gdc-common-utils-ts 2.5.2 → 2.5.4

package/dist/models/index.js

@@ -19,6 +19,7 @@ export * from './dataspace-discovery.js';
 export * from './dataspace-discovery-defaults.js';
 export * from './dataspace-protocol.js';
 export * from './device-license.js';
+export * from './organization-employee-lifecycle.js';
 export * from './did.js';
 export * from './fhir-documents.js';
 export * from './gaia-x.js';

package/dist/models/inter-tenant-access-contract.d.ts

@@ -16,6 +16,12 @@ export declare enum ClaimInterTenantAccessContract {
     identifier = "Contract.identifier",
     /** FHIR Contract lifecycle status, for example `executed` or `amended`. */
     status = "Contract.status",
+    /**
+     * FHIR `Contract.type` CodeableConcept encoded as `system|code` in the flat
+     * claims transport. The terminology authority is supplied by the adopting
+     * governance domain rather than hardcoded in this product-neutral package.
+     */
+    type = "Contract.type",
     /** When the agreement was formally issued. */
     issued = "Contract.issued",
     /** Agreement validity start date/time. */

package/dist/models/inter-tenant-access-contract.js

@@ -18,6 +18,12 @@ export var ClaimInterTenantAccessContract;
     ClaimInterTenantAccessContract["identifier"] = "Contract.identifier";
     /** FHIR Contract lifecycle status, for example `executed` or `amended`. */
     ClaimInterTenantAccessContract["status"] = "Contract.status";
+    /**
+     * FHIR `Contract.type` CodeableConcept encoded as `system|code` in the flat
+     * claims transport. The terminology authority is supplied by the adopting
+     * governance domain rather than hardcoded in this product-neutral package.
+     */
+    ClaimInterTenantAccessContract["type"] = "Contract.type";
     /** When the agreement was formally issued. */
     ClaimInterTenantAccessContract["issued"] = "Contract.issued";
     /** Agreement validity start date/time. */

package/dist/models/organization-employee-lifecycle.d.ts

@@ -0,0 +1,45 @@
+import type { DeviceBindingStatus } from '../constants/device';
+import type { EmployeeActivationGrantVersion, EmployeeDirectoryStatus } from '../constants/employee-lifecycle';
+/** One installation in the controller-facing employee lifecycle projection. */
+export type OrganizationEmployeeDeviceRecord = Readonly<{
+    clientId: string;
+    name: string;
+    status: DeviceBindingStatus;
+}>;
+/** License state attached to one employee directory entry. */
+export type OrganizationEmployeeLicenseRecord = Readonly<{
+    id: string;
+    status: string;
+    maxDevices: number;
+    activeDevices: number;
+    devices: ReadonlyArray<OrganizationEmployeeDeviceRecord>;
+}>;
+/** Product-neutral employee, seat and installation lifecycle projection. */
+export type OrganizationEmployeeLifecycleRecord = Readonly<{
+    resourceId: string;
+    email: string;
+    roleCode: string;
+    employeeDid: string;
+    status: EmployeeDirectoryStatus;
+    license?: OrganizationEmployeeLicenseRecord;
+}>;
+/** Typed wire request for revoking one installation without releasing its seat. */
+export type EmployeeDeviceRevocationTarget = Readonly<{
+    licenseId: string;
+    clientId: string;
+}>;
+/** Tenant routing metadata bound to an employee activation credential digest. */
+export type EmployeeActivationGrant = Readonly<{
+    version: EmployeeActivationGrantVersion;
+    employeeDid: string;
+    employeeRoleCode: string;
+    employeeActorIdentifier: string;
+    providerDid: string;
+    routeContext: Readonly<{
+        tenantId: string;
+        jurisdiction: string;
+        sector: string;
+    }>;
+    createdAt: string;
+    expiresAt: string;
+}>;

package/dist/models/organization-employee-lifecycle.js

@@ -0,0 +1 @@
+export {};

package/dist/models/urlPath.d.ts

@@ -5,6 +5,7 @@
 export declare enum Sector {
     TEST = "test",// For mock/demo endpoints and host registry in tests
     SYSTEM = "system",// Reserved for the host's bootstrap operation (TODO: deprecate)
+    ANTIFRAUD = "antifraud",
     HEALTH_CARE = "health-care",
     HEALTH_INSURANCE = "health-insurance",
     EMERGENCY = "emergency",

package/dist/models/urlPath.js

@@ -8,6 +8,7 @@ export var Sector;
 (function (Sector) {
     Sector["TEST"] = "test";
     Sector["SYSTEM"] = "system";
+    Sector["ANTIFRAUD"] = "antifraud";
     Sector["HEALTH_CARE"] = "health-care";
     Sector["HEALTH_INSURANCE"] = "health-insurance";
     Sector["EMERGENCY"] = "emergency";

package/dist/utils/activation-policy.d.ts

@@ -1,4 +1,4 @@
-export type ActivationRepresentativePolicyErrorCode = 'MISSING_REPRESENTATIVE_SUBJECT_ID' | 'MISSING_REPRESENTATIVE_ROLE_RESPRSN' | 'MISSING_REPRESENTATIVE_CREDENTIAL_BINDING' | 'REPRESENTATIVE_TAXID_MISMATCH';
+export type ActivationRepresentativePolicyErrorCode = 'MISSING_REPRESENTATIVE_SUBJECT_ID' | 'MISSING_REPRESENTATIVE_ROLE_RESPRSN' | 'MISSING_REPRESENTATIVE_CREDENTIAL_BINDING' | 'MISSING_CONTROLLER_ROLE_RESPRSN' | 'MISSING_CONTROLLER_CREDENTIAL_BINDING' | 'CONTROLLER_TAXID_MISMATCH' | 'REPRESENTATIVE_TAXID_MISMATCH';
 export type ActivationServiceAuthorizationPolicyErrorCode = 'MISSING_ORGANIZATION_SERVICE_CATEGORY' | 'MISSING_ORGANIZATION_SERVICE_TYPE' | 'UNAUTHORIZED_ORGANIZATION_SERVICE_CATEGORY' | 'UNAUTHORIZED_ORGANIZATION_SERVICE_TYPE';
 export type ActivationRepresentativePolicyError = {
     code: ActivationRepresentativePolicyErrorCode;
@@ -38,6 +38,20 @@ export declare function extractRepresentativeMemberOfTaxId(representativeCredent
  * @param representativeCredential Candidate representative credential.
  */
 export declare function extractRepresentativeRoleCode(representativeCredential: unknown): string | undefined;
+/**
+ * Reads controller-authorization codes from an ICA-issued controller VC.
+ * Professional ISCO occupations are deliberately excluded.
+ */
+export declare function extractOrganizationControllerRoleCodes(controllerCredential: unknown): string[];
+/** Canonical name for reading controller authority from a service-controller VC. */
+export declare const extractServiceControllerRoleCodes: typeof extractOrganizationControllerRoleCodes;
+/**
+ * Reads professional ISCO occupations from an ICA-issued controller VC as
+ * canonical `ISCO-08|code` tokens.
+ */
+export declare function extractOrganizationControllerOccupationCodes(controllerCredential: unknown): string[];
+/** Canonical name for reading ISCO occupations from a service-controller VC. */
+export declare const extractServiceControllerOccupationCodes: typeof extractOrganizationControllerOccupationCodes;
 /**
  * Checks whether a role code contains the required code, ignoring prefixes such as `SYSTEM|`.
  *
@@ -154,22 +168,30 @@ export declare function buildMemberDidWeb(ownerDidWeb: string, memberId: string,
  */
 export declare function isMemberDidWebUnderOwner(memberDidWeb: string, ownerDidWeb: string): boolean;
 /**
- * Validates the activation representative policy against organization and representative credentials.
+ * Validates controller authorization for organization activation.
  *
- * The representative proof model is intentionally two-dimensional:
- * - `credentialSubject.sameAs` expresses public identity continuity
- * - `credentialSubject.hasCredential.material` expresses signing-key continuity
+ * Canonical three-credential flow:
+ * - `LegalRepresentativeCredential` proves legal representation and carries
+ *   the representative's professional ISCO occupation
+ * - `ServiceControllerCredential` independently carries `RESPRSN` in
+ *   `owner.additionalType` and `owner.hasCredential.material` for the
+ *   controller actor key
  *
- * For GW activation, the key-binding dimension is the hard requirement
- * enforced here. The public-identity dimension may still be used by higher
- * layers for stronger demo/production matching and auditability.
+ * Legacy two-credential compatibility is deliberately narrow. When no
+ * no service-controller credential exists, the representative credential is
+ * accepted as the controller proof only if that old credential itself carries
+ * both `RESPRSN` and `hasCredential` binding material. A modern representative
+ * credential containing only an ISCO occupation such as `ISCO-08|1120` is not
+ * promoted to controller and fails this policy.
  *
  * @param input.organizationCredential Candidate organization credential.
- * @param input.representativeCredential Candidate representative credential.
- * @param input.requiredRoleCode Required representative role, defaults to `RESPRSN`.
+ * @param input.representativeCredential Legal-representative credential.
+ * @param input.controllerCredential Canonical controller-authority credential.
+ * @param input.requiredRoleCode Required controller role, defaults to `RESPRSN`.
  */
 export declare function validateActivationRepresentativePolicy(input: {
     organizationCredential?: unknown;
     representativeCredential?: unknown;
+    controllerCredential?: unknown;
     requiredRoleCode?: string;
 }): ActivationRepresentativePolicyError[];

package/dist/utils/activation-policy.js

@@ -88,6 +88,91 @@ export function extractRepresentativeRoleCode(representativeCredential) {
     }
     return undefined;
 }
+function readOccupationEntries(value) {
+    const values = Array.isArray(value) ? value : value ? [value] : [];
+    return values.map((entry) => {
+        if (typeof entry === 'string')
+            return { identifier: entry };
+        return asObject(entry);
+    }).filter((entry) => Boolean(entry));
+}
+function readCodedIdentifier(entry) {
+    const identifier = entry.identifier;
+    if (typeof identifier === 'string') {
+        const token = identifier.trim();
+        const separator = token.lastIndexOf('|');
+        return separator >= 0
+            ? { system: token.slice(0, separator), value: token.slice(separator + 1) }
+            : { value: token };
+    }
+    const coded = asObject(identifier) || {};
+    return {
+        system: String(coded.additionalType || coded.system || '').trim() || undefined,
+        value: String(coded.value || '').trim() || undefined,
+    };
+}
+/**
+ * Reads controller-authorization codes from an ICA-issued controller VC.
+ * Professional ISCO occupations are deliberately excluded.
+ */
+export function extractOrganizationControllerRoleCodes(controllerCredential) {
+    const subject = extractCredentialSubject(controllerCredential) || {};
+    const owner = asObject(subject.owner) || {};
+    const canonical = (Array.isArray(owner.additionalType) ? owner.additionalType : [owner.additionalType])
+        .map((value) => String(value || '').trim())
+        .filter(Boolean);
+    if (canonical.length)
+        return canonical;
+    return readOccupationEntries(owner.hasOccupation)
+        .filter((entry) => String(entry['@type'] || '').toLowerCase() === 'role'
+        || readCodedIdentifier(entry).system?.toUpperCase() !== 'ISCO-08')
+        .map((entry) => readCodedIdentifier(entry).value)
+        .filter((value) => Boolean(value));
+}
+/** Canonical name for reading controller authority from a service-controller VC. */
+export const extractServiceControllerRoleCodes = extractOrganizationControllerRoleCodes;
+/**
+ * Reads professional ISCO occupations from an ICA-issued controller VC as
+ * canonical `ISCO-08|code` tokens.
+ */
+export function extractOrganizationControllerOccupationCodes(controllerCredential) {
+    const subject = extractCredentialSubject(controllerCredential) || {};
+    const owner = asObject(subject.owner) || {};
+    const occupation = asObject(owner.hasOccupation);
+    const occupationalCategory = occupation?.occupationalCategory;
+    const canonical = (Array.isArray(occupationalCategory) ? occupationalCategory : [occupationalCategory])
+        .map((value) => {
+        if (typeof value === 'string')
+            return value.trim();
+        const category = asObject(value) || {};
+        const codeValue = String(category.codeValue || '').trim();
+        const codeSet = asObject(category.inCodeSet) || {};
+        const system = String(codeSet.name || '').trim();
+        return codeValue ? `${system || 'ISCO-08'}|${codeValue}` : '';
+    })
+        .filter(Boolean);
+    if (canonical.length)
+        return canonical;
+    return readOccupationEntries(owner.hasOccupation)
+        .map(readCodedIdentifier)
+        .filter((identifier) => identifier.system?.toUpperCase() === 'ISCO-08' && identifier.value)
+        .map((identifier) => `ISCO-08|${identifier.value}`);
+}
+/** Canonical name for reading ISCO occupations from a service-controller VC. */
+export const extractServiceControllerOccupationCodes = extractOrganizationControllerOccupationCodes;
+function extractOrganizationControllerBinding(controllerCredential) {
+    const subject = extractCredentialSubject(controllerCredential) || {};
+    const owner = asObject(subject.owner) || {};
+    return extractCredentialBindingValue(owner.hasCredential);
+}
+function extractOrganizationControllerProviderTaxId(controllerCredential) {
+    const subject = extractCredentialSubject(controllerCredential) || {};
+    const provider = asObject(subject.provider) || {};
+    const identifier = asObject(provider.identifier);
+    return normalizeTaxIdentifier(provider.taxID)
+        || normalizeTaxIdentifier(provider.taxId)
+        || normalizeTaxIdentifier(identifier?.value);
+}
 /**
  * Checks whether a role code contains the required code, ignoring prefixes such as `SYSTEM|`.
  *
@@ -307,19 +392,26 @@ export function isMemberDidWebUnderOwner(memberDidWeb, ownerDidWeb) {
     return did.startsWith(`${owner}:member:`);
 }
 /**
- * Validates the activation representative policy against organization and representative credentials.
+ * Validates controller authorization for organization activation.
  *
- * The representative proof model is intentionally two-dimensional:
- * - `credentialSubject.sameAs` expresses public identity continuity
- * - `credentialSubject.hasCredential.material` expresses signing-key continuity
+ * Canonical three-credential flow:
+ * - `LegalRepresentativeCredential` proves legal representation and carries
+ *   the representative's professional ISCO occupation
+ * - `ServiceControllerCredential` independently carries `RESPRSN` in
+ *   `owner.additionalType` and `owner.hasCredential.material` for the
+ *   controller actor key
  *
- * For GW activation, the key-binding dimension is the hard requirement
- * enforced here. The public-identity dimension may still be used by higher
- * layers for stronger demo/production matching and auditability.
+ * Legacy two-credential compatibility is deliberately narrow. When no
+ * no service-controller credential exists, the representative credential is
+ * accepted as the controller proof only if that old credential itself carries
+ * both `RESPRSN` and `hasCredential` binding material. A modern representative
+ * credential containing only an ISCO occupation such as `ISCO-08|1120` is not
+ * promoted to controller and fails this policy.
  *
  * @param input.organizationCredential Candidate organization credential.
- * @param input.representativeCredential Candidate representative credential.
- * @param input.requiredRoleCode Required representative role, defaults to `RESPRSN`.
+ * @param input.representativeCredential Legal-representative credential.
+ * @param input.controllerCredential Canonical controller-authority credential.
+ * @param input.requiredRoleCode Required controller role, defaults to `RESPRSN`.
  */
 export function validateActivationRepresentativePolicy(input) {
     const errors = [];
@@ -332,16 +424,41 @@ export function validateActivationRepresentativePolicy(input) {
             message: 'ICA-issued representative credential is missing credentialSubject.id.',
         });
     }
-    if (!input.representativeCredential)
-        return errors;
     const orgTax = extractOrganizationTaxId(input.organizationCredential);
-    const repTax = extractRepresentativeMemberOfTaxId(input.representativeCredential);
-    if (orgTax && repTax && orgTax !== repTax) {
-        errors.push({
-            code: 'REPRESENTATIVE_TAXID_MISMATCH',
-            message: 'ICA-issued representative credential memberOf.taxID must match organization credential taxID.',
-        });
+    if (input.representativeCredential) {
+        const repTax = extractRepresentativeMemberOfTaxId(input.representativeCredential);
+        if (orgTax && repTax && orgTax !== repTax) {
+            errors.push({
+                code: 'REPRESENTATIVE_TAXID_MISMATCH',
+                message: 'ICA-issued representative credential memberOf.taxID must match organization credential taxID.',
+            });
+        }
+    }
+    if (input.controllerCredential) {
+        const controllerTax = extractOrganizationControllerProviderTaxId(input.controllerCredential);
+        if (orgTax && controllerTax && orgTax !== controllerTax) {
+            errors.push({
+                code: 'CONTROLLER_TAXID_MISMATCH',
+                message: 'ICA-issued controller credential provider.taxID must match organization credential taxID.',
+            });
+        }
+        const controllerRoles = extractOrganizationControllerRoleCodes(input.controllerCredential);
+        if (!controllerRoles.some((role) => hasActivationRepresentativeRole(role, input.requiredRoleCode || 'RESPRSN'))) {
+            errors.push({
+                code: 'MISSING_CONTROLLER_ROLE_RESPRSN',
+                message: 'ICA-issued service controller credential must include RESPRSN in credentialSubject.owner.additionalType.',
+            });
+        }
+        if (!extractOrganizationControllerBinding(input.controllerCredential)) {
+            errors.push({
+                code: 'MISSING_CONTROLLER_CREDENTIAL_BINDING',
+                message: 'ICA-issued service controller credential is missing credentialSubject.owner.hasCredential binding data.',
+            });
+        }
+        return errors;
     }
+    if (!input.representativeCredential)
+        return errors;
     const roleCode = extractRepresentativeRoleCode(input.representativeCredential);
     if (!hasActivationRepresentativeRole(roleCode, input.requiredRoleCode || 'RESPRSN')) {
         errors.push({

package/dist/utils/index.d.ts

@@ -67,6 +67,7 @@ export * from './individual-organization-claims';
 export * from './inter-tenant-access-contract';
 export * from './legal-organization-onboarding-editor';
 export * from './organization-lifecycle';
+export * from './organization-employee-lifecycle';
 export * from './organization-did-binding';
 export * from './organization-authorization-urn';
 export * from './individual-organization-lifecycle';

package/dist/utils/index.js

@@ -67,6 +67,7 @@ export * from './individual-organization-claims.js';
 export * from './inter-tenant-access-contract.js';
 export * from './legal-organization-onboarding-editor.js';
 export * from './organization-lifecycle.js';
+export * from './organization-employee-lifecycle.js';
 export * from './organization-did-binding.js';
 export * from './organization-authorization-urn.js';
 export * from './individual-organization-lifecycle.js';

package/dist/utils/inter-tenant-access-contract.js

@@ -15,6 +15,20 @@ function splitCsv(value) {
         .map((item) => item.trim())
         .filter(Boolean)));
 }
+function buildContractTypeCodeableConcept(value) {
+    const normalized = String(value || '').trim();
+    if (!normalized)
+        return undefined;
+    const separator = normalized.indexOf('|');
+    if (separator < 1 || separator === normalized.length - 1) {
+        return { text: normalized };
+    }
+    const system = normalized.slice(0, separator).trim();
+    const code = normalized.slice(separator + 1).trim();
+    if (!system || !code)
+        return { text: normalized };
+    return { coding: [{ system, code }] };
+}
 function readClaimWithAliases(claims, canonicalKey, aliases = []) {
     const direct = String(claims[canonicalKey] || '').trim();
     if (direct)
@@ -124,6 +138,7 @@ function normalizeNow(input) {
 export function buildInterTenantAccessContractResource(claims) {
     const identifier = readClaimWithAliases(claims, ClaimInterTenantAccessContract.identifier) || '';
     const status = readClaimWithAliases(claims, ClaimInterTenantAccessContract.status) || 'executed';
+    const type = buildContractTypeCodeableConcept(readClaimWithAliases(claims, ClaimInterTenantAccessContract.type));
     const issued = readClaimWithAliases(claims, ClaimInterTenantAccessContract.issued) || '';
     const appliesStart = readClaimWithAliases(claims, ClaimInterTenantAccessContract.appliesStart, ['Contract.applies.start']) || '';
     const appliesEnd = readClaimWithAliases(claims, ClaimInterTenantAccessContract.appliesEnd, ['Contract.applies.end']) || '';
@@ -139,6 +154,7 @@ export function buildInterTenantAccessContractResource(claims) {
         id: identifier || undefined,
         identifier: identifier ? [{ value: identifier }] : undefined,
         status,
+        type,
         issued: issued || undefined,
         instantiatesUri: instantiatesUri || undefined,
         applies: {

package/dist/utils/jwk-thumbprint.d.ts

@@ -38,6 +38,8 @@ export declare function computeRfc7638JwkThumbprint(jwk: ThumbprintableJwk): str
  * `urn:ietf:params:oauth:jwk-thumbprint:sha-256:<base64url>`
  */
 export declare function toJwkThumbprintSha256Urn(jwk: ThumbprintableJwk): string;
+/** True only for an RFC 9278 SHA-256 JWK thumbprint URI. */
+export declare function isJwkThumbprintSha256Urn(value: unknown): value is string;
 /**
  * Returns a public JWK whose `kid` is derived exclusively from its public key
  * material. Caller-provided aliases are deliberately replaced so DID methods,

package/dist/utils/jwk-thumbprint.js

@@ -55,6 +55,14 @@ export function computeRfc7638JwkThumbprint(jwk) {
 export function toJwkThumbprintSha256Urn(jwk) {
     return `${UrnPrefixes.JwkThumbprintSha256KeyId}${computeRfc7638JwkThumbprint(jwk)}`;
 }
+/** True only for an RFC 9278 SHA-256 JWK thumbprint URI. */
+export function isJwkThumbprintSha256Urn(value) {
+    const normalized = typeof value === 'string' ? value.trim() : '';
+    if (!normalized.startsWith(UrnPrefixes.JwkThumbprintSha256KeyId))
+        return false;
+    const thumbprint = normalized.slice(UrnPrefixes.JwkThumbprintSha256KeyId.length);
+    return /^[A-Za-z0-9_-]{43}$/.test(thumbprint);
+}
 /**
  * Returns a public JWK whose `kid` is derived exclusively from its public key
  * material. Caller-provided aliases are deliberately replaced so DID methods,

package/dist/utils/legal-organization-verification-result.d.ts

@@ -64,19 +64,27 @@ export declare function readLegalRepresentativeBindingFromResponseBody(responseB
  * and legal-representative credential pair.
  */
 export declare function readOrganizationControllerCredentialsFromResponseBody(responseBody: unknown): LegalOrganizationVerificationCredential[];
+/** Canonical name for reading ICA-issued service-controller credentials. */
+export declare const readServiceControllerCredentialsFromResponseBody: typeof readOrganizationControllerCredentialsFromResponseBody;
 /**
  * Returns one organization-controller service credential in an ICA or
  * projected GW verification response. Pass a stable actor `sameAs` to select
  * one controller independently; otherwise the first controller is returned.
  */
 export declare function readOrganizationControllerCredentialFromResponseBody(responseBody: unknown, controllerSameAs?: string): LegalOrganizationVerificationCredential | undefined;
+/** Canonical name for selecting one ICA-issued service-controller credential. */
+export declare const readServiceControllerCredentialFromResponseBody: typeof readOrganizationControllerCredentialFromResponseBody;
 /**
  * Reads `credentialSubject.owner.sameAs` from the first
  * organization-controller service credential when present.
  */
 export declare function readOrganizationControllerSameAsFromResponseBody(responseBody: unknown): string | undefined;
+/** Canonical name for reading a service controller's stable actor identifier. */
+export declare const readServiceControllerSameAsFromResponseBody: typeof readOrganizationControllerSameAsFromResponseBody;
 /**
  * Reads `credentialSubject.owner.hasCredential.material` from the first
  * organization-controller service credential when present.
  */
 export declare function readOrganizationControllerBindingFromResponseBody(responseBody: unknown): string | undefined;
+/** Canonical name for reading a service controller's actor-key binding. */
+export declare const readServiceControllerBindingFromResponseBody: typeof readOrganizationControllerBindingFromResponseBody;

package/dist/utils/legal-organization-verification-result.js

@@ -152,10 +152,13 @@ export function readLegalRepresentativeBindingFromResponseBody(responseBody) {
  */
 export function readOrganizationControllerCredentialsFromResponseBody(responseBody) {
     return getLegalOrganizationVerificationEntriesFromResponseBody(responseBody)
-        .filter((entry) => hasCredentialType(entry, 'OrganizationControllerCredential'))
+        .filter((entry) => hasCredentialType(entry, 'ServiceControllerCredential')
+        || hasCredentialType(entry, 'OrganizationControllerCredential'))
         .map((entry) => asObject(asObject(entry)?.resource) || asObject(entry))
         .filter((entry) => Boolean(entry));
 }
+/** Canonical name for reading ICA-issued service-controller credentials. */
+export const readServiceControllerCredentialsFromResponseBody = readOrganizationControllerCredentialsFromResponseBody;
 /**
  * Returns one organization-controller service credential in an ICA or
  * projected GW verification response. Pass a stable actor `sameAs` to select
@@ -168,6 +171,8 @@ export function readOrganizationControllerCredentialFromResponseBody(responseBod
         ? credentials.find((credential) => extractOrganizationControllerSameAs(credential) === expectedSameAs)
         : credentials[0];
 }
+/** Canonical name for selecting one ICA-issued service-controller credential. */
+export const readServiceControllerCredentialFromResponseBody = readOrganizationControllerCredentialFromResponseBody;
 /**
  * Reads `credentialSubject.owner.sameAs` from the first
  * organization-controller service credential when present.
@@ -175,6 +180,8 @@ export function readOrganizationControllerCredentialFromResponseBody(responseBod
 export function readOrganizationControllerSameAsFromResponseBody(responseBody) {
     return extractOrganizationControllerSameAs(readOrganizationControllerCredentialFromResponseBody(responseBody));
 }
+/** Canonical name for reading a service controller's stable actor identifier. */
+export const readServiceControllerSameAsFromResponseBody = readOrganizationControllerSameAsFromResponseBody;
 /**
  * Reads `credentialSubject.owner.hasCredential.material` from the first
  * organization-controller service credential when present.
@@ -182,3 +189,5 @@ export function readOrganizationControllerSameAsFromResponseBody(responseBody) {
 export function readOrganizationControllerBindingFromResponseBody(responseBody) {
     return extractOrganizationControllerBinding(readOrganizationControllerCredentialFromResponseBody(responseBody));
 }
+/** Canonical name for reading a service controller's actor-key binding. */
+export const readServiceControllerBindingFromResponseBody = readOrganizationControllerBindingFromResponseBody;

package/dist/utils/legal-organization-verification-transaction.d.ts

@@ -84,11 +84,16 @@ export type LegalOrganizationVerificationTransactionInput = Readonly<{
 }>;
 export type LegalOrganizationVerificationTransactionEntry = Readonly<{
     type?: string;
+    /** @deprecated Read-only compatibility with payloads emitted before 2.5.x. */
     meta?: {
         claims?: ClaimsRecord;
         [key: string]: unknown;
     };
     resource?: {
+        meta?: {
+            claims?: ClaimsRecord;
+            [key: string]: unknown;
+        };
         controller?: LegalOrganizationVerificationTransactionController;
         organization?: LegalOrganizationVerificationTransactionOrganization;
         /** @deprecated Legacy demo/OTP compatibility input. */
@@ -106,7 +111,7 @@ export type LegalOrganizationVerificationTransactionEntry = Readonly<{
  * verification transactions.
  *
  * Contract notes:
- * - business claims remain in `meta.claims`
+ * - business claims live in `resource.meta.claims`
  * - controller binding material remains in `resource.controller.*`
  * - organization signing material remains in `resource.organization.*`
  * - PDF evidence or URL attachments stay at the DIDComm-message level

package/dist/utils/legal-organization-verification-transaction.js

@@ -31,7 +31,7 @@ function asRecord(value) {
  * verification transactions.
  *
  * Contract notes:
- * - business claims remain in `meta.claims`
+ * - business claims live in `resource.meta.claims`
  * - controller binding material remains in `resource.controller.*`
  * - organization signing material remains in `resource.organization.*`
  * - PDF evidence or URL attachments stay at the DIDComm-message level
@@ -49,10 +49,10 @@ export function buildLegalOrganizationVerificationTransactionBundle(input) {
         total: 1,
         data: [{
                 type: LegalOrganizationVerificationTransactionEntryTypes.Request,
-                meta: {
-                    claims: input.claims,
-                },
                 resource: {
+                    meta: {
+                        claims: input.claims,
+                    },
                     controller: input.controller,
                     ...(input.organization ? { organization: input.organization } : {}),
                     ...(input.legalRepresentativePayload

package/dist/utils/license.js

@@ -1,4 +1,4 @@
-import { DeviceAppTypes, DeviceUserClasses } from '../constants/device.js';
+import { DeviceAppTypes, DeviceBindingStatuses, DeviceUserClasses } from '../constants/device.js';
 import { ClaimsIndividualProductSchemaorg, ClaimsOfferSchemaorg, ClaimsPersonSchemaorg, } from '../constants/schemaorg.js';
 /** Default simultaneous installation allowance for one professional/member seat. */
 export const DEFAULT_LICENSE_DEVICE_ALLOWANCE = 2;
@@ -13,7 +13,7 @@ export function resolveLicenseDeviceAllowance(license) {
  */
 export function listActiveLicenseDeviceBindings(license) {
     if (Array.isArray(license.deviceBindings)) {
-        return license.deviceBindings.filter((binding) => binding.status === 'active');
+        return license.deviceBindings.filter((binding) => binding.status === DeviceBindingStatuses.Active);
     }
     const clientId = String(license.deviceId || '').trim();
     if (!clientId)
@@ -22,7 +22,7 @@ export function listActiveLicenseDeviceBindings(license) {
     return [{
             clientId,
             clientInstanceId: deviceInfo.clientInstanceId || clientId,
-            status: 'active',
+            status: DeviceBindingStatuses.Active,
             deviceInfo,
             activatedAt: Number(license.activatedAt || 0),
         }];

package/dist/utils/organization-employee-lifecycle.d.ts

@@ -0,0 +1,12 @@
+import type { EmployeeDeviceRevocationTarget, OrganizationEmployeeLifecycleRecord } from '../models/organization-employee-lifecycle';
+/** Builds the exact identity/auth revoke request body from a typed target. */
+export declare function buildEmployeeDeviceRevocationBody(target: EmployeeDeviceRevocationTarget): Readonly<Record<string, string>>;
+/** Reads an employee activation credential from canonical and legacy GW envelopes. */
+export declare function readEmployeeActivationCode(value: unknown): string;
+/** Extracts GW search rows regardless of async job envelope depth. */
+export declare function extractGwSearchResources(value: unknown): ReadonlyArray<Record<string, unknown>>;
+/** Combines employee directory and license search results into one typed view. */
+export declare function projectOrganizationEmployeeLifecycle(input: Readonly<{
+    employeeResponse: unknown;
+    licenseResponse: unknown;
+}>): OrganizationEmployeeLifecycleRecord[];