gdc-common-utils-ts 2.5.3 → 2.5.4

package/dist/constants/device.d.ts

@@ -14,3 +14,9 @@ export declare const DeviceAppTypes: Readonly<{
     readonly Web: "web";
 }>;
 export type DeviceAppType = typeof DeviceAppTypes[keyof typeof DeviceAppTypes];
+/** Lifecycle states for one concrete DCR installation bound to a seat. */
+export declare const DeviceBindingStatuses: Readonly<{
+    readonly Active: "active";
+    readonly Revoked: "revoked";
+}>;
+export type DeviceBindingStatus = typeof DeviceBindingStatuses[keyof typeof DeviceBindingStatuses];

package/dist/constants/device.js

@@ -13,3 +13,8 @@ export const DeviceAppTypes = Object.freeze({
     Mobile: 'mobile',
     Web: 'web',
 });
+/** Lifecycle states for one concrete DCR installation bound to a seat. */
+export const DeviceBindingStatuses = Object.freeze({
+    Active: 'active',
+    Revoked: 'revoked',
+});

package/dist/constants/employee-lifecycle.d.ts

@@ -0,0 +1,52 @@
+/** Employee directory states exposed by organization lifecycle projections. */
+export declare const EmployeeDirectoryStatuses: Readonly<{
+    readonly Active: "active";
+    readonly Inactive: "inactive";
+    readonly Purged: "purged";
+    readonly Unknown: "unknown";
+}>;
+export type EmployeeDirectoryStatus = typeof EmployeeDirectoryStatuses[keyof typeof EmployeeDirectoryStatuses];
+/** Controller actions supported by the reusable employee lifecycle service. */
+export declare const EmployeeLifecycleActions: Readonly<{
+    readonly Disable: "disable";
+    readonly Purge: "purge";
+    readonly RevokeDevice: "revoke_device";
+}>;
+/** Read-only API actions kept separate from mutating employee lifecycle actions. */
+export declare const EmployeeLifecycleQueryActions: Readonly<{
+    readonly List: "list";
+}>;
+export type EmployeeLifecycleAction = typeof EmployeeLifecycleActions[keyof typeof EmployeeLifecycleActions];
+/** Version tag for routing metadata stored outside the high-entropy GW credential. */
+export declare const EmployeeActivationGrantVersions: Readonly<{
+    readonly V1: "employee-activation-grant-v1";
+}>;
+/** Supported durable routing-grant schema versions. */
+export type EmployeeActivationGrantVersion = typeof EmployeeActivationGrantVersions[keyof typeof EmployeeActivationGrantVersions];
+/** Shared durable-storage layout for hashed employee activation routing grants. */
+export declare const EmployeeActivationGrantStorage: Readonly<{
+    readonly ScopedLayout: "scoped-v2";
+    readonly CollectionSegment: "employee-activation-grants";
+    readonly ScopeSeparator: "__";
+    readonly DefaultTtlMs: number;
+}>;
+/** JSON field names shared by employee lifecycle portal adapters. */
+export declare const OrganizationEmployeeApiFields: Readonly<{
+    readonly Action: "action";
+    readonly ProfileId: "profileId";
+    readonly Pin: "pin";
+    readonly PasskeyAccessToken: "passkeyAccessToken";
+    readonly ResourceId: "resourceId";
+    readonly LicenseId: "licenseId";
+    readonly ClientId: "clientId";
+    readonly ActivationCode: "activationCode";
+    readonly ClientInstanceId: "clientInstanceId";
+    readonly Email: "email";
+    readonly Role: "role";
+}>;
+/** Stable employee portal error identifiers. */
+export declare const OrganizationEmployeePortalErrors: Readonly<{
+    readonly InvitationFailed: "invitation_failed";
+    readonly LifecycleFailed: "employee_lifecycle_failed";
+    readonly ActivationFailed: "employee_activation_failed";
+}>;

package/dist/constants/employee-lifecycle.js

@@ -0,0 +1,48 @@
+/** Employee directory states exposed by organization lifecycle projections. */
+export const EmployeeDirectoryStatuses = Object.freeze({
+    Active: 'active',
+    Inactive: 'inactive',
+    Purged: 'purged',
+    Unknown: 'unknown',
+});
+/** Controller actions supported by the reusable employee lifecycle service. */
+export const EmployeeLifecycleActions = Object.freeze({
+    Disable: 'disable',
+    Purge: 'purge',
+    RevokeDevice: 'revoke_device',
+});
+/** Read-only API actions kept separate from mutating employee lifecycle actions. */
+export const EmployeeLifecycleQueryActions = Object.freeze({
+    List: 'list',
+});
+/** Version tag for routing metadata stored outside the high-entropy GW credential. */
+export const EmployeeActivationGrantVersions = Object.freeze({
+    V1: 'employee-activation-grant-v1',
+});
+/** Shared durable-storage layout for hashed employee activation routing grants. */
+export const EmployeeActivationGrantStorage = Object.freeze({
+    ScopedLayout: 'scoped-v2',
+    CollectionSegment: 'employee-activation-grants',
+    ScopeSeparator: '__',
+    DefaultTtlMs: 365 * 24 * 60 * 60 * 1_000,
+});
+/** JSON field names shared by employee lifecycle portal adapters. */
+export const OrganizationEmployeeApiFields = Object.freeze({
+    Action: 'action',
+    ProfileId: 'profileId',
+    Pin: 'pin',
+    PasskeyAccessToken: 'passkeyAccessToken',
+    ResourceId: 'resourceId',
+    LicenseId: 'licenseId',
+    ClientId: 'clientId',
+    ActivationCode: 'activationCode',
+    ClientInstanceId: 'clientInstanceId',
+    Email: 'email',
+    Role: 'role',
+});
+/** Stable employee portal error identifiers. */
+export const OrganizationEmployeePortalErrors = Object.freeze({
+    InvitationFailed: 'invitation_failed',
+    LifecycleFailed: 'employee_lifecycle_failed',
+    ActivationFailed: 'employee_activation_failed',
+});

package/dist/constants/http.d.ts

@@ -0,0 +1,28 @@
+/** Numeric HTTP status values shared by route adapters and tests. */
+export declare const HttpStatusCodes: Readonly<{
+    readonly Ok: 200;
+    readonly Created: 201;
+    readonly BadRequest: 400;
+    readonly Unauthorized: 401;
+    readonly Forbidden: 403;
+    readonly NotFound: 404;
+    readonly Conflict: 409;
+    readonly Gone: 410;
+    readonly InternalServerError: 500;
+    readonly ServiceUnavailable: 503;
+}>;
+/** HTTP methods used by SDK and portal request builders. */
+export declare const HttpRequestMethods: Readonly<{
+    readonly Get: "GET";
+    readonly Post: "POST";
+    readonly Patch: "PATCH";
+}>;
+/** Canonical HTTP header names. */
+export declare const HttpHeaderNames: Readonly<{
+    readonly Authorization: "authorization";
+    readonly ContentType: "content-type";
+}>;
+/** Media types shared by JSON route adapters. */
+export declare const HttpMediaTypes: Readonly<{
+    readonly Json: "application/json";
+}>;

package/dist/constants/http.js

@@ -0,0 +1,28 @@
+/** Numeric HTTP status values shared by route adapters and tests. */
+export const HttpStatusCodes = Object.freeze({
+    Ok: 200,
+    Created: 201,
+    BadRequest: 400,
+    Unauthorized: 401,
+    Forbidden: 403,
+    NotFound: 404,
+    Conflict: 409,
+    Gone: 410,
+    InternalServerError: 500,
+    ServiceUnavailable: 503,
+});
+/** HTTP methods used by SDK and portal request builders. */
+export const HttpRequestMethods = Object.freeze({
+    Get: 'GET',
+    Post: 'POST',
+    Patch: 'PATCH',
+});
+/** Canonical HTTP header names. */
+export const HttpHeaderNames = Object.freeze({
+    Authorization: 'authorization',
+    ContentType: 'content-type',
+});
+/** Media types shared by JSON route adapters. */
+export const HttpMediaTypes = Object.freeze({
+    Json: 'application/json',
+});

package/dist/constants/identity-auth.d.ts

@@ -0,0 +1,57 @@
+/** Canonical identity/auth route actions shared by gateways, SDKs and portals. */
+export declare const IdentityAuthActions: Readonly<{
+    readonly Exchange: "_exchange";
+    readonly ExchangeResponse: "_exchange-response";
+    readonly Dcr: "_dcr";
+    readonly DcrResponse: "_dcr-response";
+    readonly Issue: "_issue";
+    readonly IssueResponse: "_issue-response";
+    readonly Revoke: "_revoke";
+    readonly RevokeResponse: "_revoke-response";
+    readonly Search: "_search";
+    readonly SearchResponse: "_search-response";
+}>;
+/** Canonical identity/auth route segments shared by all products. */
+export declare const IdentityAuthRouteSegments: Readonly<{
+    readonly Host: "host";
+    readonly Version: "v1";
+    readonly Section: "identity";
+    readonly Format: "auth";
+}>;
+/** Wire-level request keys used by identity/auth operations. */
+export declare const IdentityAuthRequestFields: Readonly<{
+    readonly SubjectToken: "subject_token";
+    readonly ClientInstanceId: "client_instance_id";
+    readonly LicenseId: "license_id";
+    readonly ClientId: "client_id";
+    readonly Code: "code";
+}>;
+/** Response keys accepted from token exchange during the compatibility window. */
+export declare const IdentityAuthResponseFields: Readonly<{
+    readonly InitialAccessToken: "initial_access_token";
+    readonly AccessToken: "access_token";
+}>;
+/** DCR metadata keys used to derive and register one installation identity. */
+export declare const IdentityDcrMetadataFields: Readonly<{
+    readonly ExtendedDeviceInfo: "ext_device_info";
+    readonly RedirectUris: "redirect_uris";
+    readonly Jwks: "jwks";
+    readonly SoftwareId: "software_id";
+    readonly ApplicationType: "application_type";
+    readonly ClientName: "client_name";
+    readonly ActorDid: "actor_did";
+    readonly ProfileDid: "profile_did";
+}>;
+/** Device metadata keys nested below `ext_device_info`. */
+export declare const IdentityDeviceInfoFields: Readonly<{
+    readonly DeviceId: "device_id";
+}>;
+/** Stable entry type emitted by license issuance responses. */
+export declare const IdentityAuthResponseEntryTypes: Readonly<{
+    readonly LicenseIssued: "License:Issued";
+    readonly DeviceRevoked: "Device:Revoked";
+}>;
+/** DIDComm response type values emitted by identity/auth managers. */
+export declare const IdentityAuthResponseTypes: Readonly<{
+    readonly DeviceRevoke: "device-revoke-response";
+}>;

package/dist/constants/identity-auth.js

@@ -0,0 +1,57 @@
+/** Canonical identity/auth route actions shared by gateways, SDKs and portals. */
+export const IdentityAuthActions = Object.freeze({
+    Exchange: '_exchange',
+    ExchangeResponse: '_exchange-response',
+    Dcr: '_dcr',
+    DcrResponse: '_dcr-response',
+    Issue: '_issue',
+    IssueResponse: '_issue-response',
+    Revoke: '_revoke',
+    RevokeResponse: '_revoke-response',
+    Search: '_search',
+    SearchResponse: '_search-response',
+});
+/** Canonical identity/auth route segments shared by all products. */
+export const IdentityAuthRouteSegments = Object.freeze({
+    Host: 'host',
+    Version: 'v1',
+    Section: 'identity',
+    Format: 'auth',
+});
+/** Wire-level request keys used by identity/auth operations. */
+export const IdentityAuthRequestFields = Object.freeze({
+    SubjectToken: 'subject_token',
+    ClientInstanceId: 'client_instance_id',
+    LicenseId: 'license_id',
+    ClientId: 'client_id',
+    Code: 'code',
+});
+/** Response keys accepted from token exchange during the compatibility window. */
+export const IdentityAuthResponseFields = Object.freeze({
+    InitialAccessToken: 'initial_access_token',
+    AccessToken: 'access_token',
+});
+/** DCR metadata keys used to derive and register one installation identity. */
+export const IdentityDcrMetadataFields = Object.freeze({
+    ExtendedDeviceInfo: 'ext_device_info',
+    RedirectUris: 'redirect_uris',
+    Jwks: 'jwks',
+    SoftwareId: 'software_id',
+    ApplicationType: 'application_type',
+    ClientName: 'client_name',
+    ActorDid: 'actor_did',
+    ProfileDid: 'profile_did',
+});
+/** Device metadata keys nested below `ext_device_info`. */
+export const IdentityDeviceInfoFields = Object.freeze({
+    DeviceId: 'device_id',
+});
+/** Stable entry type emitted by license issuance responses. */
+export const IdentityAuthResponseEntryTypes = Object.freeze({
+    LicenseIssued: 'License:Issued',
+    DeviceRevoked: 'Device:Revoked',
+});
+/** DIDComm response type values emitted by identity/auth managers. */
+export const IdentityAuthResponseTypes = Object.freeze({
+    DeviceRevoke: 'device-revoke-response',
+});

package/dist/constants/index.d.ts

@@ -8,6 +8,10 @@ export * from './dataspace-discovery';
 export * from './dataspace-protocol';
 export * from './didcomm';
 export * from './device';
+export * from './employee-lifecycle';
+export * from './identity-auth';
+export * from './http';
+export * from './organization-application';
 export * from './did-services';
 export * from './eu-countries';
 export * from './fhir-code-systems';

package/dist/constants/index.js

@@ -8,6 +8,10 @@ export * from './dataspace-discovery.js';
 export * from './dataspace-protocol.js';
 export * from './didcomm.js';
 export * from './device.js';
+export * from './employee-lifecycle.js';
+export * from './identity-auth.js';
+export * from './http.js';
+export * from './organization-application.js';
 export * from './did-services.js';
 export * from './eu-countries.js';
 export * from './fhir-code-systems.js';

package/dist/constants/organization-application.d.ts

@@ -0,0 +1,27 @@
+/** Actions accepted by the reusable organization-registration review route. */
+export declare const OrganizationRegistrationReviewActions: Readonly<{
+    readonly MarkPostalDelivered: "mark_postal_delivered";
+    readonly IssuePostalLicense: "issue_postal_license";
+    readonly DownloadDraft: "download_draft";
+    readonly Authorize: "authorize";
+    readonly Reject: "reject";
+}>;
+export type OrganizationRegistrationReviewAction = typeof OrganizationRegistrationReviewActions[keyof typeof OrganizationRegistrationReviewActions];
+/** Narrows untrusted request input to one supported review action. */
+export declare function isOrganizationRegistrationReviewAction(value: unknown): value is OrganizationRegistrationReviewAction;
+/** Stable error identifiers shared by route handlers, services and tests. */
+export declare const OrganizationRegistrationErrors: Readonly<{
+    readonly InvalidReviewAction: "invalid_review_action";
+    readonly ApplicationNotReviewable: "application_not_reviewable";
+    readonly AuthorizationCredentialRequired: "organization_authorization_credential_required";
+    readonly ReviewFailed: "review_failed";
+    readonly InvalidOrganization: "invalid_organization";
+    readonly ApplicationFailed: "application_failed";
+}>;
+/** Default and accepted authorization validity window for registration evidence. */
+export declare const OrganizationRegistrationValidity: Readonly<{
+    readonly DefaultDays: 180;
+    readonly MinimumDays: 1;
+    readonly MaximumDays: 730;
+    readonly MillisecondsPerDay: 86400000;
+}>;

package/dist/constants/organization-application.js

@@ -0,0 +1,29 @@
+/** Actions accepted by the reusable organization-registration review route. */
+export const OrganizationRegistrationReviewActions = Object.freeze({
+    MarkPostalDelivered: 'mark_postal_delivered',
+    IssuePostalLicense: 'issue_postal_license',
+    DownloadDraft: 'download_draft',
+    Authorize: 'authorize',
+    Reject: 'reject',
+});
+/** Narrows untrusted request input to one supported review action. */
+export function isOrganizationRegistrationReviewAction(value) {
+    return typeof value === 'string'
+        && Object.values(OrganizationRegistrationReviewActions).includes(value);
+}
+/** Stable error identifiers shared by route handlers, services and tests. */
+export const OrganizationRegistrationErrors = Object.freeze({
+    InvalidReviewAction: 'invalid_review_action',
+    ApplicationNotReviewable: 'application_not_reviewable',
+    AuthorizationCredentialRequired: 'organization_authorization_credential_required',
+    ReviewFailed: 'review_failed',
+    InvalidOrganization: 'invalid_organization',
+    ApplicationFailed: 'application_failed',
+});
+/** Default and accepted authorization validity window for registration evidence. */
+export const OrganizationRegistrationValidity = Object.freeze({
+    DefaultDays: 180,
+    MinimumDays: 1,
+    MaximumDays: 730,
+    MillisecondsPerDay: 86_400_000,
+});

package/dist/examples/license.d.ts

@@ -1,3 +1,43 @@
+export declare const EXAMPLE_EMPLOYEE_DEVICE_BINDINGS: readonly [Readonly<{
+    clientId: "client-employee-primary";
+    clientInstanceId: "installation-employee-primary";
+    status: "active";
+    deviceInfo: Readonly<{
+        clientInstanceId: "installation-employee-primary";
+        model: "Shared browser profile";
+    }>;
+    activatedAt: 1786570800;
+}>, Readonly<{
+    clientId: "client-employee-secondary";
+    clientInstanceId: "installation-employee-secondary";
+    status: "revoked";
+    deviceInfo: Readonly<{
+        clientInstanceId: "installation-employee-secondary";
+    }>;
+    activatedAt: 1786570900;
+    revokedAt: 1786571000;
+}>];
+/** Two simultaneously active installations used to test the default allowance. */
+export declare const EXAMPLE_EMPLOYEE_ACTIVE_DEVICE_BINDINGS: readonly Readonly<{
+    status: "active";
+    revokedAt: undefined;
+    clientId: "client-employee-primary";
+    clientInstanceId: "installation-employee-primary";
+    deviceInfo: Readonly<{
+        clientInstanceId: "installation-employee-primary";
+        model: "Shared browser profile";
+    }>;
+    activatedAt: 1786570800;
+} | {
+    status: "active";
+    revokedAt: undefined;
+    clientId: "client-employee-secondary";
+    clientInstanceId: "installation-employee-secondary";
+    deviceInfo: Readonly<{
+        clientInstanceId: "installation-employee-secondary";
+    }>;
+    activatedAt: 1786570900;
+}>[];
 export declare const EXAMPLE_LICENSE_SEAT_UUIDS: readonly ["8a8a5e1b-0d8e-4a7c-8c39-3b8034440001", "8a8a5e1b-0d8e-4a7c-8c39-3b8034440002"];
 export declare const EXAMPLE_LICENSE_ISSUE_INPUT: Readonly<{
     readonly email: "controller@acme.org";
@@ -67,6 +107,77 @@ export declare const EXAMPLE_LICENSE_LIST_RESPONSE_BODY: Readonly<{
         };
     }];
 }>;
+/** Shared async GW response for a controller-issued employee activation credential. */
+export declare const EXAMPLE_LICENSE_ISSUE_RESPONSE_BODY: Readonly<{
+    readonly body: {
+        readonly data: readonly [{
+            readonly resource: {
+                readonly data: readonly [{
+                    readonly type: "License:Issued";
+                    readonly id: "ACT-001";
+                    readonly meta: {
+                        readonly claims: {
+                            readonly "org.schema.IndividualProduct.serialNumber": "ACT-001";
+                        };
+                    };
+                }];
+            };
+        }];
+    };
+}>;
+/** Shared license search response containing the default two-installation state. */
+export declare const EXAMPLE_LICENSE_LIST_RESPONSE_BODY_WITH_DEVICES: Readonly<{
+    readonly body: {
+        readonly resource: {
+            readonly data: readonly [{
+                readonly id: "8a8a5e1b-0d8e-4a7c-8c39-3b8034440001";
+                readonly meta: {
+                    readonly status: "active";
+                    readonly subjectId: string;
+                    readonly maxDevices: 2;
+                    readonly deviceBindings: readonly [Readonly<{
+                        clientId: "client-employee-primary";
+                        clientInstanceId: "installation-employee-primary";
+                        status: "active";
+                        deviceInfo: Readonly<{
+                            clientInstanceId: "installation-employee-primary";
+                            model: "Shared browser profile";
+                        }>;
+                        activatedAt: 1786570800;
+                    }>, Readonly<{
+                        clientId: "client-employee-secondary";
+                        clientInstanceId: "installation-employee-secondary";
+                        status: "revoked";
+                        deviceInfo: Readonly<{
+                            clientInstanceId: "installation-employee-secondary";
+                        }>;
+                        activatedAt: 1786570900;
+                        revokedAt: 1786571000;
+                    }>];
+                };
+            }];
+        };
+    };
+}>;
+/** Canonical controller-facing employee projection reused across SDK and portal tests. */
+export declare const EXAMPLE_EMPLOYEE_LIFECYCLE_RECORD: Readonly<{
+    readonly resourceId: string;
+    readonly email: string;
+    readonly roleCode: string;
+    readonly employeeDid: string;
+    readonly status: "active" | "inactive" | "purged";
+    readonly license: Readonly<{
+        id: "8a8a5e1b-0d8e-4a7c-8c39-3b8034440001";
+        status: "active";
+        maxDevices: 2;
+        activeDevices: number;
+        devices: readonly Readonly<{
+            clientId: "client-employee-primary" | "client-employee-secondary";
+            name: "installation-employee-primary" | "installation-employee-secondary" | "Shared browser profile";
+            status: "active" | "revoked";
+        }>[];
+    }>;
+}>;
 export declare function buildExampleLicenseIssueClaims(): Readonly<Record<string, unknown>>;
 export declare function buildExampleLicensePurchaseClaims(): Readonly<Record<string, unknown>>;
 export declare const EXAMPLE_LICENSE_PURCHASE_CLAIMS: Readonly<Record<string, unknown>>;

package/dist/examples/license.js

@@ -1,8 +1,36 @@
-import { DeviceAppTypes, DeviceUserClasses } from '../constants/device.js';
+import { DeviceAppTypes, DeviceBindingStatuses, DeviceUserClasses } from '../constants/device.js';
 import { ClaimsOrderSchemaorg, ClaimsIndividualProductSchemaorg, ClaimsOfferSchemaorg, ClaimsPersonSchemaorg, } from '../constants/schemaorg.js';
 import { buildLicenseIssueClaims, buildLicensePurchaseClaims, LicenseClaimContext, LicenseCategories, LicenseStatuses, } from '../utils/license.js';
 import { createLicenseOfferOrderEditor } from '../utils/license-offer-order.js';
-import { EXAMPLE_LICENSE_ACCEPTED_OFFER_ID, EXAMPLE_LICENSE_AMOUNT, EXAMPLE_LICENSE_CHECKOUT_URL, EXAMPLE_LICENSE_CURRENCY, EXAMPLE_EMAIL_CONTROLLER_ORG, EXAMPLE_EMPLOYEE_ACTIVATION_CODE, EXAMPLE_HEALTHCARE_ACTOR_ROLE_GENERALIST_MEDICAL_PRACTITIONER, EXAMPLE_LICENSE_INVOICE_ID, EXAMPLE_LICENSE_OFFER_ID, EXAMPLE_LICENSE_PLAN_DEFAULT, EXAMPLE_LICENSE_PAYMENT_METHOD_INVOICE, EXAMPLE_LICENSE_PAYMENT_URL, EXAMPLE_LICENSE_RENEWAL_CYCLE_YEARLY, EXAMPLE_LICENSE_PLAN_NAME, EXAMPLE_LICENSE_SEAT_UUID_ACTIVE, EXAMPLE_LICENSE_SEAT_UUID_AVAILABLE, EXAMPLE_LICENSE_SEAT_UUID_SECONDARY, EXAMPLE_LICENSE_SKU, EXAMPLE_LICENSE_SUBJECT_ID_ACTIVE, EXAMPLE_LICENSE_SUBJECT_ID_AVAILABLE, } from './shared.js';
+import { EXAMPLE_LICENSE_ACCEPTED_OFFER_ID, EXAMPLE_LICENSE_AMOUNT, EXAMPLE_LICENSE_CHECKOUT_URL, EXAMPLE_LICENSE_CURRENCY, EXAMPLE_EMAIL_CONTROLLER_ORG, EXAMPLE_EMPLOYEE_ACTIVATION_CODE, EXAMPLE_EMPLOYEE_DEVICE_CLIENT_ID_PRIMARY, EXAMPLE_EMPLOYEE_DEVICE_CLIENT_ID_SECONDARY, EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_PRIMARY, EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_SECONDARY, EXAMPLE_EMPLOYEE_DEVICE_MODEL_PRIMARY, EXAMPLE_HEALTHCARE_ACTOR_ROLE_GENERALIST_MEDICAL_PRACTITIONER, EXAMPLE_LICENSE_INVOICE_ID, EXAMPLE_LICENSE_OFFER_ID, EXAMPLE_LICENSE_PLAN_DEFAULT, EXAMPLE_LICENSE_PAYMENT_METHOD_INVOICE, EXAMPLE_LICENSE_PAYMENT_URL, EXAMPLE_LICENSE_RENEWAL_CYCLE_YEARLY, EXAMPLE_LICENSE_PLAN_NAME, EXAMPLE_LICENSE_SEAT_UUID_ACTIVE, EXAMPLE_LICENSE_SEAT_UUID_AVAILABLE, EXAMPLE_LICENSE_SEAT_UUID_SECONDARY, EXAMPLE_LICENSE_SKU, EXAMPLE_LICENSE_SUBJECT_ID_ACTIVE, EXAMPLE_LICENSE_SUBJECT_ID_AVAILABLE, } from './shared.js';
+import { DEFAULT_LICENSE_DEVICE_ALLOWANCE } from '../utils/license.js';
+import { EXAMPLE_EMPLOYEE_CONTROLLER_ACTIVE } from './employee.js';
+export const EXAMPLE_EMPLOYEE_DEVICE_BINDINGS = Object.freeze([
+    Object.freeze({
+        clientId: EXAMPLE_EMPLOYEE_DEVICE_CLIENT_ID_PRIMARY,
+        clientInstanceId: EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_PRIMARY,
+        status: DeviceBindingStatuses.Active,
+        deviceInfo: Object.freeze({
+            clientInstanceId: EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_PRIMARY,
+            model: EXAMPLE_EMPLOYEE_DEVICE_MODEL_PRIMARY,
+        }),
+        activatedAt: 1_786_570_800,
+    }),
+    Object.freeze({
+        clientId: EXAMPLE_EMPLOYEE_DEVICE_CLIENT_ID_SECONDARY,
+        clientInstanceId: EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_SECONDARY,
+        status: DeviceBindingStatuses.Revoked,
+        deviceInfo: Object.freeze({ clientInstanceId: EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_SECONDARY }),
+        activatedAt: 1_786_570_900,
+        revokedAt: 1_786_571_000,
+    }),
+]);
+/** Two simultaneously active installations used to test the default allowance. */
+export const EXAMPLE_EMPLOYEE_ACTIVE_DEVICE_BINDINGS = Object.freeze(EXAMPLE_EMPLOYEE_DEVICE_BINDINGS.map((binding) => Object.freeze({
+    ...binding,
+    status: DeviceBindingStatuses.Active,
+    revokedAt: undefined,
+})));
 export const EXAMPLE_LICENSE_SEAT_UUIDS = Object.freeze([
     EXAMPLE_LICENSE_SEAT_UUID_ACTIVE,
     EXAMPLE_LICENSE_SEAT_UUID_SECONDARY,
@@ -60,6 +88,61 @@ export const EXAMPLE_LICENSE_LIST_RESPONSE_BODY = Object.freeze({
         },
     ],
 });
+/** Shared async GW response for a controller-issued employee activation credential. */
+export const EXAMPLE_LICENSE_ISSUE_RESPONSE_BODY = Object.freeze({
+    body: {
+        data: [{
+                resource: {
+                    data: [{
+                            type: 'License:Issued',
+                            id: EXAMPLE_EMPLOYEE_ACTIVATION_CODE,
+                            meta: {
+                                claims: {
+                                    [ClaimsIndividualProductSchemaorg.serialNumber]: EXAMPLE_EMPLOYEE_ACTIVATION_CODE,
+                                },
+                            },
+                        }],
+                },
+            }],
+    },
+});
+/** Shared license search response containing the default two-installation state. */
+export const EXAMPLE_LICENSE_LIST_RESPONSE_BODY_WITH_DEVICES = Object.freeze({
+    body: {
+        resource: {
+            data: [{
+                    id: EXAMPLE_LICENSE_ACTIVE_RECORD.id,
+                    meta: {
+                        status: EXAMPLE_LICENSE_ACTIVE_RECORD.status,
+                        subjectId: EXAMPLE_EMPLOYEE_CONTROLLER_ACTIVE.resourceId,
+                        maxDevices: DEFAULT_LICENSE_DEVICE_ALLOWANCE,
+                        deviceBindings: EXAMPLE_EMPLOYEE_DEVICE_BINDINGS,
+                    },
+                }],
+        },
+    },
+});
+/** Canonical controller-facing employee projection reused across SDK and portal tests. */
+export const EXAMPLE_EMPLOYEE_LIFECYCLE_RECORD = Object.freeze({
+    resourceId: EXAMPLE_EMPLOYEE_CONTROLLER_ACTIVE.resourceId,
+    email: EXAMPLE_EMPLOYEE_CONTROLLER_ACTIVE.email,
+    roleCode: EXAMPLE_EMPLOYEE_CONTROLLER_ACTIVE.role,
+    employeeDid: EXAMPLE_EMPLOYEE_CONTROLLER_ACTIVE.identifier,
+    status: EXAMPLE_EMPLOYEE_CONTROLLER_ACTIVE.status,
+    license: Object.freeze({
+        id: EXAMPLE_LICENSE_ACTIVE_RECORD.id,
+        status: EXAMPLE_LICENSE_ACTIVE_RECORD.status,
+        maxDevices: DEFAULT_LICENSE_DEVICE_ALLOWANCE,
+        activeDevices: EXAMPLE_EMPLOYEE_DEVICE_BINDINGS.filter((binding) => binding.status === DeviceBindingStatuses.Active).length,
+        devices: Object.freeze(EXAMPLE_EMPLOYEE_DEVICE_BINDINGS.map((binding) => Object.freeze({
+            clientId: binding.clientId,
+            name: ('model' in binding.deviceInfo ? binding.deviceInfo.model : undefined)
+                || binding.deviceInfo.clientInstanceId
+                || binding.clientId,
+            status: binding.status,
+        }))),
+    }),
+});
 export function buildExampleLicenseIssueClaims() {
     return Object.freeze(buildLicenseIssueClaims(EXAMPLE_LICENSE_ISSUE_INPUT));
 }

package/dist/examples/shared.d.ts

@@ -86,6 +86,32 @@ export declare const EXAMPLE_OTP_INVITATION_ID: "invitation-demo-001";
 export declare const EXAMPLE_OTP_CHALLENGE_ID: "otp-challenge-demo-001";
 export declare const EXAMPLE_OTP_CODE: "123456";
 export declare const EXAMPLE_DEMO_PORTAL_ID_TOKEN: "eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJkZW1vLXVzZXIiLCJlbWFpbCI6ImRlbW9AZXhhbXBsZS5vcmcifQ.demo";
+export declare const EXAMPLE_ACCOUNT_OWNER_ID: "account-owner-example";
+export declare const EXAMPLE_PROFILE_PIN: "482951";
+export declare const EXAMPLE_JWK_THUMBPRINT_SHA256_URN: "urn:ietf:params:oauth:jwk-thumbprint:sha-256:BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB";
+export declare const EXAMPLE_DCR_REDIRECT_URI: "https://portal.example.org/auth/callback";
+export declare const EXAMPLE_EMPLOYEE_DCR_CLIENT_NAME: "Example Professional Employee";
+export declare const EXAMPLE_ASYNC_SUBMIT_STATUS: 202;
+export declare const EXAMPLE_ASYNC_POLL_STATUS: 200;
+export declare const EXAMPLE_ASYNC_POLL_ATTEMPTS: 1;
+export declare const ExampleHttpStatusText: Readonly<{
+    readonly Ok: "200";
+    readonly Conflict: "409";
+}>;
+export declare const EXAMPLE_ACTIVATION_GRANT_CREATED_AT: "2026-08-13T19:20:00.000Z";
+export declare const EXAMPLE_ACTIVATION_GRANT_EXPIRES_AT: "2027-08-13T19:20:00.000Z";
+/** Wraps any shared response body in the canonical successful async result. */
+export declare function buildExampleSubmitAndPollResult(body: unknown): Readonly<{
+    submit: Readonly<{
+        status: 202;
+        body: Readonly<{}>;
+    }>;
+    poll: Readonly<{
+        status: 200;
+        body: unknown;
+        attempts: 1;
+    }>;
+}>;
 export declare const EXAMPLE_TENANT_ROUTE_CONTEXT: {
     readonly tenantId: "acme-id";
     readonly jurisdiction: "ES";
@@ -255,6 +281,13 @@ export declare const EXAMPLE_CONTENT_ADDRESSED_CONSENT_IDENTIFIER: "zQmYwAPJzv5C
 export declare const EXAMPLE_CONTENT_ADDRESSED_SOURCE_REFERENCE: "zQmWvM9dQmWvM9dQmWvM9dQmWvM9dQmWvM9dQmWvM9dQmWv";
 export declare const EXAMPLE_CONTENT_ADDRESSED_EVIDENCE_RECORD_IDENTIFIER: "zQmXh8Y3mJQ4d7MmX7o9nP5sQ2uT1vW6xY8zA3bC4dE5fG";
 export declare const EXAMPLE_EMPLOYEE_ACTIVATION_CODE: "ACT-001";
+export declare const EXAMPLE_EMPLOYEE_DEVICE_CLIENT_ID_PRIMARY: "client-employee-primary";
+export declare const EXAMPLE_EMPLOYEE_DEVICE_CLIENT_ID_SECONDARY: "client-employee-secondary";
+export declare const EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_PRIMARY: "installation-employee-primary";
+export declare const EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_SECONDARY: "installation-employee-secondary";
+export declare const EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_TERTIARY: "installation-employee-tertiary";
+export declare const EXAMPLE_CLIENT_INSTANCE_UUID: "7f5e8d6c-91f4-4f6d-a29f-8bd42e44f101";
+export declare const EXAMPLE_EMPLOYEE_DEVICE_MODEL_PRIMARY: "Shared browser profile";
 export declare const EXAMPLE_LICENSE_OFFER_ID: "urn:offer:family-003";
 export declare const EXAMPLE_LICENSE_INVALID_OFFER_ID: "urn:offer:invalid-001";
 export declare const EXAMPLE_LICENSE_ACCEPTED_OFFER_ID: "urn:offer:family-003";

package/dist/examples/shared.js

@@ -101,6 +101,31 @@ export const EXAMPLE_OTP_INVITATION_ID = 'invitation-demo-001';
 export const EXAMPLE_OTP_CHALLENGE_ID = 'otp-challenge-demo-001';
 export const EXAMPLE_OTP_CODE = '123456';
 export const EXAMPLE_DEMO_PORTAL_ID_TOKEN = 'eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJkZW1vLXVzZXIiLCJlbWFpbCI6ImRlbW9AZXhhbXBsZS5vcmcifQ.demo';
+export const EXAMPLE_ACCOUNT_OWNER_ID = 'account-owner-example';
+export const EXAMPLE_PROFILE_PIN = '482951';
+export const EXAMPLE_JWK_THUMBPRINT_SHA256_URN = 'urn:ietf:params:oauth:jwk-thumbprint:sha-256:BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB';
+export const EXAMPLE_DCR_REDIRECT_URI = 'https://portal.example.org/auth/callback';
+export const EXAMPLE_EMPLOYEE_DCR_CLIENT_NAME = 'Example Professional Employee';
+export const EXAMPLE_ASYNC_SUBMIT_STATUS = 202;
+export const EXAMPLE_ASYNC_POLL_STATUS = 200;
+export const EXAMPLE_ASYNC_POLL_ATTEMPTS = 1;
+export const ExampleHttpStatusText = Object.freeze({
+    Ok: '200',
+    Conflict: '409',
+});
+export const EXAMPLE_ACTIVATION_GRANT_CREATED_AT = '2026-08-13T19:20:00.000Z';
+export const EXAMPLE_ACTIVATION_GRANT_EXPIRES_AT = '2027-08-13T19:20:00.000Z';
+/** Wraps any shared response body in the canonical successful async result. */
+export function buildExampleSubmitAndPollResult(body) {
+    return Object.freeze({
+        submit: Object.freeze({ status: EXAMPLE_ASYNC_SUBMIT_STATUS, body: Object.freeze({}) }),
+        poll: Object.freeze({
+            status: EXAMPLE_ASYNC_POLL_STATUS,
+            body,
+            attempts: EXAMPLE_ASYNC_POLL_ATTEMPTS,
+        }),
+    });
+}
 export const EXAMPLE_TENANT_ROUTE_CONTEXT = {
     tenantId: EXAMPLE_TENANT_IDENTIFIER,
     jurisdiction: EXAMPLE_JURISDICTION,
@@ -298,6 +323,13 @@ export const EXAMPLE_CONTENT_ADDRESSED_CONSENT_IDENTIFIER = 'zQmYwAPJzv5CZsnAzt8
 export const EXAMPLE_CONTENT_ADDRESSED_SOURCE_REFERENCE = 'zQmWvM9dQmWvM9dQmWvM9dQmWvM9dQmWvM9dQmWvM9dQmWv';
 export const EXAMPLE_CONTENT_ADDRESSED_EVIDENCE_RECORD_IDENTIFIER = 'zQmXh8Y3mJQ4d7MmX7o9nP5sQ2uT1vW6xY8zA3bC4dE5fG';
 export const EXAMPLE_EMPLOYEE_ACTIVATION_CODE = 'ACT-001';
+export const EXAMPLE_EMPLOYEE_DEVICE_CLIENT_ID_PRIMARY = 'client-employee-primary';
+export const EXAMPLE_EMPLOYEE_DEVICE_CLIENT_ID_SECONDARY = 'client-employee-secondary';
+export const EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_PRIMARY = 'installation-employee-primary';
+export const EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_SECONDARY = 'installation-employee-secondary';
+export const EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_TERTIARY = 'installation-employee-tertiary';
+export const EXAMPLE_CLIENT_INSTANCE_UUID = '7f5e8d6c-91f4-4f6d-a29f-8bd42e44f101';
+export const EXAMPLE_EMPLOYEE_DEVICE_MODEL_PRIMARY = 'Shared browser profile';
 export const EXAMPLE_LICENSE_OFFER_ID = 'urn:offer:family-003';
 export const EXAMPLE_LICENSE_INVALID_OFFER_ID = 'urn:offer:invalid-001';
 export const EXAMPLE_LICENSE_ACCEPTED_OFFER_ID = EXAMPLE_LICENSE_OFFER_ID;

package/dist/models/device-license.d.ts

@@ -1,4 +1,4 @@
-import type { DeviceAppType, DeviceUserClass } from '../constants/device';
+import type { DeviceAppType, DeviceBindingStatus, DeviceUserClass } from '../constants/device';
 /**
  * A fingerprint of a specific device, used for binding a license to it.
  */
@@ -24,7 +24,7 @@ export interface DeviceBinding {
     /** Stable application installation fingerprint supplied by the client. */
     clientInstanceId: string;
     /** Current relationship between this installation and the seat. */
-    status: 'active' | 'revoked';
+    status: DeviceBindingStatus;
     /** Device/application metadata captured during DCR. */
     deviceInfo: DeviceInfo;
     activatedAt: number;

package/dist/models/index.d.ts

@@ -19,6 +19,7 @@ export * from './dataspace-discovery';
 export * from './dataspace-discovery-defaults';
 export * from './dataspace-protocol';
 export * from './device-license';
+export * from './organization-employee-lifecycle';
 export * from './did';
 export * from './fhir-documents';
 export * from './gaia-x';

package/dist/models/index.js

@@ -19,6 +19,7 @@ export * from './dataspace-discovery.js';
 export * from './dataspace-discovery-defaults.js';
 export * from './dataspace-protocol.js';
 export * from './device-license.js';
+export * from './organization-employee-lifecycle.js';
 export * from './did.js';
 export * from './fhir-documents.js';
 export * from './gaia-x.js';

package/dist/models/organization-employee-lifecycle.d.ts

@@ -0,0 +1,45 @@
+import type { DeviceBindingStatus } from '../constants/device';
+import type { EmployeeActivationGrantVersion, EmployeeDirectoryStatus } from '../constants/employee-lifecycle';
+/** One installation in the controller-facing employee lifecycle projection. */
+export type OrganizationEmployeeDeviceRecord = Readonly<{
+    clientId: string;
+    name: string;
+    status: DeviceBindingStatus;
+}>;
+/** License state attached to one employee directory entry. */
+export type OrganizationEmployeeLicenseRecord = Readonly<{
+    id: string;
+    status: string;
+    maxDevices: number;
+    activeDevices: number;
+    devices: ReadonlyArray<OrganizationEmployeeDeviceRecord>;
+}>;
+/** Product-neutral employee, seat and installation lifecycle projection. */
+export type OrganizationEmployeeLifecycleRecord = Readonly<{
+    resourceId: string;
+    email: string;
+    roleCode: string;
+    employeeDid: string;
+    status: EmployeeDirectoryStatus;
+    license?: OrganizationEmployeeLicenseRecord;
+}>;
+/** Typed wire request for revoking one installation without releasing its seat. */
+export type EmployeeDeviceRevocationTarget = Readonly<{
+    licenseId: string;
+    clientId: string;
+}>;
+/** Tenant routing metadata bound to an employee activation credential digest. */
+export type EmployeeActivationGrant = Readonly<{
+    version: EmployeeActivationGrantVersion;
+    employeeDid: string;
+    employeeRoleCode: string;
+    employeeActorIdentifier: string;
+    providerDid: string;
+    routeContext: Readonly<{
+        tenantId: string;
+        jurisdiction: string;
+        sector: string;
+    }>;
+    createdAt: string;
+    expiresAt: string;
+}>;

package/dist/models/organization-employee-lifecycle.js

@@ -0,0 +1 @@
+export {};

package/dist/utils/index.d.ts

@@ -67,6 +67,7 @@ export * from './individual-organization-claims';
 export * from './inter-tenant-access-contract';
 export * from './legal-organization-onboarding-editor';
 export * from './organization-lifecycle';
+export * from './organization-employee-lifecycle';
 export * from './organization-did-binding';
 export * from './organization-authorization-urn';
 export * from './individual-organization-lifecycle';

package/dist/utils/index.js

@@ -67,6 +67,7 @@ export * from './individual-organization-claims.js';
 export * from './inter-tenant-access-contract.js';
 export * from './legal-organization-onboarding-editor.js';
 export * from './organization-lifecycle.js';
+export * from './organization-employee-lifecycle.js';
 export * from './organization-did-binding.js';
 export * from './organization-authorization-urn.js';
 export * from './individual-organization-lifecycle.js';

package/dist/utils/jwk-thumbprint.d.ts

@@ -38,6 +38,8 @@ export declare function computeRfc7638JwkThumbprint(jwk: ThumbprintableJwk): str
  * `urn:ietf:params:oauth:jwk-thumbprint:sha-256:<base64url>`
  */
 export declare function toJwkThumbprintSha256Urn(jwk: ThumbprintableJwk): string;
+/** True only for an RFC 9278 SHA-256 JWK thumbprint URI. */
+export declare function isJwkThumbprintSha256Urn(value: unknown): value is string;
 /**
  * Returns a public JWK whose `kid` is derived exclusively from its public key
  * material. Caller-provided aliases are deliberately replaced so DID methods,

package/dist/utils/jwk-thumbprint.js

@@ -55,6 +55,14 @@ export function computeRfc7638JwkThumbprint(jwk) {
 export function toJwkThumbprintSha256Urn(jwk) {
     return `${UrnPrefixes.JwkThumbprintSha256KeyId}${computeRfc7638JwkThumbprint(jwk)}`;
 }
+/** True only for an RFC 9278 SHA-256 JWK thumbprint URI. */
+export function isJwkThumbprintSha256Urn(value) {
+    const normalized = typeof value === 'string' ? value.trim() : '';
+    if (!normalized.startsWith(UrnPrefixes.JwkThumbprintSha256KeyId))
+        return false;
+    const thumbprint = normalized.slice(UrnPrefixes.JwkThumbprintSha256KeyId.length);
+    return /^[A-Za-z0-9_-]{43}$/.test(thumbprint);
+}
 /**
  * Returns a public JWK whose `kid` is derived exclusively from its public key
  * material. Caller-provided aliases are deliberately replaced so DID methods,

package/dist/utils/license.js

@@ -1,4 +1,4 @@
-import { DeviceAppTypes, DeviceUserClasses } from '../constants/device.js';
+import { DeviceAppTypes, DeviceBindingStatuses, DeviceUserClasses } from '../constants/device.js';
 import { ClaimsIndividualProductSchemaorg, ClaimsOfferSchemaorg, ClaimsPersonSchemaorg, } from '../constants/schemaorg.js';
 /** Default simultaneous installation allowance for one professional/member seat. */
 export const DEFAULT_LICENSE_DEVICE_ALLOWANCE = 2;
@@ -13,7 +13,7 @@ export function resolveLicenseDeviceAllowance(license) {
  */
 export function listActiveLicenseDeviceBindings(license) {
     if (Array.isArray(license.deviceBindings)) {
-        return license.deviceBindings.filter((binding) => binding.status === 'active');
+        return license.deviceBindings.filter((binding) => binding.status === DeviceBindingStatuses.Active);
     }
     const clientId = String(license.deviceId || '').trim();
     if (!clientId)
@@ -22,7 +22,7 @@ export function listActiveLicenseDeviceBindings(license) {
     return [{
             clientId,
             clientInstanceId: deviceInfo.clientInstanceId || clientId,
-            status: 'active',
+            status: DeviceBindingStatuses.Active,
             deviceInfo,
             activatedAt: Number(license.activatedAt || 0),
         }];

package/dist/utils/organization-employee-lifecycle.d.ts

@@ -0,0 +1,12 @@
+import type { EmployeeDeviceRevocationTarget, OrganizationEmployeeLifecycleRecord } from '../models/organization-employee-lifecycle';
+/** Builds the exact identity/auth revoke request body from a typed target. */
+export declare function buildEmployeeDeviceRevocationBody(target: EmployeeDeviceRevocationTarget): Readonly<Record<string, string>>;
+/** Reads an employee activation credential from canonical and legacy GW envelopes. */
+export declare function readEmployeeActivationCode(value: unknown): string;
+/** Extracts GW search rows regardless of async job envelope depth. */
+export declare function extractGwSearchResources(value: unknown): ReadonlyArray<Record<string, unknown>>;
+/** Combines employee directory and license search results into one typed view. */
+export declare function projectOrganizationEmployeeLifecycle(input: Readonly<{
+    employeeResponse: unknown;
+    licenseResponse: unknown;
+}>): OrganizationEmployeeLifecycleRecord[];

package/dist/utils/organization-employee-lifecycle.js

@@ -0,0 +1,125 @@
+import { ClaimsIndividualProductSchemaorg, ClaimsPersonSchemaorg } from '../constants/schemaorg.js';
+import { DeviceBindingStatuses } from '../constants/device.js';
+import { EmployeeDirectoryStatuses } from '../constants/employee-lifecycle.js';
+import { IdentityAuthRequestFields, IdentityAuthResponseEntryTypes, } from '../constants/identity-auth.js';
+import { DEFAULT_LICENSE_DEVICE_ALLOWANCE } from './license.js';
+/** Builds the exact identity/auth revoke request body from a typed target. */
+export function buildEmployeeDeviceRevocationBody(target) {
+    return Object.freeze({
+        [IdentityAuthRequestFields.LicenseId]: target.licenseId,
+        [IdentityAuthRequestFields.ClientId]: target.clientId,
+    });
+}
+/** Reads an employee activation credential from canonical and legacy GW envelopes. */
+export function readEmployeeActivationCode(value) {
+    for (const candidate of listNestedRecords(value)) {
+        if (candidate.type === IdentityAuthResponseEntryTypes.LicenseIssued) {
+            const issuedId = text(candidate.id);
+            if (issuedId)
+                return issuedId;
+        }
+        const claims = record(candidate.claims) || record(record(candidate.meta)?.claims);
+        const serial = text(claims?.[ClaimsIndividualProductSchemaorg.serialNumber]);
+        if (serial)
+            return serial;
+    }
+    return '';
+}
+/** Extracts GW search rows regardless of async job envelope depth. */
+export function extractGwSearchResources(value) {
+    for (const candidate of listNestedRecords(value)) {
+        const data = record(candidate.resource)?.data || candidate.data;
+        if (Array.isArray(data))
+            return data.map(record).filter(isRecord);
+    }
+    return [];
+}
+/** Combines employee directory and license search results into one typed view. */
+export function projectOrganizationEmployeeLifecycle(input) {
+    const licenses = extractGwSearchResources(input.licenseResponse);
+    return extractGwSearchResources(input.employeeResponse).map((employee) => {
+        const claims = record(employee.claims) || record(record(employee.meta)?.claims) || {};
+        const resourceId = text(employee.id);
+        const employeeDid = text(claims[ClaimsPersonSchemaorg.identifier]);
+        const license = licenses.find((candidate) => {
+            const meta = record(candidate.meta) || {};
+            const subjectId = text(meta.subjectId);
+            return subjectId === resourceId || subjectId === employeeDid;
+        });
+        const status = normalizeEmployeeDirectoryStatus(text(employee.status) || text(record(employee.meta)?.status));
+        if (!license)
+            return {
+                resourceId,
+                email: text(claims[ClaimsPersonSchemaorg.email]),
+                roleCode: text(claims[ClaimsPersonSchemaorg.hasOccupationalRoleValue]),
+                employeeDid,
+                status,
+            };
+        const meta = record(license.meta) || {};
+        const bindings = Array.isArray(meta.deviceBindings) ? meta.deviceBindings.map(record).filter(isRecord) : [];
+        const devices = bindings.map((binding) => {
+            const info = record(binding.deviceInfo) || {};
+            const clientId = text(binding.clientId);
+            return {
+                clientId,
+                name: text(info.model) || text(info.clientInstanceId) || clientId,
+                status: binding.status === DeviceBindingStatuses.Revoked
+                    ? DeviceBindingStatuses.Revoked
+                    : DeviceBindingStatuses.Active,
+            };
+        }).filter((device) => Boolean(device.clientId));
+        return {
+            resourceId,
+            email: text(claims[ClaimsPersonSchemaorg.email]),
+            roleCode: text(claims[ClaimsPersonSchemaorg.hasOccupationalRoleValue]),
+            employeeDid,
+            status,
+            license: {
+                id: text(license.id),
+                status: text(meta.status),
+                maxDevices: positiveInteger(meta.maxDevices) || DEFAULT_LICENSE_DEVICE_ALLOWANCE,
+                activeDevices: devices.filter((device) => device.status === DeviceBindingStatuses.Active).length,
+                devices,
+            },
+        };
+    }).filter((employee) => Boolean(employee.resourceId));
+}
+function normalizeEmployeeDirectoryStatus(value) {
+    return Object.values(EmployeeDirectoryStatuses).includes(value)
+        ? value
+        : EmployeeDirectoryStatuses.Unknown;
+}
+function listNestedRecords(root) {
+    const result = [];
+    const pending = [root];
+    const visited = new Set();
+    while (pending.length > 0) {
+        const value = pending.shift();
+        if (!value || typeof value !== 'object' || visited.has(value))
+            continue;
+        visited.add(value);
+        if (Array.isArray(value)) {
+            pending.push(...value);
+            continue;
+        }
+        const item = value;
+        result.push(item);
+        pending.push(...Object.values(item));
+    }
+    return result;
+}
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function isRecord(value) {
+    return Boolean(value);
+}
+function text(value) {
+    return typeof value === 'string' ? value.trim() : '';
+}
+function positiveInteger(value) {
+    const parsed = Number(value);
+    return Number.isInteger(parsed) && parsed > 0 ? parsed : undefined;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-common-utils-ts",
-  "version": "2.5.3",
+  "version": "2.5.4",
   "publishConfig": {
     "access": "public"
   },