gdc-common-utils-ts 2.6.1 → 2.6.3

package/dist/constants/employee-lifecycle.d.ts

@@ -16,6 +16,11 @@ export declare const EmployeeLifecycleActions: Readonly<{
 export declare const EmployeeLifecycleQueryActions: Readonly<{
     readonly List: "list";
 }>;
+/** Stable response-entry types for the shared employee and seat directory. */
+export declare const OrganizationEmployeeSearchResponseEntryTypes: Readonly<{
+    readonly Employee: "Employee-search-response-v1.0";
+    readonly License: "License-search-response-v1.0";
+}>;
 export type EmployeeLifecycleAction = typeof EmployeeLifecycleActions[keyof typeof EmployeeLifecycleActions];
 /** Version tag for routing metadata stored outside the high-entropy GW credential. */
 export declare const EmployeeActivationGrantVersions: Readonly<{

package/dist/constants/employee-lifecycle.js

@@ -15,6 +15,11 @@ export const EmployeeLifecycleActions = Object.freeze({
 export const EmployeeLifecycleQueryActions = Object.freeze({
     List: 'list',
 });
+/** Stable response-entry types for the shared employee and seat directory. */
+export const OrganizationEmployeeSearchResponseEntryTypes = Object.freeze({
+    Employee: 'Employee-search-response-v1.0',
+    License: 'License-search-response-v1.0',
+});
 /** Version tag for routing metadata stored outside the high-entropy GW credential. */
 export const EmployeeActivationGrantVersions = Object.freeze({
     V1: 'employee-activation-grant-v1',

package/dist/examples/break-glass.d.ts

@@ -0,0 +1,10 @@
+/** Stable product-neutral incident identifier for emergency-access examples. */
+export declare const EXAMPLE_BREAK_GLASS_INCIDENT_ID: "incident-example-001";
+/** Stable product-neutral justification for emergency-access examples. */
+export declare const EXAMPLE_BREAK_GLASS_JUSTIFICATION: "Immediate governed emergency access is required.";
+/** Stable clock instant for deterministic emergency-access examples. */
+export declare const EXAMPLE_BREAK_GLASS_ISSUED_AT: "2026-08-31T12:00:00.000Z";
+/** Stable notifier result for deterministic emergency-access examples. */
+export declare const EXAMPLE_BREAK_GLASS_NOTIFICATION_ID: "notification-example-001";
+/** Stable product-neutral ledger channel for emergency-access examples. */
+export declare const EXAMPLE_BREAK_GLASS_LEDGER_DATA_CHANNEL: "clinical-evidence-eu";

package/dist/examples/break-glass.js

@@ -0,0 +1,11 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+/** Stable product-neutral incident identifier for emergency-access examples. */
+export const EXAMPLE_BREAK_GLASS_INCIDENT_ID = 'incident-example-001';
+/** Stable product-neutral justification for emergency-access examples. */
+export const EXAMPLE_BREAK_GLASS_JUSTIFICATION = 'Immediate governed emergency access is required.';
+/** Stable clock instant for deterministic emergency-access examples. */
+export const EXAMPLE_BREAK_GLASS_ISSUED_AT = '2026-08-31T12:00:00.000Z';
+/** Stable notifier result for deterministic emergency-access examples. */
+export const EXAMPLE_BREAK_GLASS_NOTIFICATION_ID = 'notification-example-001';
+/** Stable product-neutral ledger channel for emergency-access examples. */
+export const EXAMPLE_BREAK_GLASS_LEDGER_DATA_CHANNEL = 'clinical-evidence-eu';

package/dist/examples/employee.d.ts

@@ -75,11 +75,43 @@ export declare function buildExampleEmployeeClaims(record: ExampleEmployeeRecord
  * to show employee directory flows without reauthoring `meta.claims` by hand.
  */
 export declare const EXAMPLE_EMPLOYEE_SEARCH_RESPONSE_BODY: Readonly<{
+    readonly resourceType: "Bundle";
+    readonly type: "batch-response";
+    readonly total: 3;
     readonly data: {
-        id: string;
-        meta: {
+        type: "Employee-search-response-v1.0";
+        resource: {
+            id: string;
             status: "active" | "inactive" | "purged";
             claims: Readonly<Record<string, string>>;
+            meta: {
+                status: "active" | "inactive" | "purged";
+                claims: Readonly<Record<string, string>>;
+            };
+        };
+        response: {
+            status: "200";
         };
     }[];
 }>;
+/** @deprecated Read-only fixture for GW versions that nested search rows. */
+export declare const EXAMPLE_EMPLOYEE_SEARCH_RESPONSE_BODY_LEGACY: Readonly<{
+    readonly data: readonly [{
+        readonly type: "Employee-search-response-v1.0";
+        readonly resource: {
+            readonly total: 3;
+            readonly data: {
+                id: string;
+                status: "active" | "inactive" | "purged";
+                claims: Readonly<Record<string, string>>;
+                meta: {
+                    status: "active" | "inactive" | "purged";
+                    claims: Readonly<Record<string, string>>;
+                };
+            }[];
+        };
+        readonly response: {
+            readonly status: "200";
+        };
+    }];
+}>;

package/dist/examples/employee.js

@@ -1,4 +1,6 @@
+import { OrganizationEmployeeSearchResponseEntryTypes } from '../constants/employee-lifecycle.js';
 import { ClaimsPersonSchemaorg } from '../constants/schemaorg.js';
+import { EXAMPLE_BUNDLE_RESOURCE_TYPE, EXAMPLE_BUNDLE_TYPE_BATCH_RESPONSE, ExampleHttpStatusText, } from './shared.js';
 export const ExampleEmployeeEmails = Object.freeze({
     SharedProfessional: 'shared.professional@example.org',
 });
@@ -68,11 +70,31 @@ export function buildExampleEmployeeClaims(record) {
  * to show employee directory flows without reauthoring `meta.claims` by hand.
  */
 export const EXAMPLE_EMPLOYEE_SEARCH_RESPONSE_BODY = Object.freeze({
+    resourceType: EXAMPLE_BUNDLE_RESOURCE_TYPE,
+    type: EXAMPLE_BUNDLE_TYPE_BATCH_RESPONSE,
+    total: EXAMPLE_EMPLOYEE_DIRECTORY_RECORDS.length,
     data: EXAMPLE_EMPLOYEE_DIRECTORY_RECORDS.map((record) => ({
-        id: record.resourceId,
-        meta: {
+        type: OrganizationEmployeeSearchResponseEntryTypes.Employee,
+        resource: {
+            id: record.resourceId,
             status: record.status,
             claims: buildExampleEmployeeClaims(record),
+            meta: {
+                status: record.status,
+                claims: buildExampleEmployeeClaims(record),
+            },
         },
+        response: { status: ExampleHttpStatusText.Ok },
     })),
 });
+/** @deprecated Read-only fixture for GW versions that nested search rows. */
+export const EXAMPLE_EMPLOYEE_SEARCH_RESPONSE_BODY_LEGACY = Object.freeze({
+    data: [{
+            type: OrganizationEmployeeSearchResponseEntryTypes.Employee,
+            resource: {
+                total: EXAMPLE_EMPLOYEE_SEARCH_RESPONSE_BODY.total,
+                data: EXAMPLE_EMPLOYEE_SEARCH_RESPONSE_BODY.data.map(entry => entry.resource),
+            },
+            response: { status: ExampleHttpStatusText.Ok },
+        }],
+});

package/dist/examples/index.d.ts

@@ -12,6 +12,7 @@ export * from './license';
 export * from './organization-role-license';
 export * from './invoice';
 export * from './inter-tenant-access-contract';
+export * from './break-glass';
 export * from './subject-identity-binding';
 export * from './related-person';
 export * from './consent-access';

package/dist/examples/index.js

@@ -12,6 +12,7 @@ export * from './license.js';
 export * from './organization-role-license.js';
 export * from './invoice.js';
 export * from './inter-tenant-access-contract.js';
+export * from './break-glass.js';
 export * from './subject-identity-binding.js';
 export * from './related-person.js';
 export * from './consent-access.js';

package/dist/examples/license.d.ts

@@ -141,9 +141,50 @@ export declare const EXAMPLE_LICENSE_ISSUE_RESPONSE_BODY: Readonly<{
 }>;
 /** Shared license search response containing the default two-installation state. */
 export declare const EXAMPLE_LICENSE_LIST_RESPONSE_BODY_WITH_DEVICES: Readonly<{
+    readonly body: {
+        readonly resourceType: "Bundle";
+        readonly type: "batch-response";
+        readonly total: 1;
+        readonly data: readonly [{
+            readonly type: "License-search-response-v1.0";
+            readonly resource: {
+                readonly id: "8a8a5e1b-0d8e-4a7c-8c39-3b8034440001";
+                readonly meta: {
+                    readonly status: "active";
+                    readonly subjectId: string;
+                    readonly maxDevices: 2;
+                    readonly deviceBindings: readonly [Readonly<{
+                        clientId: "client-employee-primary";
+                        clientInstanceId: "installation-employee-primary";
+                        status: "active";
+                        deviceInfo: Readonly<{
+                            clientInstanceId: "installation-employee-primary";
+                            model: "Shared browser profile";
+                        }>;
+                        activatedAt: 1786570800;
+                    }>, Readonly<{
+                        clientId: "client-employee-secondary";
+                        clientInstanceId: "installation-employee-secondary";
+                        status: "revoked";
+                        deviceInfo: Readonly<{
+                            clientInstanceId: "installation-employee-secondary";
+                        }>;
+                        activatedAt: 1786570900;
+                        revokedAt: 1786571000;
+                    }>];
+                };
+            };
+            readonly response: {
+                readonly status: "200";
+            };
+        }];
+    };
+}>;
+/** @deprecated Read-only fixture for GW versions that nested search rows. */
+export declare const EXAMPLE_LICENSE_LIST_RESPONSE_BODY_WITH_DEVICES_LEGACY: Readonly<{
     readonly body: {
         readonly resource: {
-            readonly data: readonly [{
+            readonly data: {
                 readonly id: "8a8a5e1b-0d8e-4a7c-8c39-3b8034440001";
                 readonly meta: {
                     readonly status: "active";
@@ -169,7 +210,7 @@ export declare const EXAMPLE_LICENSE_LIST_RESPONSE_BODY_WITH_DEVICES: Readonly<{
                         revokedAt: 1786571000;
                     }>];
                 };
-            }];
+            }[];
         };
     };
 }>;

package/dist/examples/license.js

@@ -1,8 +1,9 @@
 import { DeviceAppTypes, DeviceBindingStatuses, DeviceUserClasses } from '../constants/device.js';
+import { OrganizationEmployeeSearchResponseEntryTypes } from '../constants/employee-lifecycle.js';
 import { ClaimsOrderSchemaorg, ClaimsIndividualProductSchemaorg, ClaimsOfferSchemaorg, ClaimsPersonSchemaorg, } from '../constants/schemaorg.js';
 import { buildLicenseIssueClaims, buildLicensePurchaseClaims, LicenseClaimContext, LicenseCategories, LicenseStatuses, } from '../utils/license.js';
 import { createLicenseOfferOrderEditor } from '../utils/license-offer-order.js';
-import { EXAMPLE_LICENSE_ACCEPTED_OFFER_ID, EXAMPLE_LICENSE_AMOUNT, EXAMPLE_LICENSE_CHECKOUT_URL, EXAMPLE_LICENSE_CURRENCY, EXAMPLE_EMAIL_CONTROLLER_ORG, EXAMPLE_EMPLOYEE_ACTIVATION_CODE, EXAMPLE_EMPLOYEE_DEVICE_CLIENT_ID_PRIMARY, EXAMPLE_EMPLOYEE_DEVICE_CLIENT_ID_SECONDARY, EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_PRIMARY, EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_SECONDARY, EXAMPLE_EMPLOYEE_DEVICE_MODEL_PRIMARY, EXAMPLE_HEALTHCARE_ACTOR_ROLE_GENERALIST_MEDICAL_PRACTITIONER, EXAMPLE_LICENSE_INVOICE_ID, EXAMPLE_LICENSE_OFFER_ID, EXAMPLE_LICENSE_PLAN_DEFAULT, EXAMPLE_LICENSE_PAYMENT_METHOD_INVOICE, EXAMPLE_LICENSE_PAYMENT_URL, EXAMPLE_LICENSE_RENEWAL_CYCLE_YEARLY, EXAMPLE_LICENSE_PLAN_NAME, EXAMPLE_LICENSE_SEAT_UUID_ACTIVE, EXAMPLE_LICENSE_SEAT_UUID_AVAILABLE, EXAMPLE_LICENSE_SEAT_UUID_SECONDARY, EXAMPLE_LICENSE_SKU, EXAMPLE_LICENSE_SUBJECT_ID_ACTIVE, EXAMPLE_LICENSE_SUBJECT_ID_AVAILABLE, EXAMPLE_TENANT_IDENTIFIER, } from './shared.js';
+import { EXAMPLE_LICENSE_ACCEPTED_OFFER_ID, EXAMPLE_LICENSE_AMOUNT, EXAMPLE_LICENSE_CHECKOUT_URL, EXAMPLE_LICENSE_CURRENCY, EXAMPLE_EMAIL_CONTROLLER_ORG, EXAMPLE_EMPLOYEE_ACTIVATION_CODE, EXAMPLE_EMPLOYEE_DEVICE_CLIENT_ID_PRIMARY, EXAMPLE_EMPLOYEE_DEVICE_CLIENT_ID_SECONDARY, EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_PRIMARY, EXAMPLE_EMPLOYEE_DEVICE_INSTANCE_ID_SECONDARY, EXAMPLE_EMPLOYEE_DEVICE_MODEL_PRIMARY, EXAMPLE_BUNDLE_RESOURCE_TYPE, EXAMPLE_BUNDLE_TYPE_BATCH_RESPONSE, EXAMPLE_HEALTHCARE_ACTOR_ROLE_GENERALIST_MEDICAL_PRACTITIONER, EXAMPLE_LICENSE_INVOICE_ID, EXAMPLE_LICENSE_OFFER_ID, EXAMPLE_LICENSE_PLAN_DEFAULT, EXAMPLE_LICENSE_PAYMENT_METHOD_INVOICE, EXAMPLE_LICENSE_PAYMENT_URL, EXAMPLE_LICENSE_RENEWAL_CYCLE_YEARLY, EXAMPLE_LICENSE_PLAN_NAME, EXAMPLE_LICENSE_SEAT_UUID_ACTIVE, EXAMPLE_LICENSE_SEAT_UUID_AVAILABLE, EXAMPLE_LICENSE_SEAT_UUID_SECONDARY, EXAMPLE_LICENSE_SKU, EXAMPLE_LICENSE_SUBJECT_ID_ACTIVE, EXAMPLE_LICENSE_SUBJECT_ID_AVAILABLE, EXAMPLE_TENANT_IDENTIFIER, ExampleHttpStatusText, } from './shared.js';
 import { DEFAULT_LICENSE_DEVICE_ALLOWANCE } from '../utils/license.js';
 import { EXAMPLE_EMPLOYEE_CONTROLLER_ACTIVE } from './employee.js';
 export const EXAMPLE_EMPLOYEE_DEVICE_BINDINGS = Object.freeze([
@@ -123,8 +124,12 @@ export const EXAMPLE_LICENSE_ISSUE_RESPONSE_BODY = Object.freeze({
 /** Shared license search response containing the default two-installation state. */
 export const EXAMPLE_LICENSE_LIST_RESPONSE_BODY_WITH_DEVICES = Object.freeze({
     body: {
-        resource: {
-            data: [{
+        resourceType: EXAMPLE_BUNDLE_RESOURCE_TYPE,
+        type: EXAMPLE_BUNDLE_TYPE_BATCH_RESPONSE,
+        total: 1,
+        data: [{
+                type: OrganizationEmployeeSearchResponseEntryTypes.License,
+                resource: {
                     id: EXAMPLE_LICENSE_ACTIVE_RECORD.id,
                     meta: {
                         status: EXAMPLE_LICENSE_ACTIVE_RECORD.status,
@@ -132,7 +137,16 @@ export const EXAMPLE_LICENSE_LIST_RESPONSE_BODY_WITH_DEVICES = Object.freeze({
                         maxDevices: DEFAULT_LICENSE_DEVICE_ALLOWANCE,
                         deviceBindings: EXAMPLE_EMPLOYEE_DEVICE_BINDINGS,
                     },
-                }],
+                },
+                response: { status: ExampleHttpStatusText.Ok },
+            }],
+    },
+});
+/** @deprecated Read-only fixture for GW versions that nested search rows. */
+export const EXAMPLE_LICENSE_LIST_RESPONSE_BODY_WITH_DEVICES_LEGACY = Object.freeze({
+    body: {
+        resource: {
+            data: EXAMPLE_LICENSE_LIST_RESPONSE_BODY_WITH_DEVICES.body.data.map(entry => entry.resource),
         },
     },
 });

package/dist/examples/shared.d.ts

@@ -141,6 +141,8 @@ export declare const EXAMPLE_PROVIDER_ORGANIZATION_DID: "did:web:hospital.acme.o
 export declare const EXAMPLE_PROVIDER_ORGANIZATION_URL: "https://hospital.acme.org";
 export declare const EXAMPLE_GATEWAY_PUBLIC_ORIGIN: "https://gateway.example.com";
 export declare const EXAMPLE_HOST_PUBLIC_HOSTNAME: "host.example.com";
+export declare const EXAMPLE_PERSON_CARD_URI: "urn:example:card:person:subject-001";
+export declare const EXAMPLE_ANIMAL_CARD_URI: "urn:example:card:animal:subject-002";
 export declare const EXAMPLE_PROVIDER_TAX_ID: "VATES-B00112233";
 export declare const EXAMPLE_PROVIDER_DOMAIN: "health-care.provider.example.org";
 /** Synthetic public portal domain used to derive organization path DIDs. */
@@ -245,6 +247,7 @@ export declare const EXAMPLE_CONTENT_TYPE_FHIR_JSON: "application/fhir+json";
 export declare const EXAMPLE_IPS_BUNDLE_ATTACHMENT_TITLE: "IPS Document Bundle";
 export declare const EXAMPLE_BUNDLE_RESOURCE_TYPE: "Bundle";
 export declare const EXAMPLE_BUNDLE_TYPE_BATCH: "batch";
+export declare const EXAMPLE_BUNDLE_TYPE_BATCH_RESPONSE: "batch-response";
 export declare const EXAMPLE_BUNDLE_TYPE_DOCUMENT: "document";
 export declare const EXAMPLE_MEDICATION_STATEMENT_UUID: "urn:uuid:medication-statement-example-001";
 export declare const EXAMPLE_MEDICATION_STATEMENT_IDENTIFIER: "urn:uuid:medication-statement-example-001";

package/dist/examples/shared.js

@@ -159,6 +159,8 @@ export const EXAMPLE_PROVIDER_ORGANIZATION_DID = 'did:web:hospital.acme.org';
 export const EXAMPLE_PROVIDER_ORGANIZATION_URL = 'https://hospital.acme.org';
 export const EXAMPLE_GATEWAY_PUBLIC_ORIGIN = 'https://gateway.example.com';
 export const EXAMPLE_HOST_PUBLIC_HOSTNAME = 'host.example.com';
+export const EXAMPLE_PERSON_CARD_URI = 'urn:example:card:person:subject-001';
+export const EXAMPLE_ANIMAL_CARD_URI = 'urn:example:card:animal:subject-002';
 export const EXAMPLE_PROVIDER_TAX_ID = 'VATES-B00112233';
 export const EXAMPLE_PROVIDER_DOMAIN = 'health-care.provider.example.org';
 /** Synthetic public portal domain used to derive organization path DIDs. */
@@ -287,6 +289,7 @@ export const EXAMPLE_CONTENT_TYPE_FHIR_JSON = 'application/fhir+json';
 export const EXAMPLE_IPS_BUNDLE_ATTACHMENT_TITLE = 'IPS Document Bundle';
 export const EXAMPLE_BUNDLE_RESOURCE_TYPE = 'Bundle';
 export const EXAMPLE_BUNDLE_TYPE_BATCH = 'batch';
+export const EXAMPLE_BUNDLE_TYPE_BATCH_RESPONSE = 'batch-response';
 export const EXAMPLE_BUNDLE_TYPE_DOCUMENT = 'document';
 export const EXAMPLE_MEDICATION_STATEMENT_UUID = 'urn:uuid:medication-statement-example-001';
 export const EXAMPLE_MEDICATION_STATEMENT_IDENTIFIER = EXAMPLE_MEDICATION_STATEMENT_UUID;

package/dist/utils/break-glass-policy.d.ts

@@ -0,0 +1,50 @@
+/** Subject categories accepted by the shared emergency-access contract. */
+export declare const BreakGlassSubjectKinds: Readonly<{
+    readonly Human: "human";
+    readonly Animal: "animal";
+}>;
+export type BreakGlassSubjectKind = typeof BreakGlassSubjectKinds[keyof typeof BreakGlassSubjectKinds];
+/** Governed reasons accepted by the shared emergency-access contract. */
+export declare const BreakGlassReasonCodes: Readonly<{
+    readonly LifeThreatening: "life-threatening";
+    readonly SeriousImminentHarm: "serious-imminent-harm";
+    readonly UnconsciousOrIncapacitated: "unconscious-or-incapacitated";
+    readonly AnimalEmergency: "animal-emergency";
+}>;
+export type BreakGlassReasonCode = typeof BreakGlassReasonCodes[keyof typeof BreakGlassReasonCodes];
+/** Transport-neutral emergency request data evaluated before persistence. */
+export type BreakGlassRequest = Readonly<{
+    incidentId: string;
+    subjectKind: BreakGlassSubjectKind;
+    reasonCode: BreakGlassReasonCode;
+    justification: string;
+}>;
+export type BreakGlassPolicyInput = Readonly<{
+    routeSector: string;
+    subjectKind: BreakGlassSubjectKind;
+    professionalRole: string;
+    requestedScope: string;
+    reasonCode: BreakGlassReasonCode;
+}>;
+export type BreakGlassPolicyDecision = Readonly<{
+    allowed: true;
+    maxLifetimeSeconds: 900;
+}> | Readonly<{
+    allowed: false;
+    reason: string;
+}>;
+/** Extension hook owned by a domain package that recognizes its exact subject identifier. */
+export type BreakGlassSubjectKindMatcher = (subjectDid: string, subjectKind: BreakGlassSubjectKind) => boolean;
+/** Matches only neutral subject identifiers. Product/card formats require an injected matcher. */
+export declare const matchesCanonicalBreakGlassSubjectKind: BreakGlassSubjectKindMatcher;
+/**
+ * Resolves one subject identifier through the neutral matcher plus optional
+ * domain matchers. Shared code never imports a product-specific card parser.
+ */
+export declare function matchesBreakGlassSubjectKind(subjectDid: string, subjectKind: BreakGlassSubjectKind, domainMatchers?: readonly BreakGlassSubjectKindMatcher[]): boolean;
+/**
+ * Evaluates the reusable sector, role, reason and read-only scope policy.
+ * GW services orchestrate persistence and audit; domain packages may extend
+ * identifier recognition through the shared matcher interface.
+ */
+export declare function evaluateBreakGlassPolicy(input: BreakGlassPolicyInput): BreakGlassPolicyDecision;

package/dist/utils/break-glass-policy.js

@@ -0,0 +1,85 @@
+// Copyright 2026 Antifraud Services Inc. under the Apache License, Version 2.0.
+import { HealthcareActorRoleCodes } from '../constants/healthcare.js';
+import { DataspaceSectors } from '../constants/sectors.js';
+/** Subject categories accepted by the shared emergency-access contract. */
+export const BreakGlassSubjectKinds = Object.freeze({
+    Human: 'human',
+    Animal: 'animal',
+});
+/** Governed reasons accepted by the shared emergency-access contract. */
+export const BreakGlassReasonCodes = Object.freeze({
+    LifeThreatening: 'life-threatening',
+    SeriousImminentHarm: 'serious-imminent-harm',
+    UnconsciousOrIncapacitated: 'unconscious-or-incapacitated',
+    AnimalEmergency: 'animal-emergency',
+});
+const RESEARCH_SECTORS = new Set([
+    DataspaceSectors.HealthResearch,
+    DataspaceSectors.AnimalResearch,
+    DataspaceSectors.OneHealthResearch,
+]);
+function occupationCode(value) {
+    const normalized = String(value || '').trim();
+    return (normalized.includes('|') ? normalized.slice(normalized.lastIndexOf('|') + 1) : normalized)
+        .replace(/[^0-9]/g, '');
+}
+function isReadOnlyScope(scope) {
+    const tokens = String(scope || '').split(/\s+/).filter(Boolean);
+    return tokens.length > 0 && tokens.every((token) => {
+        const head = token.split('?', 1)[0] || '';
+        const permission = head.slice(head.lastIndexOf('.') + 1).toLowerCase();
+        return permission === 'r' || permission === 'rs';
+    });
+}
+/** Matches only neutral subject identifiers. Product/card formats require an injected matcher. */
+export const matchesCanonicalBreakGlassSubjectKind = (subjectDid, subjectKind) => {
+    const normalized = String(subjectDid || '').trim().toLowerCase();
+    return subjectKind === BreakGlassSubjectKinds.Human
+        ? normalized.includes(':individual:')
+        : normalized.includes(':animal:');
+};
+/**
+ * Resolves one subject identifier through the neutral matcher plus optional
+ * domain matchers. Shared code never imports a product-specific card parser.
+ */
+export function matchesBreakGlassSubjectKind(subjectDid, subjectKind, domainMatchers = []) {
+    return [matchesCanonicalBreakGlassSubjectKind, ...domainMatchers]
+        .some((matcher) => matcher(subjectDid, subjectKind));
+}
+/**
+ * Evaluates the reusable sector, role, reason and read-only scope policy.
+ * GW services orchestrate persistence and audit; domain packages may extend
+ * identifier recognition through the shared matcher interface.
+ */
+export function evaluateBreakGlassPolicy(input) {
+    const routeSector = String(input.routeSector || '').trim().toLowerCase();
+    if (RESEARCH_SECTORS.has(routeSector)) {
+        return { allowed: false, reason: 'research_sector_forbidden' };
+    }
+    if (!isReadOnlyScope(input.requestedScope)) {
+        return { allowed: false, reason: 'read_only_scope_required' };
+    }
+    const role = occupationCode(input.professionalRole);
+    if (input.subjectKind === BreakGlassSubjectKinds.Human) {
+        if (routeSector !== DataspaceSectors.HealthCare) {
+            return { allowed: false, reason: 'human_sector_mismatch' };
+        }
+        if (!role.startsWith(HealthcareActorRoleCodes.MedicalDoctors)) {
+            return { allowed: false, reason: 'professional_role_not_authorized' };
+        }
+        if (input.reasonCode === BreakGlassReasonCodes.AnimalEmergency) {
+            return { allowed: false, reason: 'reason_subject_mismatch' };
+        }
+        return { allowed: true, maxLifetimeSeconds: 900 };
+    }
+    if (routeSector !== DataspaceSectors.AnimalCare) {
+        return { allowed: false, reason: 'animal_sector_mismatch' };
+    }
+    if (role !== HealthcareActorRoleCodes.Veterinarian) {
+        return { allowed: false, reason: 'professional_role_not_authorized' };
+    }
+    if (input.reasonCode !== BreakGlassReasonCodes.AnimalEmergency) {
+        return { allowed: false, reason: 'reason_subject_mismatch' };
+    }
+    return { allowed: true, maxLifetimeSeconds: 900 };
+}

package/dist/utils/index.d.ts

@@ -118,3 +118,4 @@ export * from './wallet-memory-queue';
 export * from './profile-outbox-memory-repository';
 export * from './backend-message-manager-mem';
 export * from './profile-manager-mem';
+export * from './break-glass-policy';

package/dist/utils/index.js

@@ -118,3 +118,4 @@ export * from './wallet-memory-queue.js';
 export * from './profile-outbox-memory-repository.js';
 export * from './backend-message-manager-mem.js';
 export * from './profile-manager-mem.js';
+export * from './break-glass-policy.js';

package/dist/utils/organization-employee-lifecycle.d.ts

@@ -3,8 +3,16 @@ import type { EmployeeDeviceRevocationTarget, OrganizationEmployeeLifecycleRecor
 export declare function buildEmployeeDeviceRevocationBody(target: EmployeeDeviceRevocationTarget): Readonly<Record<string, string>>;
 /** Reads an employee activation credential from canonical and legacy GW envelopes. */
 export declare function readEmployeeActivationCode(value: unknown): string;
-/** Extracts GW search rows regardless of async job envelope depth. */
-export declare function extractGwSearchResources(value: unknown): ReadonlyArray<Record<string, unknown>>;
+/**
+ * Extracts primary resources from a DIDComm FHIR-like response Bundle.
+ *
+ * Canonical search matches live at `body.data[].resource`. The deprecated
+ * `resource.{total,data}` aggregate remains a read-only compatibility path so
+ * an SDK can survive a rolling GW deployment; producers must not emit it.
+ */
+export declare function extractBundleSearchResources(value: unknown): ReadonlyArray<Record<string, unknown>>;
+/** @deprecated Use the transport-neutral `extractBundleSearchResources`. */
+export declare const extractGwSearchResources: typeof extractBundleSearchResources;
 /** Combines employee directory and license search results into one typed view. */
 export declare function projectOrganizationEmployeeLifecycle(input: Readonly<{
     employeeResponse: unknown;

package/dist/utils/organization-employee-lifecycle.js

@@ -25,19 +25,47 @@ export function readEmployeeActivationCode(value) {
     }
     return '';
 }
-/** Extracts GW search rows regardless of async job envelope depth. */
-export function extractGwSearchResources(value) {
+/**
+ * Extracts primary resources from a DIDComm FHIR-like response Bundle.
+ *
+ * Canonical search matches live at `body.data[].resource`. The deprecated
+ * `resource.{total,data}` aggregate remains a read-only compatibility path so
+ * an SDK can survive a rolling GW deployment; producers must not emit it.
+ */
+export function extractBundleSearchResources(value) {
     for (const candidate of listNestedRecords(value)) {
-        const data = record(candidate.resource)?.data || candidate.data;
-        if (Array.isArray(data))
-            return data.map(record).filter(isRecord);
+        if (!Array.isArray(candidate.data))
+            continue;
+        const entries = candidate.data.map(record).filter(isRecord);
+        if (entries.length === 0)
+            return [];
+        const resources = entries.flatMap((entry) => {
+            const resource = record(entry.resource);
+            if (!resource)
+                return [];
+            const legacyRows = resource.total !== undefined && Array.isArray(resource.data)
+                ? resource.data.map(record).filter(isRecord)
+                : undefined;
+            return legacyRows ?? [resource];
+        });
+        if (resources.length > 0)
+            return resources;
+        // Compatibility for older SDK fixtures that passed already-extracted rows.
+        return entries;
+    }
+    for (const candidate of listNestedRecords(value)) {
+        const legacyRows = record(candidate.resource)?.data;
+        if (Array.isArray(legacyRows))
+            return legacyRows.map(record).filter(isRecord);
     }
     return [];
 }
+/** @deprecated Use the transport-neutral `extractBundleSearchResources`. */
+export const extractGwSearchResources = extractBundleSearchResources;
 /** Combines employee directory and license search results into one typed view. */
 export function projectOrganizationEmployeeLifecycle(input) {
-    const licenses = extractGwSearchResources(input.licenseResponse);
-    return extractGwSearchResources(input.employeeResponse).map((employee) => {
+    const licenses = extractBundleSearchResources(input.licenseResponse);
+    return extractBundleSearchResources(input.employeeResponse).map((employee) => {
         const claims = record(employee.claims) || record(record(employee.meta)?.claims) || {};
         const resourceId = text(employee.id);
         const employeeDid = text(claims[ClaimsPersonSchemaorg.identifier]);

package/dist/utils/subject-identity-binding.js

@@ -11,7 +11,7 @@ function isDidWeb(value) {
 }
 function isPhysicalSupportDid(value) {
     const segments = value.toLowerCase().split(':');
-    return segments.includes('card') || segments.includes('petd');
+    return segments.includes('card');
 }
 function isIndividualIdentityDid(value) {
     return isDidWeb(value) && !isPhysicalSupportDid(value);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-common-utils-ts",
-  "version": "2.6.1",
+  "version": "2.6.3",
   "publishConfig": {
     "access": "public"
   },