gdc-common-utils-ts 2.5.3 → 2.5.6

package/dist/utils/organization-employee-lifecycle.js

@@ -0,0 +1,125 @@
+import { ClaimsIndividualProductSchemaorg, ClaimsPersonSchemaorg } from '../constants/schemaorg.js';
+import { DeviceBindingStatuses } from '../constants/device.js';
+import { EmployeeDirectoryStatuses } from '../constants/employee-lifecycle.js';
+import { IdentityAuthRequestFields, IdentityAuthResponseEntryTypes, } from '../constants/identity-auth.js';
+import { DEFAULT_LICENSE_DEVICE_ALLOWANCE } from './license.js';
+/** Builds the exact identity/auth revoke request body from a typed target. */
+export function buildEmployeeDeviceRevocationBody(target) {
+    return Object.freeze({
+        [IdentityAuthRequestFields.LicenseId]: target.licenseId,
+        [IdentityAuthRequestFields.ClientId]: target.clientId,
+    });
+}
+/** Reads an employee activation credential from canonical and legacy GW envelopes. */
+export function readEmployeeActivationCode(value) {
+    for (const candidate of listNestedRecords(value)) {
+        if (candidate.type === IdentityAuthResponseEntryTypes.LicenseIssued) {
+            const issuedId = text(candidate.id);
+            if (issuedId)
+                return issuedId;
+        }
+        const claims = record(candidate.claims) || record(record(candidate.meta)?.claims);
+        const serial = text(claims?.[ClaimsIndividualProductSchemaorg.serialNumber]);
+        if (serial)
+            return serial;
+    }
+    return '';
+}
+/** Extracts GW search rows regardless of async job envelope depth. */
+export function extractGwSearchResources(value) {
+    for (const candidate of listNestedRecords(value)) {
+        const data = record(candidate.resource)?.data || candidate.data;
+        if (Array.isArray(data))
+            return data.map(record).filter(isRecord);
+    }
+    return [];
+}
+/** Combines employee directory and license search results into one typed view. */
+export function projectOrganizationEmployeeLifecycle(input) {
+    const licenses = extractGwSearchResources(input.licenseResponse);
+    return extractGwSearchResources(input.employeeResponse).map((employee) => {
+        const claims = record(employee.claims) || record(record(employee.meta)?.claims) || {};
+        const resourceId = text(employee.id);
+        const employeeDid = text(claims[ClaimsPersonSchemaorg.identifier]);
+        const license = licenses.find((candidate) => {
+            const meta = record(candidate.meta) || {};
+            const subjectId = text(meta.subjectId);
+            return subjectId === resourceId || subjectId === employeeDid;
+        });
+        const status = normalizeEmployeeDirectoryStatus(text(employee.status) || text(record(employee.meta)?.status));
+        if (!license)
+            return {
+                resourceId,
+                email: text(claims[ClaimsPersonSchemaorg.email]),
+                roleCode: text(claims[ClaimsPersonSchemaorg.hasOccupationalRoleValue]),
+                employeeDid,
+                status,
+            };
+        const meta = record(license.meta) || {};
+        const bindings = Array.isArray(meta.deviceBindings) ? meta.deviceBindings.map(record).filter(isRecord) : [];
+        const devices = bindings.map((binding) => {
+            const info = record(binding.deviceInfo) || {};
+            const clientId = text(binding.clientId);
+            return {
+                clientId,
+                name: text(info.model) || text(info.clientInstanceId) || clientId,
+                status: binding.status === DeviceBindingStatuses.Revoked
+                    ? DeviceBindingStatuses.Revoked
+                    : DeviceBindingStatuses.Active,
+            };
+        }).filter((device) => Boolean(device.clientId));
+        return {
+            resourceId,
+            email: text(claims[ClaimsPersonSchemaorg.email]),
+            roleCode: text(claims[ClaimsPersonSchemaorg.hasOccupationalRoleValue]),
+            employeeDid,
+            status,
+            license: {
+                id: text(license.id),
+                status: text(meta.status),
+                maxDevices: positiveInteger(meta.maxDevices) || DEFAULT_LICENSE_DEVICE_ALLOWANCE,
+                activeDevices: devices.filter((device) => device.status === DeviceBindingStatuses.Active).length,
+                devices,
+            },
+        };
+    }).filter((employee) => Boolean(employee.resourceId));
+}
+function normalizeEmployeeDirectoryStatus(value) {
+    return Object.values(EmployeeDirectoryStatuses).includes(value)
+        ? value
+        : EmployeeDirectoryStatuses.Unknown;
+}
+function listNestedRecords(root) {
+    const result = [];
+    const pending = [root];
+    const visited = new Set();
+    while (pending.length > 0) {
+        const value = pending.shift();
+        if (!value || typeof value !== 'object' || visited.has(value))
+            continue;
+        visited.add(value);
+        if (Array.isArray(value)) {
+            pending.push(...value);
+            continue;
+        }
+        const item = value;
+        result.push(item);
+        pending.push(...Object.values(item));
+    }
+    return result;
+}
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function isRecord(value) {
+    return Boolean(value);
+}
+function text(value) {
+    return typeof value === 'string' ? value.trim() : '';
+}
+function positiveInteger(value) {
+    const parsed = Number(value);
+    return Number.isInteger(parsed) && parsed > 0 ? parsed : undefined;
+}

package/dist/utils/{organization-registration-authorization.d.ts → organization-test-network-credential.d.ts}

@@ -1,5 +1,5 @@
 import type { VerifiableCredentialV2 } from '../models/verifiable-credential';
-/** Lifecycle of the one GW activation licence delivered to the legal postal address. */
+/** Lifecycle of the one Test Network activation licence delivered to the legal postal address. */
 export declare const PostalActivationLicenseStatuses: Readonly<{
     readonly Issued: "issued";
     readonly Delivered: "delivered";
@@ -35,7 +35,7 @@ export type PostalActivationLicenseBinding = Readonly<{
     redeemedAt?: string;
 }>;
 /** Input for the credential returned out-of-band to the applicant controller. */
-export type OrganizationRegistrationAuthorizationCredentialInput = Readonly<{
+export type OrganizationTestNetworkCredentialInput = Readonly<{
     issuerDid: string;
     subjectDid: string;
     credentialId: string;
@@ -56,7 +56,7 @@ export type OrganizationRegistrationAuthorizationCredentialInput = Readonly<{
  * to `Organization/_transaction`. The postal code itself never appears in the
  * credential; its confirmed, purpose-bound licence record is referenced.
  */
-export declare function buildOrganizationRegistrationAuthorizationCredential(input: OrganizationRegistrationAuthorizationCredentialInput): VerifiableCredentialV2;
+export declare function buildOrganizationTestNetworkCredential(input: OrganizationTestNetworkCredentialInput): VerifiableCredentialV2;
 /**
  * Applies the only legal state transitions for the purpose-bound postal code.
  * Confirmation proves delivery but deliberately does not consume the code;
@@ -68,4 +68,4 @@ export declare function transitionPostalActivationLicense(current: PostalActivat
  * same credential payload with the complete `proof` property removed, so a
  * later counter-proof cannot invalidate an earlier one.
  */
-export declare function canonicalizeOrganizationRegistrationAuthorizationCredential(credential: VerifiableCredentialV2): string;
+export declare function canonicalizeOrganizationTestNetworkCredential(credential: VerifiableCredentialV2): string;

package/dist/utils/{organization-registration-authorization.js → organization-test-network-credential.js}

@@ -1,5 +1,5 @@
 import { ContractCredentialTypes, W3cCredentialContexts, W3cCredentialTypes, } from '../constants/verifiable-credentials.js';
-/** Lifecycle of the one GW activation licence delivered to the legal postal address. */
+/** Lifecycle of the one Test Network activation licence delivered to the legal postal address. */
 export const PostalActivationLicenseStatuses = Object.freeze({
     Issued: 'issued',
     Delivered: 'delivered',
@@ -18,7 +18,7 @@ function required(value, name) {
  * to `Organization/_transaction`. The postal code itself never appears in the
  * credential; its confirmed, purpose-bound licence record is referenced.
  */
-export function buildOrganizationRegistrationAuthorizationCredential(input) {
+export function buildOrganizationTestNetworkCredential(input) {
     const applicationId = required(input.applicationId, 'applicationId');
     const organizationIdentifier = required(input.organizationIdentifier, 'organizationIdentifier');
     const controllerEmail = required(input.controllerEmail, 'controllerEmail').toLowerCase();
@@ -37,7 +37,7 @@ export function buildOrganizationRegistrationAuthorizationCredential(input) {
         id: required(input.credentialId, 'credentialId'),
         type: [
             W3cCredentialTypes.VerifiableCredential,
-            ContractCredentialTypes.OrganizationRegistrationAuthorizationCredential,
+            ContractCredentialTypes.OrganizationTestNetworkCredential,
         ],
         issuer: required(input.issuerDid, 'issuerDid'),
         credentialSubject: {
@@ -109,9 +109,9 @@ function canonicalizeValue(value) {
  * same credential payload with the complete `proof` property removed, so a
  * later counter-proof cannot invalidate an earlier one.
  */
-export function canonicalizeOrganizationRegistrationAuthorizationCredential(credential) {
-    if (!credential.type.includes(ContractCredentialTypes.OrganizationRegistrationAuthorizationCredential)) {
-        throw new Error('Credential is not an organization registration authorization.');
+export function canonicalizeOrganizationTestNetworkCredential(credential) {
+    if (!credential.type.includes(ContractCredentialTypes.OrganizationTestNetworkCredential)) {
+        throw new Error('Credential is not an organization Test Network admission.');
     }
     return JSON.stringify(canonicalizeValue(credential));
 }

package/dist/utils/test-network-organization-credentials.d.ts

@@ -0,0 +1,35 @@
+import type { VerifiableCredentialV2 } from '../models/verifiable-credential';
+export declare const TestNetworkOrganizationCredentialTypes: readonly ["OrganizationCredential", "LegalRepresentativeCredential", "ServiceControllerCredential"];
+export type TestNetworkOrganizationCredentialSet = readonly [
+    VerifiableCredentialV2,
+    VerifiableCredentialV2,
+    VerifiableCredentialV2
+];
+export type BuildTestNetworkOrganizationCredentialSetInput = Readonly<{
+    issuerDid: string;
+    organizationDid: string;
+    applicationId: string;
+    validFrom: string;
+    validUntil: string;
+    pdfSha256: string;
+    documentVersion: string;
+    legalName: string;
+    organizationIdentifier: string;
+    identifierType: string;
+    addressCountry: string;
+    serviceCategory: string;
+    legalRepresentativeEmail: string;
+    legalRepresentativeFullName: string;
+    controllerEmail: string;
+    controllerKeyMaterial: string;
+}>;
+/**
+ * Builds the three schema.org credentials used by organization activation in
+ * both environments. In this profile the reviewer/host-provider DID is the
+ * issuer, every subject is restricted to `test-network`, and the immutable PDF
+ * digest is common evidence. The function creates drafts; a reviewer proof
+ * must still be added to every returned credential.
+ */
+export declare function buildTestNetworkOrganizationCredentialSet(input: BuildTestNetworkOrganizationCredentialSetInput): TestNetworkOrganizationCredentialSet;
+/** Deterministic detached-proof payload for one of the three Test Network VCs. */
+export declare function canonicalizeTestNetworkOrganizationCredential(credential: VerifiableCredentialV2): string;

package/dist/utils/test-network-organization-credentials.js

@@ -0,0 +1,144 @@
+import { ActivationCredentialTypes, EnvironmentCredentialTypes, W3cCredentialContexts, W3cCredentialTypes, } from '../constants/verifiable-credentials.js';
+import { buildStableActorIdentifier } from './actor-identifier.js';
+export const TestNetworkOrganizationCredentialTypes = Object.freeze([
+    ActivationCredentialTypes.OrganizationCredential,
+    ActivationCredentialTypes.LegalRepresentativeCredential,
+    ActivationCredentialTypes.ServiceControllerCredential,
+]);
+function required(value, name) {
+    const normalized = String(value || '').trim();
+    if (!normalized)
+        throw new Error(`Test Network organization credentials require ${name}.`);
+    return normalized;
+}
+/**
+ * Builds the three schema.org credentials used by organization activation in
+ * both environments. In this profile the reviewer/host-provider DID is the
+ * issuer, every subject is restricted to `test-network`, and the immutable PDF
+ * digest is common evidence. The function creates drafts; a reviewer proof
+ * must still be added to every returned credential.
+ */
+export function buildTestNetworkOrganizationCredentialSet(input) {
+    const issuer = required(input.issuerDid, 'issuerDid');
+    const organizationDid = required(input.organizationDid, 'organizationDid');
+    const applicationId = required(input.applicationId, 'applicationId');
+    const validFrom = required(input.validFrom, 'validFrom');
+    const validUntil = required(input.validUntil, 'validUntil');
+    const legalName = required(input.legalName, 'legalName');
+    const organizationIdentifier = required(input.organizationIdentifier, 'organizationIdentifier');
+    const identifierType = required(input.identifierType, 'identifierType');
+    const addressCountry = required(input.addressCountry, 'addressCountry').toUpperCase();
+    const serviceCategory = required(input.serviceCategory, 'serviceCategory');
+    const legalRepresentativeEmail = required(input.legalRepresentativeEmail, 'legalRepresentativeEmail').toLowerCase();
+    const legalRepresentativeFullName = required(input.legalRepresentativeFullName, 'legalRepresentativeFullName');
+    const controllerEmail = required(input.controllerEmail, 'controllerEmail').toLowerCase();
+    const evidence = [{
+            type: 'DocumentVerification',
+            id: `urn:sha256:${required(input.pdfSha256, 'pdfSha256')}`,
+            documentVersion: required(input.documentVersion, 'documentVersion'),
+            applicationId,
+            targetNetwork: 'test-network',
+        }];
+    const base = {
+        '@context': [W3cCredentialContexts.V2, 'https://schema.org'],
+        issuer,
+        validFrom,
+        validUntil,
+        evidence,
+    };
+    const organization = {
+        ...base,
+        id: `urn:uuid:${applicationId}:organization`,
+        type: [
+            W3cCredentialTypes.VerifiableCredential,
+            ActivationCredentialTypes.OrganizationCredential,
+            EnvironmentCredentialTypes.TestNetworkCredential,
+        ],
+        credentialSubject: {
+            id: organizationDid,
+            '@type': 'Organization',
+            legalName,
+            identifier: { additionalType: identifierType, value: organizationIdentifier },
+            ...(identifierType === 'taxID' ? { taxID: organizationIdentifier } : {}),
+            address: { '@type': 'PostalAddress', addressCountry },
+            makesOffer: { '@type': 'Offer', category: serviceCategory },
+            targetNetwork: 'test-network',
+        },
+    };
+    const representative = {
+        ...base,
+        id: `urn:uuid:${applicationId}:legal-representative`,
+        type: [
+            W3cCredentialTypes.VerifiableCredential,
+            ActivationCredentialTypes.PersonCredential,
+            ActivationCredentialTypes.LegalRepresentativeCredential,
+            EnvironmentCredentialTypes.TestNetworkCredential,
+        ],
+        credentialSubject: {
+            id: buildStableActorIdentifier({ contactKind: 'email', contact: legalRepresentativeEmail }),
+            '@type': 'Person',
+            name: legalRepresentativeFullName,
+            sameAs: buildStableActorIdentifier({ contactKind: 'email', contact: legalRepresentativeEmail }),
+            hasOccupation: { '@type': 'Occupation', occupationalCategory: 'ISCO-08|1120' },
+            memberOf: {
+                '@type': 'Organization',
+                legalName,
+                ...(identifierType === 'taxID'
+                    ? { taxID: organizationIdentifier }
+                    : { identifier: { additionalType: identifierType, value: organizationIdentifier } }),
+            },
+            targetNetwork: 'test-network',
+        },
+    };
+    const controller = {
+        ...base,
+        id: `urn:uuid:${applicationId}:service-controller`,
+        type: [
+            W3cCredentialTypes.VerifiableCredential,
+            'ServiceCredential',
+            ActivationCredentialTypes.ServiceControllerCredential,
+            EnvironmentCredentialTypes.TestNetworkCredential,
+        ],
+        credentialSubject: {
+            id: organizationDid,
+            '@type': 'Service',
+            serviceType: 'OrganizationControllerService',
+            provider: {
+                '@type': 'Organization',
+                legalName,
+                ...(identifierType === 'taxID'
+                    ? { taxID: organizationIdentifier }
+                    : { identifier: { additionalType: identifierType, value: organizationIdentifier } }),
+            },
+            owner: {
+                '@type': 'Person',
+                additionalType: 'RESPRSN',
+                sameAs: buildStableActorIdentifier({ contactKind: 'email', contact: controllerEmail }),
+                hasOccupation: { '@type': 'Occupation', occupationalCategory: 'ISCO-08|1330' },
+                hasCredential: { material: required(input.controllerKeyMaterial, 'controllerKeyMaterial') },
+            },
+            targetNetwork: 'test-network',
+        },
+    };
+    return [organization, representative, controller];
+}
+function canonicalizeValue(value) {
+    if (Array.isArray(value))
+        return value.map(canonicalizeValue);
+    if (!value || typeof value !== 'object')
+        return value;
+    return Object.fromEntries(Object.entries(value)
+        .filter(([key]) => key !== 'proof')
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([key, nested]) => [key, canonicalizeValue(nested)]));
+}
+/** Deterministic detached-proof payload for one of the three Test Network VCs. */
+export function canonicalizeTestNetworkOrganizationCredential(credential) {
+    if (!TestNetworkOrganizationCredentialTypes.some(type => credential.type.includes(type))) {
+        throw new Error('Credential is not a Test Network organization credential.');
+    }
+    if (credential.credentialSubject?.targetNetwork !== 'test-network') {
+        throw new Error('Test Network organization credential requires targetNetwork=test-network.');
+    }
+    return JSON.stringify(canonicalizeValue(credential));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-common-utils-ts",
-  "version": "2.5.3",
+  "version": "2.5.6",
   "publishConfig": {
     "access": "public"
   },