sos-data-utils-ts 0.1.0 → 0.2.0

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 0.2.0
+
+- Add the shared sector-and-country organization-verification policy for
+  Canadian and US veterinary and human-health organizations.
+- Keep veterinary official-marketplace-phone OTP confirmation distinct from
+  human-health authenticated-email plus postal-code verification.
+- Publish the canonical ConnectHealth production hostnames for animal, human
+  health and SOS runtimes.
+- Require legal organizations to use `Organization/_transaction` and keep any
+  later DCR activation code separate from verification challenges.
+
 ## 0.1.0
 
 - Add the dependency-free shared BFF API-layer contract.

package/README.md

@@ -16,6 +16,24 @@ Sector behavior remains in its owner:
 - `vet-*`: animal/veterinary extensions;
 - the terminology service: international terminology and regional catalogs.
 
+The organization-verification contract resolves policy by business sector and
+ISO country. The governed CA/US profiles are:
+
+- `animal-care`: immutable form/PDF, existing marketplace organization,
+  outbound OTP to its official telephone, confirmation by web or telephone,
+  and marketplace primary-location evidence;
+- `health-care`: immutable form/PDF, existing marketplace organization,
+  authenticated representative/controller email, and a numeric code delivered
+  to the legal postal address and confirmed only in the authenticated portal.
+
+Both use `Organization/_transaction`. `Order/_batch` is used only when a new
+host Offer exists; the later licence/DCR activation code is a different secret.
+Ungoverned sector/country combinations fail closed.
+
+Canonical production operator hosts are `host-vet.connecthealth.info`,
+`host-uhc.connecthealth.info` and `host-sos.connecthealth.info`. Product aliases
+are not host identities or DID domains.
+
 ## Verify
 
 ```bash

package/dist/index.d.ts

@@ -1 +1,2 @@
 export * from './bff-api.js';
+export * from './organization-verification-policy.js';

package/dist/index.js

@@ -1 +1,2 @@
 export * from './bff-api.js';
+export * from './organization-verification-policy.js';

package/dist/organization-verification-policy.d.ts

@@ -0,0 +1,31 @@
+/** Shared production operator identities; product aliases are never host DIDs. */
+export declare const SharedProductionHostnames: Readonly<{
+    readonly animal: "host-vet.connecthealth.info";
+    readonly humanHealth: "host-uhc.connecthealth.info";
+    readonly sos: "host-sos.connecthealth.info";
+}>;
+export declare const OrganizationVerificationSectors: readonly ["animal-care", "health-care"];
+export declare const OrganizationVerificationCountryCodes: readonly ["CA", "US"];
+export type OrganizationVerificationSector = (typeof OrganizationVerificationSectors)[number];
+export type OrganizationVerificationCountryCode = (typeof OrganizationVerificationCountryCodes)[number];
+export type OrganizationVerificationContactProof = 'official-marketplace-phone-otp' | 'authenticated-representative-email';
+export type OrganizationVerificationLegalAddressProof = 'marketplace-primary-location' | 'postal-numeric-code';
+export type OrganizationVerificationConfirmationChannel = 'web' | 'telephone';
+export type OrganizationVerificationPolicy = Readonly<{
+    sector: OrganizationVerificationSector;
+    countryCode: OrganizationVerificationCountryCode;
+    marketplaceOrganizationRequired: true;
+    applicationEvidence: 'immutable-pdf-sha256';
+    contactProof: OrganizationVerificationContactProof;
+    legalAddressProof: OrganizationVerificationLegalAddressProof;
+    confirmationChannels: readonly OrganizationVerificationConfirmationChannel[];
+    telephoneLegalActivationAllowed: boolean;
+    legalOrganizationRoute: 'Organization/_transaction';
+    orderRule: 'only-when-new-host-offer';
+    dcrActivationCodeIsSeparate: true;
+}>;
+/** Resolves explicit sector/country policy and fails closed for ungoverned combinations. */
+export declare function resolveOrganizationVerificationPolicy(input: Readonly<{
+    sector: string;
+    countryCode: string;
+}>): OrganizationVerificationPolicy;

package/dist/organization-verification-policy.js

@@ -0,0 +1,53 @@
+/** Shared production operator identities; product aliases are never host DIDs. */
+export const SharedProductionHostnames = Object.freeze({
+    animal: 'host-vet.connecthealth.info',
+    humanHealth: 'host-uhc.connecthealth.info',
+    sos: 'host-sos.connecthealth.info',
+});
+export const OrganizationVerificationSectors = Object.freeze([
+    'animal-care',
+    'health-care',
+]);
+export const OrganizationVerificationCountryCodes = Object.freeze([
+    'CA',
+    'US',
+]);
+const POLICIES = new Map();
+for (const countryCode of OrganizationVerificationCountryCodes) {
+    POLICIES.set(key('animal-care', countryCode), Object.freeze({
+        sector: 'animal-care',
+        countryCode,
+        marketplaceOrganizationRequired: true,
+        applicationEvidence: 'immutable-pdf-sha256',
+        contactProof: 'official-marketplace-phone-otp',
+        legalAddressProof: 'marketplace-primary-location',
+        confirmationChannels: Object.freeze(['web', 'telephone']),
+        telephoneLegalActivationAllowed: true,
+        legalOrganizationRoute: 'Organization/_transaction',
+        orderRule: 'only-when-new-host-offer',
+        dcrActivationCodeIsSeparate: true,
+    }));
+    POLICIES.set(key('health-care', countryCode), Object.freeze({
+        sector: 'health-care',
+        countryCode,
+        marketplaceOrganizationRequired: true,
+        applicationEvidence: 'immutable-pdf-sha256',
+        contactProof: 'authenticated-representative-email',
+        legalAddressProof: 'postal-numeric-code',
+        confirmationChannels: Object.freeze(['web']),
+        telephoneLegalActivationAllowed: false,
+        legalOrganizationRoute: 'Organization/_transaction',
+        orderRule: 'only-when-new-host-offer',
+        dcrActivationCodeIsSeparate: true,
+    }));
+}
+/** Resolves explicit sector/country policy and fails closed for ungoverned combinations. */
+export function resolveOrganizationVerificationPolicy(input) {
+    const policy = POLICIES.get(key(input.sector, input.countryCode));
+    if (!policy)
+        throw new Error('organization_verification_policy_not_configured');
+    return policy;
+}
+function key(sector, countryCode) {
+    return `${String(sector || '').trim().toLowerCase()}|${String(countryCode || '').trim().toUpperCase()}`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sos-data-utils-ts",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Product-neutral SOS channel and BFF contract utilities",
   "license": "Apache-2.0",
   "type": "module",
@@ -14,6 +14,10 @@
     "./bff-api": {
       "types": "./dist/bff-api.d.ts",
       "default": "./dist/bff-api.js"
+    },
+    "./organization-verification-policy": {
+      "types": "./dist/organization-verification-policy.d.ts",
+      "default": "./dist/organization-verification-policy.js"
     }
   },
   "files": [