gdc-common-utils-ts 2.5.13 → 2.5.16

package/dist/CryptographyService.js

@@ -242,9 +242,24 @@ export class CryptographyService {
             throw new Error("Invalid Detached JWS format");
         const protectedHeaderB64Url = parts[0];
         const signatureB64Url = parts[1];
-        const payloadB64Url = Content.bytesToRawBase64UrlSafe(payloadBytes);
-        const signingInput = `${protectedHeaderB64Url}.${payloadB64Url}`;
-        const signingInputBytes = Content.stringToBytesUTF8(signingInput);
+        const protectedHeader = Content.base64UrlSafeToJSON(protectedHeaderB64Url);
+        if (protectedHeader.b64 !== undefined && typeof protectedHeader.b64 !== 'boolean') {
+            throw new Error("Detached JWS protected header 'b64' must be boolean.");
+        }
+        if (protectedHeader.b64 === false
+            && (!Array.isArray(protectedHeader.crit) || !protectedHeader.crit.includes('b64'))) {
+            throw new Error("RFC 7797 detached JWS with 'b64=false' must mark 'b64' critical.");
+        }
+        let signingInputBytes;
+        if (protectedHeader.b64 === false) {
+            const prefix = Content.stringToBytesUTF8(`${protectedHeaderB64Url}.`);
+            signingInputBytes = new Uint8Array(prefix.length + payloadBytes.length);
+            signingInputBytes.set(prefix);
+            signingInputBytes.set(payloadBytes, prefix.length);
+        }
+        else {
+            signingInputBytes = Content.stringToBytesUTF8(`${protectedHeaderB64Url}.${Content.bytesToRawBase64UrlSafe(payloadBytes)}`);
+        }
         const signatureBytes = Content.base64ToBytes(signatureB64Url);
         return this.verifyBytes(signatureBytes, signingInputBytes, publicJWKey);
     }

package/dist/examples/organization-role-license.d.ts

@@ -2,12 +2,8 @@ import type { OrganizationRoleLicense } from '../models/organization-role-licens
 import { type OrganizationRoleLicenseIdentity } from '../utils/organization-role-license';
 /** Reusable synthetic identity for role-licence contract and consumer tests. */
 export declare const EXAMPLE_ORGANIZATION_ROLE_LICENSE_IDENTITY: OrganizationRoleLicenseIdentity;
-/** Reusable catch-all plus exact-override policy example. */
-export declare const EXAMPLE_ORGANIZATION_ROLE_LICENSE_POLICIES: readonly (Readonly<{
-    sector: "";
-    active: true;
-    maxDevices: null;
-}> | Readonly<{
+/** Reusable exact-sector policies; no empty-sector wildcard is authored. */
+export declare const EXAMPLE_ORGANIZATION_ROLE_LICENSE_POLICIES: readonly (import("..").OrganizationRoleLicenseSectorPolicy | Readonly<{
     sector: "animal-care";
     active: false;
     maxDevices: 2;

package/dist/examples/organization-role-license.js

@@ -1,7 +1,8 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
 import { buildStableActorIdentifier, StableActorContactKinds } from '../utils/actor-identifier.js';
-import { buildOrganizationRoleLicenseId, } from '../utils/organization-role-license.js';
-import { EXAMPLE_EMAIL_PROFESSIONAL, EXAMPLE_EMPLOYEE_DEVICE_CLIENT_ID_PRIMARY, EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_PRIMARY, EXAMPLE_HOST_PUBLIC_HOSTNAME, EXAMPLE_JURISDICTION, EXAMPLE_LEGAL_ORGANIZATION_TAX_ID, EXAMPLE_ORGANIZATION_CONTROLLER_ROLE, EXAMPLE_SECTOR, } from './shared.js';
+import { buildOrganizationRoleLicenseId, DEFAULT_ORGANIZATION_ROLE_LICENSE_POLICY, } from '../utils/organization-role-license.js';
+import { EXAMPLE_EMAIL_PROFESSIONAL, EXAMPLE_JURISDICTION, EXAMPLE_LEGAL_ORGANIZATION_TAX_ID, EXAMPLE_ORGANIZATION_CONTROLLER_ROLE, } from './shared.js';
+import { DataspaceSectors } from '../constants/sectors.js';
 /** Reusable synthetic identity for role-licence contract and consumer tests. */
 export const EXAMPLE_ORGANIZATION_ROLE_LICENSE_IDENTITY = Object.freeze({
     jurisdiction: EXAMPLE_JURISDICTION,
@@ -12,10 +13,10 @@ export const EXAMPLE_ORGANIZATION_ROLE_LICENSE_IDENTITY = Object.freeze({
     }),
     licensedRole: EXAMPLE_ORGANIZATION_CONTROLLER_ROLE,
 });
-/** Reusable catch-all plus exact-override policy example. */
+/** Reusable exact-sector policies; no empty-sector wildcard is authored. */
 export const EXAMPLE_ORGANIZATION_ROLE_LICENSE_POLICIES = Object.freeze([
-    Object.freeze({ sector: '', active: true, maxDevices: null }),
-    Object.freeze({ sector: 'animal-care', active: false, maxDevices: 2 }),
+    DEFAULT_ORGANIZATION_ROLE_LICENSE_POLICY,
+    Object.freeze({ sector: DataspaceSectors.AnimalCare, active: false, maxDevices: 2 }),
 ]);
 /** Public ledger fixture: no clear contact or tenant-local employee UUID. */
 export const EXAMPLE_ORGANIZATION_ROLE_LICENSE = Object.freeze({
@@ -23,16 +24,6 @@ export const EXAMPLE_ORGANIZATION_ROLE_LICENSE = Object.freeze({
     ...EXAMPLE_ORGANIZATION_ROLE_LICENSE_IDENTITY,
     status: 'active',
     data: [...EXAMPLE_ORGANIZATION_ROLE_LICENSE_POLICIES],
-    devices: [
-        Object.freeze({
-            clientId: EXAMPLE_EMPLOYEE_DEVICE_CLIENT_ID_PRIMARY,
-            clientInstanceId: EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_PRIMARY,
-            sector: EXAMPLE_SECTOR,
-            host: `https://${EXAMPLE_HOST_PUBLIC_HOSTNAME}`,
-            status: 'active',
-            activatedAt: 1_700_000_000,
-        }),
-    ],
     createdAt: 1_700_000_000,
     updatedAt: 1_700_000_000,
 });

package/dist/interfaces/ICryptography.d.ts

@@ -132,6 +132,7 @@ export interface ICryptography {
      * @param publicJWKey The signer's public key (JWK) to use for verification.
      * @returns A boolean indicating if the signature is valid.
      */
+    /** Verifies encoded detached JWS and RFC 7797 `b64=false` detached payloads. */
     verifyDetachedJws(payloadBytes: Uint8Array, detachedJws: string, publicJWKey: PublicJwk): Promise<boolean>;
     /**
      * Converts a JWS Object (with decoded headers and payload) into Compact Serialization format.

package/dist/models/organization-role-license.d.ts

@@ -1,34 +1,23 @@
-import type { DeviceBindingStatus } from '../constants/device';
+import type { DataspaceSector } from '../constants/sectors';
 /** Lifecycle of one organization-owned, role-bearing licence assignment. */
 export type OrganizationRoleLicenseStatus = 'active' | 'revoked';
 /**
  * Contractual policy for one sector.
  *
- * `sector: ""` is the catch-all policy. An exact sector entry overrides it.
- * `maxDevices: null` delegates the numeric limit to the GW/portal policy; it
- * does not mean an unlimited number of installations.
+ * Every entry targets one canonical dataspace sector. Omitting `maxDevices`
+ * delegates the numeric limit to the GW/portal policy.
  */
 export interface OrganizationRoleLicenseSectorPolicy {
-    sector: string;
+    sector: DataspaceSector;
     active: boolean;
-    maxDevices: number | null;
-}
-/** One concrete DCR installation registered against the licence. */
-export interface OrganizationRoleLicenseDevice {
-    clientId: string;
-    clientInstanceId: string;
-    sector: string;
-    host: string;
-    status: DeviceBindingStatus;
-    activatedAt: number;
-    revokedAt?: number;
+    maxDevices?: number;
 }
 /**
  * Public ledger projection of one licence assigned by an organization.
  *
  * The stable contact is a one-way `urn:multibase:` identifier. Clear email,
- * telephone, tenant-local employee UUIDs, payment details and application
- * permissions must never be written to this asset.
+ * telephone, tenant-local employee UUIDs, payment details, DCR registrations,
+ * hosts and application permissions must never be written to this asset.
  */
 export interface OrganizationRoleLicense {
     id: string;
@@ -39,7 +28,6 @@ export interface OrganizationRoleLicense {
     licensedRole: string;
     status: OrganizationRoleLicenseStatus;
     data: OrganizationRoleLicenseSectorPolicy[];
-    devices: OrganizationRoleLicenseDevice[];
     createdAt: number;
     updatedAt: number;
     revokedAt?: number;

package/dist/utils/organization-role-license.d.ts

@@ -1,10 +1,11 @@
-import type { OrganizationRoleLicense, OrganizationRoleLicenseDevice, OrganizationRoleLicenseSectorPolicy } from '../models/organization-role-license';
+import type { OrganizationRoleLicense, OrganizationRoleLicenseSectorPolicy } from '../models/organization-role-license';
 export type OrganizationRoleLicenseIdentity = Readonly<{
     jurisdiction: string;
     organizationOfficialId: string;
     stableContactIdentifier: string;
     licensedRole: string;
 }>;
+export declare const DEFAULT_ORGANIZATION_ROLE_LICENSE_POLICY: OrganizationRoleLicenseSectorPolicy;
 export declare function validateOrganizationOfficialId(value: string): string;
 /**
  * Builds the exact, compact licence preimage agreed across portals and hosts.
@@ -15,28 +16,12 @@ export declare function buildOrganizationRoleLicensePreimage(identity: Organizat
 export declare function buildOrganizationRoleLicenseId(identity: OrganizationRoleLicenseIdentity): string;
 /** Validates and de-duplicates sector policies while preserving input order. */
 export declare function normalizeOrganizationRoleLicensePolicies(policies: readonly OrganizationRoleLicenseSectorPolicy[]): OrganizationRoleLicenseSectorPolicy[];
-/** Exact sector policy wins; the empty-sector catch-all is only a fallback. */
+/** Resolves the exact canonical sector policy. */
 export declare function resolveOrganizationRoleLicensePolicy(policies: readonly OrganizationRoleLicenseSectorPolicy[], sector: string): OrganizationRoleLicenseSectorPolicy | undefined;
 /** Returns the contractual limit or the positive GW/portal default. */
 export declare function resolveOrganizationRoleLicenseMaxDevices(policy: OrganizationRoleLicenseSectorPolicy, defaultMaxDevices: number): number;
-/** Checks global status plus the resolved exact/catch-all sector policy. */
+/** Checks global status plus the resolved exact-sector policy. */
 export declare function organizationRoleLicenseAllowsSector(license: Readonly<{
     status: OrganizationRoleLicense['status'];
     data: readonly OrganizationRoleLicenseSectorPolicy[];
 }>, sector: string): boolean;
-/** Active DCR installations are counted per concrete sector, across hosts/apps. */
-export declare function countActiveOrganizationRoleLicenseDevices(devices: readonly OrganizationRoleLicenseDevice[], sector: string): number;
-/**
- * Deterministic DCR admission decision. Re-registering the same active client
- * is idempotent and does not consume an additional device slot.
- */
-export declare function organizationRoleLicenseAllowsDevice(license: Readonly<{
-    status: OrganizationRoleLicense['status'];
-    data: readonly OrganizationRoleLicenseSectorPolicy[];
-    devices: readonly OrganizationRoleLicenseDevice[];
-}>, input: Readonly<{
-    sector: string;
-    clientId: string;
-    clientInstanceId: string;
-    defaultMaxDevices: number;
-}>): boolean;

package/dist/utils/organization-role-license.js

@@ -1,5 +1,6 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
 import { encodeMultibaseSha3 } from './multibasehash.js';
+import { DataspaceSectors } from '../constants/sectors.js';
 function required(value, label) {
     const normalized = String(value || '').trim();
     if (!normalized)
@@ -9,6 +10,10 @@ function required(value, label) {
 function normalizedSector(value) {
     return String(value || '').trim().toLowerCase();
 }
+export const DEFAULT_ORGANIZATION_ROLE_LICENSE_POLICY = Object.freeze({
+    sector: DataspaceSectors.OneHealthResearch,
+    active: true,
+});
 function validateStableContactIdentifier(value) {
     const normalized = required(value, 'stableContactIdentifier');
     if (!/^urn:multibase:z[1-9A-HJ-NP-Za-km-z]+$/.test(normalized)) {
@@ -46,61 +51,42 @@ export function normalizeOrganizationRoleLicensePolicies(policies) {
     const seen = new Set();
     return policies.map((policy) => {
         const sector = normalizedSector(policy.sector);
+        if (!sector)
+            throw new TypeError('Licence sector policy requires a canonical sector.');
+        if (!Object.values(DataspaceSectors).includes(sector)) {
+            throw new TypeError(`Unsupported licence sector policy: ${sector}.`);
+        }
         if (seen.has(sector))
-            throw new TypeError(`Duplicate licence sector policy: ${sector || '<all>'}.`);
+            throw new TypeError(`Duplicate licence sector policy: ${sector}.`);
         seen.add(sector);
-        if (policy.maxDevices !== null
+        if (policy.maxDevices !== undefined
             && (!Number.isInteger(policy.maxDevices) || policy.maxDevices < 1)) {
-            throw new TypeError('maxDevices must be null or a positive integer.');
+            throw new TypeError('maxDevices must be omitted or a positive integer.');
         }
-        return { sector, active: Boolean(policy.active), maxDevices: policy.maxDevices };
+        return {
+            sector,
+            active: Boolean(policy.active),
+            ...(policy.maxDevices === undefined ? {} : { maxDevices: policy.maxDevices }),
+        };
     });
 }
-/** Exact sector policy wins; the empty-sector catch-all is only a fallback. */
+/** Resolves the exact canonical sector policy. */
 export function resolveOrganizationRoleLicensePolicy(policies, sector) {
     const requested = required(sector, 'sector').toLowerCase();
-    return policies.find((policy) => normalizedSector(policy.sector) === requested)
-        ?? policies.find((policy) => normalizedSector(policy.sector) === '');
+    return policies.find((policy) => normalizedSector(policy.sector) === requested);
 }
 /** Returns the contractual limit or the positive GW/portal default. */
 export function resolveOrganizationRoleLicenseMaxDevices(policy, defaultMaxDevices) {
-    if (policy.maxDevices !== null)
+    if (policy.maxDevices !== undefined)
         return policy.maxDevices;
     if (!Number.isInteger(defaultMaxDevices) || defaultMaxDevices < 1) {
         throw new TypeError('defaultMaxDevices must be a positive integer.');
     }
     return defaultMaxDevices;
 }
-/** Checks global status plus the resolved exact/catch-all sector policy. */
+/** Checks global status plus the resolved exact-sector policy. */
 export function organizationRoleLicenseAllowsSector(license, sector) {
     if (license.status !== 'active')
         return false;
     return resolveOrganizationRoleLicensePolicy(license.data, sector)?.active === true;
 }
-/** Active DCR installations are counted per concrete sector, across hosts/apps. */
-export function countActiveOrganizationRoleLicenseDevices(devices, sector) {
-    const requested = required(sector, 'sector').toLowerCase();
-    return devices.filter((device) => device.status === 'active'
-        && normalizedSector(device.sector) === requested).length;
-}
-/**
- * Deterministic DCR admission decision. Re-registering the same active client
- * is idempotent and does not consume an additional device slot.
- */
-export function organizationRoleLicenseAllowsDevice(license, input) {
-    const sector = required(input.sector, 'sector').toLowerCase();
-    const clientId = required(input.clientId, 'clientId');
-    const clientInstanceId = required(input.clientInstanceId, 'clientInstanceId');
-    if (!organizationRoleLicenseAllowsSector(license, sector))
-        return false;
-    if (license.devices.some((device) => device.status === 'active'
-        && device.clientId === clientId
-        && device.clientInstanceId === clientInstanceId
-        && normalizedSector(device.sector) === sector))
-        return true;
-    const policy = resolveOrganizationRoleLicensePolicy(license.data, sector);
-    if (!policy)
-        return false;
-    return countActiveOrganizationRoleLicenseDevices(license.devices, sector)
-        < resolveOrganizationRoleLicenseMaxDevices(policy, input.defaultMaxDevices);
-}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-common-utils-ts",
-  "version": "2.5.13",
+  "version": "2.5.16",
   "publishConfig": {
     "access": "public"
   },