gdc-common-utils-ts 2.5.2 → 2.5.4

package/README.md

@@ -450,9 +450,10 @@ The canonical API contract should live in JSDoc on exported code. The README act
 - [`buildSmartCompositionReadScope(...)`](src/utils/smart-scope.ts)
   - Builds the current CORE GW pinned SMART root scope for `organization/Composition...` token requests.
   - This is the preferred first scope to teach when the backend only needs subject-scoped read access.
-- [`getOrganizationCredentialFromVpToken(...)`, `getLegalRepresentativeCredentialFromVpToken(...)`, `getOrganizationControllerCredentialFromVpToken(...)`](src/utils/vp-token.ts)
+- [`getOrganizationCredentialFromVpToken(...)`, `getLegalRepresentativeCredentialFromVpToken(...)`, `getServiceControllerCredentialFromVpToken(...)`](src/utils/vp-token.ts)
   - Extract typed VC objects from a VP token when GW/SDK flows carry canonical proof only in `vp_token`.
-- [`readOrganizationControllerCredentialsFromResponseBody(...)`](src/utils/legal-organization-verification-result.ts)
+- [`readServiceControllerCredentialsFromResponseBody(...)`](src/utils/legal-organization-verification-result.ts)
+- [`extractServiceControllerRoleCodes(...)`, `extractServiceControllerOccupationCodes(...)`](src/utils/activation-policy.ts) read controller authority from `owner.additionalType` and professional occupation from `owner.hasOccupation.occupationalCategory`.
   - Reads every independently issued controller service VC from direct ICA or projected GW responses; companion helpers expose `owner.sameAs` and its JWK-thumbprint binding without falling back to the legal representative.
 - [`docs/101-VP_TOKEN.md`](docs/101-VP_TOKEN.md)
   - Step-by-step guide for building the canonical compact `vp_token` string from organization and representative VCs.

package/dist/constants/device.d.ts

@@ -14,3 +14,9 @@ export declare const DeviceAppTypes: Readonly<{
     readonly Web: "web";
 }>;
 export type DeviceAppType = typeof DeviceAppTypes[keyof typeof DeviceAppTypes];
+/** Lifecycle states for one concrete DCR installation bound to a seat. */
+export declare const DeviceBindingStatuses: Readonly<{
+    readonly Active: "active";
+    readonly Revoked: "revoked";
+}>;
+export type DeviceBindingStatus = typeof DeviceBindingStatuses[keyof typeof DeviceBindingStatuses];

package/dist/constants/device.js

@@ -13,3 +13,8 @@ export const DeviceAppTypes = Object.freeze({
     Mobile: 'mobile',
     Web: 'web',
 });
+/** Lifecycle states for one concrete DCR installation bound to a seat. */
+export const DeviceBindingStatuses = Object.freeze({
+    Active: 'active',
+    Revoked: 'revoked',
+});

package/dist/constants/employee-lifecycle.d.ts

@@ -0,0 +1,52 @@
+/** Employee directory states exposed by organization lifecycle projections. */
+export declare const EmployeeDirectoryStatuses: Readonly<{
+    readonly Active: "active";
+    readonly Inactive: "inactive";
+    readonly Purged: "purged";
+    readonly Unknown: "unknown";
+}>;
+export type EmployeeDirectoryStatus = typeof EmployeeDirectoryStatuses[keyof typeof EmployeeDirectoryStatuses];
+/** Controller actions supported by the reusable employee lifecycle service. */
+export declare const EmployeeLifecycleActions: Readonly<{
+    readonly Disable: "disable";
+    readonly Purge: "purge";
+    readonly RevokeDevice: "revoke_device";
+}>;
+/** Read-only API actions kept separate from mutating employee lifecycle actions. */
+export declare const EmployeeLifecycleQueryActions: Readonly<{
+    readonly List: "list";
+}>;
+export type EmployeeLifecycleAction = typeof EmployeeLifecycleActions[keyof typeof EmployeeLifecycleActions];
+/** Version tag for routing metadata stored outside the high-entropy GW credential. */
+export declare const EmployeeActivationGrantVersions: Readonly<{
+    readonly V1: "employee-activation-grant-v1";
+}>;
+/** Supported durable routing-grant schema versions. */
+export type EmployeeActivationGrantVersion = typeof EmployeeActivationGrantVersions[keyof typeof EmployeeActivationGrantVersions];
+/** Shared durable-storage layout for hashed employee activation routing grants. */
+export declare const EmployeeActivationGrantStorage: Readonly<{
+    readonly ScopedLayout: "scoped-v2";
+    readonly CollectionSegment: "employee-activation-grants";
+    readonly ScopeSeparator: "__";
+    readonly DefaultTtlMs: number;
+}>;
+/** JSON field names shared by employee lifecycle portal adapters. */
+export declare const OrganizationEmployeeApiFields: Readonly<{
+    readonly Action: "action";
+    readonly ProfileId: "profileId";
+    readonly Pin: "pin";
+    readonly PasskeyAccessToken: "passkeyAccessToken";
+    readonly ResourceId: "resourceId";
+    readonly LicenseId: "licenseId";
+    readonly ClientId: "clientId";
+    readonly ActivationCode: "activationCode";
+    readonly ClientInstanceId: "clientInstanceId";
+    readonly Email: "email";
+    readonly Role: "role";
+}>;
+/** Stable employee portal error identifiers. */
+export declare const OrganizationEmployeePortalErrors: Readonly<{
+    readonly InvitationFailed: "invitation_failed";
+    readonly LifecycleFailed: "employee_lifecycle_failed";
+    readonly ActivationFailed: "employee_activation_failed";
+}>;

package/dist/constants/employee-lifecycle.js

@@ -0,0 +1,48 @@
+/** Employee directory states exposed by organization lifecycle projections. */
+export const EmployeeDirectoryStatuses = Object.freeze({
+    Active: 'active',
+    Inactive: 'inactive',
+    Purged: 'purged',
+    Unknown: 'unknown',
+});
+/** Controller actions supported by the reusable employee lifecycle service. */
+export const EmployeeLifecycleActions = Object.freeze({
+    Disable: 'disable',
+    Purge: 'purge',
+    RevokeDevice: 'revoke_device',
+});
+/** Read-only API actions kept separate from mutating employee lifecycle actions. */
+export const EmployeeLifecycleQueryActions = Object.freeze({
+    List: 'list',
+});
+/** Version tag for routing metadata stored outside the high-entropy GW credential. */
+export const EmployeeActivationGrantVersions = Object.freeze({
+    V1: 'employee-activation-grant-v1',
+});
+/** Shared durable-storage layout for hashed employee activation routing grants. */
+export const EmployeeActivationGrantStorage = Object.freeze({
+    ScopedLayout: 'scoped-v2',
+    CollectionSegment: 'employee-activation-grants',
+    ScopeSeparator: '__',
+    DefaultTtlMs: 365 * 24 * 60 * 60 * 1_000,
+});
+/** JSON field names shared by employee lifecycle portal adapters. */
+export const OrganizationEmployeeApiFields = Object.freeze({
+    Action: 'action',
+    ProfileId: 'profileId',
+    Pin: 'pin',
+    PasskeyAccessToken: 'passkeyAccessToken',
+    ResourceId: 'resourceId',
+    LicenseId: 'licenseId',
+    ClientId: 'clientId',
+    ActivationCode: 'activationCode',
+    ClientInstanceId: 'clientInstanceId',
+    Email: 'email',
+    Role: 'role',
+});
+/** Stable employee portal error identifiers. */
+export const OrganizationEmployeePortalErrors = Object.freeze({
+    InvitationFailed: 'invitation_failed',
+    LifecycleFailed: 'employee_lifecycle_failed',
+    ActivationFailed: 'employee_activation_failed',
+});

package/dist/constants/http.d.ts

@@ -0,0 +1,28 @@
+/** Numeric HTTP status values shared by route adapters and tests. */
+export declare const HttpStatusCodes: Readonly<{
+    readonly Ok: 200;
+    readonly Created: 201;
+    readonly BadRequest: 400;
+    readonly Unauthorized: 401;
+    readonly Forbidden: 403;
+    readonly NotFound: 404;
+    readonly Conflict: 409;
+    readonly Gone: 410;
+    readonly InternalServerError: 500;
+    readonly ServiceUnavailable: 503;
+}>;
+/** HTTP methods used by SDK and portal request builders. */
+export declare const HttpRequestMethods: Readonly<{
+    readonly Get: "GET";
+    readonly Post: "POST";
+    readonly Patch: "PATCH";
+}>;
+/** Canonical HTTP header names. */
+export declare const HttpHeaderNames: Readonly<{
+    readonly Authorization: "authorization";
+    readonly ContentType: "content-type";
+}>;
+/** Media types shared by JSON route adapters. */
+export declare const HttpMediaTypes: Readonly<{
+    readonly Json: "application/json";
+}>;

package/dist/constants/http.js

@@ -0,0 +1,28 @@
+/** Numeric HTTP status values shared by route adapters and tests. */
+export const HttpStatusCodes = Object.freeze({
+    Ok: 200,
+    Created: 201,
+    BadRequest: 400,
+    Unauthorized: 401,
+    Forbidden: 403,
+    NotFound: 404,
+    Conflict: 409,
+    Gone: 410,
+    InternalServerError: 500,
+    ServiceUnavailable: 503,
+});
+/** HTTP methods used by SDK and portal request builders. */
+export const HttpRequestMethods = Object.freeze({
+    Get: 'GET',
+    Post: 'POST',
+    Patch: 'PATCH',
+});
+/** Canonical HTTP header names. */
+export const HttpHeaderNames = Object.freeze({
+    Authorization: 'authorization',
+    ContentType: 'content-type',
+});
+/** Media types shared by JSON route adapters. */
+export const HttpMediaTypes = Object.freeze({
+    Json: 'application/json',
+});

package/dist/constants/identity-auth.d.ts

@@ -0,0 +1,57 @@
+/** Canonical identity/auth route actions shared by gateways, SDKs and portals. */
+export declare const IdentityAuthActions: Readonly<{
+    readonly Exchange: "_exchange";
+    readonly ExchangeResponse: "_exchange-response";
+    readonly Dcr: "_dcr";
+    readonly DcrResponse: "_dcr-response";
+    readonly Issue: "_issue";
+    readonly IssueResponse: "_issue-response";
+    readonly Revoke: "_revoke";
+    readonly RevokeResponse: "_revoke-response";
+    readonly Search: "_search";
+    readonly SearchResponse: "_search-response";
+}>;
+/** Canonical identity/auth route segments shared by all products. */
+export declare const IdentityAuthRouteSegments: Readonly<{
+    readonly Host: "host";
+    readonly Version: "v1";
+    readonly Section: "identity";
+    readonly Format: "auth";
+}>;
+/** Wire-level request keys used by identity/auth operations. */
+export declare const IdentityAuthRequestFields: Readonly<{
+    readonly SubjectToken: "subject_token";
+    readonly ClientInstanceId: "client_instance_id";
+    readonly LicenseId: "license_id";
+    readonly ClientId: "client_id";
+    readonly Code: "code";
+}>;
+/** Response keys accepted from token exchange during the compatibility window. */
+export declare const IdentityAuthResponseFields: Readonly<{
+    readonly InitialAccessToken: "initial_access_token";
+    readonly AccessToken: "access_token";
+}>;
+/** DCR metadata keys used to derive and register one installation identity. */
+export declare const IdentityDcrMetadataFields: Readonly<{
+    readonly ExtendedDeviceInfo: "ext_device_info";
+    readonly RedirectUris: "redirect_uris";
+    readonly Jwks: "jwks";
+    readonly SoftwareId: "software_id";
+    readonly ApplicationType: "application_type";
+    readonly ClientName: "client_name";
+    readonly ActorDid: "actor_did";
+    readonly ProfileDid: "profile_did";
+}>;
+/** Device metadata keys nested below `ext_device_info`. */
+export declare const IdentityDeviceInfoFields: Readonly<{
+    readonly DeviceId: "device_id";
+}>;
+/** Stable entry type emitted by license issuance responses. */
+export declare const IdentityAuthResponseEntryTypes: Readonly<{
+    readonly LicenseIssued: "License:Issued";
+    readonly DeviceRevoked: "Device:Revoked";
+}>;
+/** DIDComm response type values emitted by identity/auth managers. */
+export declare const IdentityAuthResponseTypes: Readonly<{
+    readonly DeviceRevoke: "device-revoke-response";
+}>;

package/dist/constants/identity-auth.js

@@ -0,0 +1,57 @@
+/** Canonical identity/auth route actions shared by gateways, SDKs and portals. */
+export const IdentityAuthActions = Object.freeze({
+    Exchange: '_exchange',
+    ExchangeResponse: '_exchange-response',
+    Dcr: '_dcr',
+    DcrResponse: '_dcr-response',
+    Issue: '_issue',
+    IssueResponse: '_issue-response',
+    Revoke: '_revoke',
+    RevokeResponse: '_revoke-response',
+    Search: '_search',
+    SearchResponse: '_search-response',
+});
+/** Canonical identity/auth route segments shared by all products. */
+export const IdentityAuthRouteSegments = Object.freeze({
+    Host: 'host',
+    Version: 'v1',
+    Section: 'identity',
+    Format: 'auth',
+});
+/** Wire-level request keys used by identity/auth operations. */
+export const IdentityAuthRequestFields = Object.freeze({
+    SubjectToken: 'subject_token',
+    ClientInstanceId: 'client_instance_id',
+    LicenseId: 'license_id',
+    ClientId: 'client_id',
+    Code: 'code',
+});
+/** Response keys accepted from token exchange during the compatibility window. */
+export const IdentityAuthResponseFields = Object.freeze({
+    InitialAccessToken: 'initial_access_token',
+    AccessToken: 'access_token',
+});
+/** DCR metadata keys used to derive and register one installation identity. */
+export const IdentityDcrMetadataFields = Object.freeze({
+    ExtendedDeviceInfo: 'ext_device_info',
+    RedirectUris: 'redirect_uris',
+    Jwks: 'jwks',
+    SoftwareId: 'software_id',
+    ApplicationType: 'application_type',
+    ClientName: 'client_name',
+    ActorDid: 'actor_did',
+    ProfileDid: 'profile_did',
+});
+/** Device metadata keys nested below `ext_device_info`. */
+export const IdentityDeviceInfoFields = Object.freeze({
+    DeviceId: 'device_id',
+});
+/** Stable entry type emitted by license issuance responses. */
+export const IdentityAuthResponseEntryTypes = Object.freeze({
+    LicenseIssued: 'License:Issued',
+    DeviceRevoked: 'Device:Revoked',
+});
+/** DIDComm response type values emitted by identity/auth managers. */
+export const IdentityAuthResponseTypes = Object.freeze({
+    DeviceRevoke: 'device-revoke-response',
+});

package/dist/constants/index.d.ts

@@ -8,6 +8,10 @@ export * from './dataspace-discovery';
 export * from './dataspace-protocol';
 export * from './didcomm';
 export * from './device';
+export * from './employee-lifecycle';
+export * from './identity-auth';
+export * from './http';
+export * from './organization-application';
 export * from './did-services';
 export * from './eu-countries';
 export * from './fhir-code-systems';

package/dist/constants/index.js

@@ -8,6 +8,10 @@ export * from './dataspace-discovery.js';
 export * from './dataspace-protocol.js';
 export * from './didcomm.js';
 export * from './device.js';
+export * from './employee-lifecycle.js';
+export * from './identity-auth.js';
+export * from './http.js';
+export * from './organization-application.js';
 export * from './did-services.js';
 export * from './eu-countries.js';
 export * from './fhir-code-systems.js';

package/dist/constants/organization-application.d.ts

@@ -0,0 +1,27 @@
+/** Actions accepted by the reusable organization-registration review route. */
+export declare const OrganizationRegistrationReviewActions: Readonly<{
+    readonly MarkPostalDelivered: "mark_postal_delivered";
+    readonly IssuePostalLicense: "issue_postal_license";
+    readonly DownloadDraft: "download_draft";
+    readonly Authorize: "authorize";
+    readonly Reject: "reject";
+}>;
+export type OrganizationRegistrationReviewAction = typeof OrganizationRegistrationReviewActions[keyof typeof OrganizationRegistrationReviewActions];
+/** Narrows untrusted request input to one supported review action. */
+export declare function isOrganizationRegistrationReviewAction(value: unknown): value is OrganizationRegistrationReviewAction;
+/** Stable error identifiers shared by route handlers, services and tests. */
+export declare const OrganizationRegistrationErrors: Readonly<{
+    readonly InvalidReviewAction: "invalid_review_action";
+    readonly ApplicationNotReviewable: "application_not_reviewable";
+    readonly AuthorizationCredentialRequired: "organization_authorization_credential_required";
+    readonly ReviewFailed: "review_failed";
+    readonly InvalidOrganization: "invalid_organization";
+    readonly ApplicationFailed: "application_failed";
+}>;
+/** Default and accepted authorization validity window for registration evidence. */
+export declare const OrganizationRegistrationValidity: Readonly<{
+    readonly DefaultDays: 180;
+    readonly MinimumDays: 1;
+    readonly MaximumDays: 730;
+    readonly MillisecondsPerDay: 86400000;
+}>;

package/dist/constants/organization-application.js

@@ -0,0 +1,29 @@
+/** Actions accepted by the reusable organization-registration review route. */
+export const OrganizationRegistrationReviewActions = Object.freeze({
+    MarkPostalDelivered: 'mark_postal_delivered',
+    IssuePostalLicense: 'issue_postal_license',
+    DownloadDraft: 'download_draft',
+    Authorize: 'authorize',
+    Reject: 'reject',
+});
+/** Narrows untrusted request input to one supported review action. */
+export function isOrganizationRegistrationReviewAction(value) {
+    return typeof value === 'string'
+        && Object.values(OrganizationRegistrationReviewActions).includes(value);
+}
+/** Stable error identifiers shared by route handlers, services and tests. */
+export const OrganizationRegistrationErrors = Object.freeze({
+    InvalidReviewAction: 'invalid_review_action',
+    ApplicationNotReviewable: 'application_not_reviewable',
+    AuthorizationCredentialRequired: 'organization_authorization_credential_required',
+    ReviewFailed: 'review_failed',
+    InvalidOrganization: 'invalid_organization',
+    ApplicationFailed: 'application_failed',
+});
+/** Default and accepted authorization validity window for registration evidence. */
+export const OrganizationRegistrationValidity = Object.freeze({
+    DefaultDays: 180,
+    MinimumDays: 1,
+    MaximumDays: 730,
+    MillisecondsPerDay: 86_400_000,
+});

package/dist/constants/schemaorg.d.ts

@@ -155,6 +155,8 @@ export declare enum ClaimsOrderSchemaorg {
  *   conventions and international contexts.
  */
 export declare enum ClaimsPersonSchemaorg {
+    /** Schema.org additional type; service-controller VCs use bare `RESPRSN`. */
+    additionalType = "org.schema.Person.additionalType",
     /** Second surname or mother's maiden name */
     additionalName = "org.schema.Person.additionalName",
     /** Short friendly name */
@@ -165,6 +167,8 @@ export declare enum ClaimsPersonSchemaorg {
     gender = "org.schema.Person.gender",
     givenName = "org.schema.Person.givenName",
     hasOccupation = "org.schema.Person.hasOccupation",
+    /** ISCO taxonomy token carried by `Occupation.occupationalCategory`. */
+    hasOccupationalCategory = "org.schema.Person.hasOccupation.occupationalCategory",
     /**
      * Canonical nested role value used in ICA/VC credential subjects and
      * supported by activation/normalization helpers.

package/dist/constants/schemaorg.js

@@ -163,6 +163,8 @@ export var ClaimsOrderSchemaorg;
  */
 export var ClaimsPersonSchemaorg;
 (function (ClaimsPersonSchemaorg) {
+    /** Schema.org additional type; service-controller VCs use bare `RESPRSN`. */
+    ClaimsPersonSchemaorg["additionalType"] = "org.schema.Person.additionalType";
     /** Second surname or mother's maiden name */
     ClaimsPersonSchemaorg["additionalName"] = "org.schema.Person.additionalName";
     /** Short friendly name */
@@ -173,6 +175,8 @@ export var ClaimsPersonSchemaorg;
     ClaimsPersonSchemaorg["gender"] = "org.schema.Person.gender";
     ClaimsPersonSchemaorg["givenName"] = "org.schema.Person.givenName";
     ClaimsPersonSchemaorg["hasOccupation"] = "org.schema.Person.hasOccupation";
+    /** ISCO taxonomy token carried by `Occupation.occupationalCategory`. */
+    ClaimsPersonSchemaorg["hasOccupationalCategory"] = "org.schema.Person.hasOccupation.occupationalCategory";
     /**
      * Canonical nested role value used in ICA/VC credential subjects and
      * supported by activation/normalization helpers.

package/dist/constants/verifiable-credentials.d.ts

@@ -28,6 +28,8 @@ export declare const ActivationCredentialTypes: Readonly<{
     OrganizationCredential: "OrganizationCredential";
     LegalOrganizationCredential: "LegalOrganizationCredential";
     LegalRepresentativeCredential: "LegalRepresentativeCredential";
+    ServiceControllerCredential: "ServiceControllerCredential";
+    /** @deprecated Read-only compatibility with pre-2.6 controller VCs. */
     OrganizationControllerCredential: "OrganizationControllerCredential";
     PersonCredential: "PersonCredential";
 }>;
@@ -69,4 +71,6 @@ export declare const REPRESENTATIVE_ACTIVATION_VC_TYPES: readonly ("LegalReprese
  * Canonical credential subtype used to bind an organization tenant service to
  * one independently authenticated controller actor and its signing key.
  */
-export declare const ORGANIZATION_CONTROLLER_ACTIVATION_VC_TYPES: readonly "OrganizationControllerCredential"[];
+export declare const SERVICE_CONTROLLER_ACTIVATION_VC_TYPES: readonly ("ServiceControllerCredential" | "OrganizationControllerCredential")[];
+/** @deprecated Use `SERVICE_CONTROLLER_ACTIVATION_VC_TYPES`. */
+export declare const ORGANIZATION_CONTROLLER_ACTIVATION_VC_TYPES: readonly ("ServiceControllerCredential" | "OrganizationControllerCredential")[];

package/dist/constants/verifiable-credentials.js

@@ -30,6 +30,8 @@ export const ActivationCredentialTypes = Object.freeze({
     OrganizationCredential: 'OrganizationCredential',
     LegalOrganizationCredential: 'LegalOrganizationCredential',
     LegalRepresentativeCredential: 'LegalRepresentativeCredential',
+    ServiceControllerCredential: 'ServiceControllerCredential',
+    /** @deprecated Read-only compatibility with pre-2.6 controller VCs. */
     OrganizationControllerCredential: 'OrganizationControllerCredential',
     PersonCredential: 'PersonCredential',
 });
@@ -77,6 +79,9 @@ export const REPRESENTATIVE_ACTIVATION_VC_TYPES = Object.freeze([
  * Canonical credential subtype used to bind an organization tenant service to
  * one independently authenticated controller actor and its signing key.
  */
-export const ORGANIZATION_CONTROLLER_ACTIVATION_VC_TYPES = Object.freeze([
+export const SERVICE_CONTROLLER_ACTIVATION_VC_TYPES = Object.freeze([
+    ActivationCredentialTypes.ServiceControllerCredential,
     ActivationCredentialTypes.OrganizationControllerCredential,
 ]);
+/** @deprecated Use `SERVICE_CONTROLLER_ACTIVATION_VC_TYPES`. */
+export const ORGANIZATION_CONTROLLER_ACTIVATION_VC_TYPES = SERVICE_CONTROLLER_ACTIVATION_VC_TYPES;

package/dist/examples/ica-activation-proof.d.ts

@@ -5,9 +5,9 @@
  * - controller-signing/audience ids and VC subtype names must be imported from
  *   this module instead of re-hardcoded
  *   inline
- * - the representative `hasCredential.material` shape below reflects the
- *   current `activation-policy` helper contract; if ICA finalizes a different
- *   VC shape, update this module first and then the dependent helpers/tests
+ * - the representative VC carries the legal occupation, while the separate
+ *   service-controller VC carries `RESPRSN`, the technical ISCO occupation and the
+ *   controller key binding
  *
  * Modeling note:
  * - this onboarding example intentionally anchors the business subject on the
@@ -24,6 +24,8 @@ export declare const EXAMPLE_ORG_CONTROLLER_SIGNING_KEY_ID: "urn:ietf:params:oau
 export declare const EXAMPLE_PRESENTATION_AUDIENCE_HOST_ID: "host:node-operator-es";
 export declare const EXAMPLE_ORGANIZATION_TAX_ID: "ESB00112233";
 export declare const EXAMPLE_REPRESENTATIVE_ROLE_CODE: "RESPRSN";
+export declare const EXAMPLE_LEGAL_REPRESENTATIVE_ISCO_CODE: "1120";
+export declare const EXAMPLE_TECHNICAL_CONTROLLER_ISCO_CODE: "1330";
 export declare const EXAMPLE_REPRESENTATIVE_IDENTIFIER: "IDCES-99999999R";
 export declare const EXAMPLE_REPRESENTATIVE_EMAIL: "legal.rep@example.org";
 export declare const EXAMPLE_REPRESENTATIVE_SUBJECT_URN: "urn:person:identifier:IDCES-99999999R";
@@ -55,15 +57,37 @@ export declare const EXAMPLE_ORG_ACTIVATION_LEGAL_REPRESENTATIVE_CREDENTIAL: Rea
             taxID: "ESB00112233";
         };
         hasOccupation: {
-            identifier: "RESPRSN";
-        };
-        hasCredential: {
-            material: "urn:ietf:params:oauth:jwk-thumbprint:sha-256:Q0ZfM0V4YW1wbGVUaHVtYnByaW50X2Jhc2U2NHVybA";
+            '@type': string;
+            occupationalCategory: string;
         };
         identifier: "IDCES-99999999R";
         sameAs: "urn:multibase:zControllerHash";
     };
 }>;
+export declare const EXAMPLE_ORG_ACTIVATION_CONTROLLER_CREDENTIAL: Readonly<{
+    '@context': string[];
+    type: ("VerifiableCredential" | "ServiceControllerCredential")[];
+    credentialSubject: {
+        id: "ESB00112233";
+        '@type': string;
+        serviceType: string;
+        provider: {
+            taxID: "ESB00112233";
+        };
+        owner: {
+            '@type': string;
+            additionalType: "RESPRSN";
+            sameAs: "urn:multibase:zControllerHash";
+            hasOccupation: {
+                '@type': string;
+                occupationalCategory: string;
+            };
+            hasCredential: {
+                material: "urn:ietf:params:oauth:jwk-thumbprint:sha-256:Q0ZfM0V4YW1wbGVUaHVtYnByaW50X2Jhc2U2NHVybA";
+            };
+        };
+    };
+}>;
 export declare const EXAMPLE_ORG_ACTIVATION_PROOF_VP_PAYLOAD: Readonly<{
     iss: "urn:ietf:params:oauth:jwk-thumbprint:sha-256:Q0ZfM0V4YW1wbGVUaHVtYnByaW50X2Jhc2U2NHVybA";
     sub: "ESB00112233";

package/dist/examples/ica-activation-proof.js

@@ -11,9 +11,9 @@ import { DataspaceSectors } from '../constants/sectors.js';
  * - controller-signing/audience ids and VC subtype names must be imported from
  *   this module instead of re-hardcoded
  *   inline
- * - the representative `hasCredential.material` shape below reflects the
- *   current `activation-policy` helper contract; if ICA finalizes a different
- *   VC shape, update this module first and then the dependent helpers/tests
+ * - the representative VC carries the legal occupation, while the separate
+ *   service-controller VC carries `RESPRSN`, the technical ISCO occupation and the
+ *   controller key binding
  *
  * Modeling note:
  * - this onboarding example intentionally anchors the business subject on the
@@ -30,6 +30,8 @@ export const EXAMPLE_ORG_CONTROLLER_SIGNING_KEY_ID = `${UrnPrefixes.JwkThumbprin
 export const EXAMPLE_PRESENTATION_AUDIENCE_HOST_ID = 'host:node-operator-es';
 export const EXAMPLE_ORGANIZATION_TAX_ID = 'ESB00112233';
 export const EXAMPLE_REPRESENTATIVE_ROLE_CODE = 'RESPRSN';
+export const EXAMPLE_LEGAL_REPRESENTATIVE_ISCO_CODE = '1120';
+export const EXAMPLE_TECHNICAL_CONTROLLER_ISCO_CODE = '1330';
 export const EXAMPLE_REPRESENTATIVE_IDENTIFIER = 'IDCES-99999999R';
 export const EXAMPLE_REPRESENTATIVE_EMAIL = 'legal.rep@example.org';
 export const EXAMPLE_REPRESENTATIVE_SUBJECT_URN = `urn:person:identifier:${EXAMPLE_REPRESENTATIVE_IDENTIFIER}`;
@@ -67,15 +69,36 @@ export const EXAMPLE_ORG_ACTIVATION_LEGAL_REPRESENTATIVE_CREDENTIAL = Object.fre
             taxID: EXAMPLE_ORGANIZATION_TAX_ID,
         },
         hasOccupation: {
-            identifier: EXAMPLE_REPRESENTATIVE_ROLE_CODE,
-        },
-        hasCredential: {
-            material: EXAMPLE_ORG_CONTROLLER_SIGNING_KEY_ID,
+            '@type': 'Occupation',
+            occupationalCategory: `ISCO-08|${EXAMPLE_LEGAL_REPRESENTATIVE_ISCO_CODE}`,
         },
         identifier: EXAMPLE_REPRESENTATIVE_IDENTIFIER,
         sameAs: EXAMPLE_REPRESENTATIVE_SAME_AS,
     },
 });
+export const EXAMPLE_ORG_ACTIVATION_CONTROLLER_CREDENTIAL = Object.freeze({
+    '@context': [W3cCredentialContexts.V2, 'https://schema.org'],
+    type: [
+        W3cCredentialTypes.VerifiableCredential,
+        ActivationCredentialTypes.ServiceControllerCredential,
+    ],
+    credentialSubject: {
+        id: EXAMPLE_ORGANIZATION_ID,
+        '@type': 'Service',
+        serviceType: 'OrganizationControllerService',
+        provider: { taxID: EXAMPLE_ORGANIZATION_TAX_ID },
+        owner: {
+            '@type': 'Person',
+            additionalType: EXAMPLE_REPRESENTATIVE_ROLE_CODE,
+            sameAs: EXAMPLE_REPRESENTATIVE_SAME_AS,
+            hasOccupation: {
+                '@type': 'Occupation',
+                occupationalCategory: `ISCO-08|${EXAMPLE_TECHNICAL_CONTROLLER_ISCO_CODE}`,
+            },
+            hasCredential: { material: EXAMPLE_ORG_CONTROLLER_SIGNING_KEY_ID },
+        },
+    },
+});
 export const EXAMPLE_ORG_ACTIVATION_PROOF_VP_PAYLOAD = Object.freeze({
     iss: EXAMPLE_ORG_CONTROLLER_SIGNING_KEY_ID,
     sub: EXAMPLE_ORGANIZATION_TAX_ID,
@@ -87,6 +110,7 @@ export const EXAMPLE_ORG_ACTIVATION_PROOF_VP_PAYLOAD = Object.freeze({
         verifiableCredential: [
             JSON.stringify(EXAMPLE_ORG_ACTIVATION_ORGANIZATION_CREDENTIAL),
             JSON.stringify(EXAMPLE_ORG_ACTIVATION_LEGAL_REPRESENTATIVE_CREDENTIAL),
+            JSON.stringify(EXAMPLE_ORG_ACTIVATION_CONTROLLER_CREDENTIAL),
         ],
     },
 });