier]: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_ID,
+    [ClaimInterTenantAccessContract.status]: 'executed',
+    [ClaimInterTenantAccessContract.issued]: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_VALID_FROM,
+    [ClaimInterTenantAccessContract.appliesStart]: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_VALID_FROM,
+    [ClaimInterTenantAccessContract.appliesEnd]: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_VALID_UNTIL,
+    [ClaimInterTenantAccessContract.providerOrganization]: EXAMPLE_API_ORGANIZATION_DID,
+    [ClaimInterTenantAccessContract.consumerOrganization]: EXAMPLE_RESEARCH_API_ORGANIZATION_DID,
+    [ClaimInterTenantAccessContract.providerController]: EXAMPLE_CONTROLLER_DID,
+    [ClaimInterTenantAccessContract.consumerController]: EXAMPLE_RESEARCH_CONTROLLER_DID,
+    [ClaimInterTenantAccessContract.capability]: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_SCOPE,
+    [ClaimInterTenantAccessContract.purpose]: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_PURPOSE,
+    [ClaimInterTenantAccessContract.instantiatesUri]: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_AGREEMENT_PDF_URL,
+});
+export const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_RESOURCE = Object.freeze(buildInterTenantAccessContractResource(EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CLAIMS));
+export const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CREDENTIAL = Object.freeze(buildInterTenantAccessContractCredential({
+    claims: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CLAIMS,
+    issuer: EXAMPLE_CONTROLLER_DID,
+    validFrom: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_VALID_FROM,
+    validUntil: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_VALID_UNTIL,
+    additionalCredential: {
+        id: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_ID,
+    },
+}));
+export const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CONTEXT = Object.freeze({
+    providerTenantId: EXAMPLE_TENANT_IDENTIFIER,
+    providerSector: EXAMPLE_SECTOR,
+    providerOrganizationDid: EXAMPLE_API_ORGANIZATION_DID,
+    consumerTenantId: EXAMPLE_RESEARCH_TENANT_IDENTIFIER,
+    consumerSector: DataspaceSectors.HealthResearch,
+    consumerOrganizationDid: EXAMPLE_RESEARCH_API_ORGANIZATION_DID,
+    jurisdiction: EXAMPLE_JURISDICTION,
+    actorRole: EXAMPLE_HEALTHCARE_ACTOR_ROLE_PHYSICIAN,
+    subjectDid: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_SUBJECT_DID,
+    consumerProfessionalDid: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CONSUMER_PROFESSIONAL_DID,
+    requestedScope: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_SCOPE,
+    requestedSection: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_SECTION,
+    smartScope: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_SMART_SCOPE,
+    purpose: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_PURPOSE,
+});
+export const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_PROVIDER_ORGANIZATION_URN = buildOrganizationAuthorizationUrn({
+    identifierType: 'TAX',
+    identifierValue: EXAMPLE_TENANT_IDENTIFIER,
+});
+export const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CONSUMER_ORGANIZATION_URN = buildOrganizationAuthorizationUrn({
+    identifierType: 'TAX',
+    identifierValue: EXAMPLE_RESEARCH_TENANT_IDENTIFIER,
+});
+export const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CONSUMER_MEMBER_URN = buildMemberAuthorizationUrn({
+    organizationUrn: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CONSUMER_ORGANIZATION_URN,
+    memberId: 'researcher-001',
+});
+export const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CONTEXT_WITH_URNS = Object.freeze({
+    ...EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CONTEXT,
+    providerOrganizationUrn: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_PROVIDER_ORGANIZATION_URN,
+    consumerOrganizationUrn: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CONSUMER_ORGANIZATION_URN,
+    consumerMemberUrn: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CONSUMER_MEMBER_URN,
+});
+/**
+ * Consent-style organization-to-employee delegation rule reused for the
+ * consumer tenant side.
+ *
+ * This intentionally reuses the existing `Consent.*` rule pattern:
+ * - `Consent.subject` is the consumer organization URN
+ * - `Consent.actor-identifier` is the delegated member URN
+ * - `Consent.actor-role` carries the role separately
+ * - `Consent.source-reference` points to the blockchain-safe contract VC
+ *   reference that was or will be anchored on-chain
+ */
+export const EXAMPLE_INTER_TENANT_EMPLOYEE_CONTRACT_AUTHORIZATION_CONSENT = Object.freeze({
+    '@context': 'org.hl7.fhir.api',
+    [ClaimConsent.identifier]: 'urn:uuid:employee-contract-authorization-001',
+    [ClaimConsent.subject]: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CONSUMER_ORGANIZATION_URN,
+    [ClaimConsent.actorIdentifier]: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CONSUMER_MEMBER_URN,
+    [ClaimConsent.actorRole]: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CONTEXT.actorRole,
+    [ClaimConsent.decision]: 'permit',
+    [ClaimConsent.purpose]: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CONTEXT.purpose,
+    [ClaimConsent.action]: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CONTEXT.requestedScope,
+    [ClaimConsent.sourceReference]: getInterTenantAccessContractBlockchainReference(EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CREDENTIAL),
+    [ClaimConsent.date]: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_VALID_FROM,
+    [ClaimConsent.periodStart]: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_VALID_FROM,
+    [ClaimConsent.periodEnd]: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_VALID_UNTIL,
+});
+export const EXAMPLE_INTER_TENANT_PROVIDER_CONTRACT_AUTHORIZATION_CONSENT = Object.freeze({
+    '@context': 'org.hl7.fhir.api',
+    [ClaimConsent.identifier]: 'urn:uuid:provider-contract-authorization-001',
+    [ClaimConsent.subject]: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_PROVIDER_ORGANIZATION_URN,
+    [ClaimConsent.actorIdentifier]: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CONSUMER_ORGANIZATION_URN,
+    [ClaimConsent.actorRole]: 'organization',
+    [ClaimConsent.decision]: 'permit',
+    [ClaimConsent.purpose]: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CONTEXT.purpose,
+    [ClaimConsent.action]: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CONTEXT.requestedScope,
+    [ClaimConsent.sourceReference]: getInterTenantAccessContractBlockchainReference(EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CREDENTIAL),
+    [ClaimConsent.date]: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_VALID_FROM,
+    [ClaimConsent.periodStart]: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_VALID_FROM,
+    [ClaimConsent.periodEnd]: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_VALID_UNTIL,
+});

package/dist/examples/shared.d.ts

@@ -11,12 +11,15 @@ import { IdKind } from '../constants/identity-identifiers';
  * - all values below are synthetic documentation/test fixtures, never real data
  */
 export declare const EXAMPLE_TENANT_IDENTIFIER: "acme-id";
+export declare const EXAMPLE_RESEARCH_TENANT_IDENTIFIER: "lab-id";
 export declare const EXAMPLE_JURISDICTION: "ES";
 export declare const EXAMPLE_HOST_COVERAGE_SCOPE: "EU";
 export declare const EXAMPLE_NETWORK_TYPE: "test";
 export declare const EXAMPLE_ROUTE_VERSION: "v1";
 export declare const EXAMPLE_SECTOR: "health-care";
+export declare const EXAMPLE_RESEARCH_SECTOR: "health-research";
 export declare const EXAMPLE_EMAIL_CONTROLLER_ORG: "controller@acme.org";
+export declare const EXAMPLE_EMAIL_CONTROLLER_RESEARCH_ORG: "controller@lab.org";
 export declare const EXAMPLE_ORGANIZATION_LEGAL_NAME: "ACME HEALTH SL";
 export declare const EXAMPLE_LEGAL_ORGANIZATION_TAX_ID: "VATES-B00112233";
 export declare const EXAMPLE_EMAIL_CONTROLLER_INDIVIDUAL: "ana.parent@example.org";
@@ -101,9 +104,11 @@ export declare const EXAMPLE_HOST_ROUTE_CONTEXT: {
     readonly sector: "test";
 };
 export declare const EXAMPLE_CONTROLLER_DID: "did:web:people.acme.org:controllers:primary";
+export declare const EXAMPLE_RESEARCH_CONTROLLER_DID: "did:web:people.lab.org:controllers:primary";
 export declare const EXAMPLE_CONTROLLER_EMAIL: "controller@acme.org";
 export declare const EXAMPLE_CONTROLLER_SAME_AS: "mailto:controller@acme.org";
 export declare const EXAMPLE_API_ORGANIZATION_DID: "did:web:api.acme.org";
+export declare const EXAMPLE_RESEARCH_API_ORGANIZATION_DID: "did:web:api.lab.org";
 export declare const EXAMPLE_SERVICE_PUBLIC_DID: "did:web:public.acme.org";
 export declare const EXAMPLE_PROFESSIONAL_DID: string;
 export declare const EXAMPLE_PROVIDER_ORGANIZATION_DID: "did:web:hospital.acme.org";

package/dist/examples/shared.js

@@ -26,12 +26,15 @@ import { medicationStatementFlatToFhirR4 } from '../utils/clinical-resource-conv
  * - all values below are synthetic documentation/test fixtures, never real data
  */
 export const EXAMPLE_TENANT_IDENTIFIER = 'acme-id';
+export const EXAMPLE_RESEARCH_TENANT_IDENTIFIER = 'lab-id';
 export const EXAMPLE_JURISDICTION = 'ES';
 export const EXAMPLE_HOST_COVERAGE_SCOPE = 'EU';
 export const EXAMPLE_NETWORK_TYPE = HostNetworkTypes.Test;
 export const EXAMPLE_ROUTE_VERSION = 'v1';
 export const EXAMPLE_SECTOR = DataspaceSectors.HealthCare;
+export const EXAMPLE_RESEARCH_SECTOR = DataspaceSectors.HealthResearch;
 export const EXAMPLE_EMAIL_CONTROLLER_ORG = 'controller@acme.org';
+export const EXAMPLE_EMAIL_CONTROLLER_RESEARCH_ORG = 'controller@lab.org';
 export const EXAMPLE_ORGANIZATION_LEGAL_NAME = 'ACME HEALTH SL';
 export const EXAMPLE_LEGAL_ORGANIZATION_TAX_ID = 'VATES-B00112233';
 export const EXAMPLE_EMAIL_CONTROLLER_INDIVIDUAL = 'ana.parent@example.org';
@@ -116,9 +119,11 @@ export const EXAMPLE_HOST_ROUTE_CONTEXT = {
     sector: EXAMPLE_NETWORK_TYPE,
 };
 export const EXAMPLE_CONTROLLER_DID = 'did:web:people.acme.org:controllers:primary';
+export const EXAMPLE_RESEARCH_CONTROLLER_DID = 'did:web:people.lab.org:controllers:primary';
 export const EXAMPLE_CONTROLLER_EMAIL = EXAMPLE_EMAIL_CONTROLLER_ORG;
 export const EXAMPLE_CONTROLLER_SAME_AS = `mailto:${EXAMPLE_CONTROLLER_EMAIL}`;
 export const EXAMPLE_API_ORGANIZATION_DID = 'did:web:api.acme.org';
+export const EXAMPLE_RESEARCH_API_ORGANIZATION_DID = 'did:web:api.lab.org';
 export const EXAMPLE_SERVICE_PUBLIC_DID = 'did:web:public.acme.org';
 export const EXAMPLE_PROFESSIONAL_DID = buildProfessionalDidWeb({
     organizationDidWeb: 'did:web:api.acme.org',

package/dist/models/index.d.ts

@@ -22,6 +22,7 @@ export * from './interoperable-claims';
 export * from './indexing';
 export * from './identity-bootstrap';
 export * from './individual-onboarding';
+export * from './inter-tenant-access-contract';
 export * from './issue';
 export * from './jsonapi';
 export * from './jwe';

package/dist/models/index.js

@@ -22,6 +22,7 @@ export * from './interoperable-claims.js';
 export * from './indexing.js';
 export * from './identity-bootstrap.js';
 export * from './individual-onboarding.js';
+export * from './inter-tenant-access-contract.js';
 export * from './issue.js';
 export * from './jsonapi.js';
 export * from './jwe.js';

package/dist/models/inter-tenant-access-contract.d.ts

@@ -0,0 +1,105 @@
+/**
+ * Canonical flat claim keys used when a frontend captures an inter-tenant
+ * access contract form and sends it to a backend before the final FHIR
+ * `Contract` resource is assembled.
+ *
+ * Notes:
+ * - these keys are claims-first transport helpers, not the legal source of
+ *   truth
+ * - the canonical legal payload is the FHIR `Contract` placed in
+ *   `credentialSubject` of the emitted VC
+ * - custom flat keys are used only where base FHIR does not define a simple
+ *   one-claim scalar path suitable for UI transport
+ */
+export declare enum ClaimInterTenantAccessContract {
+    /** Stable business identifier of the agreement/contract. */
+    identifier = "Contract.identifier",
+    /** FHIR Contract lifecycle status, for example `executed` or `amended`. */
+    status = "Contract.status",
+    /** When the agreement was formally issued. */
+    issued = "Contract.issued",
+    /** Agreement validity start date/time. */
+    appliesStart = "Contract.applies-start",
+    /** Agreement validity end date/time. */
+    appliesEnd = "Contract.applies-end",
+    /**
+     * Provider organization DID.
+     *
+     * Meaning for programmers:
+     * - this is the tenant that owns/exposes the protected data
+     * - in the current example this is `did:web:api.acme.org`
+     */
+    providerOrganization = "Contract.provider-organization",
+    /**
+     * Consumer organization DID.
+     *
+     * Meaning for programmers:
+     * - this is the foreign tenant requesting access under the agreement
+     * - in the current example this is `did:web:api.lab.org`
+     */
+    consumerOrganization = "Contract.consumer-organization",
+    /**
+     * DID of the controller who signed on behalf of the provider organization.
+     */
+    providerController = "Contract.provider-controller",
+    /**
+     * DID of the controller who signed on behalf of the consumer organization.
+     */
+    consumerController = "Contract.consumer-controller",
+    /**
+     * Allowed operational capability, expressed with the same vocabulary used by
+     * GW service capabilities and SMART-like root scopes.
+     *
+     * Example:
+     * - `organization/Composition.rs`
+     */
+    capability = "Contract.security-label",
+    /**
+     * Allowed business/legal purpose for the access.
+     *
+     * Example:
+     * - `RESEARCH`
+     */
+    purpose = "Contract.term-type",
+    /**
+     * External instantiated artifact for the agreement, typically the signed PDF
+     * or CID/URL of the contract itself plus direct contractual annexes.
+     *
+     * Canonical FHIR field:
+     * - `Contract.instantiatesUri`
+     *
+     * Flat claim rule in this stack:
+     * - use FHIR-style `instantiates-uri` in claims, then map it to
+     *   `instantiatesUri` in the actual FHIR resource object
+     */
+    instantiatesUri = "Contract.instantiates-uri"
+}
+export type InterTenantAccessContractClaims = Partial<Record<ClaimInterTenantAccessContract, string>>;
+export type InterTenantAccessContractSummary = Readonly<{
+    identifier?: string;
+    status?: string;
+    issued?: string;
+    appliesStart?: string;
+    appliesEnd?: string;
+    providerOrganizationDid?: string;
+    consumerOrganizationDid?: string;
+    providerControllerDid?: string;
+    consumerControllerDid?: string;
+    capabilities: readonly string[];
+    purposes: readonly string[];
+}>;
+export type InterTenantAccessContractMatchCriteria = Readonly<{
+    providerOrganizationDid: string;
+    consumerOrganizationDid: string;
+    requiredCapabilities?: readonly string[];
+    purpose?: string;
+    now?: string | Date;
+}>;
+export type InterTenantContractAuthorizationConsentCriteria = Readonly<{
+    consumerOrganizationDid: string;
+    actorIdentifier: string;
+    actorRole?: string;
+    requiredCapabilities?: readonly string[];
+    purpose?: string;
+    now?: string | Date;
+}>;

package/dist/models/inter-tenant-access-contract.js

@@ -0,0 +1,78 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+/**
+ * Canonical flat claim keys used when a frontend captures an inter-tenant
+ * access contract form and sends it to a backend before the final FHIR
+ * `Contract` resource is assembled.
+ *
+ * Notes:
+ * - these keys are claims-first transport helpers, not the legal source of
+ *   truth
+ * - the canonical legal payload is the FHIR `Contract` placed in
+ *   `credentialSubject` of the emitted VC
+ * - custom flat keys are used only where base FHIR does not define a simple
+ *   one-claim scalar path suitable for UI transport
+ */
+export var ClaimInterTenantAccessContract;
+(function (ClaimInterTenantAccessContract) {
+    /** Stable business identifier of the agreement/contract. */
+    ClaimInterTenantAccessContract["identifier"] = "Contract.identifier";
+    /** FHIR Contract lifecycle status, for example `executed` or `amended`. */
+    ClaimInterTenantAccessContract["status"] = "Contract.status";
+    /** When the agreement was formally issued. */
+    ClaimInterTenantAccessContract["issued"] = "Contract.issued";
+    /** Agreement validity start date/time. */
+    ClaimInterTenantAccessContract["appliesStart"] = "Contract.applies-start";
+    /** Agreement validity end date/time. */
+    ClaimInterTenantAccessContract["appliesEnd"] = "Contract.applies-end";
+    /**
+     * Provider organization DID.
+     *
+     * Meaning for programmers:
+     * - this is the tenant that owns/exposes the protected data
+     * - in the current example this is `did:web:api.acme.org`
+     */
+    ClaimInterTenantAccessContract["providerOrganization"] = "Contract.provider-organization";
+    /**
+     * Consumer organization DID.
+     *
+     * Meaning for programmers:
+     * - this is the foreign tenant requesting access under the agreement
+     * - in the current example this is `did:web:api.lab.org`
+     */
+    ClaimInterTenantAccessContract["consumerOrganization"] = "Contract.consumer-organization";
+    /**
+     * DID of the controller who signed on behalf of the provider organization.
+     */
+    ClaimInterTenantAccessContract["providerController"] = "Contract.provider-controller";
+    /**
+     * DID of the controller who signed on behalf of the consumer organization.
+     */
+    ClaimInterTenantAccessContract["consumerController"] = "Contract.consumer-controller";
+    /**
+     * Allowed operational capability, expressed with the same vocabulary used by
+     * GW service capabilities and SMART-like root scopes.
+     *
+     * Example:
+     * - `organization/Composition.rs`
+     */
+    ClaimInterTenantAccessContract["capability"] = "Contract.security-label";
+    /**
+     * Allowed business/legal purpose for the access.
+     *
+     * Example:
+     * - `RESEARCH`
+     */
+    ClaimInterTenantAccessContract["purpose"] = "Contract.term-type";
+    /**
+     * External instantiated artifact for the agreement, typically the signed PDF
+     * or CID/URL of the contract itself plus direct contractual annexes.
+     *
+     * Canonical FHIR field:
+     * - `Contract.instantiatesUri`
+     *
+     * Flat claim rule in this stack:
+     * - use FHIR-style `instantiates-uri` in claims, then map it to
+     *   `instantiatesUri` in the actual FHIR resource object
+     */
+    ClaimInterTenantAccessContract["instantiatesUri"] = "Contract.instantiates-uri";
+})(ClaimInterTenantAccessContract || (ClaimInterTenantAccessContract = {}));

package/dist/utils/evidence-blockchain-references.d.ts

@@ -4,6 +4,8 @@ import type { EvidenceObjectDLT } from '../models/oidc4ida.evidence.model.js';
  *
  * Current shared rule:
  * - `z...` multibase base58 references are already public and stable
+ * - `sha3-384:...` references are already blockchain-safe and must pass
+ *   through unchanged
  * - any other identifier-like value is SHA3-384 hashed before persistence
  */
 export declare function sanitizeBlockchainReference(value: unknown): string | undefined;

package/dist/utils/evidence-blockchain-references.js

@@ -5,6 +5,8 @@ const SHA3_384_PREFIX = 'sha3-384:';
  *
  * Current shared rule:
  * - `z...` multibase base58 references are already public and stable
+ * - `sha3-384:...` references are already blockchain-safe and must pass
+ *   through unchanged
  * - any other identifier-like value is SHA3-384 hashed before persistence
  */
 export function sanitizeBlockchainReference(value) {
@@ -13,6 +15,8 @@ export function sanitizeBlockchainReference(value) {
         return undefined;
     if (/^z[1-9A-HJ-NP-Za-km-z]+$/.test(normalized))
         return normalized;
+    if (/^sha3-384:[a-f0-9]{96}$/i.test(normalized))
+        return normalized;
     return `${SHA3_384_PREFIX}${createHash('sha3-384').update(normalized, 'utf8').digest('hex')}`;
 }
 /**

package/dist/utils/index.d.ts

@@ -54,9 +54,11 @@ export * from './fhir-validator';
 export * from './family-registration-test-data';
 export * from './individual-form-pdf';
 export * from './individual-organization-claims';
+export * from './inter-tenant-access-contract';
 export * from './legal-organization-onboarding-editor';
 export * from './organization-lifecycle';
 export * from './organization-did-binding';
+export * from './organization-authorization-urn';
 export * from './individual-organization-lifecycle';
 export * from './individual-onboarding-editor';
 export * from './individual-onboarding-document-reference';

package/dist/utils/index.js

@@ -54,9 +54,11 @@ export * from './fhir-validator.js';
 export * from './family-registration-test-data.js';
 export * from './individual-form-pdf.js';
 export * from './individual-organization-claims.js';
+export * from './inter-tenant-access-contract.js';
 export * from './legal-organization-onboarding-editor.js';
 export * from './organization-lifecycle.js';
 export * from './organization-did-binding.js';
+export * from './organization-authorization-urn.js';
 export * from './individual-organization-lifecycle.js';
 export * from './individual-onboarding-editor.js';
 export * from './individual-onboarding-document-reference.js';

package/dist/utils/inter-tenant-access-contract.d.ts

@@ -0,0 +1,44 @@
+import type { InterTenantAccessContractClaims, InterTenantContractAuthorizationConsentCriteria, InterTenantAccessContractMatchCriteria, InterTenantAccessContractSummary } from '../models/inter-tenant-access-contract';
+import type { VerifiableCredentialV2 } from '../models/verifiable-credential';
+type ContractLike = Record<string, any>;
+export declare function buildInterTenantAccessContractResource(claims: InterTenantAccessContractClaims): ContractLike;
+export declare function buildInterTenantAccessContractCredential(input: Readonly<{
+    claims: InterTenantAccessContractClaims;
+    issuer: string;
+    validFrom: string;
+    validUntil?: string;
+    additionalCredential?: Record<string, unknown>;
+}>): VerifiableCredentialV2;
+export declare function summarizeInterTenantAccessContract(credential: unknown): InterTenantAccessContractSummary | undefined;
+export declare function isInterTenantAccessContractActive(summary: InterTenantAccessContractSummary | undefined, options?: Readonly<{
+    now?: string | Date;
+}>): boolean;
+export declare function matchesInterTenantAccessContract(summary: InterTenantAccessContractSummary | undefined, criteria: InterTenantAccessContractMatchCriteria): boolean;
+export declare function getMatchingInterTenantAccessContractFromVpToken(vpToken: string, criteria: InterTenantAccessContractMatchCriteria): Record<string, unknown> | undefined;
+/**
+ * Returns the public blockchain-safe reference that a reused consent-style
+ * authorization rule should store under `Consent.source-reference` when it
+ * delegates use of one inter-tenant contract VC to an employee/researcher.
+ *
+ * Source-of-truth order:
+ * - VC `id`
+ * - FHIR `Contract.identifier`
+ *
+ * In both cases the reference is normalized through the same blockchain-safe
+ * sanitization rule already used by consent-access assets.
+ */
+export declare function getInterTenantAccessContractBlockchainReference(credential: unknown): string | undefined;
+/**
+ * Evaluates one consent-style rule reused as an organization-to-employee
+ * delegation for inter-tenant contract usage.
+ *
+ * Shared semantic contract:
+ * - `Consent.subject` = consumer organization DID
+ * - `Consent.actor-identifier` = delegated employee/researcher identifier
+ * - `Consent.action` = allowed capabilities/scopes
+ * - `Consent.purpose` = allowed purpose
+ * - `Consent.source-reference` = blockchain-safe hash/reference of the
+ *   underlying contract VC
+ */
+export declare function matchesInterTenantContractAuthorizationConsentRule(rule: Record<string, unknown>, contractCredential: unknown, criteria: InterTenantContractAuthorizationConsentCriteria): boolean;
+export {};

package/dist/utils/inter-tenant-access-contract.js

@@ -0,0 +1,358 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+import { ContractCredentialTypes, W3cCredentialContexts, W3cCredentialTypes } from '../constants/verifiable-credentials.js';
+import { ClaimConsent } from '../models/consent-rule.js';
+import { ClaimInterTenantAccessContract } from '../models/inter-tenant-access-contract.js';
+import { sanitizeBlockchainReference } from './evidence-blockchain-references.js';
+import { getVpCredentials } from './vp-token.js';
+const ACTIVE_CONTRACT_STATUSES = new Set(['executed', 'amended', 'appended']);
+const PROVIDER_ROLE = 'provider';
+const CONSUMER_ROLE = 'consumer';
+const PROVIDER_CONTROLLER_ROLE = 'provider-controller';
+const CONSUMER_CONTROLLER_ROLE = 'consumer-controller';
+function splitCsv(value) {
+    return Array.from(new Set(String(value || '')
+        .split(',')
+        .map((item) => item.trim())
+        .filter(Boolean)));
+}
+function readClaimWithAliases(claims, canonicalKey, aliases = []) {
+    const direct = String(claims[canonicalKey] || '').trim();
+    if (direct)
+        return direct;
+    for (const alias of aliases) {
+        const value = String(claims[alias] || '').trim();
+        if (value)
+            return value;
+    }
+    return undefined;
+}
+function firstIdentifierValue(input) {
+    if (Array.isArray(input)) {
+        for (const candidate of input) {
+            const found = firstIdentifierValue(candidate);
+            if (found)
+                return found;
+        }
+        return undefined;
+    }
+    if (!input || typeof input !== 'object')
+        return undefined;
+    const direct = String(input.value || input.id || '').trim();
+    return direct || undefined;
+}
+function extractRoleTexts(input) {
+    const items = Array.isArray(input) ? input : input ? [input] : [];
+    return items
+        .flatMap((item) => {
+        if (!item || typeof item !== 'object')
+            return [];
+        const text = String(item.text || '').trim();
+        const codingItems = Array.isArray(item.coding) ? item.coding : item.coding ? [item.coding] : [];
+        const codingValues = codingItems
+            .map((coding) => String(coding?.code || coding?.display || '').trim())
+            .filter(Boolean);
+        return [text, ...codingValues].filter(Boolean);
+    });
+}
+function extractCapabilityValues(input) {
+    const items = Array.isArray(input) ? input : input ? [input] : [];
+    return Array.from(new Set(items.flatMap((item) => {
+        if (!item || typeof item !== 'object')
+            return [];
+        const text = String(item.text || '').trim();
+        const codingItems = Array.isArray(item.coding) ? item.coding : item.coding ? [item.coding] : [];
+        const codingValues = codingItems
+            .map((coding) => String(coding?.code || coding?.display || '').trim())
+            .filter(Boolean);
+        return [text, ...codingValues].flatMap((value) => splitCsv(value));
+    })));
+}
+function extractOfferPartyReference(contract, expectedRole) {
+    const terms = Array.isArray(contract.term) ? contract.term : contract.term ? [contract.term] : [];
+    for (const term of terms) {
+        const parties = Array.isArray(term?.offer?.party) ? term.offer.party : term?.offer?.party ? [term.offer.party] : [];
+        for (const party of parties) {
+            const roleTexts = extractRoleTexts(party?.role).map((value) => value.toLowerCase());
+            if (!roleTexts.includes(expectedRole))
+                continue;
+            const reference = String(party?.reference?.reference || party?.reference || '').trim();
+            if (reference)
+                return reference;
+        }
+    }
+    return undefined;
+}
+function extractSignerReference(contract, expectedRole) {
+    const signers = Array.isArray(contract.signer) ? contract.signer : contract.signer ? [contract.signer] : [];
+    for (const signer of signers) {
+        const roleTexts = extractRoleTexts(signer?.type).map((value) => value.toLowerCase());
+        if (!roleTexts.includes(expectedRole))
+            continue;
+        const reference = String(signer?.party?.reference || signer?.party?.identifier?.value || '').trim();
+        if (reference)
+            return reference;
+    }
+    return undefined;
+}
+function extractPurposes(contract) {
+    const terms = Array.isArray(contract.term) ? contract.term : contract.term ? [contract.term] : [];
+    return Array.from(new Set(terms.flatMap((term) => {
+        const typeItems = Array.isArray(term?.type) ? term.type : term?.type ? [term.type] : [];
+        return typeItems.flatMap((item) => {
+            if (!item || typeof item !== 'object')
+                return [];
+            const text = String(item.text || '').trim();
+            const codingItems = Array.isArray(item.coding) ? item.coding : item.coding ? [item.coding] : [];
+            const codingValues = codingItems
+                .map((coding) => String(coding?.code || coding?.display || '').trim())
+                .filter(Boolean);
+            return [text, ...codingValues].flatMap((value) => splitCsv(value));
+        });
+    })));
+}
+function extractCapabilities(contract) {
+    const terms = Array.isArray(contract.term) ? contract.term : contract.term ? [contract.term] : [];
+    return Array.from(new Set(terms.flatMap((term) => extractCapabilityValues(term?.offer?.securityLabel))));
+}
+function normalizeNow(input) {
+    if (input instanceof Date)
+        return input.getTime();
+    if (input)
+        return new Date(input).getTime();
+    return Date.now();
+}
+export function buildInterTenantAccessContractResource(claims) {
+    const identifier = readClaimWithAliases(claims, ClaimInterTenantAccessContract.identifier) || '';
+    const status = readClaimWithAliases(claims, ClaimInterTenantAccessContract.status) || 'executed';
+    const issued = readClaimWithAliases(claims, ClaimInterTenantAccessContract.issued) || '';
+    const appliesStart = readClaimWithAliases(claims, ClaimInterTenantAccessContract.appliesStart, ['Contract.applies.start']) || '';
+    const appliesEnd = readClaimWithAliases(claims, ClaimInterTenantAccessContract.appliesEnd, ['Contract.applies.end']) || '';
+    const providerOrganization = readClaimWithAliases(claims, ClaimInterTenantAccessContract.providerOrganization, ['Contract.term.offer.party.provider']) || '';
+    const consumerOrganization = readClaimWithAliases(claims, ClaimInterTenantAccessContract.consumerOrganization, ['Contract.term.offer.party.consumer']) || '';
+    const providerController = readClaimWithAliases(claims, ClaimInterTenantAccessContract.providerController, ['Contract.signer.provider']) || '';
+    const consumerController = readClaimWithAliases(claims, ClaimInterTenantAccessContract.consumerController, ['Contract.signer.consumer']) || '';
+    const instantiatesUri = readClaimWithAliases(claims, ClaimInterTenantAccessContract.instantiatesUri, ['Contract.instantiatesUri']) || '';
+    const capabilities = splitCsv(readClaimWithAliases(claims, ClaimInterTenantAccessContract.capability, ['Contract.term.offer.securityLabel']));
+    const purposes = splitCsv(readClaimWithAliases(claims, ClaimInterTenantAccessContract.purpose, ['Contract.term.type']));
+    return {
+        resourceType: 'Contract',
+        id: identifier || undefined,
+        identifier: identifier ? [{ value: identifier }] : undefined,
+        status,
+        issued: issued || undefined,
+        instantiatesUri: instantiatesUri || undefined,
+        applies: {
+            ...(appliesStart ? { start: appliesStart } : {}),
+            ...(appliesEnd ? { end: appliesEnd } : {}),
+        },
+        signer: [
+            providerController
+                ? {
+                    type: [{ text: PROVIDER_CONTROLLER_ROLE }],
+                    party: { reference: providerController },
+                }
+                : undefined,
+            consumerController
+                ? {
+                    type: [{ text: CONSUMER_CONTROLLER_ROLE }],
+                    party: { reference: consumerController },
+                }
+                : undefined,
+        ].filter(Boolean),
+        term: [{
+                type: purposes.map((purpose) => ({ text: purpose })),
+                offer: {
+                    party: [
+                        providerOrganization
+                            ? {
+                                reference: { reference: providerOrganization },
+                                role: [{ text: PROVIDER_ROLE }],
+                            }
+                            : undefined,
+                        consumerOrganization
+                            ? {
+                                reference: { reference: consumerOrganization },
+                                role: [{ text: CONSUMER_ROLE }],
+                            }
+                            : undefined,
+                    ].filter(Boolean),
+                    securityLabel: capabilities.map((capability) => ({ text: capability })),
+                },
+            }],
+    };
+}
+export function buildInterTenantAccessContractCredential(input) {
+    return {
+        '@context': [W3cCredentialContexts.V2],
+        type: [
+            W3cCredentialTypes.VerifiableCredential,
+            ContractCredentialTypes.InterTenantAccessContractCredential,
+        ],
+        issuer: String(input.issuer || '').trim(),
+        validFrom: String(input.validFrom || '').trim(),
+        ...(input.validUntil ? { validUntil: String(input.validUntil).trim() } : {}),
+        credentialSubject: buildInterTenantAccessContractResource(input.claims),
+        ...(input.additionalCredential || {}),
+    };
+}
+export function summarizeInterTenantAccessContract(credential) {
+    if (!credential || typeof credential !== 'object')
+        return undefined;
+    const typeRaw = Array.isArray(credential.type) ? credential.type : [credential.type].filter(Boolean);
+    if (!typeRaw.includes(ContractCredentialTypes.InterTenantAccessContractCredential))
+        return undefined;
+    const subject = (credential.credentialSubject || {});
+    if (String(subject.resourceType || '').trim() !== 'Contract')
+        return undefined;
+    return {
+        identifier: firstIdentifierValue(subject.identifier) || String(subject.id || '').trim() || undefined,
+        status: String(subject.status || '').trim() || undefined,
+        issued: String(subject.issued || '').trim() || undefined,
+        appliesStart: String(subject.applies?.start || '').trim() || undefined,
+        appliesEnd: String(subject.applies?.end || '').trim() || undefined,
+        providerOrganizationDid: extractOfferPartyReference(subject, PROVIDER_ROLE),
+        consumerOrganizationDid: extractOfferPartyReference(subject, CONSUMER_ROLE),
+        providerControllerDid: extractSignerReference(subject, PROVIDER_CONTROLLER_ROLE),
+        consumerControllerDid: extractSignerReference(subject, CONSUMER_CONTROLLER_ROLE),
+        capabilities: extractCapabilities(subject),
+        purposes: extractPurposes(subject),
+    };
+}
+export function isInterTenantAccessContractActive(summary, options = {}) {
+    if (!summary)
+        return false;
+    const status = String(summary.status || '').trim().toLowerCase();
+    if (!ACTIVE_CONTRACT_STATUSES.has(status))
+        return false;
+    const nowMs = normalizeNow(options.now);
+    const startMs = summary.appliesStart ? Date.parse(summary.appliesStart) : NaN;
+    const endMs = summary.appliesEnd ? Date.parse(summary.appliesEnd) : NaN;
+    if (!Number.isNaN(startMs) && startMs > nowMs)
+        return false;
+    if (!Number.isNaN(endMs) && endMs < nowMs)
+        return false;
+    return true;
+}
+export function matchesInterTenantAccessContract(summary, criteria) {
+    if (!isInterTenantAccessContractActive(summary, { now: criteria.now }))
+        return false;
+    if (String(summary?.providerOrganizationDid || '').trim() !== String(criteria.providerOrganizationDid || '').trim())
+        return false;
+    if (String(summary?.consumerOrganizationDid || '').trim() !== String(criteria.consumerOrganizationDid || '').trim())
+        return false;
+    const requiredCapabilities = Array.from(new Set((criteria.requiredCapabilities || []).map((value) => String(value || '').trim()).filter(Boolean)));
+    if (requiredCapabilities.length > 0) {
+        const contractCapabilities = new Set((summary?.capabilities || []).map((value) => String(value || '').trim()));
+        if (!requiredCapabilities.every((value) => contractCapabilities.has(value)))
+            return false;
+    }
+    const purpose = String(criteria.purpose || '').trim();
+    if (purpose) {
+        const contractPurposes = new Set((summary?.purposes || []).map((value) => String(value || '').trim()));
+        if (contractPurposes.size > 0 && !contractPurposes.has(purpose))
+            return false;
+    }
+    return true;
+}
+export function getMatchingInterTenantAccessContractFromVpToken(vpToken, criteria) {
+    const credentials = getVpCredentials(vpToken);
+    return credentials.find((credential) => matchesInterTenantAccessContract(summarizeInterTenantAccessContract(credential), criteria));
+}
+function splitClaimCsv(value) {
+    return Array.from(new Set(String(value || '')
+        .split(',')
+        .map((item) => item.trim())
+        .filter(Boolean)));
+}
+function isConsentLikeRuleActive(rule, now) {
+    const nowMs = normalizeNow(now);
+    const startMs = Date.parse(String(rule[ClaimConsent.periodStart] || '').trim());
+    const endMs = Date.parse(String(rule[ClaimConsent.periodEnd] || '').trim());
+    if (!Number.isNaN(startMs) && startMs > nowMs)
+        return false;
+    if (!Number.isNaN(endMs) && endMs < nowMs)
+        return false;
+    return true;
+}
+/**
+ * Returns the public blockchain-safe reference that a reused consent-style
+ * authorization rule should store under `Consent.source-reference` when it
+ * delegates use of one inter-tenant contract VC to an employee/researcher.
+ *
+ * Source-of-truth order:
+ * - VC `id`
+ * - FHIR `Contract.identifier`
+ *
+ * In both cases the reference is normalized through the same blockchain-safe
+ * sanitization rule already used by consent-access assets.
+ */
+export function getInterTenantAccessContractBlockchainReference(credential) {
+    if (!credential || typeof credential !== 'object')
+        return undefined;
+    const vcId = sanitizeBlockchainReference(credential.id);
+    if (vcId)
+        return vcId;
+    const summary = summarizeInterTenantAccessContract(credential);
+    return sanitizeBlockchainReference(summary?.identifier);
+}
+/**
+ * Evaluates one consent-style rule reused as an organization-to-employee
+ * delegation for inter-tenant contract usage.
+ *
+ * Shared semantic contract:
+ * - `Consent.subject` = consumer organization DID
+ * - `Consent.actor-identifier` = delegated employee/researcher identifier
+ * - `Consent.action` = allowed capabilities/scopes
+ * - `Consent.purpose` = allowed purpose
+ * - `Consent.source-reference` = blockchain-safe hash/reference of the
+ *   underlying contract VC
+ */
+export function matchesInterTenantContractAuthorizationConsentRule(rule, contractCredential, criteria) {
+    const summary = summarizeInterTenantAccessContract(contractCredential);
+    if (!isInterTenantAccessContractActive(summary, { now: criteria.now })) {
+        return false;
+    }
+    if (String(rule[ClaimConsent.decision] || '').trim() !== 'permit')
+        return false;
+    if (!isConsentLikeRuleActive(rule, criteria.now))
+        return false;
+    if (String(rule[ClaimConsent.subject] || '').trim() !== String(criteria.consumerOrganizationDid || '').trim())
+        return false;
+    if (String(rule[ClaimConsent.actorIdentifier] || '').trim() !== String(criteria.actorIdentifier || '').trim())
+        return false;
+    const expectedReference = getInterTenantAccessContractBlockchainReference(contractCredential);
+    const ruleReference = String(rule[ClaimConsent.sourceReference]
+        || rule[ClaimConsent.eventBasedOn]
+        || '').trim();
+    if (!expectedReference || ruleReference !== expectedReference)
+        return false;
+    const purpose = String(criteria.purpose || '').trim();
+    if (purpose) {
+        const rulePurpose = String(rule[ClaimConsent.purpose] || '').trim();
+        if (rulePurpose && rulePurpose !== purpose)
+            return false;
+    }
+    const actorRole = String(criteria.actorRole || '').trim();
+    if (actorRole) {
+        const allowedRoles = splitClaimCsv(rule[ClaimConsent.actorRole]);
+        if (allowedRoles.length > 0 && !allowedRoles.includes(actorRole))
+            return false;
+    }
+    const requiredCapabilities = Array.from(new Set((criteria.requiredCapabilities || []).map((value) => String(value || '').trim()).filter(Boolean)));
+    if (requiredCapabilities.length > 0) {
+        const allowedCapabilities = new Set(splitClaimCsv(rule[ClaimConsent.action]));
+        if (!requiredCapabilities.every((value) => allowedCapabilities.has(value) || allowedCapabilities.has('*')))
+            return false;
+    }
+    if (requiredCapabilities.length > 0) {
+        const contractCapabilities = new Set((summary?.capabilities || []).map((value) => String(value || '').trim()));
+        if (!requiredCapabilities.every((value) => contractCapabilities.has(value)))
+            return false;
+    }
+    if (purpose) {
+        const contractPurposes = new Set((summary?.purposes || []).map((value) => String(value || '').trim()));
+        if (contractPurposes.size > 0 && !contractPurposes.has(purpose))
+            return false;
+    }
+    return true;
+}

package/dist/utils/organization-authorization-urn.d.ts

@@ -0,0 +1,43 @@
+import type { ClaimsRecord } from '../models/resource-document';
+export type OrganizationAuthorizationUrnInput = Readonly<{
+    identifierType: string;
+    identifierValue: string;
+}>;
+export type MemberAuthorizationUrnInput = Readonly<{
+    organizationUrn?: string;
+    identifierType?: string;
+    identifierValue?: string;
+    memberId: string;
+    /** Optional compatibility input. Role must be persisted separately, not inside the canonical member URN. */
+    roleCode?: string;
+}>;
+/**
+ * Canonical organization authorization identifier used by ledger, consent-like
+ * rules, and inter-tenant authorization persistence.
+ *
+ * Format:
+ * - `urn:org:<identifierType-lowercase>:<identifierValue-as-canonical-input>`
+ *
+ * Examples:
+ * - `urn:org:tax:VATES-B12345678`
+ * - `urn:org:tax:acme-id`
+ */
+export declare function buildOrganizationAuthorizationUrn(input: OrganizationAuthorizationUrnInput): string;
+/**
+ * Accepts either the legacy `TYPE|VALUE` input or an already-canonical
+ * `urn:org:...` identifier and always returns the canonical URN form.
+ */
+export declare function normalizeOrganizationAuthorizationUrn(input: string): string;
+export declare function buildOrganizationAuthorizationUrnFromClaims(claims?: ClaimsRecord): string;
+/**
+ * Canonical member authorization identifier rooted in one canonical
+ * `urn:org:...`.
+ *
+ * Format:
+ * - `urn:org:<type>:<value>:member:<memberId>`
+ *
+ * Important rule:
+ * - role must be stored as a separate claim, not inside the canonical member
+ *   identifier
+ */
+export declare function buildMemberAuthorizationUrn(input: MemberAuthorizationUrnInput): string;

package/dist/utils/organization-authorization-urn.js

@@ -0,0 +1,87 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+import { ClaimsOrganizationSchemaorg } from '../constants/schemaorg.js';
+const ORGANIZATION_URN_PREFIX = 'urn:org:';
+function normalizeTypeSegment(identifierType) {
+    return String(identifierType || '').trim().toLowerCase();
+}
+function normalizeValueSegment(identifierValue) {
+    return String(identifierValue || '').trim();
+}
+/**
+ * Canonical organization authorization identifier used by ledger, consent-like
+ * rules, and inter-tenant authorization persistence.
+ *
+ * Format:
+ * - `urn:org:<identifierType-lowercase>:<identifierValue-as-canonical-input>`
+ *
+ * Examples:
+ * - `urn:org:tax:VATES-B12345678`
+ * - `urn:org:tax:acme-id`
+ */
+export function buildOrganizationAuthorizationUrn(input) {
+    const identifierType = normalizeTypeSegment(input.identifierType);
+    const identifierValue = normalizeValueSegment(input.identifierValue);
+    if (!identifierType || !identifierValue) {
+        throw new Error('Organization authorization URN requires identifierType and identifierValue.');
+    }
+    return `${ORGANIZATION_URN_PREFIX}${identifierType}:${identifierValue}`;
+}
+/**
+ * Accepts either the legacy `TYPE|VALUE` input or an already-canonical
+ * `urn:org:...` identifier and always returns the canonical URN form.
+ */
+export function normalizeOrganizationAuthorizationUrn(input) {
+    const normalized = String(input || '').trim();
+    if (!normalized) {
+        throw new Error('Organization authorization identifier cannot be empty.');
+    }
+    if (normalized.toLowerCase().startsWith(ORGANIZATION_URN_PREFIX)) {
+        const parts = normalized.split(':');
+        const identifierType = String(parts[2] || '').trim();
+        const value = parts.slice(3).join(':').trim();
+        return buildOrganizationAuthorizationUrn({
+            identifierType,
+            identifierValue: value,
+        });
+    }
+    const legacyMatch = normalized.match(/^([^|:]+)\|(.+)$/);
+    if (legacyMatch) {
+        return buildOrganizationAuthorizationUrn({
+            identifierType: legacyMatch[1],
+            identifierValue: legacyMatch[2],
+        });
+    }
+    throw new Error(`Unsupported organization authorization identifier format: ${normalized}`);
+}
+export function buildOrganizationAuthorizationUrnFromClaims(claims) {
+    const identifierType = String(claims?.[ClaimsOrganizationSchemaorg.identifierType] || '').trim();
+    const identifierValue = String(claims?.[ClaimsOrganizationSchemaorg.identifierValue] || '').trim();
+    return buildOrganizationAuthorizationUrn({
+        identifierType,
+        identifierValue,
+    });
+}
+/**
+ * Canonical member authorization identifier rooted in one canonical
+ * `urn:org:...`.
+ *
+ * Format:
+ * - `urn:org:<type>:<value>:member:<memberId>`
+ *
+ * Important rule:
+ * - role must be stored as a separate claim, not inside the canonical member
+ *   identifier
+ */
+export function buildMemberAuthorizationUrn(input) {
+    const organizationUrn = input.organizationUrn
+        ? normalizeOrganizationAuthorizationUrn(input.organizationUrn)
+        : buildOrganizationAuthorizationUrn({
+            identifierType: String(input.identifierType || '').trim(),
+            identifierValue: String(input.identifierValue || '').trim(),
+        });
+    const memberId = String(input.memberId || '').trim();
+    if (!memberId) {
+        throw new Error('Member authorization URN requires memberId.');
+    }
+    return `${organizationUrn}:member:${memberId}`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-common-utils-ts",
-  "version": "2.0.17",
+  "version": "2.0.18",
   "publishConfig": {
     "access": "public"
   },