gdc-common-utils-ts 2.5.10 → 2.5.12

package/dist/constants/fhir-code-systems.d.ts

@@ -10,4 +10,5 @@ export declare const FhirCodeSystems: Readonly<{
     readonly Ucum: "http://unitsofmeasure.org";
     readonly CommunicationCategory: "http://terminology.hl7.org/CodeSystem/communication-category";
     readonly ObservationCategory: "http://terminology.hl7.org/CodeSystem/observation-category";
+    readonly EventTiming: "http://hl7.org/fhir/event-timing";
 }>;

package/dist/constants/fhir-code-systems.js

@@ -10,4 +10,5 @@ export const FhirCodeSystems = Object.freeze({
     Ucum: 'http://unitsofmeasure.org',
     CommunicationCategory: 'http://terminology.hl7.org/CodeSystem/communication-category',
     ObservationCategory: 'http://terminology.hl7.org/CodeSystem/observation-category',
+    EventTiming: 'http://hl7.org/fhir/event-timing',
 });

package/dist/constants/schemaorg.d.ts

@@ -141,6 +141,8 @@ export declare enum ClaimsIndividualProductSchemaorg {
 }
 export declare enum ClaimsOrderSchemaorg {
     acceptedOfferIdentifier = "org.schema.Order.acceptedOffer.identifier",
+    /** Schema.org Order.confirmationNumber; used for a customer-supplied order confirmation code. */
+    confirmationNumber = "org.schema.Order.confirmationNumber",
     partOfInvoice = "org.schema.Order.partOfInvoice",
     paymentMethod = "org.schema.Order.paymentMethod",
     paymentUrl = "org.schema.Order.paymentUrl",

package/dist/constants/schemaorg.js

@@ -148,6 +148,8 @@ export var ClaimsIndividualProductSchemaorg;
 export var ClaimsOrderSchemaorg;
 (function (ClaimsOrderSchemaorg) {
     ClaimsOrderSchemaorg["acceptedOfferIdentifier"] = "org.schema.Order.acceptedOffer.identifier";
+    /** Schema.org Order.confirmationNumber; used for a customer-supplied order confirmation code. */
+    ClaimsOrderSchemaorg["confirmationNumber"] = "org.schema.Order.confirmationNumber";
     ClaimsOrderSchemaorg["partOfInvoice"] = "org.schema.Order.partOfInvoice";
     ClaimsOrderSchemaorg["paymentMethod"] = "org.schema.Order.paymentMethod";
     ClaimsOrderSchemaorg["paymentUrl"] = "org.schema.Order.paymentUrl";

package/dist/constants/vital-signs.d.ts

@@ -4,6 +4,12 @@ export type { CodingDescriptor } from './observation-category';
  * Canonical LOINC descriptors for the currently supported Vital Signs.
  */
 export declare const VitalSignsCodes: Readonly<{
+    readonly BodyWeight: Readonly<{
+        system: string;
+        code: string;
+        display?: string;
+        claim: string;
+    }>;
     readonly HeartRate: Readonly<{
         system: string;
         code: string;

package/dist/constants/vital-signs.js

@@ -12,6 +12,7 @@ function defineCoding(system, code, display) {
  * Canonical LOINC descriptors for the currently supported Vital Signs.
  */
 export const VitalSignsCodes = Object.freeze({
+    BodyWeight: defineCoding(FhirCodeSystems.Loinc, '29463-7', 'Body weight'),
     HeartRate: defineCoding(FhirCodeSystems.Loinc, '8867-4', 'Heart rate'),
     BloodPressure: defineCoding(FhirCodeSystems.Loinc, '85354-9', 'Blood pressure panel'),
     SystolicBloodPressure: defineCoding(FhirCodeSystems.Loinc, '8480-6', 'Systolic blood pressure'),

package/dist/examples/index.d.ts

@@ -9,6 +9,7 @@ export * from './individual-controller';
 export * from './professional';
 export * from './employee';
 export * from './license';
+export * from './organization-role-license';
 export * from './invoice';
 export * from './inter-tenant-access-contract';
 export * from './subject-identity-binding';

package/dist/examples/index.js

@@ -9,6 +9,7 @@ export * from './individual-controller.js';
 export * from './professional.js';
 export * from './employee.js';
 export * from './license.js';
+export * from './organization-role-license.js';
 export * from './invoice.js';
 export * from './inter-tenant-access-contract.js';
 export * from './subject-identity-binding.js';

package/dist/examples/license.d.ts

@@ -78,6 +78,20 @@ export declare const EXAMPLE_LICENSE_AVAILABLE_RECORD: Readonly<{
         readonly "org.schema.Person.hasOccupation.identifier.value": "ISCO-08|2211";
     };
 }>;
+/** Complete stored device-license fixture for manager and repository tests. */
+export declare const EXAMPLE_DEVICE_LICENSE_AVAILABLE: Readonly<{
+    readonly id: "8a8a5e1b-0d8e-4a7c-8c39-3b8034440009";
+    readonly tenantId: "acme-id";
+    readonly orderId: "invoice-001";
+    readonly userClass: "employee";
+    readonly userCategory: "ISCO-08|2211";
+    readonly type: "mobile";
+    readonly status: "available";
+    readonly plan: "default";
+    readonly renewalCycle: "12m";
+    readonly reactivationEnabled: false;
+    readonly exp: 1893456000;
+}>;
 export declare const EXAMPLE_LICENSE_LIST_RESPONSE_BODY: Readonly<{
     readonly data: readonly [{
         readonly meta: {

package/dist/examples/license.js

@@ -2,7 +2,7 @@ import { DeviceAppTypes, DeviceBindingStatuses, DeviceUserClasses } from '../con
 import { ClaimsOrderSchemaorg, ClaimsIndividualProductSchemaorg, ClaimsOfferSchemaorg, ClaimsPersonSchemaorg, } from '../constants/schemaorg.js';
 import { buildLicenseIssueClaims, buildLicensePurchaseClaims, LicenseClaimContext, LicenseCategories, LicenseStatuses, } from '../utils/license.js';
 import { createLicenseOfferOrderEditor } from '../utils/license-offer-order.js';
-import { EXAMPLE_LICENSE_ACCEPTED_OFFER_ID, EXAMPLE_LICENSE_AMOUNT, EXAMPLE_LICENSE_CHECKOUT_URL, EXAMPLE_LICENSE_CURRENCY, EXAMPLE_EMAIL_CONTROLLER_ORG, EXAMPLE_EMPLOYEE_ACTIVATION_CODE, EXAMPLE_EMPLOYEE_DEVICE_CLIENT_ID_PRIMARY, EXAMPLE_EMPLOYEE_DEVICE_CLIENT_ID_SECONDARY, EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_PRIMARY, EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_SECONDARY, EXAMPLE_EMPLOYEE_DEVICE_MODEL_PRIMARY, EXAMPLE_HEALTHCARE_ACTOR_ROLE_GENERALIST_MEDICAL_PRACTITIONER, EXAMPLE_LICENSE_INVOICE_ID, EXAMPLE_LICENSE_OFFER_ID, EXAMPLE_LICENSE_PLAN_DEFAULT, EXAMPLE_LICENSE_PAYMENT_METHOD_INVOICE, EXAMPLE_LICENSE_PAYMENT_URL, EXAMPLE_LICENSE_RENEWAL_CYCLE_YEARLY, EXAMPLE_LICENSE_PLAN_NAME, EXAMPLE_LICENSE_SEAT_UUID_ACTIVE, EXAMPLE_LICENSE_SEAT_UUID_AVAILABLE, EXAMPLE_LICENSE_SEAT_UUID_SECONDARY, EXAMPLE_LICENSE_SKU, EXAMPLE_LICENSE_SUBJECT_ID_ACTIVE, EXAMPLE_LICENSE_SUBJECT_ID_AVAILABLE, } from './shared.js';
+import { EXAMPLE_LICENSE_ACCEPTED_OFFER_ID, EXAMPLE_LICENSE_AMOUNT, EXAMPLE_LICENSE_CHECKOUT_URL, EXAMPLE_LICENSE_CURRENCY, EXAMPLE_EMAIL_CONTROLLER_ORG, EXAMPLE_EMPLOYEE_ACTIVATION_CODE, EXAMPLE_EMPLOYEE_DEVICE_CLIENT_ID_PRIMARY, EXAMPLE_EMPLOYEE_DEVICE_CLIENT_ID_SECONDARY, EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_PRIMARY, EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_SECONDARY, EXAMPLE_EMPLOYEE_DEVICE_MODEL_PRIMARY, EXAMPLE_HEALTHCARE_ACTOR_ROLE_GENERALIST_MEDICAL_PRACTITIONER, EXAMPLE_LICENSE_INVOICE_ID, EXAMPLE_LICENSE_OFFER_ID, EXAMPLE_LICENSE_PLAN_DEFAULT, EXAMPLE_LICENSE_PAYMENT_METHOD_INVOICE, EXAMPLE_LICENSE_PAYMENT_URL, EXAMPLE_LICENSE_RENEWAL_CYCLE_YEARLY, EXAMPLE_LICENSE_PLAN_NAME, EXAMPLE_LICENSE_SEAT_UUID_ACTIVE, EXAMPLE_LICENSE_SEAT_UUID_AVAILABLE, EXAMPLE_LICENSE_SEAT_UUID_SECONDARY, EXAMPLE_LICENSE_SKU, EXAMPLE_LICENSE_SUBJECT_ID_ACTIVE, EXAMPLE_LICENSE_SUBJECT_ID_AVAILABLE, EXAMPLE_TENANT_IDENTIFIER, } from './shared.js';
 import { DEFAULT_LICENSE_DEVICE_ALLOWANCE } from '../utils/license.js';
 import { EXAMPLE_EMPLOYEE_CONTROLLER_ACTIVE } from './employee.js';
 export const EXAMPLE_EMPLOYEE_DEVICE_BINDINGS = Object.freeze([
@@ -70,6 +70,20 @@ export const EXAMPLE_LICENSE_AVAILABLE_RECORD = Object.freeze({
         [ClaimsIndividualProductSchemaorg.serialNumber]: EXAMPLE_LICENSE_SEAT_UUID_AVAILABLE,
     },
 });
+/** Complete stored device-license fixture for manager and repository tests. */
+export const EXAMPLE_DEVICE_LICENSE_AVAILABLE = Object.freeze({
+    id: EXAMPLE_LICENSE_SEAT_UUID_AVAILABLE,
+    tenantId: EXAMPLE_TENANT_IDENTIFIER,
+    orderId: EXAMPLE_LICENSE_INVOICE_ID,
+    userClass: DeviceUserClasses.Employee,
+    userCategory: EXAMPLE_HEALTHCARE_ACTOR_ROLE_GENERALIST_MEDICAL_PRACTITIONER,
+    type: DeviceAppTypes.Mobile,
+    status: LicenseStatuses.Available,
+    plan: EXAMPLE_LICENSE_PLAN_DEFAULT,
+    renewalCycle: EXAMPLE_LICENSE_RENEWAL_CYCLE_YEARLY,
+    reactivationEnabled: false,
+    exp: 1_893_456_000,
+});
 export const EXAMPLE_LICENSE_LIST_RESPONSE_BODY = Object.freeze({
     data: [
         {

package/dist/examples/organization-role-license.d.ts

@@ -0,0 +1,16 @@
+import type { OrganizationRoleLicense } from '../models/organization-role-license';
+import { type OrganizationRoleLicenseIdentity } from '../utils/organization-role-license';
+/** Reusable synthetic identity for role-licence contract and consumer tests. */
+export declare const EXAMPLE_ORGANIZATION_ROLE_LICENSE_IDENTITY: OrganizationRoleLicenseIdentity;
+/** Reusable catch-all plus exact-override policy example. */
+export declare const EXAMPLE_ORGANIZATION_ROLE_LICENSE_POLICIES: readonly (Readonly<{
+    sector: "";
+    active: true;
+    maxDevices: null;
+}> | Readonly<{
+    sector: "animal-care";
+    active: false;
+    maxDevices: 2;
+}>)[];
+/** Public ledger fixture: no clear contact or tenant-local employee UUID. */
+export declare const EXAMPLE_ORGANIZATION_ROLE_LICENSE: OrganizationRoleLicense;

package/dist/examples/organization-role-license.js

@@ -0,0 +1,37 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+import { buildStableActorIdentifier } from '../utils/actor-identifier.js';
+import { buildOrganizationRoleLicenseId, } from '../utils/organization-role-license.js';
+/** Reusable synthetic identity for role-licence contract and consumer tests. */
+export const EXAMPLE_ORGANIZATION_ROLE_LICENSE_IDENTITY = Object.freeze({
+    jurisdiction: 'es',
+    organizationId: 'urn:org:TAX:ES-B12345678',
+    stableContactIdentifier: buildStableActorIdentifier({
+        contactKind: 'email',
+        contact: 'professional@example.org',
+    }),
+    licensedRole: 'RESPRSN',
+});
+/** Reusable catch-all plus exact-override policy example. */
+export const EXAMPLE_ORGANIZATION_ROLE_LICENSE_POLICIES = Object.freeze([
+    Object.freeze({ sector: '', active: true, maxDevices: null }),
+    Object.freeze({ sector: 'animal-care', active: false, maxDevices: 2 }),
+]);
+/** Public ledger fixture: no clear contact or tenant-local employee UUID. */
+export const EXAMPLE_ORGANIZATION_ROLE_LICENSE = Object.freeze({
+    id: buildOrganizationRoleLicenseId(EXAMPLE_ORGANIZATION_ROLE_LICENSE_IDENTITY),
+    ...EXAMPLE_ORGANIZATION_ROLE_LICENSE_IDENTITY,
+    status: 'active',
+    data: [...EXAMPLE_ORGANIZATION_ROLE_LICENSE_POLICIES],
+    devices: [
+        Object.freeze({
+            clientId: 'example-client-health-1',
+            clientInstanceId: 'example-installation-health-1',
+            sector: 'health-care',
+            host: 'https://gw.example.org',
+            status: 'active',
+            activatedAt: 1_700_000_000,
+        }),
+    ],
+    createdAt: 1_700_000_000,
+    updatedAt: 1_700_000_000,
+});

package/dist/examples/shared.d.ts

@@ -296,9 +296,14 @@ export declare const EXAMPLE_LICENSE_CURRENCY: "EUR";
 export declare const EXAMPLE_LICENSE_PLAN_NAME: "Family starter";
 export declare const EXAMPLE_LICENSE_SKU: "FAM-START";
 export declare const EXAMPLE_LICENSE_PAYMENT_METHOD_INVOICE: "invoice";
+export declare const EXAMPLE_LICENSE_PAYMENT_METHOD_STRIPE: "Stripe";
 export declare const EXAMPLE_LICENSE_CHECKOUT_URL: "https://pay.example/offer-001";
 export declare const EXAMPLE_LICENSE_PAYMENT_URL: "https://pay.example/invoice-001";
 export declare const EXAMPLE_LICENSE_INVOICE_ID: "invoice-001";
+export declare const EXAMPLE_POSTAL_ACTIVATION_CODE: "EXAMPLE-ACTIVATION-001";
+export declare const EXAMPLE_POSTAL_ACTIVATION_CODE_INVALID: "EXAMPLE-ACTIVATION-INVALID";
+export declare const EXAMPLE_POSTAL_ACTIVATION_PEPPER: "example-host-pepper";
+export declare const EXAMPLE_POSTAL_ACTIVATION_SALT: "example-base64url-salt";
 export declare const EXAMPLE_INVOICE_DATE: "2026-06-11T10:00:00Z";
 export declare const EXAMPLE_INVOICE_CHARGEITEM_PRODUCT_CODE: "08412345678903";
 export declare const EXAMPLE_INVOICE_CHARGEITEM_PRODUCT_NAME: "Sterile saline bottle 500 mL";
@@ -347,6 +352,24 @@ export declare const EXAMPLE_VITAL_SIGN_VALUE_DIASTOLIC: 78;
 export declare const EXAMPLE_VITAL_SIGN_VALUE_BODY_TEMPERATURE: 37.1;
 export declare const EXAMPLE_VITAL_SIGN_UNIT_BEATS_PER_MINUTE: "/min";
 export declare const EXAMPLE_OBSERVATION_CATEGORY_VITAL_SIGNS: "http://terminology.hl7.org/CodeSystem/observation-category|vital-signs";
+/** Reusable LOINC Coding for body-weight Observation examples and metadata. */
+export declare const EXAMPLE_OBSERVATION_BODY_WEIGHT_CODING: Readonly<{
+    system: "http://loinc.org";
+    code: "29463-7";
+    display: "Body weight";
+}>;
+/** Reusable SNOMED CT Coding for anxiety Observation examples and metadata. */
+export declare const EXAMPLE_OBSERVATION_ANXIETY_CODING: Readonly<{
+    system: "http://snomed.info/sct";
+    code: "48694002";
+    display: "Anxiety";
+}>;
+/** Reusable FHIR event-timing Coding for a night-time event. */
+export declare const EXAMPLE_OBSERVATION_EVENT_TIMING_NIGHT_CODING: Readonly<{
+    system: "http://hl7.org/fhir/event-timing";
+    code: "NIGHT";
+    display: "Night";
+}>;
 export declare const EXAMPLE_VITAL_SIGN_CODE_HEART_RATE: "8867-4";
 export declare const EXAMPLE_VITAL_SIGN_CODE_BODY_TEMPERATURE: "8310-5";
 export declare const EXAMPLE_VITAL_SIGN_CODE_BLOOD_PRESSURE_PANEL: "85354-9";

package/dist/examples/shared.js

@@ -338,9 +338,14 @@ export const EXAMPLE_LICENSE_CURRENCY = 'EUR';
 export const EXAMPLE_LICENSE_PLAN_NAME = 'Family starter';
 export const EXAMPLE_LICENSE_SKU = 'FAM-START';
 export const EXAMPLE_LICENSE_PAYMENT_METHOD_INVOICE = 'invoice';
+export const EXAMPLE_LICENSE_PAYMENT_METHOD_STRIPE = 'Stripe';
 export const EXAMPLE_LICENSE_CHECKOUT_URL = 'https://pay.example/offer-001';
 export const EXAMPLE_LICENSE_PAYMENT_URL = 'https://pay.example/invoice-001';
 export const EXAMPLE_LICENSE_INVOICE_ID = 'invoice-001';
+export const EXAMPLE_POSTAL_ACTIVATION_CODE = 'EXAMPLE-ACTIVATION-001';
+export const EXAMPLE_POSTAL_ACTIVATION_CODE_INVALID = 'EXAMPLE-ACTIVATION-INVALID';
+export const EXAMPLE_POSTAL_ACTIVATION_PEPPER = 'example-host-pepper';
+export const EXAMPLE_POSTAL_ACTIVATION_SALT = 'example-base64url-salt';
 export const EXAMPLE_INVOICE_DATE = '2026-06-11T10:00:00Z';
 export const EXAMPLE_INVOICE_CHARGEITEM_PRODUCT_CODE = '08412345678903';
 export const EXAMPLE_INVOICE_CHARGEITEM_PRODUCT_NAME = 'Sterile saline bottle 500 mL';
@@ -389,6 +394,24 @@ export const EXAMPLE_VITAL_SIGN_VALUE_DIASTOLIC = 78;
 export const EXAMPLE_VITAL_SIGN_VALUE_BODY_TEMPERATURE = 37.1;
 export const EXAMPLE_VITAL_SIGN_UNIT_BEATS_PER_MINUTE = '/min';
 export const EXAMPLE_OBSERVATION_CATEGORY_VITAL_SIGNS = 'http://terminology.hl7.org/CodeSystem/observation-category|vital-signs';
+/** Reusable LOINC Coding for body-weight Observation examples and metadata. */
+export const EXAMPLE_OBSERVATION_BODY_WEIGHT_CODING = Object.freeze({
+    system: FhirCodeSystems.Loinc,
+    code: '29463-7',
+    display: 'Body weight',
+});
+/** Reusable SNOMED CT Coding for anxiety Observation examples and metadata. */
+export const EXAMPLE_OBSERVATION_ANXIETY_CODING = Object.freeze({
+    system: FhirCodeSystems.SnomedCt,
+    code: '48694002',
+    display: 'Anxiety',
+});
+/** Reusable FHIR event-timing Coding for a night-time event. */
+export const EXAMPLE_OBSERVATION_EVENT_TIMING_NIGHT_CODING = Object.freeze({
+    system: FhirCodeSystems.EventTiming,
+    code: 'NIGHT',
+    display: 'Night',
+});
 export const EXAMPLE_VITAL_SIGN_CODE_HEART_RATE = '8867-4';
 export const EXAMPLE_VITAL_SIGN_CODE_BODY_TEMPERATURE = '8310-5';
 export const EXAMPLE_VITAL_SIGN_CODE_BLOOD_PRESSURE_PANEL = '85354-9';

package/dist/models/index.d.ts

@@ -19,6 +19,7 @@ export * from './dataspace-discovery';
 export * from './dataspace-discovery-defaults';
 export * from './dataspace-protocol';
 export * from './device-license';
+export * from './organization-role-license';
 export * from './organization-employee-lifecycle';
 export * from './did';
 export * from './fhir-documents';

package/dist/models/index.js

@@ -19,6 +19,7 @@ export * from './dataspace-discovery.js';
 export * from './dataspace-discovery-defaults.js';
 export * from './dataspace-protocol.js';
 export * from './device-license.js';
+export * from './organization-role-license.js';
 export * from './organization-employee-lifecycle.js';
 export * from './did.js';
 export * from './fhir-documents.js';

package/dist/models/organization-role-license.d.ts

@@ -0,0 +1,45 @@
+import type { DeviceBindingStatus } from '../constants/device';
+/** Lifecycle of one organization-owned, role-bearing licence assignment. */
+export type OrganizationRoleLicenseStatus = 'active' | 'revoked';
+/**
+ * Contractual policy for one sector.
+ *
+ * `sector: ""` is the catch-all policy. An exact sector entry overrides it.
+ * `maxDevices: null` delegates the numeric limit to the GW/portal policy; it
+ * does not mean an unlimited number of installations.
+ */
+export interface OrganizationRoleLicenseSectorPolicy {
+    sector: string;
+    active: boolean;
+    maxDevices: number | null;
+}
+/** One concrete DCR installation registered against the licence. */
+export interface OrganizationRoleLicenseDevice {
+    clientId: string;
+    clientInstanceId: string;
+    sector: string;
+    host: string;
+    status: DeviceBindingStatus;
+    activatedAt: number;
+    revokedAt?: number;
+}
+/**
+ * Public ledger projection of one licence assigned by an organization.
+ *
+ * The stable contact is a one-way `urn:multibase:` identifier. Clear email,
+ * telephone, tenant-local employee UUIDs, payment details and application
+ * permissions must never be written to this asset.
+ */
+export interface OrganizationRoleLicense {
+    id: string;
+    organizationId: string;
+    jurisdiction: string;
+    stableContactIdentifier: string;
+    licensedRole: string;
+    status: OrganizationRoleLicenseStatus;
+    data: OrganizationRoleLicenseSectorPolicy[];
+    devices: OrganizationRoleLicenseDevice[];
+    createdAt: number;
+    updatedAt: number;
+    revokedAt?: number;
+}

package/dist/models/organization-role-license.js

@@ -0,0 +1,2 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+export {};

package/dist/utils/index.d.ts

@@ -88,6 +88,7 @@ export * from './organization-test-network-credential';
 export * from './test-network-organization-credentials';
 export * from './local-terminology-provider';
 export * from './license';
+export * from './organization-role-license';
 export * from './license-commercial-search';
 export * from './license-list-search';
 export * from './license-offer-order';

package/dist/utils/index.js

@@ -88,6 +88,7 @@ export * from './organization-test-network-credential.js';
 export * from './test-network-organization-credentials.js';
 export * from './local-terminology-provider.js';
 export * from './license.js';
+export * from './organization-role-license.js';
 export * from './license-commercial-search.js';
 export * from './license-list-search.js';
 export * from './license-offer-order.js';

package/dist/utils/organization-role-license.d.ts

@@ -0,0 +1,41 @@
+import type { OrganizationRoleLicense, OrganizationRoleLicenseDevice, OrganizationRoleLicenseSectorPolicy } from '../models/organization-role-license';
+export type OrganizationRoleLicenseIdentity = Readonly<{
+    jurisdiction: string;
+    organizationId: string;
+    stableContactIdentifier: string;
+    licensedRole: string;
+}>;
+/**
+ * Builds the exact, compact licence preimage agreed across portals and hosts.
+ * The preimage is hashed before persistence and is never itself a ledger key.
+ */
+export declare function buildOrganizationRoleLicensePreimage(identity: OrganizationRoleLicenseIdentity): string;
+/** SHA3-384 multihash identifier for organization + contact + licensed role. */
+export declare function buildOrganizationRoleLicenseId(identity: OrganizationRoleLicenseIdentity): string;
+/** Validates and de-duplicates sector policies while preserving input order. */
+export declare function normalizeOrganizationRoleLicensePolicies(policies: readonly OrganizationRoleLicenseSectorPolicy[]): OrganizationRoleLicenseSectorPolicy[];
+/** Exact sector policy wins; the empty-sector catch-all is only a fallback. */
+export declare function resolveOrganizationRoleLicensePolicy(policies: readonly OrganizationRoleLicenseSectorPolicy[], sector: string): OrganizationRoleLicenseSectorPolicy | undefined;
+/** Returns the contractual limit or the positive GW/portal default. */
+export declare function resolveOrganizationRoleLicenseMaxDevices(policy: OrganizationRoleLicenseSectorPolicy, defaultMaxDevices: number): number;
+/** Checks global status plus the resolved exact/catch-all sector policy. */
+export declare function organizationRoleLicenseAllowsSector(license: Readonly<{
+    status: OrganizationRoleLicense['status'];
+    data: readonly OrganizationRoleLicenseSectorPolicy[];
+}>, sector: string): boolean;
+/** Active DCR installations are counted per concrete sector, across hosts/apps. */
+export declare function countActiveOrganizationRoleLicenseDevices(devices: readonly OrganizationRoleLicenseDevice[], sector: string): number;
+/**
+ * Deterministic DCR admission decision. Re-registering the same active client
+ * is idempotent and does not consume an additional device slot.
+ */
+export declare function organizationRoleLicenseAllowsDevice(license: Readonly<{
+    status: OrganizationRoleLicense['status'];
+    data: readonly OrganizationRoleLicenseSectorPolicy[];
+    devices: readonly OrganizationRoleLicenseDevice[];
+}>, input: Readonly<{
+    sector: string;
+    clientId: string;
+    clientInstanceId: string;
+    defaultMaxDevices: number;
+}>): boolean;

package/dist/utils/organization-role-license.js

@@ -0,0 +1,99 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+import { encodeMultibaseSha3 } from './multibasehash.js';
+function required(value, label) {
+    const normalized = String(value || '').trim();
+    if (!normalized)
+        throw new TypeError(`${label} is required.`);
+    return normalized;
+}
+function normalizedSector(value) {
+    return String(value || '').trim().toLowerCase();
+}
+function validateStableContactIdentifier(value) {
+    const normalized = required(value, 'stableContactIdentifier');
+    if (!/^urn:multibase:z[1-9A-HJ-NP-Za-km-z]+$/.test(normalized)) {
+        throw new TypeError('stableContactIdentifier must be a canonical urn:multibase value.');
+    }
+    return normalized;
+}
+/**
+ * Builds the exact, compact licence preimage agreed across portals and hosts.
+ * The preimage is hashed before persistence and is never itself a ledger key.
+ */
+export function buildOrganizationRoleLicensePreimage(identity) {
+    const jurisdiction = required(identity.jurisdiction, 'jurisdiction').toLowerCase();
+    const organizationId = required(identity.organizationId, 'organizationId');
+    const stableContactIdentifier = validateStableContactIdentifier(identity.stableContactIdentifier);
+    const licensedRole = required(identity.licensedRole, 'licensedRole');
+    return `urn:cds-${jurisdiction}:${organizationId}:${stableContactIdentifier}:${licensedRole}`;
+}
+/** SHA3-384 multihash identifier for organization + contact + licensed role. */
+export function buildOrganizationRoleLicenseId(identity) {
+    return `urn:multibase:${encodeMultibaseSha3(buildOrganizationRoleLicensePreimage(identity), 384)}`;
+}
+/** Validates and de-duplicates sector policies while preserving input order. */
+export function normalizeOrganizationRoleLicensePolicies(policies) {
+    if (!Array.isArray(policies) || policies.length === 0) {
+        throw new TypeError('At least one licence sector policy is required.');
+    }
+    const seen = new Set();
+    return policies.map((policy) => {
+        const sector = normalizedSector(policy.sector);
+        if (seen.has(sector))
+            throw new TypeError(`Duplicate licence sector policy: ${sector || '<all>'}.`);
+        seen.add(sector);
+        if (policy.maxDevices !== null
+            && (!Number.isInteger(policy.maxDevices) || policy.maxDevices < 1)) {
+            throw new TypeError('maxDevices must be null or a positive integer.');
+        }
+        return { sector, active: Boolean(policy.active), maxDevices: policy.maxDevices };
+    });
+}
+/** Exact sector policy wins; the empty-sector catch-all is only a fallback. */
+export function resolveOrganizationRoleLicensePolicy(policies, sector) {
+    const requested = required(sector, 'sector').toLowerCase();
+    return policies.find((policy) => normalizedSector(policy.sector) === requested)
+        ?? policies.find((policy) => normalizedSector(policy.sector) === '');
+}
+/** Returns the contractual limit or the positive GW/portal default. */
+export function resolveOrganizationRoleLicenseMaxDevices(policy, defaultMaxDevices) {
+    if (policy.maxDevices !== null)
+        return policy.maxDevices;
+    if (!Number.isInteger(defaultMaxDevices) || defaultMaxDevices < 1) {
+        throw new TypeError('defaultMaxDevices must be a positive integer.');
+    }
+    return defaultMaxDevices;
+}
+/** Checks global status plus the resolved exact/catch-all sector policy. */
+export function organizationRoleLicenseAllowsSector(license, sector) {
+    if (license.status !== 'active')
+        return false;
+    return resolveOrganizationRoleLicensePolicy(license.data, sector)?.active === true;
+}
+/** Active DCR installations are counted per concrete sector, across hosts/apps. */
+export function countActiveOrganizationRoleLicenseDevices(devices, sector) {
+    const requested = required(sector, 'sector').toLowerCase();
+    return devices.filter((device) => device.status === 'active'
+        && normalizedSector(device.sector) === requested).length;
+}
+/**
+ * Deterministic DCR admission decision. Re-registering the same active client
+ * is idempotent and does not consume an additional device slot.
+ */
+export function organizationRoleLicenseAllowsDevice(license, input) {
+    const sector = required(input.sector, 'sector').toLowerCase();
+    const clientId = required(input.clientId, 'clientId');
+    const clientInstanceId = required(input.clientInstanceId, 'clientInstanceId');
+    if (!organizationRoleLicenseAllowsSector(license, sector))
+        return false;
+    if (license.devices.some((device) => device.status === 'active'
+        && device.clientId === clientId
+        && device.clientInstanceId === clientInstanceId
+        && normalizedSector(device.sector) === sector))
+        return true;
+    const policy = resolveOrganizationRoleLicensePolicy(license.data, sector);
+    if (!policy)
+        return false;
+    return countActiveOrganizationRoleLicenseDevices(license.devices, sector)
+        < resolveOrganizationRoleLicenseMaxDevices(policy, input.defaultMaxDevices);
+}

package/dist/utils/organization-test-network-credential.d.ts

@@ -1,4 +1,6 @@
 import type { VerifiableCredentialV2 } from '../models/verifiable-credential';
+/** Canonical protected-code algorithm used by postal activation bindings. */
+export declare const POSTAL_ACTIVATION_CODE_BINDING_ALGORITHM: "scrypt-v1";
 /** Lifecycle for a separate postal-address verification credential. */
 export declare const PostalActivationLicenseStatuses: Readonly<{
     readonly Issued: "issued";
@@ -22,7 +24,7 @@ export type PostalActivationLicenseBinding = Readonly<{
     controllerKeyMaterial: string;
     postalAddressHash: string;
     protectedCode: Readonly<{
-        algorithm: 'scrypt-v1';
+        algorithm: typeof POSTAL_ACTIVATION_CODE_BINDING_ALGORITHM;
         salt: string;
         digest: string;
     }>;
@@ -34,6 +36,8 @@ export type PostalActivationLicenseBinding = Readonly<{
     deliveredAt?: string;
     redeemedAt?: string;
 }>;
+/** Reusable protected-code slice stored in encrypted host registration state. */
+export type PostalActivationCodeBinding = PostalActivationLicenseBinding['protectedCode'];
 /** Input for the credential returned out-of-band to the applicant controller. */
 export type OrganizationTestNetworkCredentialInput = Readonly<{
     issuerDid: string;

package/dist/utils/organization-test-network-credential.js

@@ -1,4 +1,6 @@
 import { ContractCredentialTypes, W3cCredentialContexts, W3cCredentialTypes, } from '../constants/verifiable-credentials.js';
+/** Canonical protected-code algorithm used by postal activation bindings. */
+export const POSTAL_ACTIVATION_CODE_BINDING_ALGORITHM = 'scrypt-v1';
 /** Lifecycle for a separate postal-address verification credential. */
 export const PostalActivationLicenseStatuses = Object.freeze({
     Issued: 'issued',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-common-utils-ts",
-  "version": "2.5.10",
+  "version": "2.5.12",
   "publishConfig": {
     "access": "public"
   },
@@ -24,7 +24,8 @@
     "verify:dist": "node scripts/verify-dist-syntax.mjs",
     "check:product-neutrality": "node scripts/check-product-neutrality.mjs",
     "prepack": "npm run verify:dist",
-    "prepublishOnly": "npm run check:product-neutrality && npm run typecheck && npm test -- --watchman=false && npm run build"
+    "prepublishOnly": "npm run check:product-neutrality && npm run typecheck && npm test -- --watchman=false && npm run build",
+    "prepare": "npm run build"
   },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",