gdc-common-utils-ts 2.5.16 → 2.5.19

package/dist/examples/inter-tenant-access-contract.d.ts

@@ -37,8 +37,8 @@ export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CLAIMS: Readonly<{
     readonly "Contract.applies-end": "2027-06-29T00:00:00.000Z";
     readonly "Contract.provider-organization": "did:web:api.acme.org";
     readonly "Contract.consumer-organization": "did:web:api.lab.org";
-    readonly "Contract.provider-controller": "did:web:people.acme.org:controllers:primary";
-    readonly "Contract.consumer-controller": "did:web:people.lab.org:controllers:primary";
+    readonly "Contract.provider-authorized-signatory": "did:web:people.acme.org:controllers:primary";
+    readonly "Contract.consumer-authorized-signatory": "did:web:people.lab.org:controllers:primary";
     readonly "Contract.security-label": "organization/Composition.rs";
     readonly "Contract.term-type": "HRESCH";
     readonly "Contract.instantiates-uri": "https://portal.example.org/files/contracts/inter-tenant-contract-acme-lab-001.pdf";

package/dist/examples/inter-tenant-access-contract.js

@@ -47,8 +47,8 @@ export const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CLAIMS = Object.freeze({
     [ClaimInterTenantAccessContract.appliesEnd]: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_VALID_UNTIL,
     [ClaimInterTenantAccessContract.providerOrganization]: EXAMPLE_API_ORGANIZATION_DID,
     [ClaimInterTenantAccessContract.consumerOrganization]: EXAMPLE_RESEARCH_API_ORGANIZATION_DID,
-    [ClaimInterTenantAccessContract.providerController]: EXAMPLE_CONTROLLER_DID,
-    [ClaimInterTenantAccessContract.consumerController]: EXAMPLE_RESEARCH_CONTROLLER_DID,
+    [ClaimInterTenantAccessContract.providerAuthorizedSignatory]: EXAMPLE_CONTROLLER_DID,
+    [ClaimInterTenantAccessContract.consumerAuthorizedSignatory]: EXAMPLE_RESEARCH_CONTROLLER_DID,
     [ClaimInterTenantAccessContract.capability]: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_SCOPE,
     [ClaimInterTenantAccessContract.purpose]: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_PURPOSE,
     [ClaimInterTenantAccessContract.instantiatesUri]: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_AGREEMENT_PDF_URL,
@@ -61,6 +61,20 @@ export const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CREDENTIAL = Object.freeze(bui
     validUntil: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_VALID_UNTIL,
     additionalCredential: {
         id: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_ID,
+        proof: [
+            {
+                type: 'JsonWebSignature2020',
+                proofPurpose: 'contractAgreement',
+                verificationMethod: `${EXAMPLE_CONTROLLER_DID}#contract-agreement`,
+                jws: 'provider-authorized-signatory-proof',
+            },
+            {
+                type: 'JsonWebSignature2020',
+                proofPurpose: 'contractAgreement',
+                verificationMethod: `${EXAMPLE_RESEARCH_CONTROLLER_DID}#contract-agreement`,
+                jws: 'consumer-authorized-signatory-proof',
+            },
+        ],
     },
 }));
 export const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CONTEXT = Object.freeze({

package/dist/examples/legal-organization-verification-transaction.d.ts

@@ -1 +1,2 @@
+export declare const EXAMPLE_LEGAL_ORGANIZATION_SERVICE_TYPE: string;
 export declare const EXAMPLE_LEGAL_ORGANIZATION_VERIFICATION_TRANSACTION_BUNDLE: import("..").BundleJsonApi<import("..").ErrorEntry | import("..").BundleEntry>;

package/dist/examples/legal-organization-verification-transaction.js

@@ -30,6 +30,15 @@ const exampleControllerBinding = {
         }
         : {}),
 };
+/** Canonical capabilities reused by organization-onboarding editor tests. */
+const exampleLegalOrganizationServiceType = serializeServiceCapabilityTokens([
+    ServiceCapability.IndexProvider,
+    ServiceCapability.DigitalTwinReader,
+]);
+if (!exampleLegalOrganizationServiceType) {
+    throw new Error('Canonical legal-organization example capabilities must not be empty.');
+}
+export const EXAMPLE_LEGAL_ORGANIZATION_SERVICE_TYPE = exampleLegalOrganizationServiceType;
 export const EXAMPLE_LEGAL_ORGANIZATION_VERIFICATION_TRANSACTION_BUNDLE = buildLegalOrganizationVerificationTransactionBundle({
     claims: {
         '@context': 'org.schema',
@@ -42,10 +51,7 @@ export const EXAMPLE_LEGAL_ORGANIZATION_VERIFICATION_TRANSACTION_BUNDLE = buildL
         [ClaimsServiceSchemaorg.category]: EXAMPLE_SECTOR,
         [ClaimsServiceSchemaorg.identifier]: EXAMPLE_TENANT_SERVICE_DID,
         [ClaimsServiceSchemaorg.url]: `https://operator.example.net/acme/cds-${String(EXAMPLE_JURISDICTION).toLowerCase()}/v1/${EXAMPLE_SECTOR}`,
-        [ClaimsServiceSchemaorg.serviceType]: serializeServiceCapabilityTokens([
-            ServiceCapability.IndexProvider,
-            ServiceCapability.DigitalTwinReader,
-        ]),
+        [ClaimsServiceSchemaorg.serviceType]: EXAMPLE_LEGAL_ORGANIZATION_SERVICE_TYPE,
     },
     controller: exampleControllerBinding,
     organization: {

package/dist/examples/lifecycle.d.ts

@@ -109,6 +109,7 @@ export declare const EXAMPLE_TENANT_ENABLE_MESSAGE: {
     };
     readonly claims: {
         readonly '@context': "org.schema";
+        readonly "org.schema.Organization.identifier.additionalType": "taxID";
         readonly "org.schema.Organization.identifier.value": "{{tenantTaxId}}";
         readonly "org.schema.Organization.taxID": "{{tenantTaxId}}";
         readonly "org.schema.Organization.identifier": "{{tenantDid}}";
@@ -124,6 +125,7 @@ export declare const EXAMPLE_TENANT_DISABLE_MESSAGE: {
     };
     readonly claims: {
         readonly '@context': "org.schema";
+        readonly "org.schema.Organization.identifier.additionalType": "taxID";
         readonly "org.schema.Organization.identifier.value": "{{tenantTaxId}}";
         readonly "org.schema.Organization.taxID": "{{tenantTaxId}}";
         readonly "org.schema.Organization.identifier": "{{tenantDid}}";
@@ -144,6 +146,7 @@ export declare const EXAMPLE_TENANT_DELETE_MESSAGE: {
     };
     readonly claims: {
         readonly '@context': "org.schema";
+        readonly "org.schema.Organization.identifier.additionalType": "taxID";
         readonly "org.schema.Organization.identifier.value": "{{tenantTaxId}}";
         readonly "org.schema.Organization.taxID": "{{tenantTaxId}}";
         readonly "org.schema.Organization.identifier": "{{tenantDid}}";
@@ -391,6 +394,7 @@ export declare const EXAMPLE_LIFECYCLE_REFERENCE: {
             };
             readonly claims: {
                 readonly '@context': "org.schema";
+                readonly "org.schema.Organization.identifier.additionalType": "taxID";
                 readonly "org.schema.Organization.identifier.value": "{{tenantTaxId}}";
                 readonly "org.schema.Organization.taxID": "{{tenantTaxId}}";
                 readonly "org.schema.Organization.identifier": "{{tenantDid}}";
@@ -406,6 +410,7 @@ export declare const EXAMPLE_LIFECYCLE_REFERENCE: {
             };
             readonly claims: {
                 readonly '@context': "org.schema";
+                readonly "org.schema.Organization.identifier.additionalType": "taxID";
                 readonly "org.schema.Organization.identifier.value": "{{tenantTaxId}}";
                 readonly "org.schema.Organization.taxID": "{{tenantTaxId}}";
                 readonly "org.schema.Organization.identifier": "{{tenantDid}}";
@@ -426,6 +431,7 @@ export declare const EXAMPLE_LIFECYCLE_REFERENCE: {
             };
             readonly claims: {
                 readonly '@context': "org.schema";
+                readonly "org.schema.Organization.identifier.additionalType": "taxID";
                 readonly "org.schema.Organization.identifier.value": "{{tenantTaxId}}";
                 readonly "org.schema.Organization.taxID": "{{tenantTaxId}}";
                 readonly "org.schema.Organization.identifier": "{{tenantDid}}";

package/dist/examples/lifecycle.js

@@ -117,6 +117,7 @@ export const EXAMPLE_TENANT_ENABLE_MESSAGE = {
     },
     claims: {
         '@context': 'org.schema',
+        [ClaimsOrganizationSchemaorg.identifierType]: 'taxID',
         [ClaimsOrganizationSchemaorg.identifierValue]: EXAMPLE_LIFECYCLE_PLACEHOLDERS.tenantTaxId,
         [ClaimsOrganizationSchemaorg.taxId]: EXAMPLE_LIFECYCLE_PLACEHOLDERS.tenantTaxId,
         [ClaimsOrganizationSchemaorg.identifier]: EXAMPLE_LIFECYCLE_PLACEHOLDERS.tenantDid,
@@ -132,6 +133,7 @@ export const EXAMPLE_TENANT_DISABLE_MESSAGE = {
     },
     claims: {
         '@context': 'org.schema',
+        [ClaimsOrganizationSchemaorg.identifierType]: 'taxID',
         [ClaimsOrganizationSchemaorg.identifierValue]: EXAMPLE_LIFECYCLE_PLACEHOLDERS.tenantTaxId,
         [ClaimsOrganizationSchemaorg.taxId]: EXAMPLE_LIFECYCLE_PLACEHOLDERS.tenantTaxId,
         [ClaimsOrganizationSchemaorg.identifier]: EXAMPLE_LIFECYCLE_PLACEHOLDERS.tenantDid,
@@ -152,6 +154,7 @@ export const EXAMPLE_TENANT_DELETE_MESSAGE = {
     },
     claims: {
         '@context': 'org.schema',
+        [ClaimsOrganizationSchemaorg.identifierType]: 'taxID',
         [ClaimsOrganizationSchemaorg.identifierValue]: EXAMPLE_LIFECYCLE_PLACEHOLDERS.tenantTaxId,
         [ClaimsOrganizationSchemaorg.taxId]: EXAMPLE_LIFECYCLE_PLACEHOLDERS.tenantTaxId,
         [ClaimsOrganizationSchemaorg.identifier]: EXAMPLE_LIFECYCLE_PLACEHOLDERS.tenantDid,

package/dist/models/inter-tenant-access-contract.d.ts

@@ -44,13 +44,13 @@ export declare enum ClaimInterTenantAccessContract {
      * - in the current example this is `did:web:api.lab.org`
      */
     consumerOrganization = "Contract.consumer-organization",
-    /**
-     * DID of the controller who signed on behalf of the provider organization.
-     */
+    /** DID of the person legally authorized to sign for the provider. */
+    providerAuthorizedSignatory = "Contract.provider-authorized-signatory",
+    /** DID of the person legally authorized to sign for the consumer. */
+    consumerAuthorizedSignatory = "Contract.consumer-authorized-signatory",
+    /** @deprecated Read-only compatibility alias. Technical control is not legal signing authority. */
     providerController = "Contract.provider-controller",
-    /**
-     * DID of the controller who signed on behalf of the consumer organization.
-     */
+    /** @deprecated Read-only compatibility alias. Technical control is not legal signing authority. */
     consumerController = "Contract.consumer-controller",
     /**
      * Allowed operational capability, expressed with the same vocabulary used by
@@ -89,8 +89,14 @@ export type InterTenantAccessContractSummary = Readonly<{
     appliesEnd?: string;
     providerOrganizationDid?: string;
     consumerOrganizationDid?: string;
+    providerAuthorizedSignatoryDid?: string;
+    consumerAuthorizedSignatoryDid?: string;
+    /** @deprecated Use providerAuthorizedSignatoryDid. */
     providerControllerDid?: string;
+    /** @deprecated Use consumerAuthorizedSignatoryDid. */
     consumerControllerDid?: string;
+    hasProviderContractAgreementProof: boolean;
+    hasConsumerContractAgreementProof: boolean;
     capabilities: readonly string[];
     purposes: readonly string[];
 }>;
@@ -100,6 +106,8 @@ export type InterTenantAccessContractMatchCriteria = Readonly<{
     requiredCapabilities?: readonly string[];
     purpose?: string;
     now?: string | Date;
+    /** Defaults to true for access-token authorization. */
+    requireBilateralContractAgreementProofs?: boolean;
 }>;
 export type InterTenantContractAuthorizationConsentCriteria = Readonly<{
     consumerOrganizationDid: string;

package/dist/models/inter-tenant-access-contract.js

@@ -46,13 +46,13 @@ export var ClaimInterTenantAccessContract;
      * - in the current example this is `did:web:api.lab.org`
      */
     ClaimInterTenantAccessContract["consumerOrganization"] = "Contract.consumer-organization";
-    /**
-     * DID of the controller who signed on behalf of the provider organization.
-     */
+    /** DID of the person legally authorized to sign for the provider. */
+    ClaimInterTenantAccessContract["providerAuthorizedSignatory"] = "Contract.provider-authorized-signatory";
+    /** DID of the person legally authorized to sign for the consumer. */
+    ClaimInterTenantAccessContract["consumerAuthorizedSignatory"] = "Contract.consumer-authorized-signatory";
+    /** @deprecated Read-only compatibility alias. Technical control is not legal signing authority. */
     ClaimInterTenantAccessContract["providerController"] = "Contract.provider-controller";
-    /**
-     * DID of the controller who signed on behalf of the consumer organization.
-     */
+    /** @deprecated Read-only compatibility alias. Technical control is not legal signing authority. */
     ClaimInterTenantAccessContract["consumerController"] = "Contract.consumer-controller";
     /**
      * Allowed operational capability, expressed with the same vocabulary used by

package/dist/utils/activation-policy.d.ts

@@ -8,6 +8,11 @@ export type ActivationServiceAuthorizationPolicyError = {
     code: ActivationServiceAuthorizationPolicyErrorCode;
     message: string;
 };
+/** Typed legal identifier used to bind one organization across credentials and lifecycle commands. */
+export type LegalOrganizationIdentifier = Readonly<{
+    type: string;
+    value: string;
+}>;
 /**
  * Extracts `credentialSubject` from a VC-like object.
  *
@@ -20,6 +25,26 @@ export declare function extractCredentialSubject(credential: unknown): Record<st
  * @param value Raw tax identifier value.
  */
 export declare function normalizeTaxIdentifier(value: unknown): string | undefined;
+/**
+ * Normalizes a typed organization identifier for equality checks without
+ * changing the canonical value stored in credentials or tenant records.
+ */
+export declare function normalizeLegalOrganizationIdentifier(identifier: Readonly<{
+    type?: unknown;
+    value?: unknown;
+}> | undefined): LegalOrganizationIdentifier | undefined;
+/** Extracts the typed legal identifier from an organization credential subject. */
+export declare function extractOrganizationLegalIdentifier(organizationCredential: unknown): LegalOrganizationIdentifier | undefined;
+/** Extracts the typed organization identifier from a representative `memberOf` binding. */
+export declare function extractRepresentativeMemberOfLegalIdentifier(representativeCredential: unknown): LegalOrganizationIdentifier | undefined;
+/** Compares typed legal identifiers without discarding punctuation from their values. */
+export declare function legalOrganizationIdentifiersMatch(left: Readonly<{
+    type?: unknown;
+    value?: unknown;
+}> | undefined, right: Readonly<{
+    type?: unknown;
+    value?: unknown;
+}> | undefined): boolean;
 /**
  * Extracts an organization tax id from a VC-like organization credential.
  *

package/dist/utils/activation-policy.js

@@ -31,6 +31,44 @@ export function normalizeTaxIdentifier(value) {
     const normalized = String(value || '').trim().toUpperCase();
     return normalized || undefined;
 }
+/**
+ * Normalizes a typed organization identifier for equality checks without
+ * changing the canonical value stored in credentials or tenant records.
+ */
+export function normalizeLegalOrganizationIdentifier(identifier) {
+    const rawType = String(identifier?.type || '').trim().toUpperCase();
+    const type = rawType === 'TAXID' || rawType === 'TAX_ID' ? 'TAX' : rawType;
+    const value = String(identifier?.value || '').trim().toUpperCase();
+    return type && value ? { type, value } : undefined;
+}
+function extractLegalOrganizationIdentifier(value) {
+    const source = asObject(value) || {};
+    const identifier = asObject(source.identifier) || {};
+    const taxId = source.taxID ?? source.taxId;
+    return normalizeLegalOrganizationIdentifier(taxId !== undefined
+        ? { type: 'taxID', value: taxId }
+        : {
+            type: identifier.additionalType ?? identifier.type ?? source.identifierType,
+            value: identifier.value ?? source.identifierValue,
+        });
+}
+/** Extracts the typed legal identifier from an organization credential subject. */
+export function extractOrganizationLegalIdentifier(organizationCredential) {
+    return extractLegalOrganizationIdentifier(extractCredentialSubject(organizationCredential));
+}
+/** Extracts the typed organization identifier from a representative `memberOf` binding. */
+export function extractRepresentativeMemberOfLegalIdentifier(representativeCredential) {
+    const subject = extractCredentialSubject(representativeCredential) || {};
+    return extractLegalOrganizationIdentifier(subject.memberOf);
+}
+/** Compares typed legal identifiers without discarding punctuation from their values. */
+export function legalOrganizationIdentifiersMatch(left, right) {
+    const normalizedLeft = normalizeLegalOrganizationIdentifier(left);
+    const normalizedRight = normalizeLegalOrganizationIdentifier(right);
+    return Boolean(normalizedLeft && normalizedRight
+        && normalizedLeft.type === normalizedRight.type
+        && normalizedLeft.value === normalizedRight.value);
+}
 /**
  * Extracts an organization tax id from a VC-like organization credential.
  *
@@ -39,10 +77,8 @@ export function normalizeTaxIdentifier(value) {
 export function extractOrganizationTaxId(organizationCredential) {
     const subject = extractCredentialSubject(organizationCredential) || {};
     const identifier = asObject(subject.identifier);
-    return (normalizeTaxIdentifier(subject.taxID)
-        || normalizeTaxIdentifier(subject.taxId)
-        || normalizeTaxIdentifier(identifier?.value)
-        || normalizeTaxIdentifier(subject.identifierValue));
+    const value = String(subject.taxID ?? subject.taxId ?? identifier?.value ?? '').trim();
+    return normalizeTaxIdentifier(value) || undefined;
 }
 /**
  * Extracts the `memberOf` tax id from a representative credential.
@@ -53,10 +89,8 @@ export function extractRepresentativeMemberOfTaxId(representativeCredential) {
     const subject = extractCredentialSubject(representativeCredential) || {};
     const memberOf = asObject(subject.memberOf) || {};
     const identifier = asObject(memberOf.identifier);
-    return (normalizeTaxIdentifier(memberOf.taxID)
-        || normalizeTaxIdentifier(memberOf.taxId)
-        || normalizeTaxIdentifier(identifier?.value)
-        || normalizeTaxIdentifier(memberOf.identifierValue));
+    const value = String(memberOf.taxID ?? memberOf.taxId ?? identifier?.value ?? '').trim();
+    return normalizeTaxIdentifier(value) || undefined;
 }
 /**
  * Extracts the representative role code from `credentialSubject.hasOccupation`.

package/dist/utils/consent-blockchain-rules.js

@@ -86,6 +86,7 @@ function deriveRuleEntriesFromConsentEntry(entry, options, bundleEvidenceReferen
         for (const purpose of purposes) {
             for (const role of normalizedRoles) {
                 const ruleId = buildConsentAtomicRuleId({
+                    sourceConsentIdentifier,
                     subject,
                     decision,
                     actorIdentifier,

package/dist/utils/consent-duplicate-rules.d.ts

@@ -32,9 +32,12 @@ export type ConsentDuplicateRuleConflict = Readonly<{
  *
  * The identifier intentionally excludes section/resource targets so that two
  * entries that authorize different target sets for the same subject, decision,
- * actor, purpose, and role collide into the same duplicate group.
+ * actor, purpose, and role collide into the same duplicate group. It includes
+ * the stable source Consent identifier so independent portal or study
+ * consents never collapse into the same rule.
  */
 export declare function buildConsentAtomicRuleId(input: Readonly<{
+    sourceConsentIdentifier?: string;
     subject?: string;
     decision?: string;
     actorIdentifier: string;

package/dist/utils/consent-duplicate-rules.js

@@ -9,10 +9,13 @@ const RESOURCE_TYPE_PREFIX = 'resourceType:';
  *
  * The identifier intentionally excludes section/resource targets so that two
  * entries that authorize different target sets for the same subject, decision,
- * actor, purpose, and role collide into the same duplicate group.
+ * actor, purpose, and role collide into the same duplicate group. It includes
+ * the stable source Consent identifier so independent portal or study
+ * consents never collapse into the same rule.
  */
 export function buildConsentAtomicRuleId(input) {
     return [
+        normalizeRuleKeyPart(input.sourceConsentIdentifier),
         normalizeRuleKeyPart(input.subject),
         normalizeDecision(input.decision).toLowerCase(),
         normalizeRuleKeyPart(input.actorIdentifier),
@@ -102,6 +105,7 @@ function deriveAtomicConsentRules(entry, entryIndex) {
             for (const role of normalizedRoles) {
                 derived.push({
                     ruleId: buildConsentAtomicRuleId({
+                        sourceConsentIdentifier: identifier,
                         subject,
                         decision,
                         actorIdentifier,

package/dist/utils/inter-tenant-access-contract.d.ts

@@ -1,6 +1,11 @@
 import type { InterTenantAccessContractClaims, InterTenantContractAuthorizationConsentCriteria, InterTenantAccessContractMatchCriteria, InterTenantAccessContractSummary } from '../models/inter-tenant-access-contract';
 import type { VerifiableCredentialV2 } from '../models/verifiable-credential';
 type ContractLike = Record<string, any>;
+/**
+ * Builds the canonical FHIR Contract. Signer entries identify legally
+ * authorized signatories; technical tenant controllers are not inferred as
+ * signatories. Historical controller role labels are accepted only on read.
+ */
 export declare function buildInterTenantAccessContractResource(claims: InterTenantAccessContractClaims): ContractLike;
 export declare function buildInterTenantAccessContractCredential(input: Readonly<{
     claims: InterTenantAccessContractClaims;
@@ -9,10 +14,16 @@ export declare function buildInterTenantAccessContractCredential(input: Readonly
     validUntil?: string;
     additionalCredential?: Record<string, unknown>;
 }>): VerifiableCredentialV2;
+/** Summarizes tenant, authority and bilateral proof evidence from one Contract VC. */
 export declare function summarizeInterTenantAccessContract(credential: unknown): InterTenantAccessContractSummary | undefined;
 export declare function isInterTenantAccessContractActive(summary: InterTenantAccessContractSummary | undefined, options?: Readonly<{
     now?: string | Date;
 }>): boolean;
+/**
+ * Matches an active contract and, by default, requires contractAgreement
+ * proofs whose verification methods belong to both named signatories.
+ * Cryptographic proof verification must occur before this structural match.
+ */
 export declare function matchesInterTenantAccessContract(summary: InterTenantAccessContractSummary | undefined, criteria: InterTenantAccessContractMatchCriteria): boolean;
 export declare function getMatchingInterTenantAccessContractFromVpToken(vpToken: string, criteria: InterTenantAccessContractMatchCriteria): Record<string, unknown> | undefined;
 /**

package/dist/utils/inter-tenant-access-contract.js

@@ -7,8 +7,10 @@ import { getVpCredentials } from './vp-token.js';
 const ACTIVE_CONTRACT_STATUSES = new Set(['executed', 'amended', 'appended']);
 const PROVIDER_ROLE = 'provider';
 const CONSUMER_ROLE = 'consumer';
-const PROVIDER_CONTROLLER_ROLE = 'provider-controller';
-const CONSUMER_CONTROLLER_ROLE = 'consumer-controller';
+const PROVIDER_AUTHORIZED_SIGNATORY_ROLE = 'provider-authorized-signatory';
+const CONSUMER_AUTHORIZED_SIGNATORY_ROLE = 'consumer-authorized-signatory';
+const LEGACY_PROVIDER_CONTROLLER_ROLE = 'provider-controller';
+const LEGACY_CONSUMER_CONTROLLER_ROLE = 'consumer-controller';
 function splitCsv(value) {
     return Array.from(new Set(String(value || '')
         .split(',')
@@ -108,6 +110,20 @@ function extractSignerReference(contract, expectedRole) {
     }
     return undefined;
 }
+function extractSignerReferenceWithAliases(contract, canonicalRole, legacyRole) {
+    return extractSignerReference(contract, canonicalRole) || extractSignerReference(contract, legacyRole);
+}
+function hasContractAgreementProof(credential, signatoryDid) {
+    if (!signatoryDid)
+        return false;
+    const proofs = Array.isArray(credential.proof) ? credential.proof : credential.proof ? [credential.proof] : [];
+    return proofs.some((proof) => {
+        if (String(proof?.proofPurpose || '').trim() !== 'contractAgreement')
+            return false;
+        const verificationMethod = String(proof?.verificationMethod || '').trim();
+        return verificationMethod === signatoryDid || verificationMethod.startsWith(`${signatoryDid}#`);
+    });
+}
 function extractPurposes(contract) {
     const terms = Array.isArray(contract.term) ? contract.term : contract.term ? [contract.term] : [];
     return Array.from(new Set(terms.flatMap((term) => {
@@ -135,6 +151,11 @@ function normalizeNow(input) {
         return new Date(input).getTime();
     return Date.now();
 }
+/**
+ * Builds the canonical FHIR Contract. Signer entries identify legally
+ * authorized signatories; technical tenant controllers are not inferred as
+ * signatories. Historical controller role labels are accepted only on read.
+ */
 export function buildInterTenantAccessContractResource(claims) {
     const identifier = readClaimWithAliases(claims, ClaimInterTenantAccessContract.identifier) || '';
     const status = readClaimWithAliases(claims, ClaimInterTenantAccessContract.status) || 'executed';
@@ -144,8 +165,8 @@ export function buildInterTenantAccessContractResource(claims) {
     const appliesEnd = readClaimWithAliases(claims, ClaimInterTenantAccessContract.appliesEnd, ['Contract.applies.end']) || '';
     const providerOrganization = readClaimWithAliases(claims, ClaimInterTenantAccessContract.providerOrganization, ['Contract.term.offer.party.provider']) || '';
     const consumerOrganization = readClaimWithAliases(claims, ClaimInterTenantAccessContract.consumerOrganization, ['Contract.term.offer.party.consumer']) || '';
-    const providerController = readClaimWithAliases(claims, ClaimInterTenantAccessContract.providerController, ['Contract.signer.provider']) || '';
-    const consumerController = readClaimWithAliases(claims, ClaimInterTenantAccessContract.consumerController, ['Contract.signer.consumer']) || '';
+    const providerAuthorizedSignatory = readClaimWithAliases(claims, ClaimInterTenantAccessContract.providerAuthorizedSignatory, [ClaimInterTenantAccessContract.providerController, 'Contract.signer.provider']) || '';
+    const consumerAuthorizedSignatory = readClaimWithAliases(claims, ClaimInterTenantAccessContract.consumerAuthorizedSignatory, [ClaimInterTenantAccessContract.consumerController, 'Contract.signer.consumer']) || '';
     const instantiatesUri = readClaimWithAliases(claims, ClaimInterTenantAccessContract.instantiatesUri, ['Contract.instantiatesUri']) || '';
     const capabilities = splitCsv(readClaimWithAliases(claims, ClaimInterTenantAccessContract.capability, ['Contract.term.offer.securityLabel']));
     const purposes = splitCsv(readClaimWithAliases(claims, ClaimInterTenantAccessContract.purpose, ['Contract.term.type']));
@@ -162,16 +183,16 @@ export function buildInterTenantAccessContractResource(claims) {
             ...(appliesEnd ? { end: appliesEnd } : {}),
         },
         signer: [
-            providerController
+            providerAuthorizedSignatory
                 ? {
-                    type: [{ text: PROVIDER_CONTROLLER_ROLE }],
-                    party: { reference: providerController },
+                    type: [{ text: PROVIDER_AUTHORIZED_SIGNATORY_ROLE }],
+                    party: { reference: providerAuthorizedSignatory },
                 }
                 : undefined,
-            consumerController
+            consumerAuthorizedSignatory
                 ? {
-                    type: [{ text: CONSUMER_CONTROLLER_ROLE }],
-                    party: { reference: consumerController },
+                    type: [{ text: CONSUMER_AUTHORIZED_SIGNATORY_ROLE }],
+                    party: { reference: consumerAuthorizedSignatory },
                 }
                 : undefined,
         ].filter(Boolean),
@@ -211,6 +232,7 @@ export function buildInterTenantAccessContractCredential(input) {
         ...(input.additionalCredential || {}),
     };
 }
+/** Summarizes tenant, authority and bilateral proof evidence from one Contract VC. */
 export function summarizeInterTenantAccessContract(credential) {
     if (!credential || typeof credential !== 'object')
         return undefined;
@@ -220,6 +242,8 @@ export function summarizeInterTenantAccessContract(credential) {
     const subject = (credential.credentialSubject || {});
     if (String(subject.resourceType || '').trim() !== 'Contract')
         return undefined;
+    const providerAuthorizedSignatoryDid = extractSignerReferenceWithAliases(subject, PROVIDER_AUTHORIZED_SIGNATORY_ROLE, LEGACY_PROVIDER_CONTROLLER_ROLE);
+    const consumerAuthorizedSignatoryDid = extractSignerReferenceWithAliases(subject, CONSUMER_AUTHORIZED_SIGNATORY_ROLE, LEGACY_CONSUMER_CONTROLLER_ROLE);
     return {
         identifier: firstIdentifierValue(subject.identifier) || String(subject.id || '').trim() || undefined,
         status: String(subject.status || '').trim() || undefined,
@@ -228,8 +252,12 @@ export function summarizeInterTenantAccessContract(credential) {
         appliesEnd: String(subject.applies?.end || '').trim() || undefined,
         providerOrganizationDid: extractOfferPartyReference(subject, PROVIDER_ROLE),
         consumerOrganizationDid: extractOfferPartyReference(subject, CONSUMER_ROLE),
-        providerControllerDid: extractSignerReference(subject, PROVIDER_CONTROLLER_ROLE),
-        consumerControllerDid: extractSignerReference(subject, CONSUMER_CONTROLLER_ROLE),
+        providerAuthorizedSignatoryDid,
+        consumerAuthorizedSignatoryDid,
+        providerControllerDid: providerAuthorizedSignatoryDid,
+        consumerControllerDid: consumerAuthorizedSignatoryDid,
+        hasProviderContractAgreementProof: hasContractAgreementProof(credential, providerAuthorizedSignatoryDid),
+        hasConsumerContractAgreementProof: hasContractAgreementProof(credential, consumerAuthorizedSignatoryDid),
         capabilities: extractCapabilities(subject),
         purposes: extractPurposes(subject),
     };
@@ -249,6 +277,11 @@ export function isInterTenantAccessContractActive(summary, options = {}) {
         return false;
     return true;
 }
+/**
+ * Matches an active contract and, by default, requires contractAgreement
+ * proofs whose verification methods belong to both named signatories.
+ * Cryptographic proof verification must occur before this structural match.
+ */
 export function matchesInterTenantAccessContract(summary, criteria) {
     if (!isInterTenantAccessContractActive(summary, { now: criteria.now }))
         return false;
@@ -256,6 +289,9 @@ export function matchesInterTenantAccessContract(summary, criteria) {
         return false;
     if (String(summary?.consumerOrganizationDid || '').trim() !== String(criteria.consumerOrganizationDid || '').trim())
         return false;
+    if ((criteria.requireBilateralContractAgreementProofs ?? true)
+        && (!summary?.hasProviderContractAgreementProof || !summary?.hasConsumerContractAgreementProof))
+        return false;
     const requiredCapabilities = Array.from(new Set((criteria.requiredCapabilities || []).map((value) => String(value || '').trim()).filter(Boolean)));
     if (requiredCapabilities.length > 0) {
         const contractCapabilities = new Set((summary?.capabilities || []).map((value) => String(value || '').trim()));

package/dist/utils/legal-organization-onboarding-editor.d.ts

@@ -10,6 +10,8 @@ export type LegalOrganizationFormTemplateFields = Readonly<{
     controllerRole?: string;
     serviceCategory?: string;
     serviceIdentifier?: string;
+    /** Canonical CSV of capabilities stored in `org.schema.Service.serviceType`. */
+    serviceType?: string;
     serviceUrl?: string;
     tenantAlias?: string;
 }>;
@@ -90,6 +92,8 @@ export interface LegalOrganizationOnboardingFacade {
     getServiceCategory(fields: LegalOrganizationFormTemplateFields): string | undefined;
     setServiceIdentifier(fields: LegalOrganizationFormTemplateFields, value: string): LegalOrganizationFormTemplateFields;
     getServiceIdentifier(fields: LegalOrganizationFormTemplateFields): string | undefined;
+    setServiceType(fields: LegalOrganizationFormTemplateFields, value: string): LegalOrganizationFormTemplateFields;
+    getServiceType(fields: LegalOrganizationFormTemplateFields): string | undefined;
     setServiceUrl(fields: LegalOrganizationFormTemplateFields, value: string): LegalOrganizationFormTemplateFields;
     getServiceUrl(fields: LegalOrganizationFormTemplateFields): string | undefined;
     /**
@@ -136,6 +140,8 @@ export interface LegalOrganizationOnboardingEditor {
     getServiceCategory(): string | undefined;
     setServiceIdentifier(value: string): LegalOrganizationOnboardingEditor;
     getServiceIdentifier(): string | undefined;
+    setServiceType(value: string): LegalOrganizationOnboardingEditor;
+    getServiceType(): string | undefined;
     setServiceUrl(value: string): LegalOrganizationOnboardingEditor;
     getServiceUrl(): string | undefined;
     setTenantAlias(value: string): LegalOrganizationOnboardingEditor;

package/dist/utils/legal-organization-onboarding-editor.js

@@ -51,6 +51,8 @@ function createEditorFromFacade(facade, initial) {
         getServiceCategory() { return facade.getServiceCategory(formFields); },
         setServiceIdentifier(value) { formFields = facade.setServiceIdentifier(formFields, value); return editor; },
         getServiceIdentifier() { return facade.getServiceIdentifier(formFields); },
+        setServiceType(value) { formFields = facade.setServiceType(formFields, value); return editor; },
+        getServiceType() { return facade.getServiceType(formFields); },
         setServiceUrl(value) { formFields = facade.setServiceUrl(formFields, value); return editor; },
         getServiceUrl() { return facade.getServiceUrl(formFields); },
         setTenantAlias(value) { formFields = facade.setTenantAlias(formFields, value); return editor; },
@@ -133,6 +135,12 @@ export function createLegalOrganizationOnboardingFacade() {
         getServiceIdentifier(fields) {
             return normalizeOptionalText(fields.serviceIdentifier);
         },
+        setServiceType(fields, value) {
+            return patchFields(fields, { serviceType: normalizeText(value) });
+        },
+        getServiceType(fields) {
+            return normalizeOptionalText(fields.serviceType);
+        },
         setServiceUrl(fields, value) {
             return patchFields(fields, { serviceUrl: normalizeText(value) });
         },
@@ -176,6 +184,9 @@ export function createLegalOrganizationOnboardingFacade() {
             if (normalizeOptionalText(fields.serviceIdentifier)) {
                 claims[ClaimsServiceSchemaorg.identifier] = normalizeText(fields.serviceIdentifier);
             }
+            if (normalizeOptionalText(fields.serviceType)) {
+                claims[ClaimsServiceSchemaorg.serviceType] = normalizeText(fields.serviceType);
+            }
             if (normalizeOptionalText(fields.serviceUrl)) {
                 claims[ClaimsServiceSchemaorg.url] = normalizeText(fields.serviceUrl);
             }
@@ -236,6 +247,14 @@ export function createLegalOrganizationOnboardingFacade() {
                     field: 'serviceCategory',
                 });
             }
+            if (!normalizeOptionalText(fields.serviceType)) {
+                issues.push({
+                    severity: 'error',
+                    code: 'missing-service-type',
+                    message: 'serviceType is required because GW authorizes activation capabilities from it.',
+                    field: 'serviceType',
+                });
+            }
             if (!normalizeOptionalText(fields.controllerRole)) {
                 issues.push({
                     severity: 'warning',

package/dist/utils/organization-lifecycle.d.ts

@@ -40,6 +40,8 @@ export declare class OrganizationLifecycleEditor {
     setContext(context: string): this;
     setIdentifier(identifier: string): this;
     setIdentifierValue(identifierValue: string): this;
+    /** Sets the jurisdiction-defined identifier type independently from its complete value. */
+    setIdentifierType(identifierType: string): this;
     setTaxId(taxId: string): this;
     setOperation(operation: OrganizationLifecycleOperation): this;
     setRequestType(requestType: string): this;
@@ -47,6 +49,8 @@ export declare class OrganizationLifecycleEditor {
     getContext(): string | undefined;
     getIdentifier(): string | undefined;
     getIdentifierValue(): string | undefined;
+    /** Returns the jurisdiction-defined identifier type used by lifecycle authorization. */
+    getIdentifierType(): string | undefined;
     getTaxId(): string | undefined;
     getOperation(): OrganizationLifecycleOperation;
     getRequestType(): string | undefined;

package/dist/utils/organization-lifecycle.js

@@ -73,6 +73,16 @@ export class OrganizationLifecycleEditor {
         });
         return this;
     }
+    /** Sets the jurisdiction-defined identifier type independently from its complete value. */
+    setIdentifierType(identifierType) {
+        this.draft = patchDraft(this.draft, {
+            claims: {
+                ...this.draft.claims,
+                [ClaimsOrganizationSchemaorg.identifierType]: String(identifierType).trim(),
+            },
+        });
+        return this;
+    }
     setTaxId(taxId) {
         this.draft = patchDraft(this.draft, {
             claims: {
@@ -103,6 +113,10 @@ export class OrganizationLifecycleEditor {
     getIdentifierValue() {
         return normalizeText(this.draft.claims[ClaimsOrganizationSchemaorg.identifierValue]) || undefined;
     }
+    /** Returns the jurisdiction-defined identifier type used by lifecycle authorization. */
+    getIdentifierType() {
+        return normalizeText(this.draft.claims[ClaimsOrganizationSchemaorg.identifierType]) || undefined;
+    }
     getTaxId() {
         return normalizeText(this.draft.claims[ClaimsOrganizationSchemaorg.taxId]) || undefined;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-common-utils-ts",
-  "version": "2.5.16",
+  "version": "2.5.19",
   "publishConfig": {
     "access": "public"
   },