gdc-common-utils-ts 2.3.1 → 2.3.3

package/dist/convert/schemaorg-to-gaia-x.js

@@ -0,0 +1,208 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+import { ClaimsOrganizationSchemaorg, ClaimsServiceSchemaorg } from '../constants/schemaorg.js';
+import { GaiaXCredentialAttachmentFormat, GaiaXCredentialAttachmentRole, GaiaXCredentialMediaType, } from '../models/gaia-x.js';
+const W3C_VC_V2_CONTEXT = 'https://www.w3.org/ns/credentials/v2';
+function requiredClaim(claims, key, label) {
+    const value = String(claims[key] ?? '').trim();
+    if (!value)
+        throw new Error(`Missing ${label} required for Gaia-X projection.`);
+    return value;
+}
+function optionalClaim(claims, key) {
+    const value = String(claims[key] ?? '').trim();
+    return value || undefined;
+}
+function requiredInput(value, label) {
+    const normalized = value.trim();
+    if (!normalized)
+        throw new Error(`Missing ${label} required for Gaia-X projection.`);
+    return normalized;
+}
+function asObject(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function asString(value) {
+    return typeof value === 'string' ? value.trim() : '';
+}
+/**
+ * Reads the canonical schema.org `PropertyValue` organization identifier.
+ * During migration it also accepts the historical nested
+ * `identifier.identifier` form. When the structure is absent, `taxID` becomes
+ * a VAT/TAX fallback, matching ICA's OrganizationCredential issuance rule.
+ */
+export function resolveSchemaOrgOrganizationRegistrationIdentifier(credentialSubject) {
+    const outerIdentifier = asObject(credentialSubject.identifier);
+    const identifier = asObject(outerIdentifier?.identifier) || outerIdentifier;
+    const taxId = asString(credentialSubject.taxID || credentialSubject.taxId);
+    const value = asString(identifier?.value) || taxId;
+    if (!value)
+        throw new Error('Missing OrganizationCredential credentialSubject.identifier.value or taxID.');
+    const explicitType = asString(identifier?.additionalType || outerIdentifier?.additionalType);
+    return {
+        additionalType: explicitType || (/^VAT[A-Z]{2}-/i.test(value) ? 'VAT' : 'TAX'),
+        value,
+    };
+}
+/**
+ * Converts canonical schema.org organization claims into an unsigned Gaia-X
+ * ICAM 25.11 LegalPerson VC draft.
+ *
+ * Semantic boundary:
+ * - Gaia-X `LegalPerson` is the juridical organization/legal entity. It is not
+ *   GDC's natural-person `LegalRepresentativeCredential`.
+ * - representative claims are intentionally never projected by this function.
+ * - VAT/tax remains in the source schema.org OrganizationCredential. Gaia-X's
+ *   `gx:legalRegistrationNumber` is a resolvable reference to the separate
+ *   registration/notary credential, not an assertion synthesized from VAT.
+ * - this function is deterministic and does not sign. The authoritative GW
+ *   signs the returned draft as VC-JWT; ICA caches and verifies that exact JWT.
+ *
+ * This projection targets the credential structure and semantic model described
+ * by Gaia-X ICAM 25.11. Passing the resulting shape tests neither Gaia-X policy
+ * compliance nor GXDCH/TCK conformance.
+ *
+ * @see https://docs.gaia-x.eu/technical-committee/identity-credential-access-management/25.11/gaia-x_credentials/
+ * @see https://docs.gaia-x.eu/technical-committee/identity-credential-access-management/25.11/semantic_model/
+ */
+export function buildGaiaXLegalPersonCredentialDraft(input) {
+    const country = requiredClaim(input.claims, ClaimsOrganizationSchemaorg.addressCountry, 'organization ISO 3166-1 country code').toUpperCase();
+    const gaiaXAddress = { 'gx:countryCode': country };
+    const website = optionalClaim(input.claims, ClaimsOrganizationSchemaorg.url);
+    return {
+        '@context': [W3C_VC_V2_CONTEXT],
+        type: ['VerifiableCredential', 'LegalPerson'],
+        id: requiredInput(input.credentialId, 'credentialId'),
+        issuer: requiredInput(input.issuerId, 'issuerId'),
+        validFrom: requiredInput(input.validFrom, 'validFrom'),
+        credentialSubject: {
+            id: requiredInput(input.subjectId, 'subjectId'),
+            type: 'gx:LegalPerson',
+            'gx:legalName': requiredClaim(input.claims, ClaimsOrganizationSchemaorg.legalName, 'organization legal name'),
+            'gx:legalRegistrationNumber': {
+                id: requiredInput(input.legalRegistrationNumberCredentialId, 'legal registration number credential id'),
+            },
+            'gx:headquarterAddress': gaiaXAddress,
+            'gx:legalAddress': gaiaXAddress,
+            ...(website ? { 'gx:website': website } : {}),
+        },
+    };
+}
+/**
+ * Projects an ICA/GDC schema.org OrganizationCredential into a Gaia-X
+ * LegalPerson draft while preserving the organization `credentialSubject.id`.
+ *
+ * The source VC and Gaia-X VC are different signed statements, so their
+ * credential IDs must not silently collide. By default the Gaia-X credential
+ * receives `<source credential id>#gaia-x-legal-person`; callers may provide a
+ * separately resolvable ID. `registrationIdentifier` is returned for the
+ * notary/GXDCH registration step, while `gx:legalRegistrationNumber` remains a
+ * reference to the resulting registration credential.
+ */
+export function buildGaiaXLegalPersonProjectionFromOrganizationCredential(input) {
+    const sourceCredentialId = requiredInput(asString(input.organizationCredential.id), 'source credential id');
+    const subject = asObject(input.organizationCredential.credentialSubject);
+    if (!subject)
+        throw new Error('OrganizationCredential requires one object credentialSubject.');
+    const subjectId = requiredInput(asString(subject.id || subject['@id']), 'organization credentialSubject.id');
+    const registrationIdentifier = resolveSchemaOrgOrganizationRegistrationIdentifier(subject);
+    const address = asObject(subject.address);
+    const claims = {
+        [ClaimsOrganizationSchemaorg.legalName]: asString(subject.legalName || subject.name),
+        [ClaimsOrganizationSchemaorg.url]: asString(subject.url),
+        [ClaimsOrganizationSchemaorg.addressCountry]: input.addressCountryCode || asString(address?.addressCountry),
+        [ClaimsOrganizationSchemaorg.identifierType]: registrationIdentifier.additionalType,
+        [ClaimsOrganizationSchemaorg.identifierValue]: registrationIdentifier.value,
+    };
+    return {
+        sourceCredentialId,
+        registrationIdentifier,
+        credential: buildGaiaXLegalPersonCredentialDraft({
+            claims,
+            credentialId: input.credentialId || `${sourceCredentialId}#gaia-x-legal-person`,
+            subjectId,
+            issuerId: input.issuerId,
+            legalRegistrationNumberCredentialId: input.legalRegistrationNumberCredentialId,
+            validFrom: input.validFrom,
+        }),
+    };
+}
+/**
+ * Converts schema.org service claims into an unsigned Gaia-X ServiceOffering
+ * VC draft. A service offering is independent from the participant credential:
+ * it references the LegalPerson credential through `gx:providedBy` and carries
+ * its own mandatory terms reference.
+ *
+ * The GW must sign this draft as a separate VC-JWT. A DCAT DataService is useful
+ * catalog metadata but is not a substitute for this credential.
+ */
+export function buildGaiaXServiceOfferingCredentialDraft(input) {
+    const name = optionalClaim(input.claims, ClaimsServiceSchemaorg.name);
+    const description = optionalClaim(input.claims, ClaimsServiceSchemaorg.description);
+    const endpointUrl = optionalClaim(input.claims, ClaimsServiceSchemaorg.url);
+    const termsHash = requiredInput(input.termsAndConditionsHash, 'terms and conditions SHA-256 hash');
+    if (!/^[a-f0-9]{64}$/i.test(termsHash)) {
+        throw new Error('Gaia-X terms and conditions hash must be a 64-character SHA-256 hexadecimal digest of the published document bytes.');
+    }
+    return {
+        '@context': [W3C_VC_V2_CONTEXT],
+        type: ['VerifiableCredential', 'ServiceOffering'],
+        id: requiredInput(input.credentialId, 'credentialId'),
+        issuer: requiredInput(input.issuerId, 'issuerId'),
+        validFrom: requiredInput(input.validFrom, 'validFrom'),
+        credentialSubject: {
+            id: requiredInput(input.subjectId, 'subjectId'),
+            type: 'gx:ServiceOffering',
+            'gx:providedBy': { id: requiredInput(input.providedByCredentialId, 'providedBy credential id') },
+            'gx:serviceOfferingTermsAndConditions': [{
+                    'gx:url': requiredInput(input.termsAndConditionsUrl, 'terms and conditions URL'),
+                    'gx:hash': termsHash.toLowerCase(),
+                }],
+            ...(name ? { 'gx:name': name } : {}),
+            ...(description ? { 'gx:description': description } : {}),
+            ...(endpointUrl ? { 'gx:endpoint': [{ 'gx:endpointURL': endpointUrl }] } : {}),
+        },
+    };
+}
+/** Builds the mandatory first Gaia-X participant attachment for ICA discovery. */
+export function buildGaiaXParticipantAttachment(input) {
+    return buildGaiaXVcJwtAttachment({
+        ...input,
+        role: GaiaXCredentialAttachmentRole.Participant,
+    });
+}
+/** Wraps an exact signed Gaia-X VC-JWT without decoding or re-signing it. */
+export function buildGaiaXVcJwtAttachment(input) {
+    return {
+        id: requiredInput(input.id, 'attachment id'),
+        format: GaiaXCredentialAttachmentFormat,
+        role: input.role,
+        media_type: GaiaXCredentialMediaType.VcJwt,
+        data: { json: { jwt: requiredInput(input.jwt, 'VC-JWT') } },
+    };
+}
+/**
+ * Assembles one ICA member discovery entry and enforces the interoperable
+ * ordering contract: schema.org OrganizationCredential first in `vc[]`, and
+ * Gaia-X participant VC-JWT first in `attachments[]`.
+ *
+ * The caller owns signature verification and cache freshness. This helper does
+ * not derive or duplicate VAT outside `vc[]` and does not mutate signed data.
+ */
+export function buildIcaMemberDiscoveryData(input) {
+    if (!input.vc.length) {
+        throw new Error('ICA member discovery requires vc[0] OrganizationCredential.');
+    }
+    if (input.attachments[0]?.role !== GaiaXCredentialAttachmentRole.Participant) {
+        throw new Error('ICA member discovery requires the Gaia-X participant VC-JWT as attachments[0].');
+    }
+    return {
+        id: requiredInput(input.id, 'member id'),
+        vc: [...input.vc],
+        did: { document: input.did.document, meta: { ...input.did.meta } },
+        attachments: [...input.attachments],
+        ...(input.dcat ? { dcat: input.dcat } : {}),
+        ...(input.meta ? { meta: input.meta } : {}),
+    };
+}

package/dist/models/bundle-editor-types.d.ts

@@ -1,5 +1,5 @@
 import { type BundleEntry, type BundleJsonApi, type BundleRequest } from './bundle';
-import { EmployeeBundleOperations, type EmployeeClaims } from '../utils/employee';
+import { type EmployeeClaims } from '../utils/employee';
 import type { BundleEntryEditor } from '../utils/bundle-entry-editor';
 import type { EmployeeEntryEditor } from '../utils/employee-entry-editor';
 import type { VitalSignEntryEditor } from '../utils/vital-sign-entry-editor';
@@ -18,11 +18,21 @@ import type { CoverageEntryEditor } from '../utils/coverage-entry-editor';
 import type { ImmunizationEntryEditor } from '../utils/immunization-entry-editor';
 import type { ProcedureEntryEditor } from '../utils/procedure-entry-editor';
 import type { DiagnosticReportEntryEditor } from '../utils/diagnostic-report-entry-editor';
-export type BundleOperation = (typeof EmployeeBundleOperations)[keyof typeof EmployeeBundleOperations];
+import type { ConsentEntryEditor } from '../utils/consent-entry-editor';
+import type { RelatedPersonEntryEditor } from '../utils/related-person-entry-editor';
+/** Runtime-neutral business operations staged by `BundleEditor`. */
+export declare const BundleOperations: Readonly<{
+    readonly create: "create";
+    readonly search: "search";
+    readonly disable: "disable";
+    readonly purge: "purge";
+}>;
+export type BundleOperation = (typeof BundleOperations)[keyof typeof BundleOperations];
 /** Resource types that the shared bundle editors currently know how to open as typed entry editors. */
 export declare const BundleEditableResourceTypes: Readonly<{
     readonly employee: "Employee";
     readonly consent: "Consent";
+    readonly relatedPerson: "RelatedPerson";
     readonly observation: "Observation";
     readonly vitalSign: "Observation";
     readonly allergyIntolerance: "AllergyIntolerance";
@@ -86,4 +96,4 @@ export type BundleJsonApiShape = BundleJsonApi<BundleEntry>;
  * resource type they requested, instead of falling back to the generic
  * `BundleEntryEditor` API.
  */
-export type ResourceTypeEntryEditor<T extends AllowedResourceType> = T extends typeof BundleEditableResourceTypes.employee ? EmployeeEntryEditor : T extends typeof BundleEditableResourceTypes.vitalSign ? VitalSignEntryEditor : T extends typeof BundleEditableResourceTypes.observation ? ObservationEntryEditor : T extends typeof BundleEditableResourceTypes.allergyIntolerance ? AllergyIntoleranceEntryEditor : T extends typeof BundleEditableResourceTypes.condition ? ConditionEntryEditor : T extends typeof BundleEditableResourceTypes.medicationStatement ? MedicationStatementEntryEditor : T extends typeof BundleEditableResourceTypes.documentReference ? DocumentReferenceEntryEditor : T extends typeof BundleEditableResourceTypes.carePlan ? CarePlanEntryEditor : T extends typeof BundleEditableResourceTypes.flag ? FlagEntryEditor : T extends typeof BundleEditableResourceTypes.clinicalImpression ? ClinicalImpressionEntryEditor : T extends typeof BundleEditableResourceTypes.device ? DeviceEntryEditor : T extends typeof BundleEditableResourceTypes.deviceUseStatement ? DeviceUseStatementEntryEditor : T extends typeof BundleEditableResourceTypes.encounter ? EncounterEntryEditor : T extends typeof BundleEditableResourceTypes.coverage ? CoverageEntryEditor : T extends typeof BundleEditableResourceTypes.immunization ? ImmunizationEntryEditor : T extends typeof BundleEditableResourceTypes.procedure ? ProcedureEntryEditor : T extends typeof BundleEditableResourceTypes.diagnosticReport ? DiagnosticReportEntryEditor : BundleEntryEditor;
+export type ResourceTypeEntryEditor<T extends AllowedResourceType> = T extends typeof BundleEditableResourceTypes.employee ? EmployeeEntryEditor : T extends typeof BundleEditableResourceTypes.consent ? ConsentEntryEditor : T extends typeof BundleEditableResourceTypes.relatedPerson ? RelatedPersonEntryEditor : T extends typeof BundleEditableResourceTypes.vitalSign ? VitalSignEntryEditor : T extends typeof BundleEditableResourceTypes.observation ? ObservationEntryEditor : T extends typeof BundleEditableResourceTypes.allergyIntolerance ? AllergyIntoleranceEntryEditor : T extends typeof BundleEditableResourceTypes.condition ? ConditionEntryEditor : T extends typeof BundleEditableResourceTypes.medicationStatement ? MedicationStatementEntryEditor : T extends typeof BundleEditableResourceTypes.documentReference ? DocumentReferenceEntryEditor : T extends typeof BundleEditableResourceTypes.carePlan ? CarePlanEntryEditor : T extends typeof BundleEditableResourceTypes.flag ? FlagEntryEditor : T extends typeof BundleEditableResourceTypes.clinicalImpression ? ClinicalImpressionEntryEditor : T extends typeof BundleEditableResourceTypes.device ? DeviceEntryEditor : T extends typeof BundleEditableResourceTypes.deviceUseStatement ? DeviceUseStatementEntryEditor : T extends typeof BundleEditableResourceTypes.encounter ? EncounterEntryEditor : T extends typeof BundleEditableResourceTypes.coverage ? CoverageEntryEditor : T extends typeof BundleEditableResourceTypes.immunization ? ImmunizationEntryEditor : T extends typeof BundleEditableResourceTypes.procedure ? ProcedureEntryEditor : T extends typeof BundleEditableResourceTypes.diagnosticReport ? DiagnosticReportEntryEditor : BundleEntryEditor;

package/dist/models/bundle-editor-types.js

@@ -5,11 +5,19 @@
  * - Do not move helper implementations or class logic here.
  */
 import { ResourceTypesFhirR4 } from '../constants/fhir-resource-types.js';
-import { EmployeeResourceTypes, } from '../utils/employee.js';
+import { EmployeeBundleOperations, EmployeeResourceTypes, } from '../utils/employee.js';
+/** Runtime-neutral business operations staged by `BundleEditor`. */
+export const BundleOperations = Object.freeze({
+    create: EmployeeBundleOperations.create,
+    search: EmployeeBundleOperations.search,
+    disable: EmployeeBundleOperations.disable,
+    purge: EmployeeBundleOperations.purge,
+});
 /** Resource types that the shared bundle editors currently know how to open as typed entry editors. */
 export const BundleEditableResourceTypes = Object.freeze({
     employee: EmployeeResourceTypes.employee,
     consent: ResourceTypesFhirR4.Consent,
+    relatedPerson: ResourceTypesFhirR4.RelatedPerson,
     observation: ResourceTypesFhirR4.Observation,
     vitalSign: ResourceTypesFhirR4.Observation,
     allergyIntolerance: ResourceTypesFhirR4.AllergyIntolerance,

package/dist/models/gaia-x.d.ts

@@ -0,0 +1,128 @@
+import type { DidCommAttachment } from './comm';
+import type { DidDocument } from './did';
+export type JsonObject = Record<string, unknown>;
+/** Versioned Gaia-X profile targeted by the schema.org semantic projection. */
+export declare const GaiaXProfile: Readonly<{
+    readonly Icam2511: "icam-25.11";
+}>;
+/** Media types used to transport signed Gaia-X credentials without decoding them. */
+export declare const GaiaXCredentialMediaType: Readonly<{
+    readonly VcJwt: "application/vc+jwt";
+}>;
+/** DIDComm attachment format identifier used by the existing ICA contract. */
+export declare const GaiaXCredentialAttachmentFormat: "vc+jwt";
+/**
+ * Semantic roles for Gaia-X VC-JWT attachments in an ICA member aggregate.
+ *
+ * `Participant` is deliberately first in a member's `attachments[]`. It is the
+ * Gaia-X legal-entity projection corresponding to the same organization
+ * represented by the first schema.org `OrganizationCredential` in `vc[]`.
+ * They are different signed credentials and MUST NOT be treated as bytewise or
+ * schema-equivalent copies.
+ */
+export declare const GaiaXCredentialAttachmentRole: Readonly<{
+    readonly Participant: "gaia-x-participant-vc-jwt";
+    readonly LegalRegistrationNumber: "gaia-x-legal-registration-number-vc-jwt";
+    readonly TermsAndConditions: "gaia-x-terms-and-conditions-vc-jwt";
+    readonly ServiceOffering: "gaia-x-service-offering-vc-jwt";
+}>;
+export type GaiaXCredentialAttachmentRoleValue = typeof GaiaXCredentialAttachmentRole[keyof typeof GaiaXCredentialAttachmentRole];
+/** DIDComm attachment containing the compact, already-signed Gaia-X VC-JWT. */
+export interface GaiaXVcJwtAttachment extends DidCommAttachment {
+    media_type: typeof GaiaXCredentialMediaType.VcJwt;
+    format: typeof GaiaXCredentialAttachmentFormat;
+    role: GaiaXCredentialAttachmentRoleValue;
+    data: {
+        json: {
+            jwt: string;
+        };
+    };
+}
+/** Cache metadata kept next to a resolved artifact, never inside that artifact. */
+export interface IcaDiscoveryArtifactMeta {
+    sourceUrl?: string;
+    fetchedAt: string;
+    sourceUpdatedAt?: string;
+    verifiedAt?: string;
+    expiresAt?: string;
+    etag?: string;
+    contentHash?: string;
+}
+/** Resolved DID document plus cache provenance, following the old document/meta split. */
+export interface IcaDiscoveredDid {
+    document: DidDocument;
+    meta: IcaDiscoveryArtifactMeta;
+}
+/** Resolved DCAT document plus cache provenance. */
+export interface IcaDiscoveredDcat {
+    document: JsonObject;
+    meta: IcaDiscoveryArtifactMeta;
+}
+/**
+ * One authorized ICA member's complete discovery record.
+ *
+ * The VAT is intentionally not repeated at this level. Consumers obtain legal
+ * identifiers from the authoritative schema.org OrganizationCredential in
+ * `vc[0].credentialSubject.taxID` (or the versioned equivalent). `attachments`
+ * contains exact Gaia-X VC-JWT artifacts, while `did.document` and
+ * `dcat.document` make discovery possible without a second host request.
+ */
+export interface IcaMemberDiscoveryData {
+    id: string;
+    vc: JsonObject[];
+    did: IcaDiscoveredDid;
+    attachments: GaiaXVcJwtAttachment[];
+    dcat?: IcaDiscoveredDcat;
+    meta?: {
+        assembledAt: string;
+        refreshAfter?: string;
+    };
+}
+/** DIDComm/JSON:API-compatible body returned by ICA member autodiscovery. */
+export interface IcaMemberDiscoveryBody {
+    data: IcaMemberDiscoveryData[];
+    meta: {
+        generatedAt: string;
+        maxAgeSeconds?: number;
+    };
+}
+export interface GaiaXLegalPersonCredentialSubject extends JsonObject {
+    id: string;
+    type: 'gx:LegalPerson';
+    'gx:legalName': string;
+    'gx:legalRegistrationNumber': {
+        id: string;
+    };
+    'gx:headquarterAddress': {
+        'gx:countryCode': string;
+    };
+    'gx:legalAddress': {
+        'gx:countryCode': string;
+    };
+    'gx:website'?: string;
+}
+export interface GaiaXServiceOfferingCredentialSubject extends JsonObject {
+    id: string;
+    type: 'gx:ServiceOffering';
+    'gx:providedBy': {
+        id: string;
+    };
+    'gx:serviceOfferingTermsAndConditions': Array<{
+        'gx:url': string;
+        'gx:hash': string;
+    }>;
+    'gx:name'?: string;
+    'gx:description'?: string;
+    'gx:endpoint'?: Array<{
+        'gx:endpointURL': string;
+    }>;
+}
+/** Unsigned VC Data Model 2.0 draft. Signing and VC-JWT encoding belong to the GW. */
+export interface GaiaXCredentialDraft<TSubject extends JsonObject> extends JsonObject {
+    '@context': ['https://www.w3.org/ns/credentials/v2'];
+    type: ['VerifiableCredential', 'LegalPerson' | 'ServiceOffering'];
+    id: string;
+    issuer: string;
+    validFrom: string;
+    credentialSubject: TSubject;
+}

package/dist/models/gaia-x.js

@@ -0,0 +1,26 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+/** Versioned Gaia-X profile targeted by the schema.org semantic projection. */
+export const GaiaXProfile = Object.freeze({
+    Icam2511: 'icam-25.11',
+});
+/** Media types used to transport signed Gaia-X credentials without decoding them. */
+export const GaiaXCredentialMediaType = Object.freeze({
+    VcJwt: 'application/vc+jwt',
+});
+/** DIDComm attachment format identifier used by the existing ICA contract. */
+export const GaiaXCredentialAttachmentFormat = 'vc+jwt';
+/**
+ * Semantic roles for Gaia-X VC-JWT attachments in an ICA member aggregate.
+ *
+ * `Participant` is deliberately first in a member's `attachments[]`. It is the
+ * Gaia-X legal-entity projection corresponding to the same organization
+ * represented by the first schema.org `OrganizationCredential` in `vc[]`.
+ * They are different signed credentials and MUST NOT be treated as bytewise or
+ * schema-equivalent copies.
+ */
+export const GaiaXCredentialAttachmentRole = Object.freeze({
+    Participant: 'gaia-x-participant-vc-jwt',
+    LegalRegistrationNumber: 'gaia-x-legal-registration-number-vc-jwt',
+    TermsAndConditions: 'gaia-x-terms-and-conditions-vc-jwt',
+    ServiceOffering: 'gaia-x-service-offering-vc-jwt',
+});

package/dist/models/index.d.ts

@@ -21,6 +21,7 @@ export * from './dataspace-protocol';
 export * from './device-license';
 export * from './did';
 export * from './fhir-documents';
+export * from './gaia-x';
 export * from './interoperable-claims';
 export * from './indexing';
 export * from './identity-bootstrap';
@@ -46,6 +47,7 @@ export * from './permission-templates';
 export * from './resource-document';
 export * from './relationship-access';
 export * from './response';
+export * from './subject-identifier-ledger';
 export * from './urlPath';
 export * from './verifiable-credential';
 export * from './wallet';

package/dist/models/index.js

@@ -21,6 +21,7 @@ export * from './dataspace-protocol.js';
 export * from './device-license.js';
 export * from './did.js';
 export * from './fhir-documents.js';
+export * from './gaia-x.js';
 export * from './interoperable-claims.js';
 export * from './indexing.js';
 export * from './identity-bootstrap.js';
@@ -46,6 +47,7 @@ export * from './permission-templates.js';
 export * from './resource-document.js';
 export * from './relationship-access.js';
 export * from './response.js';
+export * from './subject-identifier-ledger.js';
 export * from './urlPath.js';
 export * from './verifiable-credential.js';
 export * from './wallet.js';

package/dist/models/jwe.d.ts

@@ -16,6 +16,12 @@ export interface ProtectedHeadersJWE {
     kid?: string;
     skid?: string;
     zip?: string;
+    /** Versioned private profile while the JOSE ML-KEM binding remains an IETF draft. */
+    gdc_pq_profile?: 'confidential-pqc-v1';
+    /** Domain-separated purpose for storage envelopes. */
+    gdc_key_purpose?: 'document-at-rest';
+    /** Non-reversible binding to the profile/tenant storage owner. */
+    gdc_owner_binding?: string;
 }
 /**
  * Unprotected headers that are not integrity protected.
@@ -33,6 +39,25 @@ export interface RecipientDataJWE {
         kid: string;
     };
 }
+/**
+ * Opaque recipient payload carried by JWE `encrypted_key` for
+ * `confidential-pqc-v1`.
+ *
+ * The content is encrypted once with a random AES-256-GCM CEK. ML-KEM derives
+ * a recipient KEK, and that KEK protects the CEK with AES-256-GCM. Keeping the
+ * CEK distinct from the KEM shared secret makes a future General JWE
+ * multi-recipient profile possible without re-encrypting the document.
+ */
+export interface MlKemWrappedCekV1 {
+    v: 'gdc-mlkem-cek-wrap-v1';
+    kem: 'ML-KEM-768';
+    kdf: 'HKDF-SHA-256';
+    wrap: 'A256GCM';
+    kemCiphertext: string;
+    iv: string;
+    ciphertext: string;
+    tag: string;
+}
 /**
  * Represents the protected (integrity-protected) header of a JWE.
  * These parameters are combined with the AAD (Additional Authenticated Data)

package/dist/models/subject-identifier-ledger.d.ts

@@ -0,0 +1,16 @@
+/** Public provider pointer stored for one opaque subject-identifier asset. */
+export type SubjectIdentifierProviderPointer = Readonly<{
+    identifier: Readonly<{
+        value: string;
+    }>;
+    /** Bare DNS domain: no URL scheme, path, DID or tenant identifier. */
+    url: string;
+}>;
+/** Ledger payload. It deliberately contains no subject DID or raw identifier. */
+export type SubjectIdentifierLedgerPayload = Readonly<{
+    provider: SubjectIdentifierProviderPointer;
+}>;
+/** One individual/animal bundle entry expanded into one write per `sameAs` alias. */
+export type SubjectIdentifierLedgerBundleEntry = Readonly<{
+    sameAs: string | readonly string[];
+}>;

package/dist/models/subject-identifier-ledger.js

@@ -0,0 +1 @@
+export {};

package/dist/utils/bundle-editor-core.d.ts

@@ -50,6 +50,15 @@ export declare class BundleEditor {
     setBundleType(type: BundleType): this;
     /** Returns the declared target bundle shape. */
     getBundleType(): BundleType;
+    /**
+     * Replaces staged entries with one previously materialized JSON-API-like
+     * Bundle snapshot so a later UI session can reopen, edit or append entries.
+     *
+     * This is an in-memory authoring operation only. It does not imply that the
+     * supplied Bundle came from authoritative GW readback and it performs no
+     * Communication wrapping, submission or polling.
+     */
+    setBundle(bundle: BundleJsonApi<BundleEntry>): this;
     setCompositionIdentifier(identifier?: string | null): this;
     /** Returns the normalized `Composition.identifier` staged for the future document root. */
     getCompositionIdentifier(): string | undefined;

package/dist/utils/bundle-editor-core.js

@@ -77,6 +77,52 @@ export class BundleEditor {
     getBundleType() {
         return this.bundleType;
     }
+    /**
+     * Replaces staged entries with one previously materialized JSON-API-like
+     * Bundle snapshot so a later UI session can reopen, edit or append entries.
+     *
+     * This is an in-memory authoring operation only. It does not imply that the
+     * supplied Bundle came from authoritative GW readback and it performs no
+     * Communication wrapping, submission or polling.
+     */
+    setBundle(bundle) {
+        if (!bundle || bundle.resourceType !== ResourceTypesFhirR4.Bundle || !Array.isArray(bundle.data)) {
+            throw new TypeError('BundleEditor.setBundle requires a Bundle with data[].');
+        }
+        if (!Object.values(BundleTypes).includes(bundle.type)) {
+            throw new TypeError(`BundleEditor.setBundle does not support Bundle.type: ${String(bundle.type || '')}`);
+        }
+        const operation = this.requireBundleOperation();
+        const nextEntries = bundle.data.map((source, index) => {
+            const resource = source?.resource;
+            const resourceType = normalizeOptionalIdentifier(resource?.resourceType);
+            if (!resource || !resourceType) {
+                throw new TypeError(`BundleEditor.setBundle requires data[${index}].resource.resourceType.`);
+            }
+            if (bundle.type !== BundleTypes.document
+                && this.allowedResourceType
+                && resourceType !== this.allowedResourceType) {
+                throw new Error(`BundleEditor cannot mix resource types in ${bundle.type} mode: ${this.allowedResourceType} vs ${resourceType}`);
+            }
+            const cloned = cloneEntry(source);
+            return {
+                type: normalizeOptionalIdentifier(cloned.type) || inferGenericEntryType(resourceType, operation),
+                request: cloned.request || { method: resolveRequestMethodForOperation(operation) },
+                ...(cloned.fullUrl ? { fullUrl: cloned.fullUrl } : {}),
+                resource: {
+                    ...cloned.resource,
+                    resourceType,
+                    meta: {
+                        ...(cloned.resource?.meta || {}),
+                        claims: { ...(cloned.resource?.meta?.claims || {}) },
+                    },
+                },
+            };
+        });
+        this.bundleType = bundle.type;
+        this.entries.splice(0, this.entries.length, ...nextEntries);
+        return this;
+    }
     setCompositionIdentifier(identifier) {
         return this.setCompositionScalarClaim(CompositionClaim.Identifier, identifier);
     }

package/dist/utils/bundle-editor.d.ts

@@ -19,3 +19,5 @@ export * from './immunization-entry-editor';
 export * from './procedure-entry-editor';
 export * from './diagnostic-report-entry-editor';
 export * from './employee-entry-editor';
+export * from './consent-entry-editor';
+export * from './related-person-entry-editor';

package/dist/utils/bundle-editor.js

@@ -19,3 +19,5 @@ export * from './immunization-entry-editor.js';
 export * from './procedure-entry-editor.js';
 export * from './diagnostic-report-entry-editor.js';
 export * from './employee-entry-editor.js';
+export * from './consent-entry-editor.js';
+export * from './related-person-entry-editor.js';

package/dist/utils/bundle-entry-editor.d.ts

@@ -17,6 +17,8 @@ import type { MedicationStatementEntryEditor } from './medication-statement-entr
 import type { ObservationEntryEditor } from './observation-entry-editor';
 import type { ProcedureEntryEditor } from './procedure-entry-editor';
 import type { VitalSignEntryEditor } from './vital-sign-entry-editor';
+import type { ConsentEntryEditor } from './consent-entry-editor';
+import type { RelatedPersonEntryEditor } from './related-person-entry-editor';
 import { type EmployeeClaims } from './employee';
 export declare class BundleEntryEditor {
     protected readonly bundleEditor: BundleEditor;
@@ -31,6 +33,10 @@ export declare class BundleEntryEditor {
     asResourceType<T extends AllowedResourceType>(resourceType: T): ResourceTypeEntryEditor<T>;
     /** Opens the current entry as one employee-specific resource editor. */
     asEmployee(): EmployeeEntryEditor;
+    /** Opens the current entry as one Consent permission editor. */
+    asConsent(): ConsentEntryEditor;
+    /** Opens the current entry as one RelatedPerson/contact editor. */
+    asRelatedPerson(): RelatedPersonEntryEditor;
     /** Opens the current entry as one vital-sign-specific Observation editor. */
     asVitalSign(): VitalSignEntryEditor;
     /** Opens the current entry as one general Observation editor. */

package/dist/utils/bundle-entry-editor.js

@@ -27,6 +27,10 @@ export class BundleEntryEditor {
         switch (normalized) {
             case BundleEditableResourceTypes.employee:
                 return this.asEmployee();
+            case BundleEditableResourceTypes.consent:
+                return this.asConsent();
+            case BundleEditableResourceTypes.relatedPerson:
+                return this.asRelatedPerson();
             case BundleEditableResourceTypes.vitalSign:
                 return this.asVitalSign();
             case BundleEditableResourceTypes.observation:
@@ -71,6 +75,22 @@ export class BundleEntryEditor {
         }
         return createRegisteredBundleEntryEditor(BundleEditableResourceTypes.employee, this.bundleEditor, this.entryIndex);
     }
+    /** Opens the current entry as one Consent permission editor. */
+    asConsent() {
+        const entry = this.getMutableEntry();
+        if (entry.resource?.resourceType !== ResourceTypesFhirR4.Consent) {
+            throw new Error(`BundleEntryEditor cannot open this entry as Consent: ${String(entry.resource?.resourceType || '')}`);
+        }
+        return createRegisteredBundleEntryEditor(BundleEditableResourceTypes.consent, this.bundleEditor, this.entryIndex);
+    }
+    /** Opens the current entry as one RelatedPerson/contact editor. */
+    asRelatedPerson() {
+        const entry = this.getMutableEntry();
+        if (entry.resource?.resourceType !== ResourceTypesFhirR4.RelatedPerson) {
+            throw new Error(`BundleEntryEditor cannot open this entry as RelatedPerson: ${String(entry.resource?.resourceType || '')}`);
+        }
+        return createRegisteredBundleEntryEditor(BundleEditableResourceTypes.relatedPerson, this.bundleEditor, this.entryIndex);
+    }
     /** Opens the current entry as one vital-sign-specific Observation editor. */
     asVitalSign() {
         const entry = this.getMutableEntry();