gdc-common-utils-ts 2.5.12 → 2.5.15

package/dist/examples/organization-role-license.d.ts

@@ -2,12 +2,8 @@ import type { OrganizationRoleLicense } from '../models/organization-role-licens
 import { type OrganizationRoleLicenseIdentity } from '../utils/organization-role-license';
 /** Reusable synthetic identity for role-licence contract and consumer tests. */
 export declare const EXAMPLE_ORGANIZATION_ROLE_LICENSE_IDENTITY: OrganizationRoleLicenseIdentity;
-/** Reusable catch-all plus exact-override policy example. */
-export declare const EXAMPLE_ORGANIZATION_ROLE_LICENSE_POLICIES: readonly (Readonly<{
-    sector: "";
-    active: true;
-    maxDevices: null;
-}> | Readonly<{
+/** Reusable exact-sector policies; no empty-sector wildcard is authored. */
+export declare const EXAMPLE_ORGANIZATION_ROLE_LICENSE_POLICIES: readonly (import("..").OrganizationRoleLicenseSectorPolicy | Readonly<{
     sector: "animal-care";
     active: false;
     maxDevices: 2;

package/dist/examples/organization-role-license.js

@@ -1,20 +1,22 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
-import { buildStableActorIdentifier } from '../utils/actor-identifier.js';
-import { buildOrganizationRoleLicenseId, } from '../utils/organization-role-license.js';
+import { buildStableActorIdentifier, StableActorContactKinds } from '../utils/actor-identifier.js';
+import { buildOrganizationRoleLicenseId, DEFAULT_ORGANIZATION_ROLE_LICENSE_POLICY, } from '../utils/organization-role-license.js';
+import { EXAMPLE_EMAIL_PROFESSIONAL, EXAMPLE_JURISDICTION, EXAMPLE_LEGAL_ORGANIZATION_TAX_ID, EXAMPLE_ORGANIZATION_CONTROLLER_ROLE, } from './shared.js';
+import { DataspaceSectors } from '../constants/sectors.js';
 /** Reusable synthetic identity for role-licence contract and consumer tests. */
 export const EXAMPLE_ORGANIZATION_ROLE_LICENSE_IDENTITY = Object.freeze({
-    jurisdiction: 'es',
-    organizationId: 'urn:org:TAX:ES-B12345678',
+    jurisdiction: EXAMPLE_JURISDICTION,
+    organizationOfficialId: EXAMPLE_LEGAL_ORGANIZATION_TAX_ID,
     stableContactIdentifier: buildStableActorIdentifier({
-        contactKind: 'email',
-        contact: 'professional@example.org',
+        contactKind: StableActorContactKinds.Email,
+        contact: EXAMPLE_EMAIL_PROFESSIONAL,
     }),
-    licensedRole: 'RESPRSN',
+    licensedRole: EXAMPLE_ORGANIZATION_CONTROLLER_ROLE,
 });
-/** Reusable catch-all plus exact-override policy example. */
+/** Reusable exact-sector policies; no empty-sector wildcard is authored. */
 export const EXAMPLE_ORGANIZATION_ROLE_LICENSE_POLICIES = Object.freeze([
-    Object.freeze({ sector: '', active: true, maxDevices: null }),
-    Object.freeze({ sector: 'animal-care', active: false, maxDevices: 2 }),
+    DEFAULT_ORGANIZATION_ROLE_LICENSE_POLICY,
+    Object.freeze({ sector: DataspaceSectors.AnimalCare, active: false, maxDevices: 2 }),
 ]);
 /** Public ledger fixture: no clear contact or tenant-local employee UUID. */
 export const EXAMPLE_ORGANIZATION_ROLE_LICENSE = Object.freeze({
@@ -22,16 +24,6 @@ export const EXAMPLE_ORGANIZATION_ROLE_LICENSE = Object.freeze({
     ...EXAMPLE_ORGANIZATION_ROLE_LICENSE_IDENTITY,
     status: 'active',
     data: [...EXAMPLE_ORGANIZATION_ROLE_LICENSE_POLICIES],
-    devices: [
-        Object.freeze({
-            clientId: 'example-client-health-1',
-            clientInstanceId: 'example-installation-health-1',
-            sector: 'health-care',
-            host: 'https://gw.example.org',
-            status: 'active',
-            activatedAt: 1_700_000_000,
-        }),
-    ],
     createdAt: 1_700_000_000,
     updatedAt: 1_700_000_000,
 });

package/dist/models/organization-role-license.d.ts

@@ -1,44 +1,33 @@
-import type { DeviceBindingStatus } from '../constants/device';
+import type { DataspaceSector } from '../constants/sectors';
 /** Lifecycle of one organization-owned, role-bearing licence assignment. */
 export type OrganizationRoleLicenseStatus = 'active' | 'revoked';
 /**
  * Contractual policy for one sector.
  *
- * `sector: ""` is the catch-all policy. An exact sector entry overrides it.
- * `maxDevices: null` delegates the numeric limit to the GW/portal policy; it
- * does not mean an unlimited number of installations.
+ * Every entry targets one canonical dataspace sector. Omitting `maxDevices`
+ * delegates the numeric limit to the GW/portal policy.
  */
 export interface OrganizationRoleLicenseSectorPolicy {
-    sector: string;
+    sector: DataspaceSector;
     active: boolean;
-    maxDevices: number | null;
-}
-/** One concrete DCR installation registered against the licence. */
-export interface OrganizationRoleLicenseDevice {
-    clientId: string;
-    clientInstanceId: string;
-    sector: string;
-    host: string;
-    status: DeviceBindingStatus;
-    activatedAt: number;
-    revokedAt?: number;
+    maxDevices?: number;
 }
 /**
  * Public ledger projection of one licence assigned by an organization.
  *
  * The stable contact is a one-way `urn:multibase:` identifier. Clear email,
- * telephone, tenant-local employee UUIDs, payment details and application
- * permissions must never be written to this asset.
+ * telephone, tenant-local employee UUIDs, payment details, DCR registrations,
+ * hosts and application permissions must never be written to this asset.
  */
 export interface OrganizationRoleLicense {
     id: string;
-    organizationId: string;
+    /** Official legal identifier value; never an embedded `urn:org:*` identifier. */
+    organizationOfficialId: string;
     jurisdiction: string;
     stableContactIdentifier: string;
     licensedRole: string;
     status: OrganizationRoleLicenseStatus;
     data: OrganizationRoleLicenseSectorPolicy[];
-    devices: OrganizationRoleLicenseDevice[];
     createdAt: number;
     updatedAt: number;
     revokedAt?: number;

package/dist/utils/actor-identifier.d.ts

@@ -1,4 +1,8 @@
-export type StableActorContactKind = 'email' | 'phone';
+export declare const StableActorContactKinds: Readonly<{
+    readonly Email: "email";
+    readonly Phone: "phone";
+}>;
+export type StableActorContactKind = typeof StableActorContactKinds[keyof typeof StableActorContactKinds];
 /**
  * Builds the private, stable actor identifier shared by independent portals.
  *

package/dist/utils/actor-identifier.js

@@ -1,5 +1,9 @@
 import { normalizePhone } from './consent.js';
 import { normalizeSameAsHash, normalizeTelephoneHash } from './same-as.js';
+export const StableActorContactKinds = Object.freeze({
+    Email: 'email',
+    Phone: 'phone',
+});
 /**
  * Builds the private, stable actor identifier shared by independent portals.
  *

package/dist/utils/organization-role-license.d.ts

@@ -1,10 +1,12 @@
-import type { OrganizationRoleLicense, OrganizationRoleLicenseDevice, OrganizationRoleLicenseSectorPolicy } from '../models/organization-role-license';
+import type { OrganizationRoleLicense, OrganizationRoleLicenseSectorPolicy } from '../models/organization-role-license';
 export type OrganizationRoleLicenseIdentity = Readonly<{
     jurisdiction: string;
-    organizationId: string;
+    organizationOfficialId: string;
     stableContactIdentifier: string;
     licensedRole: string;
 }>;
+export declare const DEFAULT_ORGANIZATION_ROLE_LICENSE_POLICY: OrganizationRoleLicenseSectorPolicy;
+export declare function validateOrganizationOfficialId(value: string): string;
 /**
  * Builds the exact, compact licence preimage agreed across portals and hosts.
  * The preimage is hashed before persistence and is never itself a ledger key.
@@ -14,28 +16,12 @@ export declare function buildOrganizationRoleLicensePreimage(identity: Organizat
 export declare function buildOrganizationRoleLicenseId(identity: OrganizationRoleLicenseIdentity): string;
 /** Validates and de-duplicates sector policies while preserving input order. */
 export declare function normalizeOrganizationRoleLicensePolicies(policies: readonly OrganizationRoleLicenseSectorPolicy[]): OrganizationRoleLicenseSectorPolicy[];
-/** Exact sector policy wins; the empty-sector catch-all is only a fallback. */
+/** Resolves the exact canonical sector policy. */
 export declare function resolveOrganizationRoleLicensePolicy(policies: readonly OrganizationRoleLicenseSectorPolicy[], sector: string): OrganizationRoleLicenseSectorPolicy | undefined;
 /** Returns the contractual limit or the positive GW/portal default. */
 export declare function resolveOrganizationRoleLicenseMaxDevices(policy: OrganizationRoleLicenseSectorPolicy, defaultMaxDevices: number): number;
-/** Checks global status plus the resolved exact/catch-all sector policy. */
+/** Checks global status plus the resolved exact-sector policy. */
 export declare function organizationRoleLicenseAllowsSector(license: Readonly<{
     status: OrganizationRoleLicense['status'];
     data: readonly OrganizationRoleLicenseSectorPolicy[];
 }>, sector: string): boolean;
-/** Active DCR installations are counted per concrete sector, across hosts/apps. */
-export declare function countActiveOrganizationRoleLicenseDevices(devices: readonly OrganizationRoleLicenseDevice[], sector: string): number;
-/**
- * Deterministic DCR admission decision. Re-registering the same active client
- * is idempotent and does not consume an additional device slot.
- */
-export declare function organizationRoleLicenseAllowsDevice(license: Readonly<{
-    status: OrganizationRoleLicense['status'];
-    data: readonly OrganizationRoleLicenseSectorPolicy[];
-    devices: readonly OrganizationRoleLicenseDevice[];
-}>, input: Readonly<{
-    sector: string;
-    clientId: string;
-    clientInstanceId: string;
-    defaultMaxDevices: number;
-}>): boolean;

package/dist/utils/organization-role-license.js

@@ -1,5 +1,6 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
 import { encodeMultibaseSha3 } from './multibasehash.js';
+import { DataspaceSectors } from '../constants/sectors.js';
 function required(value, label) {
     const normalized = String(value || '').trim();
     if (!normalized)
@@ -9,6 +10,10 @@ function required(value, label) {
 function normalizedSector(value) {
     return String(value || '').trim().toLowerCase();
 }
+export const DEFAULT_ORGANIZATION_ROLE_LICENSE_POLICY = Object.freeze({
+    sector: DataspaceSectors.OneHealthResearch,
+    active: true,
+});
 function validateStableContactIdentifier(value) {
     const normalized = required(value, 'stableContactIdentifier');
     if (!/^urn:multibase:z[1-9A-HJ-NP-Za-km-z]+$/.test(normalized)) {
@@ -16,16 +21,23 @@ function validateStableContactIdentifier(value) {
     }
     return normalized;
 }
+export function validateOrganizationOfficialId(value) {
+    const normalized = required(value, 'organizationOfficialId');
+    if (normalized.includes(':') || /^urn:/i.test(normalized)) {
+        throw new TypeError('organizationOfficialId must be the official identifier value, not an organization URN.');
+    }
+    return normalized;
+}
 /**
  * Builds the exact, compact licence preimage agreed across portals and hosts.
  * The preimage is hashed before persistence and is never itself a ledger key.
  */
 export function buildOrganizationRoleLicensePreimage(identity) {
     const jurisdiction = required(identity.jurisdiction, 'jurisdiction').toLowerCase();
-    const organizationId = required(identity.organizationId, 'organizationId');
+    const organizationOfficialId = validateOrganizationOfficialId(identity.organizationOfficialId);
     const stableContactIdentifier = validateStableContactIdentifier(identity.stableContactIdentifier);
     const licensedRole = required(identity.licensedRole, 'licensedRole');
-    return `urn:cds-${jurisdiction}:${organizationId}:${stableContactIdentifier}:${licensedRole}`;
+    return `urn:cds-${jurisdiction}:${organizationOfficialId}:${stableContactIdentifier}:${licensedRole}`;
 }
 /** SHA3-384 multihash identifier for organization + contact + licensed role. */
 export function buildOrganizationRoleLicenseId(identity) {
@@ -39,61 +51,42 @@ export function normalizeOrganizationRoleLicensePolicies(policies) {
     const seen = new Set();
     return policies.map((policy) => {
         const sector = normalizedSector(policy.sector);
+        if (!sector)
+            throw new TypeError('Licence sector policy requires a canonical sector.');
+        if (!Object.values(DataspaceSectors).includes(sector)) {
+            throw new TypeError(`Unsupported licence sector policy: ${sector}.`);
+        }
         if (seen.has(sector))
-            throw new TypeError(`Duplicate licence sector policy: ${sector || '<all>'}.`);
+            throw new TypeError(`Duplicate licence sector policy: ${sector}.`);
         seen.add(sector);
-        if (policy.maxDevices !== null
+        if (policy.maxDevices !== undefined
             && (!Number.isInteger(policy.maxDevices) || policy.maxDevices < 1)) {
-            throw new TypeError('maxDevices must be null or a positive integer.');
+            throw new TypeError('maxDevices must be omitted or a positive integer.');
         }
-        return { sector, active: Boolean(policy.active), maxDevices: policy.maxDevices };
+        return {
+            sector,
+            active: Boolean(policy.active),
+            ...(policy.maxDevices === undefined ? {} : { maxDevices: policy.maxDevices }),
+        };
     });
 }
-/** Exact sector policy wins; the empty-sector catch-all is only a fallback. */
+/** Resolves the exact canonical sector policy. */
 export function resolveOrganizationRoleLicensePolicy(policies, sector) {
     const requested = required(sector, 'sector').toLowerCase();
-    return policies.find((policy) => normalizedSector(policy.sector) === requested)
-        ?? policies.find((policy) => normalizedSector(policy.sector) === '');
+    return policies.find((policy) => normalizedSector(policy.sector) === requested);
 }
 /** Returns the contractual limit or the positive GW/portal default. */
 export function resolveOrganizationRoleLicenseMaxDevices(policy, defaultMaxDevices) {
-    if (policy.maxDevices !== null)
+    if (policy.maxDevices !== undefined)
         return policy.maxDevices;
     if (!Number.isInteger(defaultMaxDevices) || defaultMaxDevices < 1) {
         throw new TypeError('defaultMaxDevices must be a positive integer.');
     }
     return defaultMaxDevices;
 }
-/** Checks global status plus the resolved exact/catch-all sector policy. */
+/** Checks global status plus the resolved exact-sector policy. */
 export function organizationRoleLicenseAllowsSector(license, sector) {
     if (license.status !== 'active')
         return false;
     return resolveOrganizationRoleLicensePolicy(license.data, sector)?.active === true;
 }
-/** Active DCR installations are counted per concrete sector, across hosts/apps. */
-export function countActiveOrganizationRoleLicenseDevices(devices, sector) {
-    const requested = required(sector, 'sector').toLowerCase();
-    return devices.filter((device) => device.status === 'active'
-        && normalizedSector(device.sector) === requested).length;
-}
-/**
- * Deterministic DCR admission decision. Re-registering the same active client
- * is idempotent and does not consume an additional device slot.
- */
-export function organizationRoleLicenseAllowsDevice(license, input) {
-    const sector = required(input.sector, 'sector').toLowerCase();
-    const clientId = required(input.clientId, 'clientId');
-    const clientInstanceId = required(input.clientInstanceId, 'clientInstanceId');
-    if (!organizationRoleLicenseAllowsSector(license, sector))
-        return false;
-    if (license.devices.some((device) => device.status === 'active'
-        && device.clientId === clientId
-        && device.clientInstanceId === clientInstanceId
-        && normalizedSector(device.sector) === sector))
-        return true;
-    const policy = resolveOrganizationRoleLicensePolicy(license.data, sector);
-    if (!policy)
-        return false;
-    return countActiveOrganizationRoleLicenseDevices(license.devices, sector)
-        < resolveOrganizationRoleLicenseMaxDevices(policy, input.defaultMaxDevices);
-}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-common-utils-ts",
-  "version": "2.5.12",
+  "version": "2.5.15",
   "publishConfig": {
     "access": "public"
   },