gdc-common-utils-ts 2.6.0 → 2.6.2

package/dist/constants/schemaorg.d.ts

@@ -159,6 +159,10 @@ export declare enum ClaimsOrderSchemaorg {
 export declare enum ClaimsPersonSchemaorg {
     /** Schema.org additional type; service-controller VCs use bare `RESPRSN`. */
     additionalType = "org.schema.Person.additionalType",
+    /** ISO 3166 country governing one independently evidenced identity document. */
+    addressCountry = "org.schema.Person.address.addressCountry",
+    /** ISO 3166-2 subdivision when the evidenced identifier is regional. */
+    addressRegion = "org.schema.Person.address.addressRegion",
     /** Second surname or mother's maiden name */
     additionalName = "org.schema.Person.additionalName",
     /** Short friendly name */

package/dist/constants/schemaorg.js

@@ -167,6 +167,10 @@ export var ClaimsPersonSchemaorg;
 (function (ClaimsPersonSchemaorg) {
     /** Schema.org additional type; service-controller VCs use bare `RESPRSN`. */
     ClaimsPersonSchemaorg["additionalType"] = "org.schema.Person.additionalType";
+    /** ISO 3166 country governing one independently evidenced identity document. */
+    ClaimsPersonSchemaorg["addressCountry"] = "org.schema.Person.address.addressCountry";
+    /** ISO 3166-2 subdivision when the evidenced identifier is regional. */
+    ClaimsPersonSchemaorg["addressRegion"] = "org.schema.Person.address.addressRegion";
     /** Second surname or mother's maiden name */
     ClaimsPersonSchemaorg["additionalName"] = "org.schema.Person.additionalName";
     /** Short friendly name */

package/dist/examples/break-glass.d.ts

@@ -0,0 +1,10 @@
+/** Stable product-neutral incident identifier for emergency-access examples. */
+export declare const EXAMPLE_BREAK_GLASS_INCIDENT_ID: "incident-example-001";
+/** Stable product-neutral justification for emergency-access examples. */
+export declare const EXAMPLE_BREAK_GLASS_JUSTIFICATION: "Immediate governed emergency access is required.";
+/** Stable clock instant for deterministic emergency-access examples. */
+export declare const EXAMPLE_BREAK_GLASS_ISSUED_AT: "2026-08-31T12:00:00.000Z";
+/** Stable notifier result for deterministic emergency-access examples. */
+export declare const EXAMPLE_BREAK_GLASS_NOTIFICATION_ID: "notification-example-001";
+/** Stable product-neutral ledger channel for emergency-access examples. */
+export declare const EXAMPLE_BREAK_GLASS_LEDGER_DATA_CHANNEL: "clinical-evidence-eu";

package/dist/examples/break-glass.js

@@ -0,0 +1,11 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+/** Stable product-neutral incident identifier for emergency-access examples. */
+export const EXAMPLE_BREAK_GLASS_INCIDENT_ID = 'incident-example-001';
+/** Stable product-neutral justification for emergency-access examples. */
+export const EXAMPLE_BREAK_GLASS_JUSTIFICATION = 'Immediate governed emergency access is required.';
+/** Stable clock instant for deterministic emergency-access examples. */
+export const EXAMPLE_BREAK_GLASS_ISSUED_AT = '2026-08-31T12:00:00.000Z';
+/** Stable notifier result for deterministic emergency-access examples. */
+export const EXAMPLE_BREAK_GLASS_NOTIFICATION_ID = 'notification-example-001';
+/** Stable product-neutral ledger channel for emergency-access examples. */
+export const EXAMPLE_BREAK_GLASS_LEDGER_DATA_CHANNEL = 'clinical-evidence-eu';

package/dist/examples/index.d.ts

@@ -12,6 +12,7 @@ export * from './license';
 export * from './organization-role-license';
 export * from './invoice';
 export * from './inter-tenant-access-contract';
+export * from './break-glass';
 export * from './subject-identity-binding';
 export * from './related-person';
 export * from './consent-access';

package/dist/examples/index.js

@@ -12,6 +12,7 @@ export * from './license.js';
 export * from './organization-role-license.js';
 export * from './invoice.js';
 export * from './inter-tenant-access-contract.js';
+export * from './break-glass.js';
 export * from './subject-identity-binding.js';
 export * from './related-person.js';
 export * from './consent-access.js';

package/dist/examples/shared.d.ts

@@ -141,6 +141,8 @@ export declare const EXAMPLE_PROVIDER_ORGANIZATION_DID: "did:web:hospital.acme.o
 export declare const EXAMPLE_PROVIDER_ORGANIZATION_URL: "https://hospital.acme.org";
 export declare const EXAMPLE_GATEWAY_PUBLIC_ORIGIN: "https://gateway.example.com";
 export declare const EXAMPLE_HOST_PUBLIC_HOSTNAME: "host.example.com";
+export declare const EXAMPLE_PERSON_CARD_URI: "urn:example:card:person:subject-001";
+export declare const EXAMPLE_ANIMAL_CARD_URI: "urn:example:card:animal:subject-002";
 export declare const EXAMPLE_PROVIDER_TAX_ID: "VATES-B00112233";
 export declare const EXAMPLE_PROVIDER_DOMAIN: "health-care.provider.example.org";
 /** Synthetic public portal domain used to derive organization path DIDs. */

package/dist/examples/shared.js

@@ -159,6 +159,8 @@ export const EXAMPLE_PROVIDER_ORGANIZATION_DID = 'did:web:hospital.acme.org';
 export const EXAMPLE_PROVIDER_ORGANIZATION_URL = 'https://hospital.acme.org';
 export const EXAMPLE_GATEWAY_PUBLIC_ORIGIN = 'https://gateway.example.com';
 export const EXAMPLE_HOST_PUBLIC_HOSTNAME = 'host.example.com';
+export const EXAMPLE_PERSON_CARD_URI = 'urn:example:card:person:subject-001';
+export const EXAMPLE_ANIMAL_CARD_URI = 'urn:example:card:animal:subject-002';
 export const EXAMPLE_PROVIDER_TAX_ID = 'VATES-B00112233';
 export const EXAMPLE_PROVIDER_DOMAIN = 'health-care.provider.example.org';
 /** Synthetic public portal domain used to derive organization path DIDs. */

package/dist/utils/break-glass-policy.d.ts

@@ -0,0 +1,50 @@
+/** Subject categories accepted by the shared emergency-access contract. */
+export declare const BreakGlassSubjectKinds: Readonly<{
+    readonly Human: "human";
+    readonly Animal: "animal";
+}>;
+export type BreakGlassSubjectKind = typeof BreakGlassSubjectKinds[keyof typeof BreakGlassSubjectKinds];
+/** Governed reasons accepted by the shared emergency-access contract. */
+export declare const BreakGlassReasonCodes: Readonly<{
+    readonly LifeThreatening: "life-threatening";
+    readonly SeriousImminentHarm: "serious-imminent-harm";
+    readonly UnconsciousOrIncapacitated: "unconscious-or-incapacitated";
+    readonly AnimalEmergency: "animal-emergency";
+}>;
+export type BreakGlassReasonCode = typeof BreakGlassReasonCodes[keyof typeof BreakGlassReasonCodes];
+/** Transport-neutral emergency request data evaluated before persistence. */
+export type BreakGlassRequest = Readonly<{
+    incidentId: string;
+    subjectKind: BreakGlassSubjectKind;
+    reasonCode: BreakGlassReasonCode;
+    justification: string;
+}>;
+export type BreakGlassPolicyInput = Readonly<{
+    routeSector: string;
+    subjectKind: BreakGlassSubjectKind;
+    professionalRole: string;
+    requestedScope: string;
+    reasonCode: BreakGlassReasonCode;
+}>;
+export type BreakGlassPolicyDecision = Readonly<{
+    allowed: true;
+    maxLifetimeSeconds: 900;
+}> | Readonly<{
+    allowed: false;
+    reason: string;
+}>;
+/** Extension hook owned by a domain package that recognizes its exact subject identifier. */
+export type BreakGlassSubjectKindMatcher = (subjectDid: string, subjectKind: BreakGlassSubjectKind) => boolean;
+/** Matches only neutral subject identifiers. Product/card formats require an injected matcher. */
+export declare const matchesCanonicalBreakGlassSubjectKind: BreakGlassSubjectKindMatcher;
+/**
+ * Resolves one subject identifier through the neutral matcher plus optional
+ * domain matchers. Shared code never imports a product-specific card parser.
+ */
+export declare function matchesBreakGlassSubjectKind(subjectDid: string, subjectKind: BreakGlassSubjectKind, domainMatchers?: readonly BreakGlassSubjectKindMatcher[]): boolean;
+/**
+ * Evaluates the reusable sector, role, reason and read-only scope policy.
+ * GW services orchestrate persistence and audit; domain packages may extend
+ * identifier recognition through the shared matcher interface.
+ */
+export declare function evaluateBreakGlassPolicy(input: BreakGlassPolicyInput): BreakGlassPolicyDecision;

package/dist/utils/break-glass-policy.js

@@ -0,0 +1,85 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+import { HealthcareActorRoleCodes } from '../constants/healthcare.js';
+import { DataspaceSectors } from '../constants/sectors.js';
+/** Subject categories accepted by the shared emergency-access contract. */
+export const BreakGlassSubjectKinds = Object.freeze({
+    Human: 'human',
+    Animal: 'animal',
+});
+/** Governed reasons accepted by the shared emergency-access contract. */
+export const BreakGlassReasonCodes = Object.freeze({
+    LifeThreatening: 'life-threatening',
+    SeriousImminentHarm: 'serious-imminent-harm',
+    UnconsciousOrIncapacitated: 'unconscious-or-incapacitated',
+    AnimalEmergency: 'animal-emergency',
+});
+const RESEARCH_SECTORS = new Set([
+    DataspaceSectors.HealthResearch,
+    DataspaceSectors.AnimalResearch,
+    DataspaceSectors.OneHealthResearch,
+]);
+function occupationCode(value) {
+    const normalized = String(value || '').trim();
+    return (normalized.includes('|') ? normalized.slice(normalized.lastIndexOf('|') + 1) : normalized)
+        .replace(/[^0-9]/g, '');
+}
+function isReadOnlyScope(scope) {
+    const tokens = String(scope || '').split(/\s+/).filter(Boolean);
+    return tokens.length > 0 && tokens.every((token) => {
+        const head = token.split('?', 1)[0] || '';
+        const permission = head.slice(head.lastIndexOf('.') + 1).toLowerCase();
+        return permission === 'r' || permission === 'rs';
+    });
+}
+/** Matches only neutral subject identifiers. Product/card formats require an injected matcher. */
+export const matchesCanonicalBreakGlassSubjectKind = (subjectDid, subjectKind) => {
+    const normalized = String(subjectDid || '').trim().toLowerCase();
+    return subjectKind === BreakGlassSubjectKinds.Human
+        ? normalized.includes(':individual:')
+        : normalized.includes(':animal:');
+};
+/**
+ * Resolves one subject identifier through the neutral matcher plus optional
+ * domain matchers. Shared code never imports a product-specific card parser.
+ */
+export function matchesBreakGlassSubjectKind(subjectDid, subjectKind, domainMatchers = []) {
+    return [matchesCanonicalBreakGlassSubjectKind, ...domainMatchers]
+        .some((matcher) => matcher(subjectDid, subjectKind));
+}
+/**
+ * Evaluates the reusable sector, role, reason and read-only scope policy.
+ * GW services orchestrate persistence and audit; domain packages may extend
+ * identifier recognition through the shared matcher interface.
+ */
+export function evaluateBreakGlassPolicy(input) {
+    const routeSector = String(input.routeSector || '').trim().toLowerCase();
+    if (RESEARCH_SECTORS.has(routeSector)) {
+        return { allowed: false, reason: 'research_sector_forbidden' };
+    }
+    if (!isReadOnlyScope(input.requestedScope)) {
+        return { allowed: false, reason: 'read_only_scope_required' };
+    }
+    const role = occupationCode(input.professionalRole);
+    if (input.subjectKind === BreakGlassSubjectKinds.Human) {
+        if (routeSector !== DataspaceSectors.HealthCare) {
+            return { allowed: false, reason: 'human_sector_mismatch' };
+        }
+        if (!role.startsWith(HealthcareActorRoleCodes.MedicalDoctors)) {
+            return { allowed: false, reason: 'professional_role_not_authorized' };
+        }
+        if (input.reasonCode === BreakGlassReasonCodes.AnimalEmergency) {
+            return { allowed: false, reason: 'reason_subject_mismatch' };
+        }
+        return { allowed: true, maxLifetimeSeconds: 900 };
+    }
+    if (routeSector !== DataspaceSectors.AnimalCare) {
+        return { allowed: false, reason: 'animal_sector_mismatch' };
+    }
+    if (role !== HealthcareActorRoleCodes.Veterinarian) {
+        return { allowed: false, reason: 'professional_role_not_authorized' };
+    }
+    if (input.reasonCode !== BreakGlassReasonCodes.AnimalEmergency) {
+        return { allowed: false, reason: 'reason_subject_mismatch' };
+    }
+    return { allowed: true, maxLifetimeSeconds: 900 };
+}

package/dist/utils/index.d.ts

@@ -118,3 +118,4 @@ export * from './wallet-memory-queue';
 export * from './profile-outbox-memory-repository';
 export * from './backend-message-manager-mem';
 export * from './profile-manager-mem';
+export * from './break-glass-policy';

package/dist/utils/index.js

@@ -118,3 +118,4 @@ export * from './wallet-memory-queue.js';
 export * from './profile-outbox-memory-repository.js';
 export * from './backend-message-manager-mem.js';
 export * from './profile-manager-mem.js';
+export * from './break-glass-policy.js';

package/dist/utils/subject-identity-binding.js

@@ -11,7 +11,7 @@ function isDidWeb(value) {
 }
 function isPhysicalSupportDid(value) {
     const segments = value.toLowerCase().split(':');
-    return segments.includes('card') || segments.includes('petd');
+    return segments.includes('card');
 }
 function isIndividualIdentityDid(value) {
     return isDidWeb(value) && !isPhysicalSupportDid(value);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-common-utils-ts",
-  "version": "2.6.0",
+  "version": "2.6.2",
   "publishConfig": {
     "access": "public"
   },