gdc-common-utils-ts 2.5.3 → 2.5.6

package/dist/examples/license.js

@@ -1,8 +1,36 @@
-import { DeviceAppTypes, DeviceUserClasses } from '../constants/device.js';
+import { DeviceAppTypes, DeviceBindingStatuses, DeviceUserClasses } from '../constants/device.js';
 import { ClaimsOrderSchemaorg, ClaimsIndividualProductSchemaorg, ClaimsOfferSchemaorg, ClaimsPersonSchemaorg, } from '../constants/schemaorg.js';
 import { buildLicenseIssueClaims, buildLicensePurchaseClaims, LicenseClaimContext, LicenseCategories, LicenseStatuses, } from '../utils/license.js';
 import { createLicenseOfferOrderEditor } from '../utils/license-offer-order.js';
-import { EXAMPLE_LICENSE_ACCEPTED_OFFER_ID, EXAMPLE_LICENSE_AMOUNT, EXAMPLE_LICENSE_CHECKOUT_URL, EXAMPLE_LICENSE_CURRENCY, EXAMPLE_EMAIL_CONTROLLER_ORG, EXAMPLE_EMPLOYEE_ACTIVATION_CODE, EXAMPLE_HEALTHCARE_ACTOR_ROLE_GENERALIST_MEDICAL_PRACTITIONER, EXAMPLE_LICENSE_INVOICE_ID, EXAMPLE_LICENSE_OFFER_ID, EXAMPLE_LICENSE_PLAN_DEFAULT, EXAMPLE_LICENSE_PAYMENT_METHOD_INVOICE, EXAMPLE_LICENSE_PAYMENT_URL, EXAMPLE_LICENSE_RENEWAL_CYCLE_YEARLY, EXAMPLE_LICENSE_PLAN_NAME, EXAMPLE_LICENSE_SEAT_UUID_ACTIVE, EXAMPLE_LICENSE_SEAT_UUID_AVAILABLE, EXAMPLE_LICENSE_SEAT_UUID_SECONDARY, EXAMPLE_LICENSE_SKU, EXAMPLE_LICENSE_SUBJECT_ID_ACTIVE, EXAMPLE_LICENSE_SUBJECT_ID_AVAILABLE, } from './shared.js';
+import { EXAMPLE_LICENSE_ACCEPTED_OFFER_ID, EXAMPLE_LICENSE_AMOUNT, EXAMPLE_LICENSE_CHECKOUT_URL, EXAMPLE_LICENSE_CURRENCY, EXAMPLE_EMAIL_CONTROLLER_ORG, EXAMPLE_EMPLOYEE_ACTIVATION_CODE, EXAMPLE_EMPLOYEE_DEVICE_CLIENT_ID_PRIMARY, EXAMPLE_EMPLOYEE_DEVICE_CLIENT_ID_SECONDARY, EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_PRIMARY, EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_SECONDARY, EXAMPLE_EMPLOYEE_DEVICE_MODEL_PRIMARY, EXAMPLE_HEALTHCARE_ACTOR_ROLE_GENERALIST_MEDICAL_PRACTITIONER, EXAMPLE_LICENSE_INVOICE_ID, EXAMPLE_LICENSE_OFFER_ID, EXAMPLE_LICENSE_PLAN_DEFAULT, EXAMPLE_LICENSE_PAYMENT_METHOD_INVOICE, EXAMPLE_LICENSE_PAYMENT_URL, EXAMPLE_LICENSE_RENEWAL_CYCLE_YEARLY, EXAMPLE_LICENSE_PLAN_NAME, EXAMPLE_LICENSE_SEAT_UUID_ACTIVE, EXAMPLE_LICENSE_SEAT_UUID_AVAILABLE, EXAMPLE_LICENSE_SEAT_UUID_SECONDARY, EXAMPLE_LICENSE_SKU, EXAMPLE_LICENSE_SUBJECT_ID_ACTIVE, EXAMPLE_LICENSE_SUBJECT_ID_AVAILABLE, } from './shared.js';
+import { DEFAULT_LICENSE_DEVICE_ALLOWANCE } from '../utils/license.js';
+import { EXAMPLE_EMPLOYEE_CONTROLLER_ACTIVE } from './employee.js';
+export const EXAMPLE_EMPLOYEE_DEVICE_BINDINGS = Object.freeze([
+    Object.freeze({
+        clientId: EXAMPLE_EMPLOYEE_DEVICE_CLIENT_ID_PRIMARY,
+        clientInstanceId: EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_PRIMARY,
+        status: DeviceBindingStatuses.Active,
+        deviceInfo: Object.freeze({
+            clientInstanceId: EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_PRIMARY,
+            model: EXAMPLE_EMPLOYEE_DEVICE_MODEL_PRIMARY,
+        }),
+        activatedAt: 1_786_570_800,
+    }),
+    Object.freeze({
+        clientId: EXAMPLE_EMPLOYEE_DEVICE_CLIENT_ID_SECONDARY,
+        clientInstanceId: EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_SECONDARY,
+        status: DeviceBindingStatuses.Revoked,
+        deviceInfo: Object.freeze({ clientInstanceId: EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_SECONDARY }),
+        activatedAt: 1_786_570_900,
+        revokedAt: 1_786_571_000,
+    }),
+]);
+/** Two simultaneously active installations used to test the default allowance. */
+export const EXAMPLE_EMPLOYEE_ACTIVE_DEVICE_BINDINGS = Object.freeze(EXAMPLE_EMPLOYEE_DEVICE_BINDINGS.map((binding) => Object.freeze({
+    ...binding,
+    status: DeviceBindingStatuses.Active,
+    revokedAt: undefined,
+})));
 export const EXAMPLE_LICENSE_SEAT_UUIDS = Object.freeze([
     EXAMPLE_LICENSE_SEAT_UUID_ACTIVE,
     EXAMPLE_LICENSE_SEAT_UUID_SECONDARY,
@@ -60,6 +88,61 @@ export const EXAMPLE_LICENSE_LIST_RESPONSE_BODY = Object.freeze({
         },
     ],
 });
+/** Shared async GW response for a controller-issued employee activation credential. */
+export const EXAMPLE_LICENSE_ISSUE_RESPONSE_BODY = Object.freeze({
+    body: {
+        data: [{
+                resource: {
+                    data: [{
+                            type: 'License:Issued',
+                            id: EXAMPLE_EMPLOYEE_ACTIVATION_CODE,
+                            meta: {
+                                claims: {
+                                    [ClaimsIndividualProductSchemaorg.serialNumber]: EXAMPLE_EMPLOYEE_ACTIVATION_CODE,
+                                },
+                            },
+                        }],
+                },
+            }],
+    },
+});
+/** Shared license search response containing the default two-installation state. */
+export const EXAMPLE_LICENSE_LIST_RESPONSE_BODY_WITH_DEVICES = Object.freeze({
+    body: {
+        resource: {
+            data: [{
+                    id: EXAMPLE_LICENSE_ACTIVE_RECORD.id,
+                    meta: {
+                        status: EXAMPLE_LICENSE_ACTIVE_RECORD.status,
+                        subjectId: EXAMPLE_EMPLOYEE_CONTROLLER_ACTIVE.resourceId,
+                        maxDevices: DEFAULT_LICENSE_DEVICE_ALLOWANCE,
+                        deviceBindings: EXAMPLE_EMPLOYEE_DEVICE_BINDINGS,
+                    },
+                }],
+        },
+    },
+});
+/** Canonical controller-facing employee projection reused across SDK and portal tests. */
+export const EXAMPLE_EMPLOYEE_LIFECYCLE_RECORD = Object.freeze({
+    resourceId: EXAMPLE_EMPLOYEE_CONTROLLER_ACTIVE.resourceId,
+    email: EXAMPLE_EMPLOYEE_CONTROLLER_ACTIVE.email,
+    roleCode: EXAMPLE_EMPLOYEE_CONTROLLER_ACTIVE.role,
+    employeeDid: EXAMPLE_EMPLOYEE_CONTROLLER_ACTIVE.identifier,
+    status: EXAMPLE_EMPLOYEE_CONTROLLER_ACTIVE.status,
+    license: Object.freeze({
+        id: EXAMPLE_LICENSE_ACTIVE_RECORD.id,
+        status: EXAMPLE_LICENSE_ACTIVE_RECORD.status,
+        maxDevices: DEFAULT_LICENSE_DEVICE_ALLOWANCE,
+        activeDevices: EXAMPLE_EMPLOYEE_DEVICE_BINDINGS.filter((binding) => binding.status === DeviceBindingStatuses.Active).length,
+        devices: Object.freeze(EXAMPLE_EMPLOYEE_DEVICE_BINDINGS.map((binding) => Object.freeze({
+            clientId: binding.clientId,
+            name: ('model' in binding.deviceInfo ? binding.deviceInfo.model : undefined)
+                || binding.deviceInfo.clientInstanceId
+                || binding.clientId,
+            status: binding.status,
+        }))),
+    }),
+});
 export function buildExampleLicenseIssueClaims() {
     return Object.freeze(buildLicenseIssueClaims(EXAMPLE_LICENSE_ISSUE_INPUT));
 }

package/dist/examples/shared.d.ts

@@ -86,6 +86,32 @@ export declare const EXAMPLE_OTP_INVITATION_ID: "invitation-demo-001";
 export declare const EXAMPLE_OTP_CHALLENGE_ID: "otp-challenge-demo-001";
 export declare const EXAMPLE_OTP_CODE: "123456";
 export declare const EXAMPLE_DEMO_PORTAL_ID_TOKEN: "eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJkZW1vLXVzZXIiLCJlbWFpbCI6ImRlbW9AZXhhbXBsZS5vcmcifQ.demo";
+export declare const EXAMPLE_ACCOUNT_OWNER_ID: "account-owner-example";
+export declare const EXAMPLE_PROFILE_PIN: "482951";
+export declare const EXAMPLE_JWK_THUMBPRINT_SHA256_URN: "urn:ietf:params:oauth:jwk-thumbprint:sha-256:BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB";
+export declare const EXAMPLE_DCR_REDIRECT_URI: "https://portal.example.org/auth/callback";
+export declare const EXAMPLE_EMPLOYEE_DCR_CLIENT_NAME: "Example Professional Employee";
+export declare const EXAMPLE_ASYNC_SUBMIT_STATUS: 202;
+export declare const EXAMPLE_ASYNC_POLL_STATUS: 200;
+export declare const EXAMPLE_ASYNC_POLL_ATTEMPTS: 1;
+export declare const ExampleHttpStatusText: Readonly<{
+    readonly Ok: "200";
+    readonly Conflict: "409";
+}>;
+export declare const EXAMPLE_ACTIVATION_GRANT_CREATED_AT: "2026-08-13T19:20:00.000Z";
+export declare const EXAMPLE_ACTIVATION_GRANT_EXPIRES_AT: "2027-08-13T19:20:00.000Z";
+/** Wraps any shared response body in the canonical successful async result. */
+export declare function buildExampleSubmitAndPollResult(body: unknown): Readonly<{
+    submit: Readonly<{
+        status: 202;
+        body: Readonly<{}>;
+    }>;
+    poll: Readonly<{
+        status: 200;
+        body: unknown;
+        attempts: 1;
+    }>;
+}>;
 export declare const EXAMPLE_TENANT_ROUTE_CONTEXT: {
     readonly tenantId: "acme-id";
     readonly jurisdiction: "ES";
@@ -255,6 +281,13 @@ export declare const EXAMPLE_CONTENT_ADDRESSED_CONSENT_IDENTIFIER: "zQmYwAPJzv5C
 export declare const EXAMPLE_CONTENT_ADDRESSED_SOURCE_REFERENCE: "zQmWvM9dQmWvM9dQmWvM9dQmWvM9dQmWvM9dQmWvM9dQmWv";
 export declare const EXAMPLE_CONTENT_ADDRESSED_EVIDENCE_RECORD_IDENTIFIER: "zQmXh8Y3mJQ4d7MmX7o9nP5sQ2uT1vW6xY8zA3bC4dE5fG";
 export declare const EXAMPLE_EMPLOYEE_ACTIVATION_CODE: "ACT-001";
+export declare const EXAMPLE_EMPLOYEE_DEVICE_CLIENT_ID_PRIMARY: "client-employee-primary";
+export declare const EXAMPLE_EMPLOYEE_DEVICE_CLIENT_ID_SECONDARY: "client-employee-secondary";
+export declare const EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_PRIMARY: "installation-employee-primary";
+export declare const EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_SECONDARY: "installation-employee-secondary";
+export declare const EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_TERTIARY: "installation-employee-tertiary";
+export declare const EXAMPLE_CLIENT_INSTANCE_UUID: "7f5e8d6c-91f4-4f6d-a29f-8bd42e44f101";
+export declare const EXAMPLE_EMPLOYEE_DEVICE_MODEL_PRIMARY: "Shared browser profile";
 export declare const EXAMPLE_LICENSE_OFFER_ID: "urn:offer:family-003";
 export declare const EXAMPLE_LICENSE_INVALID_OFFER_ID: "urn:offer:invalid-001";
 export declare const EXAMPLE_LICENSE_ACCEPTED_OFFER_ID: "urn:offer:family-003";

package/dist/examples/shared.js

@@ -101,6 +101,31 @@ export const EXAMPLE_OTP_INVITATION_ID = 'invitation-demo-001';
 export const EXAMPLE_OTP_CHALLENGE_ID = 'otp-challenge-demo-001';
 export const EXAMPLE_OTP_CODE = '123456';
 export const EXAMPLE_DEMO_PORTAL_ID_TOKEN = 'eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJkZW1vLXVzZXIiLCJlbWFpbCI6ImRlbW9AZXhhbXBsZS5vcmcifQ.demo';
+export const EXAMPLE_ACCOUNT_OWNER_ID = 'account-owner-example';
+export const EXAMPLE_PROFILE_PIN = '482951';
+export const EXAMPLE_JWK_THUMBPRINT_SHA256_URN = 'urn:ietf:params:oauth:jwk-thumbprint:sha-256:BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB';
+export const EXAMPLE_DCR_REDIRECT_URI = 'https://portal.example.org/auth/callback';
+export const EXAMPLE_EMPLOYEE_DCR_CLIENT_NAME = 'Example Professional Employee';
+export const EXAMPLE_ASYNC_SUBMIT_STATUS = 202;
+export const EXAMPLE_ASYNC_POLL_STATUS = 200;
+export const EXAMPLE_ASYNC_POLL_ATTEMPTS = 1;
+export const ExampleHttpStatusText = Object.freeze({
+    Ok: '200',
+    Conflict: '409',
+});
+export const EXAMPLE_ACTIVATION_GRANT_CREATED_AT = '2026-08-13T19:20:00.000Z';
+export const EXAMPLE_ACTIVATION_GRANT_EXPIRES_AT = '2027-08-13T19:20:00.000Z';
+/** Wraps any shared response body in the canonical successful async result. */
+export function buildExampleSubmitAndPollResult(body) {
+    return Object.freeze({
+        submit: Object.freeze({ status: EXAMPLE_ASYNC_SUBMIT_STATUS, body: Object.freeze({}) }),
+        poll: Object.freeze({
+            status: EXAMPLE_ASYNC_POLL_STATUS,
+            body,
+            attempts: EXAMPLE_ASYNC_POLL_ATTEMPTS,
+        }),
+    });
+}
 export const EXAMPLE_TENANT_ROUTE_CONTEXT = {
     tenantId: EXAMPLE_TENANT_IDENTIFIER,
     jurisdiction: EXAMPLE_JURISDICTION,
@@ -298,6 +323,13 @@ export const EXAMPLE_CONTENT_ADDRESSED_CONSENT_IDENTIFIER = 'zQmYwAPJzv5CZsnAzt8
 export const EXAMPLE_CONTENT_ADDRESSED_SOURCE_REFERENCE = 'zQmWvM9dQmWvM9dQmWvM9dQmWvM9dQmWvM9dQmWvM9dQmWv';
 export const EXAMPLE_CONTENT_ADDRESSED_EVIDENCE_RECORD_IDENTIFIER = 'zQmXh8Y3mJQ4d7MmX7o9nP5sQ2uT1vW6xY8zA3bC4dE5fG';
 export const EXAMPLE_EMPLOYEE_ACTIVATION_CODE = 'ACT-001';
+export const EXAMPLE_EMPLOYEE_DEVICE_CLIENT_ID_PRIMARY = 'client-employee-primary';
+export const EXAMPLE_EMPLOYEE_DEVICE_CLIENT_ID_SECONDARY = 'client-employee-secondary';
+export const EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_PRIMARY = 'installation-employee-primary';
+export const EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_SECONDARY = 'installation-employee-secondary';
+export const EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_TERTIARY = 'installation-employee-tertiary';
+export const EXAMPLE_CLIENT_INSTANCE_UUID = '7f5e8d6c-91f4-4f6d-a29f-8bd42e44f101';
+export const EXAMPLE_EMPLOYEE_DEVICE_MODEL_PRIMARY = 'Shared browser profile';
 export const EXAMPLE_LICENSE_OFFER_ID = 'urn:offer:family-003';
 export const EXAMPLE_LICENSE_INVALID_OFFER_ID = 'urn:offer:invalid-001';
 export const EXAMPLE_LICENSE_ACCEPTED_OFFER_ID = EXAMPLE_LICENSE_OFFER_ID;

package/dist/models/device-license.d.ts

@@ -1,4 +1,4 @@
-import type { DeviceAppType, DeviceUserClass } from '../constants/device';
+import type { DeviceAppType, DeviceBindingStatus, DeviceUserClass } from '../constants/device';
 /**
  * A fingerprint of a specific device, used for binding a license to it.
  */
@@ -24,7 +24,7 @@ export interface DeviceBinding {
     /** Stable application installation fingerprint supplied by the client. */
     clientInstanceId: string;
     /** Current relationship between this installation and the seat. */
-    status: 'active' | 'revoked';
+    status: DeviceBindingStatus;
     /** Device/application metadata captured during DCR. */
     deviceInfo: DeviceInfo;
     activatedAt: number;

package/dist/models/index.d.ts

@@ -19,6 +19,7 @@ export * from './dataspace-discovery';
 export * from './dataspace-discovery-defaults';
 export * from './dataspace-protocol';
 export * from './device-license';
+export * from './organization-employee-lifecycle';
 export * from './did';
 export * from './fhir-documents';
 export * from './gaia-x';
@@ -53,6 +54,7 @@ export * from './response';
 export * from './subject-identifier-ledger';
 export * from './subject-identity';
 export * from './subject-identity-binding';
+export * from './test-network-organization-registration-form';
 export * from './terminology';
 export * from './urlPath';
 export * from './verifiable-credential';

package/dist/models/index.js

@@ -19,6 +19,7 @@ export * from './dataspace-discovery.js';
 export * from './dataspace-discovery-defaults.js';
 export * from './dataspace-protocol.js';
 export * from './device-license.js';
+export * from './organization-employee-lifecycle.js';
 export * from './did.js';
 export * from './fhir-documents.js';
 export * from './gaia-x.js';
@@ -53,6 +54,7 @@ export * from './response.js';
 export * from './subject-identifier-ledger.js';
 export * from './subject-identity.js';
 export * from './subject-identity-binding.js';
+export * from './test-network-organization-registration-form.js';
 export * from './terminology.js';
 export * from './urlPath.js';
 export * from './verifiable-credential.js';

package/dist/models/inter-tenant-access-contract.d.ts

@@ -64,7 +64,7 @@ export declare enum ClaimInterTenantAccessContract {
      * Allowed business/legal purpose for the access.
      *
      * Example:
-     * - `RESEARCH`
+     * - `HRESCH` (HL7 v3 ActReason: healthcare research)
      */
     purpose = "Contract.term-type",
     /**

package/dist/models/inter-tenant-access-contract.js

@@ -66,7 +66,7 @@ export var ClaimInterTenantAccessContract;
      * Allowed business/legal purpose for the access.
      *
      * Example:
-     * - `RESEARCH`
+     * - `HRESCH` (HL7 v3 ActReason: healthcare research)
      */
     ClaimInterTenantAccessContract["purpose"] = "Contract.term-type";
     /**

package/dist/models/organization-employee-lifecycle.d.ts

@@ -0,0 +1,45 @@
+import type { DeviceBindingStatus } from '../constants/device';
+import type { EmployeeActivationGrantVersion, EmployeeDirectoryStatus } from '../constants/employee-lifecycle';
+/** One installation in the controller-facing employee lifecycle projection. */
+export type OrganizationEmployeeDeviceRecord = Readonly<{
+    clientId: string;
+    name: string;
+    status: DeviceBindingStatus;
+}>;
+/** License state attached to one employee directory entry. */
+export type OrganizationEmployeeLicenseRecord = Readonly<{
+    id: string;
+    status: string;
+    maxDevices: number;
+    activeDevices: number;
+    devices: ReadonlyArray<OrganizationEmployeeDeviceRecord>;
+}>;
+/** Product-neutral employee, seat and installation lifecycle projection. */
+export type OrganizationEmployeeLifecycleRecord = Readonly<{
+    resourceId: string;
+    email: string;
+    roleCode: string;
+    employeeDid: string;
+    status: EmployeeDirectoryStatus;
+    license?: OrganizationEmployeeLicenseRecord;
+}>;
+/** Typed wire request for revoking one installation without releasing its seat. */
+export type EmployeeDeviceRevocationTarget = Readonly<{
+    licenseId: string;
+    clientId: string;
+}>;
+/** Tenant routing metadata bound to an employee activation credential digest. */
+export type EmployeeActivationGrant = Readonly<{
+    version: EmployeeActivationGrantVersion;
+    employeeDid: string;
+    employeeRoleCode: string;
+    employeeActorIdentifier: string;
+    providerDid: string;
+    routeContext: Readonly<{
+        tenantId: string;
+        jurisdiction: string;
+        sector: string;
+    }>;
+    createdAt: string;
+    expiresAt: string;
+}>;

package/dist/models/organization-employee-lifecycle.js

@@ -0,0 +1 @@
+export {};

package/dist/models/test-network-organization-registration-form.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Host-service fields written by the portal BFF. They are deployment facts,
+ * not editable applicant input.
+ */
+export interface TestNetworkProviderPdfForm {
+    hostServiceCountry: string;
+    hostServiceLegalName: string;
+    hostServiceTaxId: string;
+    hostServiceUrl: string;
+}
+/** Legal-organization fields captured from the applicant. */
+export interface TestNetworkLegalOrganizationPdfForm {
+    'Identification number': string;
+    organizationLegalName: string;
+    organizationName: string;
+    organizationAddressCountry: string;
+    organizationAddressRegion: string;
+    organizationOfficialLicense: string;
+    organizationAddressPostalCode: string;
+    organizationAddressLine: string;
+    organizationAddressCity: string;
+    organizationContactUrl: string;
+    organizationContactEmail: string;
+    organizationContactPhone: string;
+    organizationServiceCategory: string;
+    organizationIdentifierType: string;
+    organizationIndexProvider: boolean;
+    organizationResearchProvider: boolean;
+}
+/** Legal-representative fields captured from the applicant. */
+export interface TestNetworkLegalRepresentativePdfForm {
+    representativeFullName: string;
+    representativeContactEmail: string;
+    representativeContactPhone: string;
+    representativeIdentifierType: string;
+    representativeIdentifierValue: string;
+    representativeIdentifierCountry: string;
+    representativeIdentifierRegion: string;
+    representativeSelfDeclaration: boolean;
+    'I confirm that I am duly authorized by the organization to submit this application': boolean;
+}
+/** Technical-controller fields captured from the applicant. */
+export interface TestNetworkControllerPdfForm {
+    controllerFullName: string;
+    controllerContactEmail: string;
+    controllerContactPhone: string;
+    controllerIdentifierType: string;
+    controllerIdentifierValue: string;
+    controllerIdentifierCountry: string;
+    controllerIdentifierRegion: string;
+    representativeIsController: boolean;
+    'The legal representative and the technical controller of the service are the same person': boolean;
+}
+/**
+ * Immutable values added by the portal BFF after browser validation. The JWK
+ * commitment is generated from the server-created controller key; the browser
+ * must never be allowed to replace it.
+ */
+export interface TestNetworkRegistrationDocumentMetadata {
+    docVersion: string;
+    signDate: string;
+    controllerKeyCommitment: string;
+}
+/**
+ * Canonical AcroForm projection used by the Test Network registration PDF.
+ * The property names are the PDF field names, including the two historical
+ * sentence-shaped checkbox names present in the supplied form.
+ */
+export type TestNetworkOrganizationRegistrationPdfForm = TestNetworkProviderPdfForm & TestNetworkLegalOrganizationPdfForm & TestNetworkLegalRepresentativePdfForm & TestNetworkControllerPdfForm & TestNetworkRegistrationDocumentMetadata;
+export declare const TEST_NETWORK_ORGANIZATION_REGISTRATION_PDF_FIELDS: readonly ["Identification number", "I confirm that I am duly authorized by the organization to submit this application", "The legal representative and the technical controller of the service are the same person", "hostServiceCountry", "hostServiceLegalName", "hostServiceTaxId", "hostServiceUrl", "organizationLegalName", "organizationName", "organizationAddressCountry", "organizationAddressRegion", "organizationOfficialLicense", "organizationAddressPostalCode", "organizationAddressLine", "organizationAddressCity", "organizationContactUrl", "organizationContactEmail", "organizationContactPhone", "representativeContactEmail", "representativeFullName", "representativeIdentifierValue", "representativeIdentifierCountry", "representativeIdentifierRegion", "controllerContactPhone", "controllerFullName", "controllerContactEmail", "controllerIdentifierValue", "controllerIdentifierCountry", "controllerIdentifierRegion", "representativeContactPhone", "organizationServiceCategory", "representativeIdentifierType", "controllerIdentifierType", "representativeSelfDeclaration", "representativeIsController", "docVersion", "signDate", "organizationIndexProvider", "organizationResearchProvider", "organizationIdentifierType", "controllerKeyCommitment"];
+export type TestNetworkOrganizationRegistrationPdfFieldName = typeof TEST_NETWORK_ORGANIZATION_REGISTRATION_PDF_FIELDS[number];

package/dist/models/test-network-organization-registration-form.js

@@ -0,0 +1,43 @@
+export const TEST_NETWORK_ORGANIZATION_REGISTRATION_PDF_FIELDS = Object.freeze([
+    'Identification number',
+    'I confirm that I am duly authorized by the organization to submit this application',
+    'The legal representative and the technical controller of the service are the same person',
+    'hostServiceCountry',
+    'hostServiceLegalName',
+    'hostServiceTaxId',
+    'hostServiceUrl',
+    'organizationLegalName',
+    'organizationName',
+    'organizationAddressCountry',
+    'organizationAddressRegion',
+    'organizationOfficialLicense',
+    'organizationAddressPostalCode',
+    'organizationAddressLine',
+    'organizationAddressCity',
+    'organizationContactUrl',
+    'organizationContactEmail',
+    'organizationContactPhone',
+    'representativeContactEmail',
+    'representativeFullName',
+    'representativeIdentifierValue',
+    'representativeIdentifierCountry',
+    'representativeIdentifierRegion',
+    'controllerContactPhone',
+    'controllerFullName',
+    'controllerContactEmail',
+    'controllerIdentifierValue',
+    'controllerIdentifierCountry',
+    'controllerIdentifierRegion',
+    'representativeContactPhone',
+    'organizationServiceCategory',
+    'representativeIdentifierType',
+    'controllerIdentifierType',
+    'representativeSelfDeclaration',
+    'representativeIsController',
+    'docVersion',
+    'signDate',
+    'organizationIndexProvider',
+    'organizationResearchProvider',
+    'organizationIdentifierType',
+    'controllerKeyCommitment',
+]);

package/dist/utils/index.d.ts

@@ -67,6 +67,7 @@ export * from './individual-organization-claims';
 export * from './inter-tenant-access-contract';
 export * from './legal-organization-onboarding-editor';
 export * from './organization-lifecycle';
+export * from './organization-employee-lifecycle';
 export * from './organization-did-binding';
 export * from './organization-authorization-urn';
 export * from './individual-organization-lifecycle';
@@ -83,7 +84,8 @@ export * from './jwt-signer';
 export * from './jwk-thumbprint';
 export * from './legal-organization-onboarding';
 export * from './legal-organization-verification-transaction';
-export * from './organization-registration-authorization';
+export * from './organization-test-network-credential';
+export * from './test-network-organization-credentials';
 export * from './local-terminology-provider';
 export * from './license';
 export * from './license-commercial-search';

package/dist/utils/index.js

@@ -67,6 +67,7 @@ export * from './individual-organization-claims.js';
 export * from './inter-tenant-access-contract.js';
 export * from './legal-organization-onboarding-editor.js';
 export * from './organization-lifecycle.js';
+export * from './organization-employee-lifecycle.js';
 export * from './organization-did-binding.js';
 export * from './organization-authorization-urn.js';
 export * from './individual-organization-lifecycle.js';
@@ -83,7 +84,8 @@ export * from './jwt-signer.js';
 export * from './jwk-thumbprint.js';
 export * from './legal-organization-onboarding.js';
 export * from './legal-organization-verification-transaction.js';
-export * from './organization-registration-authorization.js';
+export * from './organization-test-network-credential.js';
+export * from './test-network-organization-credentials.js';
 export * from './local-terminology-provider.js';
 export * from './license.js';
 export * from './license-commercial-search.js';

package/dist/utils/jwk-thumbprint.d.ts

@@ -38,6 +38,8 @@ export declare function computeRfc7638JwkThumbprint(jwk: ThumbprintableJwk): str
  * `urn:ietf:params:oauth:jwk-thumbprint:sha-256:<base64url>`
  */
 export declare function toJwkThumbprintSha256Urn(jwk: ThumbprintableJwk): string;
+/** True only for an RFC 9278 SHA-256 JWK thumbprint URI. */
+export declare function isJwkThumbprintSha256Urn(value: unknown): value is string;
 /**
  * Returns a public JWK whose `kid` is derived exclusively from its public key
  * material. Caller-provided aliases are deliberately replaced so DID methods,

package/dist/utils/jwk-thumbprint.js

@@ -55,6 +55,14 @@ export function computeRfc7638JwkThumbprint(jwk) {
 export function toJwkThumbprintSha256Urn(jwk) {
     return `${UrnPrefixes.JwkThumbprintSha256KeyId}${computeRfc7638JwkThumbprint(jwk)}`;
 }
+/** True only for an RFC 9278 SHA-256 JWK thumbprint URI. */
+export function isJwkThumbprintSha256Urn(value) {
+    const normalized = typeof value === 'string' ? value.trim() : '';
+    if (!normalized.startsWith(UrnPrefixes.JwkThumbprintSha256KeyId))
+        return false;
+    const thumbprint = normalized.slice(UrnPrefixes.JwkThumbprintSha256KeyId.length);
+    return /^[A-Za-z0-9_-]{43}$/.test(thumbprint);
+}
 /**
  * Returns a public JWK whose `kid` is derived exclusively from its public key
  * material. Caller-provided aliases are deliberately replaced so DID methods,

package/dist/utils/legal-organization-verification-transaction.d.ts

@@ -27,6 +27,8 @@ export type LegalOrganizationVerificationTransactionEntryType = typeof LegalOrga
  */
 export type LegalOrganizationVerificationTransactionController = Readonly<{
     did?: string;
+    /** Normalized controller contact bound independently from the representative. */
+    email?: string;
     sameAs?: string;
     publicKeyJwk?: Record<string, unknown>;
     jwks?: {
@@ -80,6 +82,8 @@ export type LegalOrganizationVerificationTransactionInput = Readonly<{
     verification?: LegalOrganizationVerificationRouting;
     /** Out-of-band host authorization used only by the Test Network path. */
     authorizationCredential?: VerifiableCredentialV2;
+    /** Three reviewer-issued domain VCs accepted only with Test Network authorization. */
+    testNetworkCredentials?: readonly VerifiableCredentialV2[];
     attachments?: unknown[];
 }>;
 export type LegalOrganizationVerificationTransactionEntry = Readonly<{
@@ -102,6 +106,7 @@ export type LegalOrganizationVerificationTransactionEntry = Readonly<{
         legalRepresentative?: LegalOrganizationVerificationRepresentativePayload;
         verification?: LegalOrganizationVerificationRouting;
         authorizationCredential?: VerifiableCredentialV2;
+        testNetworkCredentials?: readonly VerifiableCredentialV2[];
         [key: string]: unknown;
     };
     [key: string]: unknown;

package/dist/utils/legal-organization-verification-transaction.js

@@ -64,6 +64,9 @@ export function buildLegalOrganizationVerificationTransactionBundle(input) {
                     ...(input.authorizationCredential
                         ? { authorizationCredential: input.authorizationCredential }
                         : {}),
+                    ...(input.testNetworkCredentials?.length
+                        ? { testNetworkCredentials: input.testNetworkCredentials }
+                        : {}),
                 },
             }],
         ...(Array.isArray(input.attachments) && input.attachments.length > 0

package/dist/utils/license.js

@@ -1,4 +1,4 @@
-import { DeviceAppTypes, DeviceUserClasses } from '../constants/device.js';
+import { DeviceAppTypes, DeviceBindingStatuses, DeviceUserClasses } from '../constants/device.js';
 import { ClaimsIndividualProductSchemaorg, ClaimsOfferSchemaorg, ClaimsPersonSchemaorg, } from '../constants/schemaorg.js';
 /** Default simultaneous installation allowance for one professional/member seat. */
 export const DEFAULT_LICENSE_DEVICE_ALLOWANCE = 2;
@@ -13,7 +13,7 @@ export function resolveLicenseDeviceAllowance(license) {
  */
 export function listActiveLicenseDeviceBindings(license) {
     if (Array.isArray(license.deviceBindings)) {
-        return license.deviceBindings.filter((binding) => binding.status === 'active');
+        return license.deviceBindings.filter((binding) => binding.status === DeviceBindingStatuses.Active);
     }
     const clientId = String(license.deviceId || '').trim();
     if (!clientId)
@@ -22,7 +22,7 @@ export function listActiveLicenseDeviceBindings(license) {
     return [{
             clientId,
             clientInstanceId: deviceInfo.clientInstanceId || clientId,
-            status: 'active',
+            status: DeviceBindingStatuses.Active,
             deviceInfo,
             activatedAt: Number(license.activatedAt || 0),
         }];

package/dist/utils/organization-employee-lifecycle.d.ts

@@ -0,0 +1,12 @@
+import type { EmployeeDeviceRevocationTarget, OrganizationEmployeeLifecycleRecord } from '../models/organization-employee-lifecycle';
+/** Builds the exact identity/auth revoke request body from a typed target. */
+export declare function buildEmployeeDeviceRevocationBody(target: EmployeeDeviceRevocationTarget): Readonly<Record<string, string>>;
+/** Reads an employee activation credential from canonical and legacy GW envelopes. */
+export declare function readEmployeeActivationCode(value: unknown): string;
+/** Extracts GW search rows regardless of async job envelope depth. */
+export declare function extractGwSearchResources(value: unknown): ReadonlyArray<Record<string, unknown>>;
+/** Combines employee directory and license search results into one typed view. */
+export declare function projectOrganizationEmployeeLifecycle(input: Readonly<{
+    employeeResponse: unknown;
+    licenseResponse: unknown;
+}>): OrganizationEmployeeLifecycleRecord[];