gdc-common-utils-ts 2.5.3 → 2.5.6

package/dist/constants/employee-lifecycle.js

@@ -0,0 +1,48 @@
+/** Employee directory states exposed by organization lifecycle projections. */
+export const EmployeeDirectoryStatuses = Object.freeze({
+    Active: 'active',
+    Inactive: 'inactive',
+    Purged: 'purged',
+    Unknown: 'unknown',
+});
+/** Controller actions supported by the reusable employee lifecycle service. */
+export const EmployeeLifecycleActions = Object.freeze({
+    Disable: 'disable',
+    Purge: 'purge',
+    RevokeDevice: 'revoke_device',
+});
+/** Read-only API actions kept separate from mutating employee lifecycle actions. */
+export const EmployeeLifecycleQueryActions = Object.freeze({
+    List: 'list',
+});
+/** Version tag for routing metadata stored outside the high-entropy GW credential. */
+export const EmployeeActivationGrantVersions = Object.freeze({
+    V1: 'employee-activation-grant-v1',
+});
+/** Shared durable-storage layout for hashed employee activation routing grants. */
+export const EmployeeActivationGrantStorage = Object.freeze({
+    ScopedLayout: 'scoped-v2',
+    CollectionSegment: 'employee-activation-grants',
+    ScopeSeparator: '__',
+    DefaultTtlMs: 365 * 24 * 60 * 60 * 1_000,
+});
+/** JSON field names shared by employee lifecycle portal adapters. */
+export const OrganizationEmployeeApiFields = Object.freeze({
+    Action: 'action',
+    ProfileId: 'profileId',
+    Pin: 'pin',
+    PasskeyAccessToken: 'passkeyAccessToken',
+    ResourceId: 'resourceId',
+    LicenseId: 'licenseId',
+    ClientId: 'clientId',
+    ActivationCode: 'activationCode',
+    ClientInstanceId: 'clientInstanceId',
+    Email: 'email',
+    Role: 'role',
+});
+/** Stable employee portal error identifiers. */
+export const OrganizationEmployeePortalErrors = Object.freeze({
+    InvitationFailed: 'invitation_failed',
+    LifecycleFailed: 'employee_lifecycle_failed',
+    ActivationFailed: 'employee_activation_failed',
+});

package/dist/constants/healthcare.d.ts

@@ -1705,6 +1705,8 @@ export declare function getHealthcareSectionsByFamily(family: HealthcareSectionF
 export declare const HealthcareConsentPurposes: Readonly<{
     readonly Treatment: "TREAT";
     readonly EmergencyTreatment: "ETREAT";
+    /** HL7 v3 ActReason: healthcare research. */
+    readonly Research: "HRESCH";
     readonly CareManagement: "CAREMGT";
     readonly Operations: "HOPERAT";
     readonly PatientAdministration: "PATADMIN";

package/dist/constants/healthcare.js

@@ -337,6 +337,8 @@ export function getHealthcareSectionsByFamily(family) {
 export const HealthcareConsentPurposes = Object.freeze({
     Treatment: 'TREAT',
     EmergencyTreatment: 'ETREAT',
+    /** HL7 v3 ActReason: healthcare research. */
+    Research: 'HRESCH',
     CareManagement: 'CAREMGT',
     Operations: 'HOPERAT',
     PatientAdministration: 'PATADMIN',

package/dist/constants/http.d.ts

@@ -0,0 +1,28 @@
+/** Numeric HTTP status values shared by route adapters and tests. */
+export declare const HttpStatusCodes: Readonly<{
+    readonly Ok: 200;
+    readonly Created: 201;
+    readonly BadRequest: 400;
+    readonly Unauthorized: 401;
+    readonly Forbidden: 403;
+    readonly NotFound: 404;
+    readonly Conflict: 409;
+    readonly Gone: 410;
+    readonly InternalServerError: 500;
+    readonly ServiceUnavailable: 503;
+}>;
+/** HTTP methods used by SDK and portal request builders. */
+export declare const HttpRequestMethods: Readonly<{
+    readonly Get: "GET";
+    readonly Post: "POST";
+    readonly Patch: "PATCH";
+}>;
+/** Canonical HTTP header names. */
+export declare const HttpHeaderNames: Readonly<{
+    readonly Authorization: "authorization";
+    readonly ContentType: "content-type";
+}>;
+/** Media types shared by JSON route adapters. */
+export declare const HttpMediaTypes: Readonly<{
+    readonly Json: "application/json";
+}>;

package/dist/constants/http.js

@@ -0,0 +1,28 @@
+/** Numeric HTTP status values shared by route adapters and tests. */
+export const HttpStatusCodes = Object.freeze({
+    Ok: 200,
+    Created: 201,
+    BadRequest: 400,
+    Unauthorized: 401,
+    Forbidden: 403,
+    NotFound: 404,
+    Conflict: 409,
+    Gone: 410,
+    InternalServerError: 500,
+    ServiceUnavailable: 503,
+});
+/** HTTP methods used by SDK and portal request builders. */
+export const HttpRequestMethods = Object.freeze({
+    Get: 'GET',
+    Post: 'POST',
+    Patch: 'PATCH',
+});
+/** Canonical HTTP header names. */
+export const HttpHeaderNames = Object.freeze({
+    Authorization: 'authorization',
+    ContentType: 'content-type',
+});
+/** Media types shared by JSON route adapters. */
+export const HttpMediaTypes = Object.freeze({
+    Json: 'application/json',
+});

package/dist/constants/identity-auth.d.ts

@@ -0,0 +1,57 @@
+/** Canonical identity/auth route actions shared by gateways, SDKs and portals. */
+export declare const IdentityAuthActions: Readonly<{
+    readonly Exchange: "_exchange";
+    readonly ExchangeResponse: "_exchange-response";
+    readonly Dcr: "_dcr";
+    readonly DcrResponse: "_dcr-response";
+    readonly Issue: "_issue";
+    readonly IssueResponse: "_issue-response";
+    readonly Revoke: "_revoke";
+    readonly RevokeResponse: "_revoke-response";
+    readonly Search: "_search";
+    readonly SearchResponse: "_search-response";
+}>;
+/** Canonical identity/auth route segments shared by all products. */
+export declare const IdentityAuthRouteSegments: Readonly<{
+    readonly Host: "host";
+    readonly Version: "v1";
+    readonly Section: "identity";
+    readonly Format: "auth";
+}>;
+/** Wire-level request keys used by identity/auth operations. */
+export declare const IdentityAuthRequestFields: Readonly<{
+    readonly SubjectToken: "subject_token";
+    readonly ClientInstanceId: "client_instance_id";
+    readonly LicenseId: "license_id";
+    readonly ClientId: "client_id";
+    readonly Code: "code";
+}>;
+/** Response keys accepted from token exchange during the compatibility window. */
+export declare const IdentityAuthResponseFields: Readonly<{
+    readonly InitialAccessToken: "initial_access_token";
+    readonly AccessToken: "access_token";
+}>;
+/** DCR metadata keys used to derive and register one installation identity. */
+export declare const IdentityDcrMetadataFields: Readonly<{
+    readonly ExtendedDeviceInfo: "ext_device_info";
+    readonly RedirectUris: "redirect_uris";
+    readonly Jwks: "jwks";
+    readonly SoftwareId: "software_id";
+    readonly ApplicationType: "application_type";
+    readonly ClientName: "client_name";
+    readonly ActorDid: "actor_did";
+    readonly ProfileDid: "profile_did";
+}>;
+/** Device metadata keys nested below `ext_device_info`. */
+export declare const IdentityDeviceInfoFields: Readonly<{
+    readonly DeviceId: "device_id";
+}>;
+/** Stable entry type emitted by license issuance responses. */
+export declare const IdentityAuthResponseEntryTypes: Readonly<{
+    readonly LicenseIssued: "License:Issued";
+    readonly DeviceRevoked: "Device:Revoked";
+}>;
+/** DIDComm response type values emitted by identity/auth managers. */
+export declare const IdentityAuthResponseTypes: Readonly<{
+    readonly DeviceRevoke: "device-revoke-response";
+}>;

package/dist/constants/identity-auth.js

@@ -0,0 +1,57 @@
+/** Canonical identity/auth route actions shared by gateways, SDKs and portals. */
+export const IdentityAuthActions = Object.freeze({
+    Exchange: '_exchange',
+    ExchangeResponse: '_exchange-response',
+    Dcr: '_dcr',
+    DcrResponse: '_dcr-response',
+    Issue: '_issue',
+    IssueResponse: '_issue-response',
+    Revoke: '_revoke',
+    RevokeResponse: '_revoke-response',
+    Search: '_search',
+    SearchResponse: '_search-response',
+});
+/** Canonical identity/auth route segments shared by all products. */
+export const IdentityAuthRouteSegments = Object.freeze({
+    Host: 'host',
+    Version: 'v1',
+    Section: 'identity',
+    Format: 'auth',
+});
+/** Wire-level request keys used by identity/auth operations. */
+export const IdentityAuthRequestFields = Object.freeze({
+    SubjectToken: 'subject_token',
+    ClientInstanceId: 'client_instance_id',
+    LicenseId: 'license_id',
+    ClientId: 'client_id',
+    Code: 'code',
+});
+/** Response keys accepted from token exchange during the compatibility window. */
+export const IdentityAuthResponseFields = Object.freeze({
+    InitialAccessToken: 'initial_access_token',
+    AccessToken: 'access_token',
+});
+/** DCR metadata keys used to derive and register one installation identity. */
+export const IdentityDcrMetadataFields = Object.freeze({
+    ExtendedDeviceInfo: 'ext_device_info',
+    RedirectUris: 'redirect_uris',
+    Jwks: 'jwks',
+    SoftwareId: 'software_id',
+    ApplicationType: 'application_type',
+    ClientName: 'client_name',
+    ActorDid: 'actor_did',
+    ProfileDid: 'profile_did',
+});
+/** Device metadata keys nested below `ext_device_info`. */
+export const IdentityDeviceInfoFields = Object.freeze({
+    DeviceId: 'device_id',
+});
+/** Stable entry type emitted by license issuance responses. */
+export const IdentityAuthResponseEntryTypes = Object.freeze({
+    LicenseIssued: 'License:Issued',
+    DeviceRevoked: 'Device:Revoked',
+});
+/** DIDComm response type values emitted by identity/auth managers. */
+export const IdentityAuthResponseTypes = Object.freeze({
+    DeviceRevoke: 'device-revoke-response',
+});

package/dist/constants/index.d.ts

@@ -8,6 +8,10 @@ export * from './dataspace-discovery';
 export * from './dataspace-protocol';
 export * from './didcomm';
 export * from './device';
+export * from './employee-lifecycle';
+export * from './identity-auth';
+export * from './http';
+export * from './organization-application';
 export * from './did-services';
 export * from './eu-countries';
 export * from './fhir-code-systems';

package/dist/constants/index.js

@@ -8,6 +8,10 @@ export * from './dataspace-discovery.js';
 export * from './dataspace-protocol.js';
 export * from './didcomm.js';
 export * from './device.js';
+export * from './employee-lifecycle.js';
+export * from './identity-auth.js';
+export * from './http.js';
+export * from './organization-application.js';
 export * from './did-services.js';
 export * from './eu-countries.js';
 export * from './fhir-code-systems.js';

package/dist/constants/organization-application.d.ts

@@ -0,0 +1,27 @@
+/** Actions accepted by the reusable organization-registration review route. */
+export declare const OrganizationRegistrationReviewActions: Readonly<{
+    readonly MarkPostalDelivered: "mark_postal_delivered";
+    readonly IssuePostalLicense: "issue_postal_license";
+    readonly DownloadDraft: "download_draft";
+    readonly Authorize: "authorize";
+    readonly Reject: "reject";
+}>;
+export type OrganizationRegistrationReviewAction = typeof OrganizationRegistrationReviewActions[keyof typeof OrganizationRegistrationReviewActions];
+/** Narrows untrusted request input to one supported review action. */
+export declare function isOrganizationRegistrationReviewAction(value: unknown): value is OrganizationRegistrationReviewAction;
+/** Stable error identifiers shared by route handlers, services and tests. */
+export declare const OrganizationRegistrationErrors: Readonly<{
+    readonly InvalidReviewAction: "invalid_review_action";
+    readonly ApplicationNotReviewable: "application_not_reviewable";
+    readonly AuthorizationCredentialRequired: "organization_authorization_credential_required";
+    readonly ReviewFailed: "review_failed";
+    readonly InvalidOrganization: "invalid_organization";
+    readonly ApplicationFailed: "application_failed";
+}>;
+/** Default and accepted authorization validity window for registration evidence. */
+export declare const OrganizationRegistrationValidity: Readonly<{
+    readonly DefaultDays: 180;
+    readonly MinimumDays: 1;
+    readonly MaximumDays: 730;
+    readonly MillisecondsPerDay: 86400000;
+}>;

package/dist/constants/organization-application.js

@@ -0,0 +1,29 @@
+/** Actions accepted by the reusable organization-registration review route. */
+export const OrganizationRegistrationReviewActions = Object.freeze({
+    MarkPostalDelivered: 'mark_postal_delivered',
+    IssuePostalLicense: 'issue_postal_license',
+    DownloadDraft: 'download_draft',
+    Authorize: 'authorize',
+    Reject: 'reject',
+});
+/** Narrows untrusted request input to one supported review action. */
+export function isOrganizationRegistrationReviewAction(value) {
+    return typeof value === 'string'
+        && Object.values(OrganizationRegistrationReviewActions).includes(value);
+}
+/** Stable error identifiers shared by route handlers, services and tests. */
+export const OrganizationRegistrationErrors = Object.freeze({
+    InvalidReviewAction: 'invalid_review_action',
+    ApplicationNotReviewable: 'application_not_reviewable',
+    AuthorizationCredentialRequired: 'organization_authorization_credential_required',
+    ReviewFailed: 'review_failed',
+    InvalidOrganization: 'invalid_organization',
+    ApplicationFailed: 'application_failed',
+});
+/** Default and accepted authorization validity window for registration evidence. */
+export const OrganizationRegistrationValidity = Object.freeze({
+    DefaultDays: 180,
+    MinimumDays: 1,
+    MaximumDays: 730,
+    MillisecondsPerDay: 86_400_000,
+});

package/dist/constants/verifiable-credentials.d.ts

@@ -62,8 +62,12 @@ export declare const IndividualCredentialTypes: Readonly<{
  */
 export declare const ContractCredentialTypes: Readonly<{
     InterTenantAccessContractCredential: "InterTenantAccessContractCredential";
-    /** Host/ICA-issued evidence that permits one controller to submit tenant registration. */
-    OrganizationRegistrationAuthorizationCredential: "OrganizationRegistrationAuthorizationCredential";
+    /** Reviewer-issued admission evidence that is valid only in Test Network. */
+    OrganizationTestNetworkCredential: "OrganizationTestNetworkCredential";
+}>;
+/** Marker added to normal domain credentials issued only for Test Network. */
+export declare const EnvironmentCredentialTypes: Readonly<{
+    TestNetworkCredential: "TestNetworkCredential";
 }>;
 export declare const ORGANIZATION_ACTIVATION_VC_TYPES: readonly ("OrganizationCredential" | "LegalOrganizationCredential")[];
 export declare const REPRESENTATIVE_ACTIVATION_VC_TYPES: readonly ("LegalRepresentativeCredential" | "PersonCredential")[];

package/dist/constants/verifiable-credentials.js

@@ -64,8 +64,12 @@ export const IndividualCredentialTypes = Object.freeze({
  */
 export const ContractCredentialTypes = Object.freeze({
     InterTenantAccessContractCredential: 'InterTenantAccessContractCredential',
-    /** Host/ICA-issued evidence that permits one controller to submit tenant registration. */
-    OrganizationRegistrationAuthorizationCredential: 'OrganizationRegistrationAuthorizationCredential',
+    /** Reviewer-issued admission evidence that is valid only in Test Network. */
+    OrganizationTestNetworkCredential: 'OrganizationTestNetworkCredential',
+});
+/** Marker added to normal domain credentials issued only for Test Network. */
+export const EnvironmentCredentialTypes = Object.freeze({
+    TestNetworkCredential: 'TestNetworkCredential',
 });
 export const ORGANIZATION_ACTIVATION_VC_TYPES = Object.freeze([
     ActivationCredentialTypes.OrganizationCredential,

package/dist/examples/inter-tenant-access-contract.d.ts

@@ -11,7 +11,7 @@
  * - consumer = the foreign tenant asking for access
  * - capability = the allowed technical scope, for example
  *   `organization/Composition.rs`
- * - purpose = the allowed business/legal reason, for example `RESEARCH`
+ * - purpose = the allowed HL7 v3 ActReason, for example `HRESCH`
  * - instantiates-uri = primary agreement artifact URL/CID, typically the
  *   signed PDF of the contract itself
  * - invoice/payment evidence is intentionally not modeled as a mandatory core
@@ -21,7 +21,7 @@ export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_ID: "urn:uuid:inter-te
 export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_TYPE: "https://example.org/fhir/CodeSystem/contract-type|data-sharing";
 export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_VALID_FROM: "2026-06-29T00:00:00.000Z";
 export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_VALID_UNTIL: "2027-06-29T00:00:00.000Z";
-export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_PURPOSE: "RESEARCH";
+export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_PURPOSE: "HRESCH";
 export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_SCOPE: "organization/Composition.rs";
 export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_SUBJECT_DID: "did:web:api.acme.org:individual:123";
 export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_SECTION: "LOINC|48765-2";
@@ -40,7 +40,7 @@ export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CLAIMS: Readonly<{
     readonly "Contract.provider-controller": "did:web:people.acme.org:controllers:primary";
     readonly "Contract.consumer-controller": "did:web:people.lab.org:controllers:primary";
     readonly "Contract.security-label": "organization/Composition.rs";
-    readonly "Contract.term-type": "RESEARCH";
+    readonly "Contract.term-type": "HRESCH";
     readonly "Contract.instantiates-uri": "https://portal.example.org/files/contracts/inter-tenant-contract-acme-lab-001.pdf";
 }>;
 export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_RESOURCE: Readonly<{
@@ -61,7 +61,7 @@ export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CONTEXT: Readonly<{
     readonly requestedScope: "organization/Composition.rs";
     readonly requestedSection: "LOINC|48765-2";
     readonly smartScope: "organization/Composition.rs?subject=did:web:api.acme.org:individual:123&section=LOINC|48765-2";
-    readonly purpose: "RESEARCH";
+    readonly purpose: "HRESCH";
 }>;
 export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_PROVIDER_ORGANIZATION_URN: string;
 export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CONSUMER_ORGANIZATION_URN: string;
@@ -83,7 +83,7 @@ export declare const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_CONTEXT_WITH_URNS: Rea
     readonly requestedScope: "organization/Composition.rs";
     readonly requestedSection: "LOINC|48765-2";
     readonly smartScope: "organization/Composition.rs?subject=did:web:api.acme.org:individual:123&section=LOINC|48765-2";
-    readonly purpose: "RESEARCH";
+    readonly purpose: "HRESCH";
 }>;
 /**
  * Consent-style organization-to-employee delegation rule reused for the
@@ -103,7 +103,7 @@ export declare const EXAMPLE_INTER_TENANT_EMPLOYEE_CONTRACT_AUTHORIZATION_CONSEN
     readonly "Consent.actor-identifier": string;
     readonly "Consent.actor-role": "ISCO-08|2211";
     readonly "Consent.decision": "permit";
-    readonly "Consent.purpose": "RESEARCH";
+    readonly "Consent.purpose": "HRESCH";
     readonly "Consent.action": "organization/Composition.rs";
     readonly "Consent.source-reference": string | undefined;
     readonly "Consent.date": "2026-06-29T00:00:00.000Z";
@@ -117,7 +117,7 @@ export declare const EXAMPLE_INTER_TENANT_PROVIDER_CONTRACT_AUTHORIZATION_CONSEN
     readonly "Consent.actor-identifier": string;
     readonly "Consent.actor-role": "organization";
     readonly "Consent.decision": "permit";
-    readonly "Consent.purpose": "RESEARCH";
+    readonly "Consent.purpose": "HRESCH";
     readonly "Consent.action": "organization/Composition.rs";
     readonly "Consent.source-reference": string | undefined;
     readonly "Consent.date": "2026-06-29T00:00:00.000Z";

package/dist/examples/inter-tenant-access-contract.js

@@ -1,5 +1,6 @@
 // Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
 import { ServiceCapability } from '../constants/service-capabilities.js';
+import { HealthcareConsentPurposes } from '../constants/healthcare.js';
 import { DataspaceSectors } from '../constants/sectors.js';
 import { ClaimConsent } from '../models/consent-rule.js';
 import { ClaimInterTenantAccessContract } from '../models/inter-tenant-access-contract.js';
@@ -20,7 +21,7 @@ import { EXAMPLE_API_ORGANIZATION_DID, EXAMPLE_CONTROLLER_DID, EXAMPLE_HEALTHCAR
  * - consumer = the foreign tenant asking for access
  * - capability = the allowed technical scope, for example
  *   `organization/Composition.rs`
- * - purpose = the allowed business/legal reason, for example `RESEARCH`
+ * - purpose = the allowed HL7 v3 ActReason, for example `HRESCH`
  * - instantiates-uri = primary agreement artifact URL/CID, typically the
  *   signed PDF of the contract itself
  * - invoice/payment evidence is intentionally not modeled as a mandatory core
@@ -30,7 +31,7 @@ export const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_ID = 'urn:uuid:inter-tenant-ac
 export const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_TYPE = 'https://example.org/fhir/CodeSystem/contract-type|data-sharing';
 export const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_VALID_FROM = '2026-06-29T00:00:00.000Z';
 export const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_VALID_UNTIL = '2027-06-29T00:00:00.000Z';
-export const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_PURPOSE = 'RESEARCH';
+export const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_PURPOSE = HealthcareConsentPurposes.Research;
 export const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_SCOPE = ServiceCapability.IndexReader;
 export const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_SUBJECT_DID = 'did:web:api.acme.org:individual:123';
 export const EXAMPLE_INTER_TENANT_ACCESS_CONTRACT_SECTION = 'LOINC|48765-2';

package/dist/examples/license.d.ts

@@ -1,3 +1,43 @@
+export declare const EXAMPLE_EMPLOYEE_DEVICE_BINDINGS: readonly [Readonly<{
+    clientId: "client-employee-primary";
+    clientInstanceId: "installation-employee-primary";
+    status: "active";
+    deviceInfo: Readonly<{
+        clientInstanceId: "installation-employee-primary";
+        model: "Shared browser profile";
+    }>;
+    activatedAt: 1786570800;
+}>, Readonly<{
+    clientId: "client-employee-secondary";
+    clientInstanceId: "installation-employee-secondary";
+    status: "revoked";
+    deviceInfo: Readonly<{
+        clientInstanceId: "installation-employee-secondary";
+    }>;
+    activatedAt: 1786570900;
+    revokedAt: 1786571000;
+}>];
+/** Two simultaneously active installations used to test the default allowance. */
+export declare const EXAMPLE_EMPLOYEE_ACTIVE_DEVICE_BINDINGS: readonly Readonly<{
+    status: "active";
+    revokedAt: undefined;
+    clientId: "client-employee-primary";
+    clientInstanceId: "installation-employee-primary";
+    deviceInfo: Readonly<{
+        clientInstanceId: "installation-employee-primary";
+        model: "Shared browser profile";
+    }>;
+    activatedAt: 1786570800;
+} | {
+    status: "active";
+    revokedAt: undefined;
+    clientId: "client-employee-secondary";
+    clientInstanceId: "installation-employee-secondary";
+    deviceInfo: Readonly<{
+        clientInstanceId: "installation-employee-secondary";
+    }>;
+    activatedAt: 1786570900;
+}>[];
 export declare const EXAMPLE_LICENSE_SEAT_UUIDS: readonly ["8a8a5e1b-0d8e-4a7c-8c39-3b8034440001", "8a8a5e1b-0d8e-4a7c-8c39-3b8034440002"];
 export declare const EXAMPLE_LICENSE_ISSUE_INPUT: Readonly<{
     readonly email: "controller@acme.org";
@@ -67,6 +107,77 @@ export declare const EXAMPLE_LICENSE_LIST_RESPONSE_BODY: Readonly<{
         };
     }];
 }>;
+/** Shared async GW response for a controller-issued employee activation credential. */
+export declare const EXAMPLE_LICENSE_ISSUE_RESPONSE_BODY: Readonly<{
+    readonly body: {
+        readonly data: readonly [{
+            readonly resource: {
+                readonly data: readonly [{
+                    readonly type: "License:Issued";
+                    readonly id: "ACT-001";
+                    readonly meta: {
+                        readonly claims: {
+                            readonly "org.schema.IndividualProduct.serialNumber": "ACT-001";
+                        };
+                    };
+                }];
+            };
+        }];
+    };
+}>;
+/** Shared license search response containing the default two-installation state. */
+export declare const EXAMPLE_LICENSE_LIST_RESPONSE_BODY_WITH_DEVICES: Readonly<{
+    readonly body: {
+        readonly resource: {
+            readonly data: readonly [{
+                readonly id: "8a8a5e1b-0d8e-4a7c-8c39-3b8034440001";
+                readonly meta: {
+                    readonly status: "active";
+                    readonly subjectId: string;
+                    readonly maxDevices: 2;
+                    readonly deviceBindings: readonly [Readonly<{
+                        clientId: "client-employee-primary";
+                        clientInstanceId: "installation-employee-primary";
+                        status: "active";
+                        deviceInfo: Readonly<{
+                            clientInstanceId: "installation-employee-primary";
+                            model: "Shared browser profile";
+                        }>;
+                        activatedAt: 1786570800;
+                    }>, Readonly<{
+                        clientId: "client-employee-secondary";
+                        clientInstanceId: "installation-employee-secondary";
+                        status: "revoked";
+                        deviceInfo: Readonly<{
+                            clientInstanceId: "installation-employee-secondary";
+                        }>;
+                        activatedAt: 1786570900;
+                        revokedAt: 1786571000;
+                    }>];
+                };
+            }];
+        };
+    };
+}>;
+/** Canonical controller-facing employee projection reused across SDK and portal tests. */
+export declare const EXAMPLE_EMPLOYEE_LIFECYCLE_RECORD: Readonly<{
+    readonly resourceId: string;
+    readonly email: string;
+    readonly roleCode: string;
+    readonly employeeDid: string;
+    readonly status: "active" | "inactive" | "purged";
+    readonly license: Readonly<{
+        id: "8a8a5e1b-0d8e-4a7c-8c39-3b8034440001";
+        status: "active";
+        maxDevices: 2;
+        activeDevices: number;
+        devices: readonly Readonly<{
+            clientId: "client-employee-primary" | "client-employee-secondary";
+            name: "installation-employee-primary" | "installation-employee-secondary" | "Shared browser profile";
+            status: "active" | "revoked";
+        }>[];
+    }>;
+}>;
 export declare function buildExampleLicenseIssueClaims(): Readonly<Record<string, unknown>>;
 export declare function buildExampleLicensePurchaseClaims(): Readonly<Record<string, unknown>>;
 export declare const EXAMPLE_LICENSE_PURCHASE_CLAIMS: Readonly<Record<string, unknown>>;