gdc-common-utils-ts 2.3.3 → 2.3.5

package/dist/constants/actor-session.d.ts

@@ -38,6 +38,7 @@ export declare const ActorCapabilities: Readonly<{
     readonly IndividualImportIps: "individual.import_ips";
     readonly IndividualGenerateDigitalTwin: "individual.generate_digital_twin";
     readonly IndividualIngestCommunication: "individual.ingest_communication";
+    readonly IndividualReadClinicalSummary: "individual.read_clinical_summary";
     readonly IndividualUpsertRelatedPerson: "individual.upsert_related_person";
     readonly IndividualMemberDisable: "individual_member.disable";
     readonly IndividualMemberPurge: "individual_member.purge";

package/dist/constants/actor-session.js

@@ -40,6 +40,7 @@ export const ActorCapabilities = Object.freeze({
     IndividualImportIps: 'individual.import_ips',
     IndividualGenerateDigitalTwin: 'individual.generate_digital_twin',
     IndividualIngestCommunication: 'individual.ingest_communication',
+    IndividualReadClinicalSummary: 'individual.read_clinical_summary',
     IndividualUpsertRelatedPerson: 'individual.upsert_related_person',
     IndividualMemberDisable: 'individual_member.disable',
     IndividualMemberPurge: 'individual_member.purge',
@@ -161,6 +162,12 @@ export const ActorCapabilityDocs = Object.freeze({
         programmingHint: 'Choose the route family carefully (`api`, `didcomm-plain`, `legacy-fhir`) to match the runtime transport profile.',
         relatedMethods: ['ingestCommunicationAndUpdateIndex'],
     },
+    [ActorCapabilities.IndividualReadClinicalSummary]: {
+        actorKind: ActorKinds.IndividualController,
+        summary: 'Reads the clinical summary currently available for one subject through an auditable Communication.',
+        programmingHint: 'Use requestClinicalSummary with Subject/$summary and attached FHIR Parameters. Do not route reads through ingestion methods.',
+        relatedMethods: ['requestClinicalSummary'],
+    },
     [ActorCapabilities.IndividualUpsertRelatedPerson]: {
         actorKind: ActorKinds.IndividualController,
         summary: 'Creates or updates one related-person/member relationship for the individual scope.',

package/dist/constants/verifiable-credentials.d.ts

@@ -44,6 +44,14 @@ export declare const IndividualCredentialTypes: Readonly<{
     IndividualControllerCredential: "IndividualControllerCredential";
     IndividualMemberCredential: "IndividualMemberCredential";
     IndividualSubjectCredential: "IndividualSubjectCredential";
+    /**
+     * Credential issued by a trusted portal/identity authority to bind two or
+     * more DIDs that identify the same individual.
+     *
+     * A physical card/support DID is not an individual alias: clients resolve
+     * the support document's `subject` first and bind that subject DID instead.
+     */
+    SubjectIdentityBindingCredential: "SubjectIdentityBindingCredential";
 }>;
 /**
  * Canonical credential subtype names used by inter-tenant authorization

package/dist/constants/verifiable-credentials.js

@@ -46,6 +46,14 @@ export const IndividualCredentialTypes = Object.freeze({
     IndividualControllerCredential: 'IndividualControllerCredential',
     IndividualMemberCredential: 'IndividualMemberCredential',
     IndividualSubjectCredential: 'IndividualSubjectCredential',
+    /**
+     * Credential issued by a trusted portal/identity authority to bind two or
+     * more DIDs that identify the same individual.
+     *
+     * A physical card/support DID is not an individual alias: clients resolve
+     * the support document's `subject` first and bind that subject DID instead.
+     */
+    SubjectIdentityBindingCredential: 'SubjectIdentityBindingCredential',
 });
 /**
  * Canonical credential subtype names used by inter-tenant authorization

package/dist/examples/index.d.ts

@@ -11,6 +11,7 @@ export * from './employee';
 export * from './license';
 export * from './invoice';
 export * from './inter-tenant-access-contract';
+export * from './subject-identity-binding';
 export * from './related-person';
 export * from './consent-access';
 export * from './relationship-access';

package/dist/examples/index.js

@@ -11,6 +11,7 @@ export * from './employee.js';
 export * from './license.js';
 export * from './invoice.js';
 export * from './inter-tenant-access-contract.js';
+export * from './subject-identity-binding.js';
 export * from './related-person.js';
 export * from './consent-access.js';
 export * from './relationship-access.js';

package/dist/examples/professional.js

@@ -210,115 +210,4 @@ function buildConsentDecisionScenario(params) {
  * consent state + actor target + role + purpose + requested scope.
  */
 export const EXAMPLE_PROFESSIONAL_CONSENT_SCENARIOS = Object.freeze({
-    physicianByEmailContinuousCareAllergiesAllowed: buildConsentDecisionScenario({
-        actorId: EXAMPLE_PHYSICIAN_EMAIL,
-        actorRole: HealthcareActorRoles.Physician,
-        purpose: HealthcareConsentPurposes.Treatment,
-        consentActions: [HealthcareBasicSections.AllergiesAndIntolerances.claim],
-        requestedSections: HealthcareBasicSections.AllergiesAndIntolerances.claim,
-        includedTypes: [
-            ResourceTypesFhirR4.Composition,
-            ResourceTypesFhirR4.AllergyIntolerance,
-            ResourceTypesFhirR4.DocumentReference,
-        ],
-        expectedSmartTokenDecision: 'allowed',
-        reason: 'physician is targeted directly by email and role for continuous care over allergies section',
-    }),
-    physicianByEmailEmergencySummaryAllowed: buildConsentDecisionScenario({
-        actorId: EXAMPLE_PHYSICIAN_EMAIL,
-        actorRole: HealthcareActorRoles.Physician,
-        purpose: HealthcareConsentPurposes.EmergencyTreatment,
-        consentActions: [HealthcareBasicSections.PatientSummaryDocument.claim],
-        requestedSections: HealthcareBasicSections.PatientSummaryDocument.claim,
-        includedTypes: [
-            ResourceTypesFhirR4.Composition,
-            ResourceTypesFhirR4.DocumentReference,
-            ResourceTypesFhirR4.Observation,
-        ],
-        expectedSmartTokenDecision: 'allowed',
-        reason: 'physician is targeted directly by email and role for emergency summary access',
-    }),
-    physicianByOrganizationResultsAllowed: buildConsentDecisionScenario({
-        actorId: { organizationUrl: EXAMPLE_PROVIDER_ORG_URL },
-        actorRole: HealthcareActorRoles.Physician,
-        purpose: HealthcareConsentPurposes.Treatment,
-        consentActions: [HealthcareBasicSections.Results.claim],
-        requestedSections: HealthcareBasicSections.Results.claim,
-        includedTypes: [
-            ResourceTypesFhirR4.Composition,
-            ResourceTypesFhirR4.DiagnosticReport,
-            ResourceTypesFhirR4.DocumentReference,
-        ],
-        expectedSmartTokenDecision: 'allowed',
-        reason: 'consent is granted to a physician role within a given organization for continuous care results access',
-    }),
-    physicianByJurisdictionEmergencySummaryAllowed: buildConsentDecisionScenario({
-        actorId: EXAMPLE_JURISDICTION,
-        actorRole: HealthcareActorRoles.Physician,
-        purpose: HealthcareConsentPurposes.EmergencyTreatment,
-        consentActions: [HealthcareBasicSections.PatientSummaryDocument.claim],
-        requestedSections: HealthcareBasicSections.PatientSummaryDocument.claim,
-        includedTypes: [
-            ResourceTypesFhirR4.Composition,
-            ResourceTypesFhirR4.DocumentReference,
-            ResourceTypesFhirR4.Observation,
-        ],
-        expectedSmartTokenDecision: 'allowed',
-        reason: 'consent is granted at jurisdiction level for physician emergency access',
-    }),
-    nursingByOrganizationMedicationHistoryAllowed: buildConsentDecisionScenario({
-        actorId: { organizationUrl: EXAMPLE_PROVIDER_ORG_URL },
-        actorRole: HealthcareActorRoles.NursingProfessional,
-        purpose: HealthcareConsentPurposes.Treatment,
-        consentActions: [HealthcareBasicSections.HistoryOfMedicationUse.claim],
-        requestedSections: HealthcareBasicSections.HistoryOfMedicationUse.claim,
-        includedTypes: [
-            ResourceTypesFhirR4.Composition,
-            ResourceTypesFhirR4.MedicationStatement,
-            ResourceTypesFhirR4.DocumentReference,
-        ],
-        expectedSmartTokenDecision: 'allowed',
-        reason: 'nursing professional is allowed to read medication history for treatment through organization-scoped consent',
-    }),
-    paramedicByJurisdictionEmergencySummaryAllowed: buildConsentDecisionScenario({
-        actorId: EXAMPLE_JURISDICTION,
-        actorRole: HealthcareActorRoles.Paramedic,
-        purpose: HealthcareConsentPurposes.EmergencyTreatment,
-        consentActions: [HealthcareBasicSections.PatientSummaryDocument.claim],
-        requestedSections: HealthcareBasicSections.PatientSummaryDocument.claim,
-        includedTypes: [
-            ResourceTypesFhirR4.Composition,
-            ResourceTypesFhirR4.DocumentReference,
-            ResourceTypesFhirR4.Observation,
-        ],
-        expectedSmartTokenDecision: 'allowed',
-        reason: 'paramedic receives emergency-only jurisdiction-scoped access to patient summary',
-    }),
-    physicianObstetricianDeniedWhenOnlyAllergiesConsent: buildConsentDecisionScenario({
-        actorId: EXAMPLE_PHYSICIAN_EMAIL,
-        actorRole: `${HealthcareActorRoles.Physician}:obstetrician`,
-        purpose: HealthcareConsentPurposes.Treatment,
-        consentActions: [HealthcareBasicSections.AllergiesAndIntolerances.claim],
-        requestedSections: HealthcareBasicSections.Results.claim,
-        includedTypes: [
-            ResourceTypesFhirR4.Composition,
-            ResourceTypesFhirR4.DiagnosticReport,
-            ResourceTypesFhirR4.DocumentReference,
-        ],
-        expectedSmartTokenDecision: 'denied',
-        reason: 'requested SMART scope targets results but active consent only covers allergies section',
-    }),
-    physicianByEmailDeniedWhenConsentRevokedAndNoOrgNorJurisdictionConsentIsActive: buildConsentDecisionScenario({
-        actorId: EXAMPLE_PHYSICIAN_EMAIL,
-        actorRole: HealthcareActorRoles.Physician,
-        purpose: HealthcareConsentPurposes.EmergencyTreatment,
-        consentActions: [HealthcareBasicSections.PatientSummaryDocument.claim],
-        requestedSections: HealthcareBasicSections.PatientSummaryDocument.claim,
-        includedTypes: [
-            ResourceTypesFhirR4.Composition,
-            ResourceTypesFhirR4.DocumentReference,
-        ],
-        expectedSmartTokenDecision: 'denied',
-        reason: 'matching consent rule existed before but is no longer active after controller deactivation/revocation',
-    }),
-});
+    physicianB

package/dist/examples/shared.d.ts

@@ -117,6 +117,8 @@ export declare const EXAMPLE_GATEWAY_PUBLIC_ORIGIN: "https://gateway.example.com
 export declare const EXAMPLE_HOST_PUBLIC_HOSTNAME: "host.example.com";
 export declare const EXAMPLE_PROVIDER_TAX_ID: "VATES-B00112233";
 export declare const EXAMPLE_PROVIDER_DOMAIN: "health-care.provider.example.org";
+/** Synthetic public portal domain used to derive organization path DIDs. */
+export declare const EXAMPLE_PUBLIC_PORTAL_DOMAIN: "portal.example.org";
 export declare const EXAMPLE_INDIVIDUAL_MULTIBASE_ID: string;
 export declare const EXAMPLE_INDIVIDUAL_MULTIBASE_ID_SECONDARY: string;
 export declare const EXAMPLE_INDIVIDUAL_MULTIBASE_ID_TERTIARY: string;

package/dist/examples/shared.js

@@ -136,6 +136,8 @@ export const EXAMPLE_GATEWAY_PUBLIC_ORIGIN = 'https://gateway.example.com';
 export const EXAMPLE_HOST_PUBLIC_HOSTNAME = 'host.example.com';
 export const EXAMPLE_PROVIDER_TAX_ID = 'VATES-B00112233';
 export const EXAMPLE_PROVIDER_DOMAIN = 'health-care.provider.example.org';
+/** Synthetic public portal domain used to derive organization path DIDs. */
+export const EXAMPLE_PUBLIC_PORTAL_DOMAIN = 'portal.example.org';
 export const EXAMPLE_INDIVIDUAL_MULTIBASE_ID = encodeHexToMultibase58btc('a87e5b15aea444759c7c40aa88354b6f');
 export const EXAMPLE_INDIVIDUAL_MULTIBASE_ID_SECONDARY = encodeHexToMultibase58btc('b98f6c24bfb545849d8d51bb99465c7e');
 export const EXAMPLE_INDIVIDUAL_MULTIBASE_ID_TERTIARY = encodeHexToMultibase58btc('c39f7d35c0c65695ae9e62cca0576d8f');

package/dist/examples/subject-identity-binding.d.ts

@@ -0,0 +1,9 @@
+/** Synthetic trusted portal DID used by binding examples and tests. */
+export declare const EXAMPLE_TRUSTED_HEALTH_PORTAL_DID: "did:web:portal.example.org";
+/** Synthetic individual DID exposed by one health portal. */
+export declare const EXAMPLE_PORTAL_INDIVIDUAL_DID: "did:web:portal.example.org:health-care:individual:multibase:zSubjectExample";
+/** Synthetic individual DID exposed by a second, independent portal. */
+export declare const EXAMPLE_ALTERNATE_PORTAL_INDIVIDUAL_DID: "did:web:cards.example.org:individual:multibase:zSubjectExample";
+/** Physical support/card DID used only to demonstrate that it is not an auth alias. */
+export declare const EXAMPLE_PHYSICAL_SUPPORT_DID: "did:web:cards.example.org:card:personal:000-000-000-001";
+export declare const EXAMPLE_SUBJECT_IDENTITY_BINDING_CREDENTIAL: Readonly<import("..").VerifiableCredentialV2>;

package/dist/examples/subject-identity-binding.js

@@ -0,0 +1,20 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+import { DataspaceSectors } from '../constants/sectors.js';
+import { buildSubjectIdentityBindingCredential } from '../utils/subject-identity-binding.js';
+/** Synthetic trusted portal DID used by binding examples and tests. */
+export const EXAMPLE_TRUSTED_HEALTH_PORTAL_DID = 'did:web:portal.example.org';
+/** Synthetic individual DID exposed by one health portal. */
+export const EXAMPLE_PORTAL_INDIVIDUAL_DID = 'did:web:portal.example.org:health-care:individual:multibase:zSubjectExample';
+/** Synthetic individual DID exposed by a second, independent portal. */
+export const EXAMPLE_ALTERNATE_PORTAL_INDIVIDUAL_DID = 'did:web:cards.example.org:individual:multibase:zSubjectExample';
+/** Physical support/card DID used only to demonstrate that it is not an auth alias. */
+export const EXAMPLE_PHYSICAL_SUPPORT_DID = 'did:web:cards.example.org:card:personal:000-000-000-001';
+export const EXAMPLE_SUBJECT_IDENTITY_BINDING_CREDENTIAL = Object.freeze(buildSubjectIdentityBindingCredential({
+    id: 'urn:uuid:subject-identity-binding-001',
+    issuerDid: EXAMPLE_TRUSTED_HEALTH_PORTAL_DID,
+    subjectDid: EXAMPLE_PORTAL_INDIVIDUAL_DID,
+    aliasDids: [EXAMPLE_ALTERNATE_PORTAL_INDIVIDUAL_DID],
+    sectors: [DataspaceSectors.HealthCare],
+    validFrom: '2026-01-01T00:00:00.000Z',
+    validUntil: '2027-01-01T00:00:00.000Z',
+}));

package/dist/models/index.d.ts

@@ -48,6 +48,7 @@ export * from './resource-document';
 export * from './relationship-access';
 export * from './response';
 export * from './subject-identifier-ledger';
+export * from './subject-identity-binding';
 export * from './urlPath';
 export * from './verifiable-credential';
 export * from './wallet';

package/dist/models/index.js

@@ -48,6 +48,7 @@ export * from './resource-document.js';
 export * from './relationship-access.js';
 export * from './response.js';
 export * from './subject-identifier-ledger.js';
+export * from './subject-identity-binding.js';
 export * from './urlPath.js';
 export * from './verifiable-credential.js';
 export * from './wallet.js';

package/dist/models/indexing.js

@@ -193,7 +193,7 @@ export function buildIndexParametersFromClaims(claims, allowedClaims) {
         const parameter = {
             name: claimKey,
             value: value,
-            type: inferParameterTypeFromClaimKey(claimKey, rawValue),
+            type: inferPa     type: inferParameterTypeFromClaimKey(claimKey, rawValue),
             ...(claimKey === ObservationClaim.ValueQuantityUnit && typeof rawValue === 'string'
                 ? { unit: rawValue }
                 : {}),

package/dist/models/subject-identity-binding.d.ts

@@ -0,0 +1,22 @@
+/** Canonical JSON members of a subject identity binding credential. */
+export declare const SubjectIdentityBindingClaims: Readonly<{
+    SubjectId: "id";
+    SameAs: "sameAs";
+    Sector: "sector";
+}>;
+/** Normalized, security-relevant projection of a subject identity binding VC. */
+export type SubjectIdentityBindingSummary = Readonly<{
+    issuerDid: string;
+    subjectDid: string;
+    aliasDids: readonly string[];
+    sectors: readonly string[];
+    validFrom?: string;
+    validUntil?: string;
+}>;
+/** Criteria used by a verifier after the enclosing VP has been verified. */
+export type SubjectIdentityBindingMatchCriteria = Readonly<{
+    trustedIssuerDids: readonly string[];
+    requiredSubjectDids: readonly string[];
+    sector?: string;
+    now?: string | Date;
+}>;

package/dist/models/subject-identity-binding.js

@@ -0,0 +1,7 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+/** Canonical JSON members of a subject identity binding credential. */
+export const SubjectIdentityBindingClaims = Object.freeze({
+    SubjectId: 'id',
+    SameAs: 'sameAs',
+    Sector: 'sector',
+});

package/dist/utils/bundle-entry-editor.js

@@ -234,7 +234,7 @@ export class BundleEntryEditor {
             resourceType: this.bundleEditor.getAllowedResourceType() || EmployeeResourceTypes.employee,
             meta: { claims: {} },
         };
-        entry.resource.meta = entry.resource.meta || {};
+        entry.resource.meta = entry.resource.meta || { claims: {} };
         entry.resource.meta.claims = {
             ...(entry.resource.meta.claims || {}),
             [String(key).trim()]: cloneClaimValue(value),
@@ -264,7 +264,7 @@ export class BundleEntryEditor {
             resourceType: this.bundleEditor.getAllowedResourceType() || EmployeeResourceTypes.employee,
             meta: { claims: {} },
         };
-        entry.resource.meta = entry.resource.meta || {};
+        entry.resource.meta = entry.resource.meta || { claims: {} };
         entry.resource.meta.claims = claims;
         return this;
     }

package/dist/utils/bundle-query.d.ts

@@ -1,8 +1,25 @@
 import type { BundleEntry, BundleJsonApi } from '../models/bundle.js';
+/** Canonical date interval shared by clinical Bundle read filters. */
+export type BundleResourceDateFilter = Readonly<{
+    start?: string;
+    end?: string;
+}>;
+/**
+ * Filters Bundle resources by section, resource type and clinical date.
+ *
+ * Use `types` and `date` in new code. The flat names remain temporary
+ * compatibility aliases for callers created before the document readers were
+ * aligned with `FhirDocumentFacade`.
+ */
 export type BundleResourceIdFilters = Readonly<{
     sections?: string | readonly string[];
+    types?: string | readonly string[];
+    date?: BundleResourceDateFilter;
+    /** @deprecated Use `types`. */
     resourceTypes?: string | readonly string[];
+    /** @deprecated Use `date.start`. */
     dateFrom?: string;
+    /** @deprecated Use `date.end`. */
     dateTo?: string;
 }>;
 /**

package/dist/utils/bundle-query.js

@@ -82,7 +82,7 @@ export class BundleQuery {
     }
     matchesResourceFilters(entry, filters) {
         const resourceType = asTrimmedString(entry?.resource?.resourceType);
-        const resourceTypeFilters = normalizeTokenInput(filters.resourceTypes);
+        const resourceTypeFilters = normalizeTokenInput(filters.types !== undefined ? filters.types : filters.resourceTypes);
         if (resourceTypeFilters.length > 0 && !resourceTypeFilters.includes(resourceType)) {
             return false;
         }
@@ -92,7 +92,9 @@ export class BundleQuery {
             return false;
         }
         const entryDate = this.resolveEntryDate(claims);
-        if (!this.matchesDateRange(entryDate, filters.dateFrom, filters.dateTo)) {
+        const dateFrom = filters.date !== undefined ? filters.date.start : filters.dateFrom;
+        const dateTo = filters.date !== undefined ? filters.date.end : filters.dateTo;
+        if (!this.matchesDateRange(entryDate, dateFrom, dateTo)) {
             return false;
         }
         return true;
@@ -116,6 +118,11 @@ export class BundleQuery {
             const normalized = String(key || '').toLowerCase();
             if (normalized.endsWith('.date')
                 || normalized.endsWith('.effective')
+                || normalized.endsWith('.effective-datetime')
+                || normalized.endsWith('.effective-period-start')
+                || normalized.endsWith('.onset-datetime')
+                || normalized.endsWith('.occurrence-datetime')
+                || normalized.endsWith('.recorded-date')
                 || normalized.endsWith('.sent')
                 || normalized.endsWith('.authored-on')) {
                 const dateValue = asTrimmedString(value);

package/dist/utils/bundle-reader.d.ts

@@ -114,6 +114,21 @@ export declare class BundleReader {
     getDocumentSectionResourceCount(sectionCodeOrClaim: string): number;
     /** Returns bundle resource references listed under one document section. */
     getDocumentSectionResourceReferences(sectionCodeOrClaim: string): string[];
+    /**
+     * Returns stable resource IDs that both belong to one Composition section
+     * and match the optional resource-type/date filters.
+     *
+     * Use this after `$summary` when a screen or channel needs the concrete
+     * resources for one section. `getDocumentSectionResourceCount(...)` counts
+     * declared Composition references; this method resolves those references
+     * against the returned Bundle and can narrow the result.
+     */
+    getDocumentSectionResourceIds(sectionCodeOrClaim: string, filters?: BundleResourceIdFilters): string[];
+    /**
+     * Returns cloned Bundle entries for the resources selected from one
+     * Composition section, optionally filtered by type and inclusive date range.
+     */
+    getDocumentSectionResourceEntries(sectionCodeOrClaim: string, filters?: BundleResourceIdFilters): BundleReaderEntry[];
     /** Returns the active entry response status when present. */
     getEntryResponseStatus(): string | undefined;
     /** Returns all active entry issue severities. */
@@ -150,6 +165,7 @@ export declare class BundleReader {
     private buildEntrySummary;
     private buildSeverityBucket;
     private resolveEntryIdentifier;
+    private resolveEntryReferenceCandidates;
 }
 export declare function unwrapBundleLikeResponseBody(input: unknown): Record<string, unknown>;
 export declare function readFirstBundleResourceFromResponseBody(input: unknown): Record<string, unknown> | undefined;

package/dist/utils/bundle-reader.js

@@ -235,7 +235,9 @@ export class BundleReader {
         if (!normalized) {
             return undefined;
         }
-        return this.getDocumentSections().find((section) => section.claim === normalized || section.code === normalized);
+        const normalizedClaim = normalizeSectionClaim(normalized);
+        return this.getDocumentSections().find((section) => section.code === normalized
+            || (section.claim !== undefined && normalizeSectionClaim(section.claim) === normalizedClaim));
     }
     /** Returns the number of resource references inside one document section. */
     getDocumentSectionResourceCount(sectionCodeOrClaim) {
@@ -245,6 +247,30 @@ export class BundleReader {
     getDocumentSectionResourceReferences(sectionCodeOrClaim) {
         return [...(this.getDocumentSectionByCode(sectionCodeOrClaim)?.entryReferences || [])];
     }
+    /**
+     * Returns stable resource IDs that both belong to one Composition section
+     * and match the optional resource-type/date filters.
+     *
+     * Use this after `$summary` when a screen or channel needs the concrete
+     * resources for one section. `getDocumentSectionResourceCount(...)` counts
+     * declared Composition references; this method resolves those references
+     * against the returned Bundle and can narrow the result.
+     */
+    getDocumentSectionResourceIds(sectionCodeOrClaim, filters = {}) {
+        const references = new Set(this.getDocumentSectionResourceReferences(sectionCodeOrClaim));
+        if (references.size === 0) {
+            return [];
+        }
+        return this.getResourceIds(filters).filter((resourceId) => this.getEntriesByIds([resourceId]).some((entry) => this.resolveEntryReferenceCandidates(entry)
+            .some((reference) => references.has(reference))));
+    }
+    /**
+     * Returns cloned Bundle entries for the resources selected from one
+     * Composition section, optionally filtered by type and inclusive date range.
+     */
+    getDocumentSectionResourceEntries(sectionCodeOrClaim, filters = {}) {
+        return this.getEntriesByIds(this.getDocumentSectionResourceIds(sectionCodeOrClaim, filters));
+    }
     /** Returns the active entry response status when present. */
     getEntryResponseStatus() {
         const entry = this.getRequiredActiveEntry();
@@ -434,10 +460,32 @@ export class BundleReader {
             .find((key) => String(key || '').toLowerCase().endsWith('.identifier'));
         return identifierKey ? normalizeOptionalString(claims[identifierKey]) : undefined;
     }
+    resolveEntryReferenceCandidates(entry) {
+        const resource = asRecord(entry.resource);
+        const resourceType = asNonEmptyString(resource.resourceType);
+        const resourceId = asNonEmptyString(resource.id);
+        return Array.from(new Set([
+            asNonEmptyString(entry.id),
+            asNonEmptyString(entry.fullUrl),
+            resourceId,
+            resourceType && resourceId ? `${resourceType}/${resourceId}` : undefined,
+            this.resolveEntryIdentifier(entry),
+        ].filter((value) => Boolean(value))));
+    }
 }
 function normalizeOptionalString(value) {
     return typeof value === 'string' && value.trim() ? value.trim() : undefined;
 }
+function normalizeSectionClaim(value) {
+    const [system, ...codeParts] = value.split('|');
+    if (codeParts.length === 0) {
+        return value.trim().toLowerCase();
+    }
+    const normalizedSystem = system.trim().toLowerCase() === 'http://loinc.org'
+        ? 'loinc'
+        : system.trim().toLowerCase();
+    return `${normalizedSystem}|${codeParts.join('|').trim().toLowerCase()}`;
+}
 export function unwrapBundleLikeResponseBody(input) {
     const body = input && typeof input === 'object' ? input : {};
     const nested = body.body && typeof body.body === 'object' ? body.body : undefined;

package/dist/utils/client-assertion.d.ts

@@ -1,4 +1,4 @@
-import { type JsonWebKey } from 'node:crypto';
+import { type JWK } from 'jose';
 export type ClientAssertionJwtAlgorithm = 'ES256' | 'ES384' | 'ES512' | 'EdDSA';
 export type BuildClientAssertionJwtInput = {
     clientId: string;
@@ -34,5 +34,5 @@ export declare function buildClientAssertionJwt(input: BuildClientAssertionJwtIn
  */
 export declare function buildClientAssertionFixture(input: BuildClientAssertionJwtInput): Promise<{
     jwt: string;
-    publicJwk: JsonWebKey;
+    publicJwk: JWK;
 }>;

package/dist/utils/clinical-resource-filter-editor.d.ts

@@ -0,0 +1,39 @@
+import type { BundleResourceDateFilter, BundleResourceIdFilters } from './bundle-query';
+/**
+ * Canonical high-level filter accepted by both Bundle section readers and
+ * `FhirDocumentFacade`.
+ */
+export type ClinicalResourceFilter = Readonly<{
+    sections?: string[];
+    types?: string[];
+    date?: BundleResourceDateFilter;
+}>;
+/**
+ * Chainable editor for one clinical document resource filter.
+ *
+ * The built value can be passed unchanged to:
+ *
+ * - `BundleReader.getDocumentSectionResourceIds(...)`
+ * - `BundleReader.getDocumentSectionResourceEntries(...)`
+ * - `FhirDocumentFacade.getResourcesByFilter(...)`
+ * - `FhirDocumentFacade.getResourceCount(...)`
+ */
+export declare class ClinicalResourceFilterEditor {
+    private sections?;
+    private types?;
+    private date?;
+    /** Replaces the selected Composition sections. An empty list means all. */
+    setSections(values: readonly string[]): this;
+    /** Replaces the selected FHIR resource types. An empty list means all. */
+    setTypes(values: readonly string[]): this;
+    /** Sets the complete clinical date interval. Either boundary may be omitted. */
+    setPeriod(start?: string, end?: string): this;
+    /** Sets or clears only the start boundary of the clinical date interval. */
+    setPeriodStart(start?: string): this;
+    /** Sets or clears only the end boundary of the clinical date interval. */
+    setPeriodEnd(end?: string): this;
+    /** Removes both clinical date boundaries. */
+    clearPeriod(): this;
+    /** Returns a detached canonical filter safe for either public reader. */
+    build(): ClinicalResourceFilter & BundleResourceIdFilters;
+}

package/dist/utils/clinical-resource-filter-editor.js

@@ -0,0 +1,84 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+/**
+ * Chainable editor for one clinical document resource filter.
+ *
+ * The built value can be passed unchanged to:
+ *
+ * - `BundleReader.getDocumentSectionResourceIds(...)`
+ * - `BundleReader.getDocumentSectionResourceEntries(...)`
+ * - `FhirDocumentFacade.getResourcesByFilter(...)`
+ * - `FhirDocumentFacade.getResourceCount(...)`
+ */
+export class ClinicalResourceFilterEditor {
+    sections;
+    types;
+    date;
+    /** Replaces the selected Composition sections. An empty list means all. */
+    setSections(values) {
+        this.sections = normalizeTokens(values);
+        return this;
+    }
+    /** Replaces the selected FHIR resource types. An empty list means all. */
+    setTypes(values) {
+        this.types = normalizeTokens(values);
+        return this;
+    }
+    /** Sets the complete clinical date interval. Either boundary may be omitted. */
+    setPeriod(start, end) {
+        this.date = buildDateFilter(start, end);
+        return this;
+    }
+    /** Sets or clears only the start boundary of the clinical date interval. */
+    setPeriodStart(start) {
+        this.date = buildDateFilter(start, this.date?.end);
+        return this;
+    }
+    /** Sets or clears only the end boundary of the clinical date interval. */
+    setPeriodEnd(end) {
+        this.date = buildDateFilter(this.date?.start, end);
+        return this;
+    }
+    /** Removes both clinical date boundaries. */
+    clearPeriod() {
+        this.date = undefined;
+        return this;
+    }
+    /** Returns a detached canonical filter safe for either public reader. */
+    build() {
+        return {
+            ...(this.sections?.length ? { sections: [...this.sections] } : {}),
+            ...(this.types?.length ? { types: [...this.types] } : {}),
+            ...(this.date ? { date: { ...this.date } } : {}),
+        };
+    }
+}
+function normalizeTokens(values) {
+    const normalized = [...new Set(values.map((value) => String(value || '').trim()).filter(Boolean))];
+    return normalized.length ? normalized : undefined;
+}
+function buildDateFilter(start, end) {
+    const normalizedStart = normalizeDate(start, 'start');
+    const normalizedEnd = normalizeDate(end, 'end');
+    if (normalizedStart && normalizedEnd) {
+        if (Date.parse(normalizedStart) > Date.parse(normalizedEnd)) {
+            throw new RangeError('Clinical resource filter period start must not be after end.');
+        }
+    }
+    if (!normalizedStart && !normalizedEnd) {
+        return undefined;
+    }
+    return {
+        ...(normalizedStart ? { start: normalizedStart } : {}),
+        ...(normalizedEnd ? { end: normalizedEnd } : {}),
+    };
+}
+function normalizeDate(value, boundary) {
+    const normalized = String(value || '').trim();
+    if (!normalized) {
+        return undefined;
+    }
+    if (!Number.isFinite(Date.parse(normalized))) {
+        throw new TypeError(`Clinical resource filter period ${boundary} must be a valid date.`);
+    }
+    return normalized;
+}

package/dist/utils/communication-bundle-document-request.d.ts

@@ -150,9 +150,10 @@ export declare function buildBundleSearchReferenceUrl(input: Readonly<{
 /**
  * Creates the canonical semantic parameters for an IPS summary-style request.
  *
- * These parameters are the source of truth. Current search flows flatten them
- * to `Communication.content-reference`, while future operation flows may attach
- * them directly as FHIR `Parameters`.
+ * These parameters are the source of truth. The canonical `$summary` read
+ * attaches them as one FHIR `Parameters` resource to an auditable
+ * `Communication`. Flattening them into a `Bundle/_search` reference is a
+ * compatibility path and must not be taught as the primary 101 read flow.
  */
 export declare function createSummaryOperationRequestParameters(subjectIdOrInput: string | CreateSummaryOperationParametersInput, filterSections?: string[]): ReadonlyArray<ParameterData>;
 /**
@@ -161,8 +162,8 @@ export declare function createSummaryOperationRequestParameters(subjectIdOrInput
  */
 export declare function createSummaryOperationRequestReferencePath(parameters: ReadonlyArray<ParameterData>): string;
 /**
- * Builds the preferred FHIR `Parameters` body for the same semantic summary
- * search represented by `createSummaryOperationRequestReferencePath(...)`.
+ * Builds the canonical FHIR `Parameters` body attached to a `$summary`
+ * request `Communication`.
  */
 export declare function createSummaryOperationRequestParametersResource(parameters: ReadonlyArray<ParameterData>): FhirParametersResource;
 export declare function buildCommunicationRequestOperationWithAttachedParametersClaims(input: CreateSummaryOperationCommunicationInput): Record<string, unknown>;
@@ -188,11 +189,11 @@ export declare const flattenParametersToSearchReference: typeof createSummaryOpe
  * carried inside `Communication`.
  *
  * Current split:
- * - `newSearchWithReferencePath(...)` keeps the existing `content-reference`
- *   search-url contract
- * - `setRequestSummaryOperation(...)` builds the operation contract where
+ * - `setRequestSummaryOperation(...)` is the canonical 101 read contract where
  *   `content-reference` points to the operation path and
  *   `content-attachment-data` carries the serialized FHIR `Parameters`
+ * - `newSearchWithReferencePath(...)` keeps the older flattened `_search`
+ *   compatibility contract
  */
 export declare const communication: Readonly<{
     /**

package/dist/utils/communication-bundle-document-request.js

@@ -217,9 +217,10 @@ export function buildBundleSearchReferenceUrl(input) {
 /**
  * Creates the canonical semantic parameters for an IPS summary-style request.
  *
- * These parameters are the source of truth. Current search flows flatten them
- * to `Communication.content-reference`, while future operation flows may attach
- * them directly as FHIR `Parameters`.
+ * These parameters are the source of truth. The canonical `$summary` read
+ * attaches them as one FHIR `Parameters` resource to an auditable
+ * `Communication`. Flattening them into a `Bundle/_search` reference is a
+ * compatibility path and must not be taught as the primary 101 read flow.
  */
 export function createSummaryOperationRequestParameters(subjectIdOrInput, filterSections) {
     const input = typeof subjectIdOrInput === 'string'
@@ -234,10 +235,14 @@ export function createSummaryOperationRequestParameters(subjectIdOrInput, filter
     if (!documentTypeDescriptor) {
         throw new Error(`Unsupported documentType: ${String(documentType)}`);
     }
+    const sections = normalizeStringArray(input.filterSections);
+    if (sections.includes('*')) {
+        throw new Error('Omit filterSections to request all available sections; "*" is reserved for SMART permission scopes.');
+    }
     return [
         buildSubjectParameter(subjectDid),
         buildDocumentTypeParameter(documentTypeDescriptor.id, documentTypeDescriptor.attributeValue),
-        ...buildSectionParameters(input.filterSections),
+        ...buildSectionParameters(sections),
     ];
 }
 /**
@@ -267,8 +272,8 @@ export function createSummaryOperationRequestReferencePath(parameters) {
     return `individual/org.hl7.fhir.r4/Bundle/_search?${params.filter(Boolean).join('&')}`;
 }
 /**
- * Builds the preferred FHIR `Parameters` body for the same semantic summary
- * search represented by `createSummaryOperationRequestReferencePath(...)`.
+ * Builds the canonical FHIR `Parameters` body attached to a `$summary`
+ * request `Communication`.
  */
 export function createSummaryOperationRequestParametersResource(parameters) {
     return buildFhirParametersResourceFromParameterData(parameters);
@@ -348,11 +353,11 @@ export const flattenParametersToSearchReference = createSummaryOperationRequestR
  * carried inside `Communication`.
  *
  * Current split:
- * - `newSearchWithReferencePath(...)` keeps the existing `content-reference`
- *   search-url contract
- * - `setRequestSummaryOperation(...)` builds the operation contract where
+ * - `setRequestSummaryOperation(...)` is the canonical 101 read contract where
  *   `content-reference` points to the operation path and
  *   `content-attachment-data` carries the serialized FHIR `Parameters`
+ * - `newSearchWithReferencePath(...)` keeps the older flattened `_search`
+ *   compatibility contract
  */
 export const communication = Object.freeze({
     /**

package/dist/utils/communication-fhir-r4.js

@@ -35,7 +35,8 @@ export function transformCommunicationClaimsToResourceFhirR4(communicationClaims
         const hasReference = Boolean(payloadReference);
         const hasCode = Boolean(payloadCodeRaw);
         const payloadKinds = [hasAttachment, hasReference, hasCode].filter(Boolean).length;
-        if (payloadKinds > 1) {
+        const isOperationReferenceWithParameters = hasAttachment && hasReference && !hasCode;
+        if (payloadKinds > 1 && !isOperationReferenceWithParameters) {
             const msg = `Communication[${index}] has more than one payload kind (attachment/reference/code).`;
             if (mode === 'strict')
                 throw new Error(msg);
@@ -50,10 +51,10 @@ export function transformCommunicationClaimsToResourceFhirR4(communicationClaims
                 throw new Error(msg);
             warnings.push(`${msg} Keeping first note only.`);
         }
-        const payload = buildPayload({
+        const payload = buildPayloads({
             hasAttachment,
-            hasReference,
-            hasCode,
+            hasReference: isOperationReferenceWithParameters || (!hasAttachment && hasReference),
+            hasCode: !hasAttachment && !hasReference && hasCode,
             payloadAttachmentData,
             payloadAttachmentType,
             payloadAttachmentTitle,
@@ -95,8 +96,8 @@ export function transformCommunicationClaimsToResourceFhirR4(communicationClaims
             resource['sender'] = { reference: sender };
         if (partOf)
             resource['partOf'] = [{ reference: partOf }];
-        if (payload)
-            resource['payload'] = [payload];
+        if (payload.length)
+            resource['payload'] = payload;
         if (noteValues.length)
             resource['note'] = [{ text: noteValues[0] }];
         return resource;
@@ -126,10 +127,13 @@ export function extractCommunicationClaimsFromResourceFhirR4(resource, options =
     const partOfRef = resource?.partOf?.[0]?.reference;
     const noteText = resource?.note?.[0]?.text;
     const categoryCoding = resource?.category?.[0]?.coding?.[0];
-    const payload = resource?.payload?.[0];
-    const contentReference = payload?.contentReference?.reference;
-    const contentAttachment = payload?.contentAttachment;
-    const contentCodeableConcept = payload?.contentCodeableConcept?.coding?.[0];
+    const payloads = resource?.payload || [];
+    const referencePayload = payloads.find((payload) => payload.contentReference !== undefined);
+    const attachmentPayload = payloads.find((payload) => payload.contentAttachment !== undefined);
+    const codePayload = payloads.find((payload) => payload.contentCodeableConcept !== undefined);
+    const contentReference = referencePayload?.contentReference?.reference;
+    const contentAttachment = attachmentPayload?.contentAttachment;
+    const contentCodeableConcept = codePayload?.contentCodeableConcept?.coding?.[0];
     setIf(claims, CommunicationClaim.Identifier, identifierValue);
     setIf(claims, CommunicationClaim.Status, status);
     setIf(claims, CommunicationClaim.Sent, sent);
@@ -177,8 +181,12 @@ function normalizeNoteValues(raw) {
     }
     return [];
 }
-function buildPayload(input) {
+function buildPayloads(input) {
     const { hasAttachment, hasReference, hasCode, payloadAttachmentData, payloadAttachmentType, payloadAttachmentTitle, payloadAttachmentUrl, payloadReference, payloadCodeRaw, } = input;
+    const payloads = [];
+    if (hasReference) {
+        payloads.push({ contentReference: { reference: payloadReference } });
+    }
     if (hasAttachment) {
         const value = {};
         if (payloadAttachmentData)
@@ -189,13 +197,12 @@ function buildPayload(input) {
             value['title'] = payloadAttachmentTitle;
         if (payloadAttachmentUrl)
             value['url'] = payloadAttachmentUrl;
-        return { contentAttachment: value };
+        payloads.push({ contentAttachment: value });
+    }
+    if (hasCode && payloadCodeRaw) {
+        payloads.push({ contentCodeableConcept: { coding: [parseSystemCode(payloadCodeRaw)] } });
     }
-    if (hasReference)
-        return { contentReference: { reference: payloadReference } };
-    if (hasCode && payloadCodeRaw)
-        return { contentCodeableConcept: { coding: [parseSystemCode(payloadCodeRaw)] } };
-    return undefined;
+    return payloads;
 }
 function parseSystemCode(value) {
     const trimmed = String(value || '').trim();

package/dist/utils/index.d.ts

@@ -99,6 +99,7 @@ export * from './permission-templates';
 export * from './smart-scope';
 export * from './service-act-reasons';
 export * from './same-as';
+export * from './subject-identity-binding';
 export * from './activation-request';
 export * from './vp-token';
 export * from './vital-sign-day-batch';

package/dist/utils/index.js

@@ -99,6 +99,7 @@ export * from './permission-templates.js';
 export * from './smart-scope.js';
 export * from './service-act-reasons.js';
 export * from './same-as.js';
+export * from './subject-identity-binding.js';
 export * from './activation-request.js';
 export * from './vp-token.js';
 export * from './vital-sign-day-batch.js';

package/dist/utils/legal-organization-onboarding-editor.d.ts

@@ -33,6 +33,19 @@ export type LegalOrganizationOnboardingDraftResult = Readonly<{
 export type LegalOrganizationGatewayVerificationSignatureFlow = 'certificate' | 'otp';
 export type LegalOrganizationGatewayVerificationRequestInput = Readonly<{
     controller: LegalOrganizationVerificationTransactionController;
+    /**
+     * Explicit public organization DID controlled by the registering portal.
+     * This is independent from the GW/service DID and from its network address.
+     */
+    publicOrganizationDid?: string;
+    /**
+     * Public portal domain used to derive the canonical path DID when
+     * `publicOrganizationDid` is omitted.
+     *
+     * Result:
+     * `did:web:<domain>:<sector>:organization:taxid:<tax-id>`
+     */
+    publicOrganizationDomain?: string;
     signatureFlow?: LegalOrganizationGatewayVerificationSignatureFlow;
     representativeSameAs?: string;
     verificationResourceType?: string;

package/dist/utils/legal-organization-onboarding-editor.js

@@ -1,5 +1,6 @@
 import { ClaimsOrganizationSchemaorg, ClaimsPersonSchemaorg, ClaimsServiceSchemaorg, } from '../constants/schemaorg.js';
 import { validateLegalOrganizationOnboardingClaims, } from './legal-organization-onboarding.js';
+import { buildHostedProviderDidWeb } from './did.js';
 function normalizeText(value) {
     return typeof value === 'string' ? value.trim() : '';
 }
@@ -275,16 +276,26 @@ export function createLegalOrganizationOnboardingFacade() {
         },
         buildGatewayVerificationRequest(fields, input) {
             const controllerEmail = facade.getControllerEmail(fields);
-            const serviceIdentifier = facade.getServiceIdentifier(fields);
             const serviceUrl = facade.getServiceUrl(fields);
+            const publicOrganizationDid = normalizeOptionalText(input.publicOrganizationDid);
+            const publicOrganizationDomain = normalizeOptionalText(input.publicOrganizationDomain);
+            const organizationDid = publicOrganizationDid || (publicOrganizationDomain
+                && facade.getServiceCategory(fields)
+                && facade.getTaxId(fields)
+                ? buildHostedProviderDidWeb({
+                    hostDomain: publicOrganizationDomain,
+                    sector: facade.getServiceCategory(fields),
+                    providerTaxId: facade.getTaxId(fields),
+                })
+                : undefined);
             const signatureFlow = normalizeText(input.signatureFlow || 'certificate').toLowerCase();
             const representativeSameAs = normalizeOptionalText(input.representativeSameAs || controllerEmail);
             const signedTermsPdfUrl = normalizeOptionalText(input.signedTermsPdfUrl);
             return facade.buildVerificationTransactionInput(fields, {
                 controller: input.controller,
-                organization: serviceIdentifier || serviceUrl
+                organization: organizationDid || serviceUrl
                     ? {
-                        ...(serviceIdentifier ? { did: serviceIdentifier } : {}),
+                        ...(organizationDid ? { did: organizationDid } : {}),
                         ...(serviceUrl ? { url: serviceUrl } : {}),
                     }
                     : undefined,

package/dist/utils/subject-identity-binding.d.ts

@@ -0,0 +1,28 @@
+import { type SubjectIdentityBindingMatchCriteria, type SubjectIdentityBindingSummary } from '../models/subject-identity-binding';
+import type { VerifiableCredentialV2 } from '../models/verifiable-credential';
+/**
+ * Builds the unsigned JSON form of a subject identity binding VC.
+ *
+ * This helper only builds the canonical payload. The issuer must sign it using
+ * the normal VC/VP signing flow before a verifier treats it as evidence.
+ */
+export declare function buildSubjectIdentityBindingCredential(input: Readonly<{
+    issuerDid: string;
+    subjectDid: string;
+    aliasDids: readonly string[];
+    sectors: readonly string[];
+    validFrom: string;
+    validUntil?: string;
+    id?: string;
+}>): VerifiableCredentialV2;
+/** Returns the normalized identity set asserted by one binding VC. */
+export declare function summarizeSubjectIdentityBinding(credential: unknown): SubjectIdentityBindingSummary | undefined;
+/** Checks issuer trust, validity, sector and exact DID membership. */
+export declare function matchesSubjectIdentityBinding(summary: SubjectIdentityBindingSummary | undefined, criteria: SubjectIdentityBindingMatchCriteria): boolean;
+/**
+ * Finds a matching binding credential in an already-verified VP token.
+ *
+ * This function decodes and matches claims; it does not verify signatures.
+ * Callers must first verify the enclosing VP/VC proof chain.
+ */
+export declare function getMatchingSubjectIdentityBindingFromVpToken(vpToken: string, criteria: SubjectIdentityBindingMatchCriteria): SubjectIdentityBindingSummary | undefined;

package/dist/utils/subject-identity-binding.js

@@ -0,0 +1,136 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+import { IndividualCredentialTypes, W3cCredentialContexts, W3cCredentialTypes, } from '../constants/verifiable-credentials.js';
+import { SubjectIdentityBindingClaims, } from '../models/subject-identity-binding.js';
+import { getVpCredentials } from './vp-token.js';
+function uniqueStrings(value) {
+    const values = Array.isArray(value) ? value : value ? [value] : [];
+    return Array.from(new Set(values.map((item) => String(item || '').trim()).filter(Boolean)));
+}
+function isDidWeb(value) {
+    return /^did:web:[^:\s]+(?::[^:\s]+)*$/.test(value);
+}
+function isPhysicalSupportDid(value) {
+    const segments = value.toLowerCase().split(':');
+    return segments.includes('card') || segments.includes('petd');
+}
+function isIndividualIdentityDid(value) {
+    return isDidWeb(value) && !isPhysicalSupportDid(value);
+}
+function includesCredentialType(credential) {
+    const types = uniqueStrings(credential?.type);
+    return types.includes(IndividualCredentialTypes.SubjectIdentityBindingCredential);
+}
+function normalizeNow(input) {
+    if (input instanceof Date)
+        return input.getTime();
+    if (input)
+        return new Date(input).getTime();
+    return Date.now();
+}
+/**
+ * Builds the unsigned JSON form of a subject identity binding VC.
+ *
+ * This helper only builds the canonical payload. The issuer must sign it using
+ * the normal VC/VP signing flow before a verifier treats it as evidence.
+ */
+export function buildSubjectIdentityBindingCredential(input) {
+    const issuerDid = String(input.issuerDid || '').trim();
+    const subjectDid = String(input.subjectDid || '').trim();
+    const aliasDids = uniqueStrings(input.aliasDids).filter((did) => did !== subjectDid);
+    const sectors = uniqueStrings(input.sectors);
+    if (!isDidWeb(issuerDid))
+        throw new Error('issuerDid must be a did:web identifier.');
+    if (!isIndividualIdentityDid(subjectDid)) {
+        throw new Error('subjectDid must be a did:web individual identifier, not a physical support DID.');
+    }
+    if (aliasDids.length === 0 || aliasDids.some((did) => !isIndividualIdentityDid(did))) {
+        throw new Error('aliasDids must contain at least one distinct did:web individual identifier and no physical support DID.');
+    }
+    if (sectors.length === 0)
+        throw new Error('sectors must contain at least one sector.');
+    if (!String(input.validFrom || '').trim() || Number.isNaN(Date.parse(input.validFrom))) {
+        throw new Error('validFrom must be an ISO date-time.');
+    }
+    if (input.validUntil && Number.isNaN(Date.parse(input.validUntil))) {
+        throw new Error('validUntil must be an ISO date-time.');
+    }
+    return {
+        '@context': [W3cCredentialContexts.V2],
+        ...(input.id ? { id: String(input.id).trim() } : {}),
+        type: [
+            W3cCredentialTypes.VerifiableCredential,
+            IndividualCredentialTypes.SubjectIdentityBindingCredential,
+        ],
+        issuer: issuerDid,
+        validFrom: String(input.validFrom).trim(),
+        ...(input.validUntil ? { validUntil: String(input.validUntil).trim() } : {}),
+        credentialSubject: {
+            [SubjectIdentityBindingClaims.SubjectId]: subjectDid,
+            [SubjectIdentityBindingClaims.SameAs]: aliasDids,
+            [SubjectIdentityBindingClaims.Sector]: sectors,
+        },
+    };
+}
+/** Returns the normalized identity set asserted by one binding VC. */
+export function summarizeSubjectIdentityBinding(credential) {
+    if (!credential || typeof credential !== 'object' || !includesCredentialType(credential))
+        return undefined;
+    const source = credential;
+    const issuerDid = String(source.issuer?.id || source.issuer || '').trim();
+    const subject = source.credentialSubject || {};
+    const subjectDid = String(subject[SubjectIdentityBindingClaims.SubjectId] || '').trim();
+    const aliasDids = uniqueStrings(subject[SubjectIdentityBindingClaims.SameAs])
+        .filter((did) => did !== subjectDid);
+    const sectors = uniqueStrings(subject[SubjectIdentityBindingClaims.Sector]);
+    if (!isDidWeb(issuerDid) || !isIndividualIdentityDid(subjectDid) || aliasDids.length === 0)
+        return undefined;
+    if (aliasDids.some((did) => !isIndividualIdentityDid(did)) || sectors.length === 0)
+        return undefined;
+    return {
+        issuerDid,
+        subjectDid,
+        aliasDids,
+        sectors,
+        validFrom: String(source.validFrom || '').trim() || undefined,
+        validUntil: String(source.validUntil || '').trim() || undefined,
+    };
+}
+/** Checks issuer trust, validity, sector and exact DID membership. */
+export function matchesSubjectIdentityBinding(summary, criteria) {
+    if (!summary)
+        return false;
+    if (!criteria.trustedIssuerDids.includes(summary.issuerDid))
+        return false;
+    const now = normalizeNow(criteria.now);
+    if (Number.isNaN(now))
+        return false;
+    if (summary.validFrom) {
+        const start = Date.parse(summary.validFrom);
+        if (Number.isNaN(start) || start > now)
+            return false;
+    }
+    if (summary.validUntil) {
+        const end = Date.parse(summary.validUntil);
+        if (Number.isNaN(end) || end < now)
+            return false;
+    }
+    if (criteria.sector && !summary.sectors.includes(criteria.sector))
+        return false;
+    const identities = new Set([summary.subjectDid, ...summary.aliasDids]);
+    const required = uniqueStrings(criteria.requiredSubjectDids);
+    return required.length > 0 && required.every((did) => identities.has(did));
+}
+/**
+ * Finds a matching binding credential in an already-verified VP token.
+ *
+ * This function decodes and matches claims; it does not verify signatures.
+ * Callers must first verify the enclosing VP/VC proof chain.
+ */
+export function getMatchingSubjectIdentityBindingFromVpToken(vpToken, criteria) {
+    for (const credential of getVpCredentials(vpToken)) {
+        const summary = summarizeSubjectIdentityBinding(credential);
+        if (matchesSubjectIdentityBinding(summary, criteria))
+            return summary;
+    }
+    return undefined;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-common-utils-ts",
-  "version": "2.3.3",
+  "version": "2.3.5",
   "publishConfig": {
     "access": "public"
   },