gdc-common-utils-ts 2.5.2 → 2.5.4

package/dist/examples/ica-verify-response.d.ts

@@ -40,11 +40,10 @@ export interface IcaVerifyResponseExampleOutcome {
  * Contract notes:
  * - `body.data[0]` carries the organization credential plus optional generated
  *   organization signing keypair
- * - `body.data[1]` carries the legal representative credential plus the
- *   controller binding public key
- * - `credentialSubject.sameAs` expresses public identity continuity
- * - `credentialSubject.hasCredential.material` expresses controller
- *   signing/binding key continuity as an RFC 9278 JWK-thumbprint URN
+ * - `body.data[1]` carries the legal representative credential and its ISCO
+ *   occupation; legal representation alone does not grant tenant control
+ * - `body.data[2]` carries the independently issued organization-controller
+ *   credential, including `RESPRSN`, controller ISCO occupation and JWK binding
  */
 export interface IcaVerifyTermsResponseExample {
     jti: string;
@@ -74,14 +73,19 @@ export declare const EXAMPLE_VERIFY_RESPONSE_PROOF_DATE: "2026-03-12T21:12:57.53
 export declare const EXAMPLE_VERIFY_RESPONSE_VERSION_ID: "zPdfVersionHash001";
 export declare const EXAMPLE_VERIFY_RESPONSE_ORG_VC_ID: "urn:uuid:org-vc-001";
 export declare const EXAMPLE_VERIFY_RESPONSE_PERSON_VC_ID: "urn:uuid:person-vc-001";
+export declare const EXAMPLE_VERIFY_RESPONSE_CONTROLLER_VC_ID: "urn:uuid:controller-vc-001";
 export declare const EXAMPLE_VERIFY_RESPONSE_ORG_ENTRY_TYPE: "Organization-verification-v1.0";
 export declare const EXAMPLE_VERIFY_RESPONSE_PERSON_ENTRY_TYPE: "LegalRepresentative-verification-v1.0";
+export declare const EXAMPLE_VERIFY_RESPONSE_CONTROLLER_ENTRY_TYPE: "ServiceController-verification-v1.0";
 export declare const EXAMPLE_VERIFY_RESPONSE_ORG_ATTACHMENT_ID: "vc-jwt-1";
 export declare const EXAMPLE_VERIFY_RESPONSE_PERSON_ATTACHMENT_ID: "vc-jwt-2";
+export declare const EXAMPLE_VERIFY_RESPONSE_CONTROLLER_ATTACHMENT_ID: "vc-jwt-3";
 export declare const EXAMPLE_VERIFY_RESPONSE_ORG_ATTACHMENT_FILENAME: "Organization-verification-v1.0-1.jwt";
 export declare const EXAMPLE_VERIFY_RESPONSE_PERSON_ATTACHMENT_FILENAME: "LegalRepresentative-verification-v1.0-2.jwt";
+export declare const EXAMPLE_VERIFY_RESPONSE_CONTROLLER_ATTACHMENT_FILENAME: "ServiceController-verification-v1.0-3.jwt";
 export declare const EXAMPLE_VERIFY_RESPONSE_ORG_JWT: "<vc-jwt-organization>";
 export declare const EXAMPLE_VERIFY_RESPONSE_PERSON_JWT: "<vc-jwt-legal-representative>";
+export declare const EXAMPLE_VERIFY_RESPONSE_CONTROLLER_JWT: "<vc-jwt-organization-controller>";
 export declare const EXAMPLE_VERIFY_RESPONSE_MEDIA_TYPE: "application/vc+jwt";
 export declare const EXAMPLE_VERIFY_RESPONSE_ATTACHMENT_FORMAT: "vc+jwt";
 export declare const EXAMPLE_VERIFY_RESPONSE_STATUS_OK: "200";
@@ -98,19 +102,24 @@ export declare const EXAMPLE_VERIFY_RESPONSE_ORG_ADDITIONAL_TYPE: "sector=onehea
 export declare const EXAMPLE_VERIFY_RESPONSE_ADDRESS_TYPE: "PostalAddress";
 export declare const EXAMPLE_VERIFY_RESPONSE_ADDRESS_COUNTRY: "ES";
 export declare const EXAMPLE_VERIFY_RESPONSE_OCCUPATION_TYPE: "Occupation";
+/** @deprecated Display-only legacy constant; no longer emitted in signed VCs. */
 export declare const EXAMPLE_VERIFY_RESPONSE_OCCUPATION_NAME: "LegalRepresentative";
-export declare const EXAMPLE_VERIFY_RESPONSE_OCCUPATION_IDENTIFIER: "RESPRSN";
+export declare const EXAMPLE_VERIFY_RESPONSE_REPRESENTATIVE_ISCO: "1120";
+export declare const EXAMPLE_VERIFY_RESPONSE_CONTROLLER_ISCO: "1330";
+export declare const EXAMPLE_VERIFY_RESPONSE_CONTROLLER_ROLE: "RESPRSN";
 export declare const EXAMPLE_VERIFY_RESPONSE_PROOF_TYPE: "JsonWebSignature2020";
 export declare const EXAMPLE_VERIFY_RESPONSE_PROOF_PURPOSE: "assertionMethod";
 export declare const EXAMPLE_VERIFY_RESPONSE_PROOF_VERIFICATION_METHOD: "did:web:localhost%3A3310#verification-key-001";
 export declare const EXAMPLE_VERIFY_RESPONSE_ORG_PROOF_JWS: "<detached-jws-organization-truncated>";
 export declare const EXAMPLE_VERIFY_RESPONSE_PERSON_PROOF_JWS: "<detached-jws-person-truncated>";
+export declare const EXAMPLE_VERIFY_RESPONSE_CONTROLLER_PROOF_JWS: "<detached-jws-controller-truncated>";
 /**
  * Shared success outcome reused at bundle level and item level.
  */
 export declare const EXAMPLE_VERIFY_RESPONSE_SUCCESS_OUTCOME: IcaVerifyResponseExampleOutcome;
 export declare const EXAMPLE_VERIFY_RESPONSE_ORG_ITEM_OUTCOME: IcaVerifyResponseExampleOutcome;
 export declare const EXAMPLE_VERIFY_RESPONSE_PERSON_ITEM_OUTCOME: IcaVerifyResponseExampleOutcome;
+export declare const EXAMPLE_VERIFY_RESPONSE_CONTROLLER_ITEM_OUTCOME: IcaVerifyResponseExampleOutcome;
 export declare const EXAMPLE_VERIFY_RESPONSE_ORG_PUBLIC_KEY_JWK: Readonly<{
     kty: "EC";
     crv: "P-384";
@@ -196,8 +205,7 @@ export declare const EXAMPLE_VERIFY_RESPONSE_PERSON_CREDENTIAL: Readonly<{
         };
         hasOccupation: {
             '@type': "Occupation";
-            name: "LegalRepresentative";
-            identifier: "RESPRSN";
+            occupationalCategory: string;
         };
         memberOf: {
             '@type': "Organization";
@@ -216,8 +224,49 @@ export declare const EXAMPLE_VERIFY_RESPONSE_PERSON_CREDENTIAL: Readonly<{
         jws: "<detached-jws-person-truncated>";
     };
 }>;
+export declare const EXAMPLE_VERIFY_RESPONSE_CONTROLLER_CREDENTIAL: Readonly<{
+    id: "urn:uuid:controller-vc-001";
+    '@context': ("https://www.w3.org/ns/credentials/v2" | "https://schema.org")[];
+    type: string[];
+    issuer: "did:web:ica.example.org";
+    validFrom: "2026-03-12T21:12:26.646Z";
+    meta: {
+        versionId: "zPdfVersionHash001";
+    };
+    credentialSubject: {
+        id: "did:web:globaldatacare.es:onehealth:organization:taxid:VATES-B00112233";
+        '@type': string;
+        serviceType: string;
+        provider: {
+            '@type': "Organization";
+            legalName: "ACME Health Provider";
+            taxID: "VATES-B00112233";
+        };
+        owner: {
+            '@type': "Person";
+            additionalType: "RESPRSN";
+            sameAs: "urn:multibase:zControllerHash";
+            hasOccupation: {
+                '@type': "Occupation";
+                occupationalCategory: string;
+            };
+            hasCredential: {
+                material: "urn:ietf:params:oauth:jwk-thumbprint:sha-256:Q0ZfM0V4YW1wbGVUaHVtYnByaW50X2Jhc2U2NHVybA";
+            };
+        };
+    };
+    evidence: never[];
+    proof: {
+        type: "JsonWebSignature2020";
+        created: "2026-03-12T21:12:57.534Z";
+        proofPurpose: "assertionMethod";
+        verificationMethod: "did:web:localhost%3A3310#verification-key-001";
+        jws: "<detached-jws-controller-truncated>";
+    };
+}>;
 export declare const EXAMPLE_VERIFY_RESPONSE_ORG_ATTACHMENT: IcaVerifyResponseExampleAttachment;
 export declare const EXAMPLE_VERIFY_RESPONSE_PERSON_ATTACHMENT: IcaVerifyResponseExampleAttachment;
+export declare const EXAMPLE_VERIFY_RESPONSE_CONTROLLER_ATTACHMENT: IcaVerifyResponseExampleAttachment;
 /**
  * Canonical `_verify-response` success example shared across ICA repos.
  */

package/dist/examples/ica-verify-response.js

@@ -19,14 +19,19 @@ export const EXAMPLE_VERIFY_RESPONSE_PROOF_DATE = '2026-03-12T21:12:57.534Z';
 export const EXAMPLE_VERIFY_RESPONSE_VERSION_ID = 'zPdfVersionHash001';
 export const EXAMPLE_VERIFY_RESPONSE_ORG_VC_ID = 'urn:uuid:org-vc-001';
 export const EXAMPLE_VERIFY_RESPONSE_PERSON_VC_ID = 'urn:uuid:person-vc-001';
+export const EXAMPLE_VERIFY_RESPONSE_CONTROLLER_VC_ID = 'urn:uuid:controller-vc-001';
 export const EXAMPLE_VERIFY_RESPONSE_ORG_ENTRY_TYPE = 'Organization-verification-v1.0';
 export const EXAMPLE_VERIFY_RESPONSE_PERSON_ENTRY_TYPE = 'LegalRepresentative-verification-v1.0';
+export const EXAMPLE_VERIFY_RESPONSE_CONTROLLER_ENTRY_TYPE = 'ServiceController-verification-v1.0';
 export const EXAMPLE_VERIFY_RESPONSE_ORG_ATTACHMENT_ID = 'vc-jwt-1';
 export const EXAMPLE_VERIFY_RESPONSE_PERSON_ATTACHMENT_ID = 'vc-jwt-2';
+export const EXAMPLE_VERIFY_RESPONSE_CONTROLLER_ATTACHMENT_ID = 'vc-jwt-3';
 export const EXAMPLE_VERIFY_RESPONSE_ORG_ATTACHMENT_FILENAME = 'Organization-verification-v1.0-1.jwt';
 export const EXAMPLE_VERIFY_RESPONSE_PERSON_ATTACHMENT_FILENAME = 'LegalRepresentative-verification-v1.0-2.jwt';
+export const EXAMPLE_VERIFY_RESPONSE_CONTROLLER_ATTACHMENT_FILENAME = 'ServiceController-verification-v1.0-3.jwt';
 export const EXAMPLE_VERIFY_RESPONSE_ORG_JWT = '<vc-jwt-organization>';
 export const EXAMPLE_VERIFY_RESPONSE_PERSON_JWT = '<vc-jwt-legal-representative>';
+export const EXAMPLE_VERIFY_RESPONSE_CONTROLLER_JWT = '<vc-jwt-organization-controller>';
 export const EXAMPLE_VERIFY_RESPONSE_MEDIA_TYPE = 'application/vc+jwt';
 export const EXAMPLE_VERIFY_RESPONSE_ATTACHMENT_FORMAT = 'vc+jwt';
 export const EXAMPLE_VERIFY_RESPONSE_STATUS_OK = '200';
@@ -43,13 +48,17 @@ export const EXAMPLE_VERIFY_RESPONSE_ORG_ADDITIONAL_TYPE = 'sector=onehealth;sec
 export const EXAMPLE_VERIFY_RESPONSE_ADDRESS_TYPE = 'PostalAddress';
 export const EXAMPLE_VERIFY_RESPONSE_ADDRESS_COUNTRY = 'ES';
 export const EXAMPLE_VERIFY_RESPONSE_OCCUPATION_TYPE = 'Occupation';
+/** @deprecated Display-only legacy constant; no longer emitted in signed VCs. */
 export const EXAMPLE_VERIFY_RESPONSE_OCCUPATION_NAME = 'LegalRepresentative';
-export const EXAMPLE_VERIFY_RESPONSE_OCCUPATION_IDENTIFIER = 'RESPRSN';
+export const EXAMPLE_VERIFY_RESPONSE_REPRESENTATIVE_ISCO = '1120';
+export const EXAMPLE_VERIFY_RESPONSE_CONTROLLER_ISCO = '1330';
+export const EXAMPLE_VERIFY_RESPONSE_CONTROLLER_ROLE = 'RESPRSN';
 export const EXAMPLE_VERIFY_RESPONSE_PROOF_TYPE = 'JsonWebSignature2020';
 export const EXAMPLE_VERIFY_RESPONSE_PROOF_PURPOSE = 'assertionMethod';
 export const EXAMPLE_VERIFY_RESPONSE_PROOF_VERIFICATION_METHOD = 'did:web:localhost%3A3310#verification-key-001';
 export const EXAMPLE_VERIFY_RESPONSE_ORG_PROOF_JWS = '<detached-jws-organization-truncated>';
 export const EXAMPLE_VERIFY_RESPONSE_PERSON_PROOF_JWS = '<detached-jws-person-truncated>';
+export const EXAMPLE_VERIFY_RESPONSE_CONTROLLER_PROOF_JWS = '<detached-jws-controller-truncated>';
 /**
  * Shared success outcome reused at bundle level and item level.
  */
@@ -83,6 +92,14 @@ export const EXAMPLE_VERIFY_RESPONSE_PERSON_ITEM_OUTCOME = {
         },
     ],
 };
+export const EXAMPLE_VERIFY_RESPONSE_CONTROLLER_ITEM_OUTCOME = {
+    resourceType: EXAMPLE_VERIFY_RESPONSE_OPERATION_OUTCOME_RESOURCE_TYPE,
+    issue: [{
+            severity: IssueSeverity.Information,
+            code: IssueType.Informational,
+            diagnostics: 'Organization controller credential extracted from verified document and JWK binding.',
+        }],
+};
 export const EXAMPLE_VERIFY_RESPONSE_ORG_PUBLIC_KEY_JWK = Object.freeze({
     kty: 'EC',
     crv: 'P-384',
@@ -167,8 +184,7 @@ export const EXAMPLE_VERIFY_RESPONSE_PERSON_CREDENTIAL = Object.freeze({
         },
         hasOccupation: {
             '@type': EXAMPLE_VERIFY_RESPONSE_OCCUPATION_TYPE,
-            name: EXAMPLE_VERIFY_RESPONSE_OCCUPATION_NAME,
-            identifier: EXAMPLE_VERIFY_RESPONSE_OCCUPATION_IDENTIFIER,
+            occupationalCategory: `ISCO-08|${EXAMPLE_VERIFY_RESPONSE_REPRESENTATIVE_ISCO}`,
         },
         memberOf: {
             '@type': EXAMPLE_VERIFY_RESPONSE_ORGANIZATION_TYPE,
@@ -187,6 +203,46 @@ export const EXAMPLE_VERIFY_RESPONSE_PERSON_CREDENTIAL = Object.freeze({
         jws: EXAMPLE_VERIFY_RESPONSE_PERSON_PROOF_JWS,
     },
 });
+export const EXAMPLE_VERIFY_RESPONSE_CONTROLLER_CREDENTIAL = Object.freeze({
+    id: EXAMPLE_VERIFY_RESPONSE_CONTROLLER_VC_ID,
+    '@context': [W3cCredentialContexts.V2, EXAMPLE_VERIFY_RESPONSE_SCHEMA_ORG_CONTEXT],
+    type: [
+        W3cCredentialTypes.VerifiableCredential,
+        'ServiceCredential',
+        ActivationCredentialTypes.ServiceControllerCredential,
+    ],
+    issuer: EXAMPLE_DEFAULT_ICA_DID,
+    validFrom: EXAMPLE_VERIFY_RESPONSE_DATE,
+    meta: { versionId: EXAMPLE_VERIFY_RESPONSE_VERSION_ID },
+    credentialSubject: {
+        id: EXAMPLE_VERIFY_RESPONSE_ORG_DID,
+        '@type': 'Service',
+        serviceType: 'OrganizationControllerService',
+        provider: {
+            '@type': EXAMPLE_VERIFY_RESPONSE_ORGANIZATION_TYPE,
+            legalName: EXAMPLE_PROVIDER_LEGAL_NAME,
+            taxID: EXAMPLE_PROVIDER_TAX_ID,
+        },
+        owner: {
+            '@type': EXAMPLE_VERIFY_RESPONSE_PERSON_TYPE,
+            additionalType: EXAMPLE_VERIFY_RESPONSE_CONTROLLER_ROLE,
+            sameAs: EXAMPLE_REPRESENTATIVE_SAME_AS,
+            hasOccupation: {
+                '@type': EXAMPLE_VERIFY_RESPONSE_OCCUPATION_TYPE,
+                occupationalCategory: `ISCO-08|${EXAMPLE_VERIFY_RESPONSE_CONTROLLER_ISCO}`,
+            },
+            hasCredential: { material: EXAMPLE_ORG_CONTROLLER_SIGNING_KEY_ID },
+        },
+    },
+    evidence: [],
+    proof: {
+        type: EXAMPLE_VERIFY_RESPONSE_PROOF_TYPE,
+        created: EXAMPLE_VERIFY_RESPONSE_PROOF_DATE,
+        proofPurpose: EXAMPLE_VERIFY_RESPONSE_PROOF_PURPOSE,
+        verificationMethod: EXAMPLE_VERIFY_RESPONSE_PROOF_VERIFICATION_METHOD,
+        jws: EXAMPLE_VERIFY_RESPONSE_CONTROLLER_PROOF_JWS,
+    },
+});
 export const EXAMPLE_VERIFY_RESPONSE_ORG_ATTACHMENT = Object.freeze({
     id: EXAMPLE_VERIFY_RESPONSE_ORG_ATTACHMENT_ID,
     format: EXAMPLE_VERIFY_RESPONSE_ATTACHMENT_FORMAT,
@@ -211,6 +267,18 @@ export const EXAMPLE_VERIFY_RESPONSE_PERSON_ATTACHMENT = Object.freeze({
         },
     },
 });
+export const EXAMPLE_VERIFY_RESPONSE_CONTROLLER_ATTACHMENT = Object.freeze({
+    id: EXAMPLE_VERIFY_RESPONSE_CONTROLLER_ATTACHMENT_ID,
+    format: EXAMPLE_VERIFY_RESPONSE_ATTACHMENT_FORMAT,
+    media_type: EXAMPLE_VERIFY_RESPONSE_MEDIA_TYPE,
+    filename: EXAMPLE_VERIFY_RESPONSE_CONTROLLER_ATTACHMENT_FILENAME,
+    data: {
+        json: {
+            format: EXAMPLE_VERIFY_RESPONSE_ATTACHMENT_FORMAT,
+            jwt: EXAMPLE_VERIFY_RESPONSE_CONTROLLER_JWT,
+        },
+    },
+});
 /**
  * Canonical `_verify-response` success example shared across ICA repos.
  */
@@ -223,11 +291,12 @@ export const EXAMPLE_ICA_VERIFY_TERMS_RESPONSE_SUCCESS = {
     attachments: [
         EXAMPLE_VERIFY_RESPONSE_ORG_ATTACHMENT,
         EXAMPLE_VERIFY_RESPONSE_PERSON_ATTACHMENT,
+        EXAMPLE_VERIFY_RESPONSE_CONTROLLER_ATTACHMENT,
     ],
     body: {
         resourceType: EXAMPLE_BUNDLE_RESOURCE_TYPE,
         type: EXAMPLE_VERIFY_RESPONSE_BATCH_RESPONSE_TYPE,
-        total: 2,
+        total: 3,
         issues: EXAMPLE_VERIFY_RESPONSE_SUCCESS_OUTCOME,
         data: [
             {
@@ -250,6 +319,15 @@ export const EXAMPLE_ICA_VERIFY_TERMS_RESPONSE_SUCCESS = {
                 },
                 resource: EXAMPLE_VERIFY_RESPONSE_PERSON_CREDENTIAL,
             },
+            {
+                type: EXAMPLE_VERIFY_RESPONSE_CONTROLLER_ENTRY_TYPE,
+                publicKeyJwk: EXAMPLE_VERIFY_RESPONSE_PERSON_PUBLIC_KEY_JWK,
+                response: {
+                    status: EXAMPLE_VERIFY_RESPONSE_STATUS_OK,
+                    outcome: EXAMPLE_VERIFY_RESPONSE_CONTROLLER_ITEM_OUTCOME,
+                },
+                resource: EXAMPLE_VERIFY_RESPONSE_CONTROLLER_CREDENTIAL,
+            },
         ],
     },
 };

package/dist/examples/inter-tenant-access-contract.d.ts

@@ -18,6 +18,7 @@
  *   field in this first inter-tenant fixture
  */
 export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_ID: "urn:uuid:inter-tenant-access-contract-001";
+export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_TYPE: "https://example.org/fhir/CodeSystem/contract-type|data-sharing";
 export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_VALID_FROM: "2026-06-29T00:00:00.000Z";
 export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_VALID_UNTIL: "2027-06-29T00:00:00.000Z";
 export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_PURPOSE: "RESEARCH";
@@ -30,6 +31,7 @@ export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_SMART_SCOPE: "organiza
 export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CLAIMS: Readonly<{
     readonly "Contract.identifier": "urn:uuid:inter-tenant-access-contract-001";
     readonly "Contract.status": "executed";
+    readonly "Contract.type": "https://example.org/fhir/CodeSystem/contract-type|data-sharing";
     readonly "Contract.issued": "2026-06-29T00:00:00.000Z";
     readonly "Contract.applies-start": "2026-06-29T00:00:00.000Z";
     readonly "Contract.applies-end": "2027-06-29T00:00:00.000Z";

package/dist/examples/inter-tenant-access-contract.js

@@ -27,6 +27,7 @@ import { EXAMPLE_API_ORGANIZATION_DID, EXAMPLE_CONTROLLER_DID, EXAMPLE_HEALTHCAR
  *   field in this first inter-tenant fixture
  */
 export const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_ID = 'urn:uuid:inter-tenant-access-contract-001';
+export const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_TYPE = 'https://example.org/fhir/CodeSystem/contract-type|data-sharing';
 export const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_VALID_FROM = '2026-06-29T00:00:00.000Z';
 export const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_VALID_UNTIL = '2027-06-29T00:00:00.000Z';
 export const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_PURPOSE = 'RESEARCH';
@@ -39,6 +40,7 @@ export const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_SMART_SCOPE = `${EXAMPLE_INTER
 export const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CLAIMS = Object.freeze({
     [ClaimInterTenantAccessContract.identifier]: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_ID,
     [ClaimInterTenantAccessContract.status]: 'executed',
+    [ClaimInterTenantAccessContract.type]: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_TYPE,
     [ClaimInterTenantAccessContract.issued]: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_VALID_FROM,
     [ClaimInterTenantAccessContract.appliesStart]: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_VALID_FROM,
     [ClaimInterTenantAccessContract.appliesEnd]: EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_VALID_UNTIL,

package/dist/examples/license.d.ts

@@ -1,3 +1,43 @@
+export declare const EXAMPLE_EMPLOYEE_DEVICE_BINDINGS: readonly [Readonly<{
+    clientId: "client-employee-primary";
+    clientInstanceId: "installation-employee-primary";
+    status: "active";
+    deviceInfo: Readonly<{
+        clientInstanceId: "installation-employee-primary";
+        model: "Shared browser profile";
+    }>;
+    activatedAt: 1786570800;
+}>, Readonly<{
+    clientId: "client-employee-secondary";
+    clientInstanceId: "installation-employee-secondary";
+    status: "revoked";
+    deviceInfo: Readonly<{
+        clientInstanceId: "installation-employee-secondary";
+    }>;
+    activatedAt: 1786570900;
+    revokedAt: 1786571000;
+}>];
+/** Two simultaneously active installations used to test the default allowance. */
+export declare const EXAMPLE_EMPLOYEE_ACTIVE_DEVICE_BINDINGS: readonly Readonly<{
+    status: "active";
+    revokedAt: undefined;
+    clientId: "client-employee-primary";
+    clientInstanceId: "installation-employee-primary";
+    deviceInfo: Readonly<{
+        clientInstanceId: "installation-employee-primary";
+        model: "Shared browser profile";
+    }>;
+    activatedAt: 1786570800;
+} | {
+    status: "active";
+    revokedAt: undefined;
+    clientId: "client-employee-secondary";
+    clientInstanceId: "installation-employee-secondary";
+    deviceInfo: Readonly<{
+        clientInstanceId: "installation-employee-secondary";
+    }>;
+    activatedAt: 1786570900;
+}>[];
 export declare const EXAMPLE_LICENSE_SEAT_UUIDS: readonly ["8a8a5e1b-0d8e-4a7c-8c39-3b8034440001", "8a8a5e1b-0d8e-4a7c-8c39-3b8034440002"];
 export declare const EXAMPLE_LICENSE_ISSUE_INPUT: Readonly<{
     readonly email: "controller@acme.org";
@@ -67,6 +107,77 @@ export declare const EXAMPLE_LICENSE_LIST_RESPONSE_BODY: Readonly<{
         };
     }];
 }>;
+/** Shared async GW response for a controller-issued employee activation credential. */
+export declare const EXAMPLE_LICENSE_ISSUE_RESPONSE_BODY: Readonly<{
+    readonly body: {
+        readonly data: readonly [{
+            readonly resource: {
+                readonly data: readonly [{
+                    readonly type: "License:Issued";
+                    readonly id: "ACT-001";
+                    readonly meta: {
+                        readonly claims: {
+                            readonly "org.schema.IndividualProduct.serialNumber": "ACT-001";
+                        };
+                    };
+                }];
+            };
+        }];
+    };
+}>;
+/** Shared license search response containing the default two-installation state. */
+export declare const EXAMPLE_LICENSE_LIST_RESPONSE_BODY_WITH_DEVICES: Readonly<{
+    readonly body: {
+        readonly resource: {
+            readonly data: readonly [{
+                readonly id: "8a8a5e1b-0d8e-4a7c-8c39-3b8034440001";
+                readonly meta: {
+                    readonly status: "active";
+                    readonly subjectId: string;
+                    readonly maxDevices: 2;
+                    readonly deviceBindings: readonly [Readonly<{
+                        clientId: "client-employee-primary";
+                        clientInstanceId: "installation-employee-primary";
+                        status: "active";
+                        deviceInfo: Readonly<{
+                            clientInstanceId: "installation-employee-primary";
+                            model: "Shared browser profile";
+                        }>;
+                        activatedAt: 1786570800;
+                    }>, Readonly<{
+                        clientId: "client-employee-secondary";
+                        clientInstanceId: "installation-employee-secondary";
+                        status: "revoked";
+                        deviceInfo: Readonly<{
+                            clientInstanceId: "installation-employee-secondary";
+                        }>;
+                        activatedAt: 1786570900;
+                        revokedAt: 1786571000;
+                    }>];
+                };
+            }];
+        };
+    };
+}>;
+/** Canonical controller-facing employee projection reused across SDK and portal tests. */
+export declare const EXAMPLE_EMPLOYEE_LIFECYCLE_RECORD: Readonly<{
+    readonly resourceId: string;
+    readonly email: string;
+    readonly roleCode: string;
+    readonly employeeDid: string;
+    readonly status: "active" | "inactive" | "purged";
+    readonly license: Readonly<{
+        id: "8a8a5e1b-0d8e-4a7c-8c39-3b8034440001";
+        status: "active";
+        maxDevices: 2;
+        activeDevices: number;
+        devices: readonly Readonly<{
+            clientId: "client-employee-primary" | "client-employee-secondary";
+            name: "installation-employee-primary" | "installation-employee-secondary" | "Shared browser profile";
+            status: "active" | "revoked";
+        }>[];
+    }>;
+}>;
 export declare function buildExampleLicenseIssueClaims(): Readonly<Record<string, unknown>>;
 export declare function buildExampleLicensePurchaseClaims(): Readonly<Record<string, unknown>>;
 export declare const EXAMPLE_LICENSE_PURCHASE_CLAIMS: Readonly<Record<string, unknown>>;

package/dist/examples/license.js

@@ -1,8 +1,36 @@
-import { DeviceAppTypes, DeviceUserClasses } from '../constants/device.js';
+import { DeviceAppTypes, DeviceBindingStatuses, DeviceUserClasses } from '../constants/device.js';
 import { ClaimsOrderSchemaorg, ClaimsIndividualProductSchemaorg, ClaimsOfferSchemaorg, ClaimsPersonSchemaorg, } from '../constants/schemaorg.js';
 import { buildLicenseIssueClaims, buildLicensePurchaseClaims, LicenseClaimContext, LicenseCategories, LicenseStatuses, } from '../utils/license.js';
 import { createLicenseOfferOrderEditor } from '../utils/license-offer-order.js';
-import { EXAMPLE_LICENSE_ACCEPTED_OFFER_ID, EXAMPLE_LICENSE_AMOUNT, EXAMPLE_LICENSE_CHECKOUT_URL, EXAMPLE_LICENSE_CURRENCY, EXAMPLE_EMAIL_CONTROLLER_ORG, EXAMPLE_EMPLOYEE_ACTIVATION_CODE, EXAMPLE_HEALTHCARE_ACTOR_ROLE_GENERALIST_MEDICAL_PRACTITIONER, EXAMPLE_LICENSE_INVOICE_ID, EXAMPLE_LICENSE_OFFER_ID, EXAMPLE_LICENSE_PLAN_DEFAULT, EXAMPLE_LICENSE_PAYMENT_METHOD_INVOICE, EXAMPLE_LICENSE_PAYMENT_URL, EXAMPLE_LICENSE_RENEWAL_CYCLE_YEARLY, EXAMPLE_LICENSE_PLAN_NAME, EXAMPLE_LICENSE_SEAT_UUID_ACTIVE, EXAMPLE_LICENSE_SEAT_UUID_AVAILABLE, EXAMPLE_LICENSE_SEAT_UUID_SECONDARY, EXAMPLE_LICENSE_SKU, EXAMPLE_LICENSE_SUBJECT_ID_ACTIVE, EXAMPLE_LICENSE_SUBJECT_ID_AVAILABLE, } from './shared.js';
+import { EXAMPLE_LICENSE_ACCEPTED_OFFER_ID, EXAMPLE_LICENSE_AMOUNT, EXAMPLE_LICENSE_CHECKOUT_URL, EXAMPLE_LICENSE_CURRENCY, EXAMPLE_EMAIL_CONTROLLER_ORG, EXAMPLE_EMPLOYEE_ACTIVATION_CODE, EXAMPLE_EMPLOYEE_DEVICE_CLIENT_ID_PRIMARY, EXAMPLE_EMPLOYEE_DEVICE_CLIENT_ID_SECONDARY, EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_PRIMARY, EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_SECONDARY, EXAMPLE_EMPLOYEE_DEVICE_MODEL_PRIMARY, EXAMPLE_HEALTHCARE_ACTOR_ROLE_GENERALIST_MEDICAL_PRACTITIONER, EXAMPLE_LICENSE_INVOICE_ID, EXAMPLE_LICENSE_OFFER_ID, EXAMPLE_LICENSE_PLAN_DEFAULT, EXAMPLE_LICENSE_PAYMENT_METHOD_INVOICE, EXAMPLE_LICENSE_PAYMENT_URL, EXAMPLE_LICENSE_RENEWAL_CYCLE_YEARLY, EXAMPLE_LICENSE_PLAN_NAME, EXAMPLE_LICENSE_SEAT_UUID_ACTIVE, EXAMPLE_LICENSE_SEAT_UUID_AVAILABLE, EXAMPLE_LICENSE_SEAT_UUID_SECONDARY, EXAMPLE_LICENSE_SKU, EXAMPLE_LICENSE_SUBJECT_ID_ACTIVE, EXAMPLE_LICENSE_SUBJECT_ID_AVAILABLE, } from './shared.js';
+import { DEFAULT_LICENSE_DEVICE_ALLOWANCE } from '../utils/license.js';
+import { EXAMPLE_EMPLOYEE_CONTROLLER_ACTIVE } from './employee.js';
+export const EXAMPLE_EMPLOYEE_DEVICE_BINDINGS = Object.freeze([
+    Object.freeze({
+        clientId: EXAMPLE_EMPLOYEE_DEVICE_CLIENT_ID_PRIMARY,
+        clientInstanceId: EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_PRIMARY,
+        status: DeviceBindingStatuses.Active,
+        deviceInfo: Object.freeze({
+            clientInstanceId: EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_PRIMARY,
+            model: EXAMPLE_EMPLOYEE_DEVICE_MODEL_PRIMARY,
+        }),
+        activatedAt: 1_786_570_800,
+    }),
+    Object.freeze({
+        clientId: EXAMPLE_EMPLOYEE_DEVICE_CLIENT_ID_SECONDARY,
+        clientInstanceId: EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_SECONDARY,
+        status: DeviceBindingStatuses.Revoked,
+        deviceInfo: Object.freeze({ clientInstanceId: EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_SECONDARY }),
+        activatedAt: 1_786_570_900,
+        revokedAt: 1_786_571_000,
+    }),
+]);
+/** Two simultaneously active installations used to test the default allowance. */
+export const EXAMPLE_EMPLOYEE_ACTIVE_DEVICE_BINDINGS = Object.freeze(EXAMPLE_EMPLOYEE_DEVICE_BINDINGS.map((binding) => Object.freeze({
+    ...binding,
+    status: DeviceBindingStatuses.Active,
+    revokedAt: undefined,
+})));
 export const EXAMPLE_LICENSE_SEAT_UUIDS = Object.freeze([
     EXAMPLE_LICENSE_SEAT_UUID_ACTIVE,
     EXAMPLE_LICENSE_SEAT_UUID_SECONDARY,
@@ -60,6 +88,61 @@ export const EXAMPLE_LICENSE_LIST_RESPONSE_BODY = Object.freeze({
         },
     ],
 });
+/** Shared async GW response for a controller-issued employee activation credential. */
+export const EXAMPLE_LICENSE_ISSUE_RESPONSE_BODY = Object.freeze({
+    body: {
+        data: [{
+                resource: {
+                    data: [{
+                            type: 'License:Issued',
+                            id: EXAMPLE_EMPLOYEE_ACTIVATION_CODE,
+                            meta: {
+                                claims: {
+                                    [ClaimsIndividualProductSchemaorg.serialNumber]: EXAMPLE_EMPLOYEE_ACTIVATION_CODE,
+                                },
+                            },
+                        }],
+                },
+            }],
+    },
+});
+/** Shared license search response containing the default two-installation state. */
+export const EXAMPLE_LICENSE_LIST_RESPONSE_BODY_WITH_DEVICES = Object.freeze({
+    body: {
+        resource: {
+            data: [{
+                    id: EXAMPLE_LICENSE_ACTIVE_RECORD.id,
+                    meta: {
+                        status: EXAMPLE_LICENSE_ACTIVE_RECORD.status,
+                        subjectId: EXAMPLE_EMPLOYEE_CONTROLLER_ACTIVE.resourceId,
+                        maxDevices: DEFAULT_LICENSE_DEVICE_ALLOWANCE,
+                        deviceBindings: EXAMPLE_EMPLOYEE_DEVICE_BINDINGS,
+                    },
+                }],
+        },
+    },
+});
+/** Canonical controller-facing employee projection reused across SDK and portal tests. */
+export const EXAMPLE_EMPLOYEE_LIFECYCLE_RECORD = Object.freeze({
+    resourceId: EXAMPLE_EMPLOYEE_CONTROLLER_ACTIVE.resourceId,
+    email: EXAMPLE_EMPLOYEE_CONTROLLER_ACTIVE.email,
+    roleCode: EXAMPLE_EMPLOYEE_CONTROLLER_ACTIVE.role,
+    employeeDid: EXAMPLE_EMPLOYEE_CONTROLLER_ACTIVE.identifier,
+    status: EXAMPLE_EMPLOYEE_CONTROLLER_ACTIVE.status,
+    license: Object.freeze({
+        id: EXAMPLE_LICENSE_ACTIVE_RECORD.id,
+        status: EXAMPLE_LICENSE_ACTIVE_RECORD.status,
+        maxDevices: DEFAULT_LICENSE_DEVICE_ALLOWANCE,
+        activeDevices: EXAMPLE_EMPLOYEE_DEVICE_BINDINGS.filter((binding) => binding.status === DeviceBindingStatuses.Active).length,
+        devices: Object.freeze(EXAMPLE_EMPLOYEE_DEVICE_BINDINGS.map((binding) => Object.freeze({
+            clientId: binding.clientId,
+            name: ('model' in binding.deviceInfo ? binding.deviceInfo.model : undefined)
+                || binding.deviceInfo.clientInstanceId
+                || binding.clientId,
+            status: binding.status,
+        }))),
+    }),
+});
 export function buildExampleLicenseIssueClaims() {
     return Object.freeze(buildLicenseIssueClaims(EXAMPLE_LICENSE_ISSUE_INPUT));
 }

package/dist/examples/shared.d.ts

@@ -86,6 +86,32 @@ export declare const EXAMPLE_OTP_INVITATION_ID: "invitation-demo-001";
 export declare const EXAMPLE_OTP_CHALLENGE_ID: "otp-challenge-demo-001";
 export declare const EXAMPLE_OTP_CODE: "123456";
 export declare const EXAMPLE_DEMO_PORTAL_ID_TOKEN: "eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJkZW1vLXVzZXIiLCJlbWFpbCI6ImRlbW9AZXhhbXBsZS5vcmcifQ.demo";
+export declare const EXAMPLE_ACCOUNT_OWNER_ID: "account-owner-example";
+export declare const EXAMPLE_PROFILE_PIN: "482951";
+export declare const EXAMPLE_JWK_THUMBPRINT_SHA256_URN: "urn:ietf:params:oauth:jwk-thumbprint:sha-256:BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB";
+export declare const EXAMPLE_DCR_REDIRECT_URI: "https://portal.example.org/auth/callback";
+export declare const EXAMPLE_EMPLOYEE_DCR_CLIENT_NAME: "Example Professional Employee";
+export declare const EXAMPLE_ASYNC_SUBMIT_STATUS: 202;
+export declare const EXAMPLE_ASYNC_POLL_STATUS: 200;
+export declare const EXAMPLE_ASYNC_POLL_ATTEMPTS: 1;
+export declare const ExampleHttpStatusText: Readonly<{
+    readonly Ok: "200";
+    readonly Conflict: "409";
+}>;
+export declare const EXAMPLE_ACTIVATION_GRANT_CREATED_AT: "2026-08-13T19:20:00.000Z";
+export declare const EXAMPLE_ACTIVATION_GRANT_EXPIRES_AT: "2027-08-13T19:20:00.000Z";
+/** Wraps any shared response body in the canonical successful async result. */
+export declare function buildExampleSubmitAndPollResult(body: unknown): Readonly<{
+    submit: Readonly<{
+        status: 202;
+        body: Readonly<{}>;
+    }>;
+    poll: Readonly<{
+        status: 200;
+        body: unknown;
+        attempts: 1;
+    }>;
+}>;
 export declare const EXAMPLE_TENANT_ROUTE_CONTEXT: {
     readonly tenantId: "acme-id";
     readonly jurisdiction: "ES";
@@ -255,6 +281,13 @@ export declare const EXAMPLE_CONTENT_ADDRESSED_CONSENT_IDENTIFIER: "zQmYwAPJzv5C
 export declare const EXAMPLE_CONTENT_ADDRESSED_SOURCE_REFERENCE: "zQmWvM9dQmWvM9dQmWvM9dQmWvM9dQmWvM9dQmWvM9dQmWv";
 export declare const EXAMPLE_CONTENT_ADDRESSED_EVIDENCE_RECORD_IDENTIFIER: "zQmXh8Y3mJQ4d7MmX7o9nP5sQ2uT1vW6xY8zA3bC4dE5fG";
 export declare const EXAMPLE_EMPLOYEE_ACTIVATION_CODE: "ACT-001";
+export declare const EXAMPLE_EMPLOYEE_DEVICE_CLIENT_ID_PRIMARY: "client-employee-primary";
+export declare const EXAMPLE_EMPLOYEE_DEVICE_CLIENT_ID_SECONDARY: "client-employee-secondary";
+export declare const EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_PRIMARY: "installation-employee-primary";
+export declare const EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_SECONDARY: "installation-employee-secondary";
+export declare const EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_TERTIARY: "installation-employee-tertiary";
+export declare const EXAMPLE_CLIENT_INSTANCE_UUID: "7f5e8d6c-91f4-4f6d-a29f-8bd42e44f101";
+export declare const EXAMPLE_EMPLOYEE_DEVICE_MODEL_PRIMARY: "Shared browser profile";
 export declare const EXAMPLE_LICENSE_OFFER_ID: "urn:offer:family-003";
 export declare const EXAMPLE_LICENSE_INVALID_OFFER_ID: "urn:offer:invalid-001";
 export declare const EXAMPLE_LICENSE_ACCEPTED_OFFER_ID: "urn:offer:family-003";

package/dist/examples/shared.js

@@ -101,6 +101,31 @@ export const EXAMPLE_OTP_INVITATION_ID = 'invitation-demo-001';
 export const EXAMPLE_OTP_CHALLENGE_ID = 'otp-challenge-demo-001';
 export const EXAMPLE_OTP_CODE = '123456';
 export const EXAMPLE_DEMO_PORTAL_ID_TOKEN = 'eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJkZW1vLXVzZXIiLCJlbWFpbCI6ImRlbW9AZXhhbXBsZS5vcmcifQ.demo';
+export const EXAMPLE_ACCOUNT_OWNER_ID = 'account-owner-example';
+export const EXAMPLE_PROFILE_PIN = '482951';
+export const EXAMPLE_JWK_THUMBPRINT_SHA256_URN = 'urn:ietf:params:oauth:jwk-thumbprint:sha-256:BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB';
+export const EXAMPLE_DCR_REDIRECT_URI = 'https://portal.example.org/auth/callback';
+export const EXAMPLE_EMPLOYEE_DCR_CLIENT_NAME = 'Example Professional Employee';
+export const EXAMPLE_ASYNC_SUBMIT_STATUS = 202;
+export const EXAMPLE_ASYNC_POLL_STATUS = 200;
+export const EXAMPLE_ASYNC_POLL_ATTEMPTS = 1;
+export const ExampleHttpStatusText = Object.freeze({
+    Ok: '200',
+    Conflict: '409',
+});
+export const EXAMPLE_ACTIVATION_GRANT_CREATED_AT = '2026-08-13T19:20:00.000Z';
+export const EXAMPLE_ACTIVATION_GRANT_EXPIRES_AT = '2027-08-13T19:20:00.000Z';
+/** Wraps any shared response body in the canonical successful async result. */
+export function buildExampleSubmitAndPollResult(body) {
+    return Object.freeze({
+        submit: Object.freeze({ status: EXAMPLE_ASYNC_SUBMIT_STATUS, body: Object.freeze({}) }),
+        poll: Object.freeze({
+            status: EXAMPLE_ASYNC_POLL_STATUS,
+            body,
+            attempts: EXAMPLE_ASYNC_POLL_ATTEMPTS,
+        }),
+    });
+}
 export const EXAMPLE_TENANT_ROUTE_CONTEXT = {
     tenantId: EXAMPLE_TENANT_IDENTIFIER,
     jurisdiction: EXAMPLE_JURISDICTION,
@@ -298,6 +323,13 @@ export const EXAMPLE_CONTENT_ADDRESSED_CONSENT_IDENTIFIER = 'zQmYwAPJzv5CZsnAzt8
 export const EXAMPLE_CONTENT_ADDRESSED_SOURCE_REFERENCE = 'zQmWvM9dQmWvM9dQmWvM9dQmWvM9dQmWvM9dQmWvM9dQmWv';
 export const EXAMPLE_CONTENT_ADDRESSED_EVIDENCE_RECORD_IDENTIFIER = 'zQmXh8Y3mJQ4d7MmX7o9nP5sQ2uT1vW6xY8zA3bC4dE5fG';
 export const EXAMPLE_EMPLOYEE_ACTIVATION_CODE = 'ACT-001';
+export const EXAMPLE_EMPLOYEE_DEVICE_CLIENT_ID_PRIMARY = 'client-employee-primary';
+export const EXAMPLE_EMPLOYEE_DEVICE_CLIENT_ID_SECONDARY = 'client-employee-secondary';
+export const EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_PRIMARY = 'installation-employee-primary';
+export const EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_SECONDARY = 'installation-employee-secondary';
+export const EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_TERTIARY = 'installation-employee-tertiary';
+export const EXAMPLE_CLIENT_INSTANCE_UUID = '7f5e8d6c-91f4-4f6d-a29f-8bd42e44f101';
+export const EXAMPLE_EMPLOYEE_DEVICE_MODEL_PRIMARY = 'Shared browser profile';
 export const EXAMPLE_LICENSE_OFFER_ID = 'urn:offer:family-003';
 export const EXAMPLE_LICENSE_INVALID_OFFER_ID = 'urn:offer:invalid-001';
 export const EXAMPLE_LICENSE_ACCEPTED_OFFER_ID = EXAMPLE_LICENSE_OFFER_ID;

package/dist/models/device-license.d.ts

@@ -1,4 +1,4 @@
-import type { DeviceAppType, DeviceUserClass } from '../constants/device';
+import type { DeviceAppType, DeviceBindingStatus, DeviceUserClass } from '../constants/device';
 /**
  * A fingerprint of a specific device, used for binding a license to it.
  */
@@ -24,7 +24,7 @@ export interface DeviceBinding {
     /** Stable application installation fingerprint supplied by the client. */
     clientInstanceId: string;
     /** Current relationship between this installation and the seat. */
-    status: 'active' | 'revoked';
+    status: DeviceBindingStatus;
     /** Device/application metadata captured during DCR. */
     deviceInfo: DeviceInfo;
     activatedAt: number;

package/dist/models/index.d.ts

@@ -19,6 +19,7 @@ export * from './dataspace-discovery';
 export * from './dataspace-discovery-defaults';
 export * from './dataspace-protocol';
 export * from './device-license';
+export * from './organization-employee-lifecycle';
 export * from './did';
 export * from './fhir-documents';
 export * from './gaia-x';