gdc-common-utils-ts 2.3.0 → 2.3.2

package/dist/convert/schemaorg-to-gaia-x.js

@@ -0,0 +1,211 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+import { ClaimsOrganizationSchemaorg, ClaimsServiceSchemaorg } from '../constants/schemaorg.js';
+import { GaiaXCredentialAttachmentFormat, GaiaXCredentialAttachmentRole, GaiaXCredentialMediaType, } from '../models/gaia-x.js';
+const W3C_VC_V2_CONTEXT = 'https://www.w3.org/ns/credentials/v2';
+function requiredClaim(claims, key, label) {
+    const value = String(claims[key] ?? '').trim();
+    if (!value)
+        throw new Error(`Missing ${label} required for Gaia-X projection.`);
+    return value;
+}
+function optionalClaim(claims, key) {
+    const value = String(claims[key] ?? '').trim();
+    return value || undefined;
+}
+function requiredInput(value, label) {
+    const normalized = value.trim();
+    if (!normalized)
+        throw new Error(`Missing ${label} required for Gaia-X projection.`);
+    return normalized;
+}
+function asObject(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function asString(value) {
+    return typeof value === 'string' ? value.trim() : '';
+}
+/**
+ * Reads the canonical schema.org `PropertyValue` organization identifier.
+ * During migration it also accepts the historical nested
+ * `identifier.identifier` form. When the structure is absent, `taxID` becomes
+ * a VAT/TAX fallback, matching ICA's OrganizationCredential issuance rule.
+ */
+export function resolveSchemaOrgOrganizationRegistrationIdentifier(credentialSubject) {
+    const outerIdentifier = asObject(credentialSubject.identifier);
+    const identifier = asObject(outerIdentifier?.identifier) || outerIdentifier;
+    const taxId = asString(credentialSubject.taxID || credentialSubject.taxId);
+    const value = asString(identifier?.value) || taxId;
+    if (!value)
+        throw new Error('Missing OrganizationCredential credentialSubject.identifier.value or taxID.');
+    const explicitType = asString(identifier?.additionalType || outerIdentifier?.additionalType);
+    return {
+        additionalType: explicitType || (/^VAT[A-Z]{2}-/i.test(value) ? 'VAT' : 'TAX'),
+        value,
+    };
+}
+/**
+ * Converts canonical schema.org organization claims into an unsigned Gaia-X
+ * ICAM 25.11 LegalPerson VC draft.
+ *
+ * Semantic boundary:
+ * - Gaia-X `LegalPerson` is the juridical organization/legal entity. It is not
+ *   GDC's natural-person `LegalRepresentativeCredential`.
+ * - representative claims are intentionally never projected by this function.
+ * - VAT/tax remains in the source schema.org OrganizationCredential. Gaia-X's
+ *   `gx:legalRegistrationNumber` is a resolvable reference to the separate
+ *   registration/notary credential, not an assertion synthesized from VAT.
+ * - this function is deterministic and does not sign. The authoritative GW
+ *   signs the returned draft as VC-JWT; ICA caches and verifies that exact JWT.
+ *
+ * This projection targets the credential structure and semantic model described
+ * by Gaia-X ICAM 25.11. Passing the resulting shape tests neither Gaia-X policy
+ * compliance nor GXDCH/TCK conformance.
+ *
+ * @see https://docs.gaia-x.eu/technical-committee/identity-credential-access-management/25.11/gaia-x_credentials/
+ * @see https://docs.gaia-x.eu/technical-committee/identity-credential-access-management/25.11/semantic_model/
+ */
+export function buildGaiaXLegalPersonCredentialDraft(input) {
+    const subdivision = optionalClaim(input.claims, ClaimsOrganizationSchemaorg.addressRegion);
+    const country = optionalClaim(input.claims, ClaimsOrganizationSchemaorg.addressCountry);
+    if (!subdivision && !country) {
+        throw new Error('Missing organization ISO 3166-2 address subdivision or ISO 3166-1 country.');
+    }
+    const gaiaXAddress = subdivision
+        ? { 'gx:countrySubdivisionCode': subdivision }
+        : { 'gx:countryCode': country };
+    const website = optionalClaim(input.claims, ClaimsOrganizationSchemaorg.url);
+    return {
+        '@context': [W3C_VC_V2_CONTEXT],
+        type: ['VerifiableCredential', 'LegalPerson'],
+        id: requiredInput(input.credentialId, 'credentialId'),
+        issuer: requiredInput(input.issuerId, 'issuerId'),
+        validFrom: requiredInput(input.validFrom, 'validFrom'),
+        credentialSubject: {
+            id: requiredInput(input.subjectId, 'subjectId'),
+            type: 'gx:LegalPerson',
+            'gx:legalName': requiredClaim(input.claims, ClaimsOrganizationSchemaorg.legalName, 'organization legal name'),
+            'gx:legalRegistrationNumber': {
+                id: requiredInput(input.legalRegistrationNumberCredentialId, 'legal registration number credential id'),
+            },
+            'gx:headquarterAddress': gaiaXAddress,
+            'gx:legalAddress': gaiaXAddress,
+            ...(website ? { 'gx:website': website } : {}),
+        },
+    };
+}
+/**
+ * Projects an ICA/GDC schema.org OrganizationCredential into a Gaia-X
+ * LegalPerson draft while preserving the organization `credentialSubject.id`.
+ *
+ * The source VC and Gaia-X VC are different signed statements, so their
+ * credential IDs must not silently collide. By default the Gaia-X credential
+ * receives `<source credential id>#gaia-x-legal-person`; callers may provide a
+ * separately resolvable ID. `registrationIdentifier` is returned for the
+ * notary/GXDCH registration step, while `gx:legalRegistrationNumber` remains a
+ * reference to the resulting registration credential.
+ */
+export function buildGaiaXLegalPersonProjectionFromOrganizationCredential(input) {
+    const sourceCredentialId = requiredInput(asString(input.organizationCredential.id), 'source credential id');
+    const subject = asObject(input.organizationCredential.credentialSubject);
+    if (!subject)
+        throw new Error('OrganizationCredential requires one object credentialSubject.');
+    const subjectId = requiredInput(asString(subject.id || subject['@id']), 'organization credentialSubject.id');
+    const registrationIdentifier = resolveSchemaOrgOrganizationRegistrationIdentifier(subject);
+    const address = asObject(subject.address);
+    const claims = {
+        [ClaimsOrganizationSchemaorg.legalName]: asString(subject.legalName || subject.name),
+        [ClaimsOrganizationSchemaorg.url]: asString(subject.url),
+        [ClaimsOrganizationSchemaorg.addressRegion]: input.addressSubdivisionCode || asString(address?.addressRegion),
+        [ClaimsOrganizationSchemaorg.addressCountry]: input.addressCountryCode || asString(address?.addressCountry),
+        [ClaimsOrganizationSchemaorg.identifierType]: registrationIdentifier.additionalType,
+        [ClaimsOrganizationSchemaorg.identifierValue]: registrationIdentifier.value,
+    };
+    return {
+        sourceCredentialId,
+        registrationIdentifier,
+        credential: buildGaiaXLegalPersonCredentialDraft({
+            claims,
+            credentialId: input.credentialId || `${sourceCredentialId}#gaia-x-legal-person`,
+            subjectId,
+            issuerId: input.issuerId,
+            legalRegistrationNumberCredentialId: input.legalRegistrationNumberCredentialId,
+            validFrom: input.validFrom,
+        }),
+    };
+}
+/**
+ * Converts schema.org service claims into an unsigned Gaia-X ServiceOffering
+ * VC draft. A service offering is independent from the participant credential:
+ * it references the LegalPerson credential through `gx:providedBy` and carries
+ * its own mandatory terms reference.
+ *
+ * The GW must sign this draft as a separate VC-JWT. A DCAT DataService is useful
+ * catalog metadata but is not a substitute for this credential.
+ */
+export function buildGaiaXServiceOfferingCredentialDraft(input) {
+    const name = optionalClaim(input.claims, ClaimsServiceSchemaorg.name);
+    const description = optionalClaim(input.claims, ClaimsServiceSchemaorg.description);
+    const endpointUrl = optionalClaim(input.claims, ClaimsServiceSchemaorg.url);
+    return {
+        '@context': [W3C_VC_V2_CONTEXT],
+        type: ['VerifiableCredential', 'ServiceOffering'],
+        id: requiredInput(input.credentialId, 'credentialId'),
+        issuer: requiredInput(input.issuerId, 'issuerId'),
+        validFrom: requiredInput(input.validFrom, 'validFrom'),
+        credentialSubject: {
+            id: requiredInput(input.subjectId, 'subjectId'),
+            type: 'gx:ServiceOffering',
+            'gx:providedBy': { id: requiredInput(input.providedByCredentialId, 'providedBy credential id') },
+            'gx:serviceOfferingTermsAndConditions': [{
+                    'gx:url': requiredInput(input.termsAndConditionsUrl, 'terms and conditions URL'),
+                    'gx:hash': requiredInput(input.termsAndConditionsHash, 'terms and conditions hash'),
+                }],
+            ...(name ? { 'gx:name': name } : {}),
+            ...(description ? { 'gx:description': description } : {}),
+            ...(endpointUrl ? { 'gx:endpoint': [{ 'gx:endpointURL': endpointUrl }] } : {}),
+        },
+    };
+}
+/** Builds the mandatory first Gaia-X participant attachment for ICA discovery. */
+export function buildGaiaXParticipantAttachment(input) {
+    return buildGaiaXVcJwtAttachment({
+        ...input,
+        role: GaiaXCredentialAttachmentRole.Participant,
+    });
+}
+/** Wraps an exact signed Gaia-X VC-JWT without decoding or re-signing it. */
+export function buildGaiaXVcJwtAttachment(input) {
+    return {
+        id: requiredInput(input.id, 'attachment id'),
+        format: GaiaXCredentialAttachmentFormat,
+        role: input.role,
+        media_type: GaiaXCredentialMediaType.VcJwt,
+        data: { json: { jwt: requiredInput(input.jwt, 'VC-JWT') } },
+    };
+}
+/**
+ * Assembles one ICA member discovery entry and enforces the interoperable
+ * ordering contract: schema.org OrganizationCredential first in `vc[]`, and
+ * Gaia-X participant VC-JWT first in `attachments[]`.
+ *
+ * The caller owns signature verification and cache freshness. This helper does
+ * not derive or duplicate VAT outside `vc[]` and does not mutate signed data.
+ */
+export function buildIcaMemberDiscoveryData(input) {
+    if (!input.vc.length) {
+        throw new Error('ICA member discovery requires vc[0] OrganizationCredential.');
+    }
+    if (input.attachments[0]?.role !== GaiaXCredentialAttachmentRole.Participant) {
+        throw new Error('ICA member discovery requires the Gaia-X participant VC-JWT as attachments[0].');
+    }
+    return {
+        id: requiredInput(input.id, 'member id'),
+        vc: [...input.vc],
+        did: { document: input.did.document, meta: { ...input.did.meta } },
+        attachments: [...input.attachments],
+        ...(input.dcat ? { dcat: input.dcat } : {}),
+        ...(input.meta ? { meta: input.meta } : {}),
+    };
+}

package/dist/examples/shared.d.ts

@@ -131,7 +131,7 @@ export declare const EXAMPLE_PROVIDER_SECTOR_DID: string;
  *
  * There are two valid base roots:
  * - hosted provider root:
- *   `did:web:<host.domain>:<sector>;organization:taxid:<provider-tax-id>`
+ *   `did:web:<host.domain>:<sector>:organization:taxid:<provider-tax-id>`
  * - external provider custom-domain root:
  *   `did:web:<sector.provider.domain>`
  *

package/dist/examples/shared.js

@@ -156,7 +156,7 @@ export const EXAMPLE_PROVIDER_SECTOR_DID = EXAMPLE_PROVIDER_DOMAIN_DID;
  *
  * There are two valid base roots:
  * - hosted provider root:
- *   `did:web:<host.domain>:<sector>;organization:taxid:<provider-tax-id>`
+ *   `did:web:<host.domain>:<sector>:organization:taxid:<provider-tax-id>`
  * - external provider custom-domain root:
  *   `did:web:<sector.provider.domain>`
  *

package/dist/models/bundle-editor-types.d.ts

@@ -1,5 +1,5 @@
 import { type BundleEntry, type BundleJsonApi, type BundleRequest } from './bundle';
-import { EmployeeBundleOperations, type EmployeeClaims } from '../utils/employee';
+import { type EmployeeClaims } from '../utils/employee';
 import type { BundleEntryEditor } from '../utils/bundle-entry-editor';
 import type { EmployeeEntryEditor } from '../utils/employee-entry-editor';
 import type { VitalSignEntryEditor } from '../utils/vital-sign-entry-editor';
@@ -18,11 +18,21 @@ import type { CoverageEntryEditor } from '../utils/coverage-entry-editor';
 import type { ImmunizationEntryEditor } from '../utils/immunization-entry-editor';
 import type { ProcedureEntryEditor } from '../utils/procedure-entry-editor';
 import type { DiagnosticReportEntryEditor } from '../utils/diagnostic-report-entry-editor';
-export type BundleOperation = (typeof EmployeeBundleOperations)[keyof typeof EmployeeBundleOperations];
+import type { ConsentEntryEditor } from '../utils/consent-entry-editor';
+import type { RelatedPersonEntryEditor } from '../utils/related-person-entry-editor';
+/** Runtime-neutral business operations staged by `BundleEditor`. */
+export declare const BundleOperations: Readonly<{
+    readonly create: "create";
+    readonly search: "search";
+    readonly disable: "disable";
+    readonly purge: "purge";
+}>;
+export type BundleOperation = (typeof BundleOperations)[keyof typeof BundleOperations];
 /** Resource types that the shared bundle editors currently know how to open as typed entry editors. */
 export declare const BundleEditableResourceTypes: Readonly<{
     readonly employee: "Employee";
     readonly consent: "Consent";
+    readonly relatedPerson: "RelatedPerson";
     readonly observation: "Observation";
     readonly vitalSign: "Observation";
     readonly allergyIntolerance: "AllergyIntolerance";
@@ -86,4 +96,4 @@ export type BundleJsonApiShape = BundleJsonApi<BundleEntry>;
  * resource type they requested, instead of falling back to the generic
  * `BundleEntryEditor` API.
  */
-export type ResourceTypeEntryEditor<T extends AllowedResourceType> = T extends typeof BundleEditableResourceTypes.employee ? EmployeeEntryEditor : T extends typeof BundleEditableResourceTypes.vitalSign ? VitalSignEntryEditor : T extends typeof BundleEditableResourceTypes.observation ? ObservationEntryEditor : T extends typeof BundleEditableResourceTypes.allergyIntolerance ? AllergyIntoleranceEntryEditor : T extends typeof BundleEditableResourceTypes.condition ? ConditionEntryEditor : T extends typeof BundleEditableResourceTypes.medicationStatement ? MedicationStatementEntryEditor : T extends typeof BundleEditableResourceTypes.documentReference ? DocumentReferenceEntryEditor : T extends typeof BundleEditableResourceTypes.carePlan ? CarePlanEntryEditor : T extends typeof BundleEditableResourceTypes.flag ? FlagEntryEditor : T extends typeof BundleEditableResourceTypes.clinicalImpression ? ClinicalImpressionEntryEditor : T extends typeof BundleEditableResourceTypes.device ? DeviceEntryEditor : T extends typeof BundleEditableResourceTypes.deviceUseStatement ? DeviceUseStatementEntryEditor : T extends typeof BundleEditableResourceTypes.encounter ? EncounterEntryEditor : T extends typeof BundleEditableResourceTypes.coverage ? CoverageEntryEditor : T extends typeof BundleEditableResourceTypes.immunization ? ImmunizationEntryEditor : T extends typeof BundleEditableResourceTypes.procedure ? ProcedureEntryEditor : T extends typeof BundleEditableResourceTypes.diagnosticReport ? DiagnosticReportEntryEditor : BundleEntryEditor;
+export type ResourceTypeEntryEditor<T extends AllowedResourceType> = T extends typeof BundleEditableResourceTypes.employee ? EmployeeEntryEditor : T extends typeof BundleEditableResourceTypes.consent ? ConsentEntryEditor : T extends typeof BundleEditableResourceTypes.relatedPerson ? RelatedPersonEntryEditor : T extends typeof BundleEditableResourceTypes.vitalSign ? VitalSignEntryEditor : T extends typeof BundleEditableResourceTypes.observation ? ObservationEntryEditor : T extends typeof BundleEditableResourceTypes.allergyIntolerance ? AllergyIntoleranceEntryEditor : T extends typeof BundleEditableResourceTypes.condition ? ConditionEntryEditor : T extends typeof BundleEditableResourceTypes.medicationStatement ? MedicationStatementEntryEditor : T extends typeof BundleEditableResourceTypes.documentReference ? DocumentReferenceEntryEditor : T extends typeof BundleEditableResourceTypes.carePlan ? CarePlanEntryEditor : T extends typeof BundleEditableResourceTypes.flag ? FlagEntryEditor : T extends typeof BundleEditableResourceTypes.clinicalImpression ? ClinicalImpressionEntryEditor : T extends typeof BundleEditableResourceTypes.device ? DeviceEntryEditor : T extends typeof BundleEditableResourceTypes.deviceUseStatement ? DeviceUseStatementEntryEditor : T extends typeof BundleEditableResourceTypes.encounter ? EncounterEntryEditor : T extends typeof BundleEditableResourceTypes.coverage ? CoverageEntryEditor : T extends typeof BundleEditableResourceTypes.immunization ? ImmunizationEntryEditor : T extends typeof BundleEditableResourceTypes.procedure ? ProcedureEntryEditor : T extends typeof BundleEditableResourceTypes.diagnosticReport ? DiagnosticReportEntryEditor : BundleEntryEditor;

package/dist/models/bundle-editor-types.js

@@ -5,11 +5,19 @@
  * - Do not move helper implementations or class logic here.
  */
 import { ResourceTypesFhirR4 } from '../constants/fhir-resource-types.js';
-import { EmployeeResourceTypes, } from '../utils/employee.js';
+import { EmployeeBundleOperations, EmployeeResourceTypes, } from '../utils/employee.js';
+/** Runtime-neutral business operations staged by `BundleEditor`. */
+export const BundleOperations = Object.freeze({
+    create: EmployeeBundleOperations.create,
+    search: EmployeeBundleOperations.search,
+    disable: EmployeeBundleOperations.disable,
+    purge: EmployeeBundleOperations.purge,
+});
 /** Resource types that the shared bundle editors currently know how to open as typed entry editors. */
 export const BundleEditableResourceTypes = Object.freeze({
     employee: EmployeeResourceTypes.employee,
     consent: ResourceTypesFhirR4.Consent,
+    relatedPerson: ResourceTypesFhirR4.RelatedPerson,
     observation: ResourceTypesFhirR4.Observation,
     vitalSign: ResourceTypesFhirR4.Observation,
     allergyIntolerance: ResourceTypesFhirR4.AllergyIntolerance,

package/dist/models/gaia-x.d.ts

@@ -0,0 +1,132 @@
+import type { DidCommAttachment } from './comm';
+import type { DidDocument } from './did';
+export type JsonObject = Record<string, unknown>;
+/** Versioned Gaia-X profile targeted by the schema.org semantic projection. */
+export declare const GaiaXProfile: Readonly<{
+    readonly Icam2511: "icam-25.11";
+}>;
+/** Media types used to transport signed Gaia-X credentials without decoding them. */
+export declare const GaiaXCredentialMediaType: Readonly<{
+    readonly VcJwt: "application/vc+jwt";
+}>;
+/** DIDComm attachment format identifier used by the existing ICA contract. */
+export declare const GaiaXCredentialAttachmentFormat: "vc+jwt";
+/**
+ * Semantic roles for Gaia-X VC-JWT attachments in an ICA member aggregate.
+ *
+ * `Participant` is deliberately first in a member's `attachments[]`. It is the
+ * Gaia-X legal-entity projection corresponding to the same organization
+ * represented by the first schema.org `OrganizationCredential` in `vc[]`.
+ * They are different signed credentials and MUST NOT be treated as bytewise or
+ * schema-equivalent copies.
+ */
+export declare const GaiaXCredentialAttachmentRole: Readonly<{
+    readonly Participant: "gaia-x-participant-vc-jwt";
+    readonly LegalRegistrationNumber: "gaia-x-legal-registration-number-vc-jwt";
+    readonly TermsAndConditions: "gaia-x-terms-and-conditions-vc-jwt";
+    readonly ServiceOffering: "gaia-x-service-offering-vc-jwt";
+}>;
+export type GaiaXCredentialAttachmentRoleValue = typeof GaiaXCredentialAttachmentRole[keyof typeof GaiaXCredentialAttachmentRole];
+/** DIDComm attachment containing the compact, already-signed Gaia-X VC-JWT. */
+export interface GaiaXVcJwtAttachment extends DidCommAttachment {
+    media_type: typeof GaiaXCredentialMediaType.VcJwt;
+    format: typeof GaiaXCredentialAttachmentFormat;
+    role: GaiaXCredentialAttachmentRoleValue;
+    data: {
+        json: {
+            jwt: string;
+        };
+    };
+}
+/** Cache metadata kept next to a resolved artifact, never inside that artifact. */
+export interface IcaDiscoveryArtifactMeta {
+    sourceUrl?: string;
+    fetchedAt: string;
+    sourceUpdatedAt?: string;
+    verifiedAt?: string;
+    expiresAt?: string;
+    etag?: string;
+    contentHash?: string;
+}
+/** Resolved DID document plus cache provenance, following the old document/meta split. */
+export interface IcaDiscoveredDid {
+    document: DidDocument;
+    meta: IcaDiscoveryArtifactMeta;
+}
+/** Resolved DCAT document plus cache provenance. */
+export interface IcaDiscoveredDcat {
+    document: JsonObject;
+    meta: IcaDiscoveryArtifactMeta;
+}
+/**
+ * One authorized ICA member's complete discovery record.
+ *
+ * The VAT is intentionally not repeated at this level. Consumers obtain legal
+ * identifiers from the authoritative schema.org OrganizationCredential in
+ * `vc[0].credentialSubject.taxID` (or the versioned equivalent). `attachments`
+ * contains exact Gaia-X VC-JWT artifacts, while `did.document` and
+ * `dcat.document` make discovery possible without a second host request.
+ */
+export interface IcaMemberDiscoveryData {
+    id: string;
+    vc: JsonObject[];
+    did: IcaDiscoveredDid;
+    attachments: GaiaXVcJwtAttachment[];
+    dcat?: IcaDiscoveredDcat;
+    meta?: {
+        assembledAt: string;
+        refreshAfter?: string;
+    };
+}
+/** DIDComm/JSON:API-compatible body returned by ICA member autodiscovery. */
+export interface IcaMemberDiscoveryBody {
+    data: IcaMemberDiscoveryData[];
+    meta: {
+        generatedAt: string;
+        maxAgeSeconds?: number;
+    };
+}
+export interface GaiaXLegalPersonCredentialSubject extends JsonObject {
+    id: string;
+    type: 'gx:LegalPerson';
+    'gx:legalName': string;
+    'gx:legalRegistrationNumber': {
+        id: string;
+    };
+    'gx:headquarterAddress': {
+        'gx:countrySubdivisionCode': string;
+    } | {
+        'gx:countryCode': string;
+    };
+    'gx:legalAddress': {
+        'gx:countrySubdivisionCode': string;
+    } | {
+        'gx:countryCode': string;
+    };
+    'gx:website'?: string;
+}
+export interface GaiaXServiceOfferingCredentialSubject extends JsonObject {
+    id: string;
+    type: 'gx:ServiceOffering';
+    'gx:providedBy': {
+        id: string;
+    };
+    'gx:serviceOfferingTermsAndConditions': Array<{
+        'gx:url': string;
+        'gx:hash': string;
+    }>;
+    'gx:name'?: string;
+    'gx:description'?: string;
+    'gx:endpoint'?: Array<{
+        'gx:endpointURL': string;
+    }>;
+}
+/** Unsigned VC Data Model 2.0 draft. Signing and VC-JWT encoding belong to the GW. */
+export interface GaiaXCredentialDraft<TSubject extends JsonObject> extends JsonObject {
+    '@context': ['https://www.w3.org/ns/credentials/v2'];
+    type: ['VerifiableCredential', 'LegalPerson' | 'ServiceOffering'];
+    id: string;
+    issuer: string;
+    validFrom: string;
+    credentialSubject: TSubject;
+}

package/dist/models/gaia-x.js

@@ -0,0 +1,26 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+/** Versioned Gaia-X profile targeted by the schema.org semantic projection. */
+export const GaiaXProfile = Object.freeze({
+    Icam2511: 'icam-25.11',
+});
+/** Media types used to transport signed Gaia-X credentials without decoding them. */
+export const GaiaXCredentialMediaType = Object.freeze({
+    VcJwt: 'application/vc+jwt',
+});
+/** DIDComm attachment format identifier used by the existing ICA contract. */
+export const GaiaXCredentialAttachmentFormat = 'vc+jwt';
+/**
+ * Semantic roles for Gaia-X VC-JWT attachments in an ICA member aggregate.
+ *
+ * `Participant` is deliberately first in a member's `attachments[]`. It is the
+ * Gaia-X legal-entity projection corresponding to the same organization
+ * represented by the first schema.org `OrganizationCredential` in `vc[]`.
+ * They are different signed credentials and MUST NOT be treated as bytewise or
+ * schema-equivalent copies.
+ */
+export const GaiaXCredentialAttachmentRole = Object.freeze({
+    Participant: 'gaia-x-participant-vc-jwt',
+    LegalRegistrationNumber: 'gaia-x-legal-registration-number-vc-jwt',
+    TermsAndConditions: 'gaia-x-terms-and-conditions-vc-jwt',
+    ServiceOffering: 'gaia-x-service-offering-vc-jwt',
+});

package/dist/models/index.d.ts

@@ -21,6 +21,7 @@ export * from './dataspace-protocol';
 export * from './device-license';
 export * from './did';
 export * from './fhir-documents';
+export * from './gaia-x';
 export * from './interoperable-claims';
 export * from './indexing';
 export * from './identity-bootstrap';
@@ -46,6 +47,7 @@ export * from './permission-templates';
 export * from './resource-document';
 export * from './relationship-access';
 export * from './response';
+export * from './subject-identifier-ledger';
 export * from './urlPath';
 export * from './verifiable-credential';
 export * from './wallet';

package/dist/models/index.js

@@ -21,6 +21,7 @@ export * from './dataspace-protocol.js';
 export * from './device-license.js';
 export * from './did.js';
 export * from './fhir-documents.js';
+export * from './gaia-x.js';
 export * from './interoperable-claims.js';
 export * from './indexing.js';
 export * from './identity-bootstrap.js';
@@ -46,6 +47,7 @@ export * from './permission-templates.js';
 export * from './resource-document.js';
 export * from './relationship-access.js';
 export * from './response.js';
+export * from './subject-identifier-ledger.js';
 export * from './urlPath.js';
 export * from './verifiable-credential.js';
 export * from './wallet.js';

package/dist/models/interoperable-claims/invoice-claims.d.ts

@@ -12,7 +12,7 @@ export declare const InvoiceClaim: {
     readonly Date: "Invoice.date";
     /** Invoice lifecycle status. Example: `issued`. */
     readonly Status: "Invoice.status";
-    /** Subject or tenant context reference. Example: `did:web:host.example.com:health-care;organization:taxid:VATES-B00112233:individual:multibase:zExampleIndividualId`. */
+    /** Subject or tenant context reference. Example: `did:web:host.example.com:health-care:organization:taxid:VATES-B00112233:individual:multibase:zExampleIndividualId`. */
     readonly Subject: "Invoice.subject";
     /** Billed recipient reference. Example: `did:web:portal.example.org:billing`. */
     readonly Recipient: "Invoice.recipient";

package/dist/models/interoperable-claims/invoice-claims.js

@@ -13,7 +13,7 @@ export const InvoiceClaim = {
     Date: 'Invoice.date',
     /** Invoice lifecycle status. Example: `issued`. */
     Status: 'Invoice.status',
-    /** Subject or tenant context reference. Example: `did:web:host.example.com:health-care;organization:taxid:VATES-B00112233:individual:multibase:zExampleIndividualId`. */
+    /** Subject or tenant context reference. Example: `did:web:host.example.com:health-care:organization:taxid:VATES-B00112233:individual:multibase:zExampleIndividualId`. */
     Subject: 'Invoice.subject',
     /** Billed recipient reference. Example: `did:web:portal.example.org:billing`. */
     Recipient: 'Invoice.recipient',
@@ -156,7 +156,7 @@ export const InvoiceClaimSpecs = [
     {
         key: InvoiceClaim.Subject,
         meaning: 'Subject or tenant context reference.',
-        example: 'did:web:host.example.com:health-care;organization:taxid:VATES-B00112233:individual:multibase:zExampleIndividualId',
+        example: 'did:web:host.example.com:health-care:organization:taxid:VATES-B00112233:individual:multibase:zExampleIndividualId',
     },
     { key: InvoiceClaim.Recipient, meaning: 'Billed recipient reference.', example: 'did:web:portal.example.org:billing' },
     { key: InvoiceClaim.Issuer, meaning: 'Invoice issuer reference.', example: 'did:web:api.acme.org' },

package/dist/models/interoperable-claims/observation-claims.d.ts

@@ -72,7 +72,7 @@ export declare const ObservationClaim: {
     readonly Language: "Observation.language";
     /** Observation method token. Example: `http://snomed.info/sct|252465000`. */
     readonly Method: "Observation.method";
-    /** Optional compatibility alias of `Observation.subject`. Example: `did:web:host.example.com:health-care;organization:taxid:VATES-B00112233:individual:multibase:zExampleIndividualId`. */
+    /** Optional compatibility alias of `Observation.subject`. Example: `did:web:host.example.com:health-care:organization:taxid:VATES-B00112233:individual:multibase:zExampleIndividualId`. */
     readonly Patient: "Observation.patient";
     /** Performer reference list. Example: `Practitioner/prac-1`. */
     readonly Performer: "Observation.performer";
@@ -80,7 +80,7 @@ export declare const ObservationClaim: {
     readonly Specimen: "Observation.specimen";
     /** Observation status. Presence marks one visible/searchable main observation. Example: `final`. */
     readonly Status: "Observation.status";
-    /** Canonical subject reference. Example: `did:web:host.example.com:health-care;organization:taxid:VATES-B00112233:individual:multibase:zExampleIndividualId`. */
+    /** Canonical subject reference. Example: `did:web:host.example.com:health-care:organization:taxid:VATES-B00112233:individual:multibase:zExampleIndividualId`. */
     readonly Subject: "Observation.subject";
     /** Value as coded concept token. Example: `http://terminology.hl7.org/CodeSystem/data-absent-reason|not-performed`. */
     readonly ValueConcept: "Observation.value-concept";

package/dist/models/interoperable-claims/observation-claims.js

@@ -74,7 +74,7 @@ export const ObservationClaim = {
     Language: 'Observation.language',
     /** Observation method token. Example: `http://snomed.info/sct|252465000`. */
     Method: 'Observation.method',
-    /** Optional compatibility alias of `Observation.subject`. Example: `did:web:host.example.com:health-care;organization:taxid:VATES-B00112233:individual:multibase:zExampleIndividualId`. */
+    /** Optional compatibility alias of `Observation.subject`. Example: `did:web:host.example.com:health-care:organization:taxid:VATES-B00112233:individual:multibase:zExampleIndividualId`. */
     Patient: 'Observation.patient',
     /** Performer reference list. Example: `Practitioner/prac-1`. */
     Performer: 'Observation.performer',
@@ -82,7 +82,7 @@ export const ObservationClaim = {
     Specimen: 'Observation.specimen',
     /** Observation status. Presence marks one visible/searchable main observation. Example: `final`. */
     Status: 'Observation.status',
-    /** Canonical subject reference. Example: `did:web:host.example.com:health-care;organization:taxid:VATES-B00112233:individual:multibase:zExampleIndividualId`. */
+    /** Canonical subject reference. Example: `did:web:host.example.com:health-care:organization:taxid:VATES-B00112233:individual:multibase:zExampleIndividualId`. */
     Subject: 'Observation.subject',
     /** Value as coded concept token. Example: `http://terminology.hl7.org/CodeSystem/data-absent-reason|not-performed`. */
     ValueConcept: 'Observation.value-concept',

package/dist/models/jwe.d.ts

@@ -16,6 +16,12 @@ export interface ProtectedHeadersJWE {
     kid?: string;
     skid?: string;
     zip?: string;
+    /** Versioned private profile while the JOSE ML-KEM binding remains an IETF draft. */
+    gdc_pq_profile?: 'confidential-pqc-v1';
+    /** Domain-separated purpose for storage envelopes. */
+    gdc_key_purpose?: 'document-at-rest';
+    /** Non-reversible binding to the profile/tenant storage owner. */
+    gdc_owner_binding?: string;
 }
 /**
  * Unprotected headers that are not integrity protected.
@@ -33,6 +39,25 @@ export interface RecipientDataJWE {
         kid: string;
     };
 }
+/**
+ * Opaque recipient payload carried by JWE `encrypted_key` for
+ * `confidential-pqc-v1`.
+ *
+ * The content is encrypted once with a random AES-256-GCM CEK. ML-KEM derives
+ * a recipient KEK, and that KEK protects the CEK with AES-256-GCM. Keeping the
+ * CEK distinct from the KEM shared secret makes a future General JWE
+ * multi-recipient profile possible without re-encrypting the document.
+ */
+export interface MlKemWrappedCekV1 {
+    v: 'gdc-mlkem-cek-wrap-v1';
+    kem: 'ML-KEM-768';
+    kdf: 'HKDF-SHA-256';
+    wrap: 'A256GCM';
+    kemCiphertext: string;
+    iv: string;
+    ciphertext: string;
+    tag: string;
+}
 /**
  * Represents the protected (integrity-protected) header of a JWE.
  * These parameters are combined with the AAD (Additional Authenticated Data)

package/dist/models/subject-identifier-ledger.d.ts

@@ -0,0 +1,16 @@
+/** Public provider pointer stored for one opaque subject-identifier asset. */
+export type SubjectIdentifierProviderPointer = Readonly<{
+    identifier: Readonly<{
+        value: string;
+    }>;
+    /** Bare DNS domain: no URL scheme, path, DID or tenant identifier. */
+    url: string;
+}>;
+/** Ledger payload. It deliberately contains no subject DID or raw identifier. */
+export type SubjectIdentifierLedgerPayload = Readonly<{
+    provider: SubjectIdentifierProviderPointer;
+}>;
+/** One individual/animal bundle entry expanded into one write per `sameAs` alias. */
+export type SubjectIdentifierLedgerBundleEntry = Readonly<{
+    sameAs: string | readonly string[];
+}>;

package/dist/models/subject-identifier-ledger.js

@@ -0,0 +1 @@
+export {};

package/dist/utils/bundle-editor-core.d.ts

@@ -50,6 +50,15 @@ export declare class BundleEditor {
     setBundleType(type: BundleType): this;
     /** Returns the declared target bundle shape. */
     getBundleType(): BundleType;
+    /**
+     * Replaces staged entries with one previously materialized JSON-API-like
+     * Bundle snapshot so a later UI session can reopen, edit or append entries.
+     *
+     * This is an in-memory authoring operation only. It does not imply that the
+     * supplied Bundle came from authoritative GW readback and it performs no
+     * Communication wrapping, submission or polling.
+     */
+    setBundle(bundle: BundleJsonApi<BundleEntry>): this;
     setCompositionIdentifier(identifier?: string | null): this;
     /** Returns the normalized `Composition.identifier` staged for the future document root. */
     getCompositionIdentifier(): string | undefined;