From b896cbd53fbf5baff012bcbc1c6aeec429b5f8f6 Mon Sep 17 00:00:00 2001
From: Simon Schweizer <simon@schwzr.de>
Date: Sun, 8 Mar 2026 22:32:29 +0100
Subject: [PATCH 1/6] minimal allowlist generator

---
 docs/src/.vuepress/client.ts                  |   3 +-
 .../components/AllowListGenerator.vue         | 587 ++++++++++++++++++
 docs/src/.vuepress/sidebar/operations-v2.ts   |   2 +-
 .../operations/v2.0.2/allowlist-generator.md  |  23 +
 4 files changed, 613 insertions(+), 2 deletions(-)
 create mode 100644 docs/src/.vuepress/components/AllowListGenerator.vue
 create mode 100644 docs/src/operations/v2.0.2/allowlist-generator.md

diff --git a/docs/src/.vuepress/client.ts b/docs/src/.vuepress/client.ts
index 5d8b1b1b5..72ed8e6e8 100644
--- a/docs/src/.vuepress/client.ts
+++ b/docs/src/.vuepress/client.ts
@@ -4,12 +4,13 @@ import { Layout as ParentLayout } from "vuepress-theme-hope/client";
 import Layout from './layouts/PageLayout.vue'
 import NotFoundLayout from './layouts/NotFoundLayout.vue'
 import BlogLayout from './layouts/BlogLayout.vue';
+import AllowListGenerator from './components/AllowListGenerator.vue';
 
 
 
 export default defineClientConfig({
     enhance({ app }) {
-    
+    app.component('AllowListGenerator', AllowListGenerator);
   },
   layouts: {
     ParentLayout,
diff --git a/docs/src/.vuepress/components/AllowListGenerator.vue b/docs/src/.vuepress/components/AllowListGenerator.vue
new file mode 100644
index 000000000..2cfceb66f
--- /dev/null
+++ b/docs/src/.vuepress/components/AllowListGenerator.vue
@@ -0,0 +1,587 @@
+<template>
+  <div class="allow-list-generator">
+    <!-- Parent Organization -->
+    <div class="section">
+      <h3>Parent Organization (Consortium / Project)</h3>
+      <div class="form-group">
+        <label>Identifier</label>
+        <input v-model="parentOrg.identifier" placeholder="e.g. dsf.dev" />
+      </div>
+      <div class="form-group">
+        <label>Name</label>
+        <input v-model="parentOrg.name" placeholder="e.g. DSF Community" />
+      </div>
+    </div>
+
+    <!-- Member Organizations -->
+    <div class="section">
+      <h3>Member Organizations</h3>
+      <div v-for="(org, idx) in members" :key="'org-' + idx" class="member-card">
+        <div class="member-header">
+          <strong>Organization {{ idx + 1 }}</strong>
+          <button class="btn-remove" @click="members.splice(idx, 1)" title="Remove Organization">&#x2715;</button>
+        </div>
+        <div class="form-group">
+          <label>Identifier</label>
+          <input v-model="org.identifier" placeholder="e.g. hospital.example.org" />
+        </div>
+        <div class="form-group">
+          <label>Name</label>
+          <input v-model="org.name" placeholder="e.g. Example Hospital" />
+        </div>
+        <div class="form-group">
+          <label>DSF FHIR Server Endpoint URL</label>
+          <input v-model="org.endpointUrl" placeholder="https://dsf.hospital.example.org/fhir" />
+        </div>
+        <div class="form-group">
+          <label>Endpoint Identifier</label>
+          <input v-model="org.endpointIdentifierOverride" :placeholder="deriveEndpointIdentifier(org.endpointUrl)" />
+          <span class="field-hint" v-if="!org.endpointIdentifierOverride && deriveEndpointIdentifier(org.endpointUrl)">Auto-generated from URL: <code>{{ deriveEndpointIdentifier(org.endpointUrl) }}</code></span>
+        </div>
+        <div class="thumbprints">
+          <label>Certificate Thumbprints (SHA-512 hex)</label>
+          <div v-for="(tp, i) in org.thumbprints" :key="'member-' + idx + '-tp-' + i" class="thumbprint-row">
+            <input v-model="org.thumbprints[i]" placeholder="SHA-512 thumbprint (128 hex characters)" />
+            <button class="btn-remove" @click="org.thumbprints.splice(i, 1)" v-if="org.thumbprints.length > 1" title="Remove">&#x2715;</button>
+          </div>
+          <button class="btn-add" @click="org.thumbprints.push('')">+ Add Thumbprint</button>
+        </div>
+        <div class="form-group">
+          <label>Roles</label>
+          <div class="roles-grid">
+            <label v-for="role in availableRoles" :key="role.code" class="role-checkbox">
+              <input type="checkbox" :value="role.code" v-model="org.roles" />
+              {{ role.code }} <span class="role-label">{{ role.display }}</span>
+            </label>
+          </div>
+        </div>
+      </div>
+      <button class="btn-primary" @click="addMember">+ Add Member Organization</button>
+    </div>
+
+    <!-- Generate -->
+    <div class="section">
+      <h3>Generated Bundle</h3>
+      <div class="button-row">
+        <button class="btn-primary" @click="generate">Generate FHIR Bundle</button>
+        <button class="btn-secondary" @click="copyToClipboard" v-if="generatedJson">Copy to Clipboard</button>
+        <button class="btn-secondary" @click="downloadJson" v-if="generatedJson">Download JSON</button>
+      </div>
+      <div v-if="validationErrors.length" class="validation-errors">
+        <p v-for="(err, i) in validationErrors" :key="i">{{ err }}</p>
+      </div>
+      <div v-if="copySuccess" class="copy-success">Copied to clipboard!</div>
+      <pre v-if="generatedJson" class="json-output"><code>{{ generatedJson }}</code></pre>
+    </div>
+  </div>
+</template>
+
+<script setup>
+import { ref, reactive } from 'vue';
+
+const availableRoles = [
+  { code: 'DIC', display: 'Data Integration Center' },
+  { code: 'DTS', display: 'Data Transfer Site' },
+  { code: 'DMS', display: 'Data Management Site' },
+  { code: 'COS', display: 'Coordinating Site' },
+  { code: 'CRR', display: 'Central Research Repository' },
+  { code: 'HRP', display: 'Health Research Platform' },
+  { code: 'TTP', display: 'Trusted Third Party' },
+  { code: 'UAC', display: 'Use-and-Access Committee' },
+  { code: 'AMS', display: 'Allowlist Management Site' },
+  { code: 'ASP', display: 'Analysis Service Provider' },
+  { code: 'SPR', display: 'Service Provider Registry' },
+  { code: 'TSP', display: 'Terminology Service Provider' },
+  { code: 'PPH', display: 'Process Plugin Hub' },
+  { code: 'BIO', display: 'Biobank' },
+];
+
+function createOrg() {
+  return {
+    identifier: '',
+    name: '',
+    endpointUrl: '',
+    endpointIdentifierOverride: '',
+    thumbprints: [''],
+    roles: [],
+  };
+}
+
+function deriveEndpointIdentifier(url) {
+  if (!url || !url.trim()) return '';
+  try {
+    const hostname = new URL(url.trim()).hostname;
+    return hostname ? hostname + '-endpoint' : '';
+  } catch {
+    return '';
+  }
+}
+
+function getEndpointIdentifier(org) {
+  return org.endpointIdentifierOverride?.trim() || deriveEndpointIdentifier(org.endpointUrl);
+}
+
+const parentOrg = reactive({
+  identifier: '',
+  name: '',
+});
+
+const members = ref([createOrg()]);
+const generatedJson = ref('');
+const validationErrors = ref([]);
+const copySuccess = ref(false);
+
+function addMember() {
+  members.value.push(createOrg());
+}
+
+function validate() {
+  const errors = [];
+  if (!parentOrg.identifier.trim()) errors.push('Parent organization identifier is required.');
+
+  if (members.value.length === 0) errors.push('At least one member organization is required.');
+
+  members.value.forEach((m, i) => {
+    const n = i + 1;
+    if (!m.identifier.trim()) errors.push(`Member ${n}: Identifier is required.`);
+    if (!m.endpointUrl.trim()) errors.push(`Member ${n}: DSF FHIR Server Endpoint URL is required.`);
+    if (!getEndpointIdentifier(m)) errors.push(`Member ${n}: Endpoint identifier could not be derived. Please enter the URL or override manually.`);
+    const mTps = m.thumbprints.filter(t => t.trim());
+    if (mTps.length === 0) errors.push(`Member ${n}: At least one certificate thumbprint is required.`);
+    if (m.roles.length === 0) errors.push(`Member ${n}: At least one role must be selected.`);
+  });
+
+  return errors;
+}
+
+const META_TAG = {
+  system: 'http://dsf.dev/fhir/CodeSystem/read-access-tag',
+  code: 'ALL',
+};
+
+function buildParentOrganization(org) {
+  return {
+    resourceType: 'Organization',
+    meta: {
+      profile: ['http://dsf.dev/fhir/StructureDefinition/organization-parent'],
+      tag: [META_TAG],
+    },
+    active: true,
+    identifier: [{
+      system: 'http://dsf.dev/sid/organization-identifier',
+      value: org.identifier.trim(),
+    }],
+    name: org.name.trim() || undefined,
+  };
+}
+
+function buildMemberOrganization(org, endpointId) {
+  const thumbprintExtensions = org.thumbprints
+    .filter(t => t.trim())
+    .map(t => ({
+      url: 'http://dsf.dev/fhir/StructureDefinition/extension-certificate-thumbprint',
+      valueString: t.trim(),
+    }));
+
+  return {
+    resourceType: 'Organization',
+    meta: {
+      profile: ['http://dsf.dev/fhir/StructureDefinition/organization'],
+      tag: [META_TAG],
+    },
+    extension: thumbprintExtensions,
+    active: true,
+    identifier: [{
+      system: 'http://dsf.dev/sid/organization-identifier',
+      value: org.identifier.trim(),
+    }],
+    name: org.name.trim() || undefined,
+    endpoint: [{
+      reference: `urn:uuid:${endpointId}`,
+      type: 'Endpoint',
+    }],
+  };
+}
+
+function buildEndpoint(org, managingOrgId) {
+  return {
+    resourceType: 'Endpoint',
+    meta: {
+      profile: ['http://dsf.dev/fhir/StructureDefinition/endpoint'],
+      tag: [META_TAG],
+    },
+    status: 'active',
+    identifier: [{
+      system: 'http://dsf.dev/sid/endpoint-identifier',
+      value: getEndpointIdentifier(org),
+    }],
+    connectionType: {
+      system: 'http://terminology.hl7.org/CodeSystem/endpoint-connection-type',
+      code: 'hl7-fhir-rest',
+    },
+    name: `DSF Endpoint for ${org.identifier.trim()}`,
+    managingOrganization: {
+      reference: `urn:uuid:${managingOrgId}`,
+      type: 'Organization',
+    },
+    payloadType: [{
+      coding: [{
+        system: 'http://hl7.org/fhir/resource-types',
+        code: 'Task',
+      }],
+    }],
+    payloadMimeType: ['application/fhir+json', 'application/fhir+xml'],
+    address: org.endpointUrl.trim(),
+  };
+}
+
+function buildAffiliation(parentOrgId, memberOrgId, endpointId, roles) {
+  return {
+    resourceType: 'OrganizationAffiliation',
+    meta: {
+      profile: ['http://dsf.dev/fhir/StructureDefinition/organization-affiliation'],
+      tag: [META_TAG],
+    },
+    active: true,
+    organization: {
+      reference: `urn:uuid:${parentOrgId}`,
+      type: 'Organization',
+    },
+    participatingOrganization: {
+      reference: `urn:uuid:${memberOrgId}`,
+      type: 'Organization',
+    },
+    code: roles.map(r => ({
+      coding: [{
+        system: 'http://dsf.dev/fhir/CodeSystem/organization-role',
+        code: r,
+      }],
+    })),
+    endpoint: [{
+      reference: `urn:uuid:${endpointId}`,
+      type: 'Endpoint',
+    }],
+  };
+}
+
+function uuid() {
+  return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, c => {
+    const r = (Math.random() * 16) | 0;
+    const v = c === 'x' ? r : (r & 0x3) | 0x8;
+    return v.toString(16);
+  });
+}
+
+function generate() {
+  const errors = validate();
+  validationErrors.value = errors;
+  if (errors.length > 0) {
+    generatedJson.value = '';
+    return;
+  }
+
+  const entries = [];
+  const parentOrgId = uuid();
+
+  // Parent Organization (no endpoint, no thumbprints)
+  entries.push({
+    fullUrl: `urn:uuid:${parentOrgId}`,
+    resource: buildParentOrganization(parentOrg),
+    request: {
+      method: 'PUT',
+      url: `Organization?identifier=http://dsf.dev/sid/organization-identifier|${encodeURIComponent(parentOrg.identifier.trim())}`,
+    },
+  });
+
+  // Members
+  members.value.forEach(member => {
+    const memberOrgId = uuid();
+    const memberEndpointId = uuid();
+
+    entries.push({
+      fullUrl: `urn:uuid:${memberOrgId}`,
+      resource: buildMemberOrganization(member, memberEndpointId),
+      request: {
+        method: 'PUT',
+        url: `Organization?identifier=http://dsf.dev/sid/organization-identifier|${encodeURIComponent(member.identifier.trim())}`,
+      },
+    });
+
+    entries.push({
+      fullUrl: `urn:uuid:${memberEndpointId}`,
+      resource: buildEndpoint(member, memberOrgId),
+      request: {
+        method: 'PUT',
+        url: `Endpoint?identifier=http://dsf.dev/sid/endpoint-identifier|${encodeURIComponent(getEndpointIdentifier(member))}`,
+      },
+    });
+
+    entries.push({
+      fullUrl: `urn:uuid:${uuid()}`,
+      resource: buildAffiliation(parentOrgId, memberOrgId, memberEndpointId, member.roles),
+      request: {
+        method: 'PUT',
+        url: `OrganizationAffiliation?primary-organization:identifier=http://dsf.dev/sid/organization-identifier|${encodeURIComponent(parentOrg.identifier.trim())}&participating-organization:identifier=http://dsf.dev/sid/organization-identifier|${encodeURIComponent(member.identifier.trim())}`,
+      },
+    });
+  });
+
+  const bundle = {
+    resourceType: 'Bundle',
+    type: 'transaction',
+    entry: entries,
+  };
+
+  generatedJson.value = JSON.stringify(bundle, null, 2);
+}
+
+async function copyToClipboard() {
+  try {
+    await navigator.clipboard.writeText(generatedJson.value);
+    copySuccess.value = true;
+    setTimeout(() => { copySuccess.value = false; }, 2000);
+  } catch {
+    // fallback
+    const el = document.createElement('textarea');
+    el.value = generatedJson.value;
+    document.body.appendChild(el);
+    el.select();
+    document.execCommand('copy');
+    document.body.removeChild(el);
+    copySuccess.value = true;
+    setTimeout(() => { copySuccess.value = false; }, 2000);
+  }
+}
+
+function downloadJson() {
+  const blob = new Blob([generatedJson.value], { type: 'application/json' });
+  const url = URL.createObjectURL(blob);
+  const a = document.createElement('a');
+  a.href = url;
+  a.download = 'allowlist-bundle.json';
+  a.click();
+  URL.revokeObjectURL(url);
+}
+</script>
+
+<style scoped>
+.allow-list-generator {
+  max-width: 900px;
+}
+
+.section {
+  margin-bottom: 2rem;
+  padding: 1.5rem;
+  border: 1px solid var(--border-color, #e2e8f0);
+  border-radius: 8px;
+  background: var(--bg-color-secondary, #f8fafc);
+}
+
+.section h3 {
+  margin-top: 0;
+  margin-bottom: 1rem;
+  padding-bottom: 0.5rem;
+  border-bottom: 2px solid var(--theme-color, #3eaf7c);
+}
+
+.form-group {
+  margin-bottom: 1rem;
+}
+
+.form-group label {
+  display: block;
+  font-weight: 600;
+  margin-bottom: 0.25rem;
+  font-size: 0.9rem;
+}
+
+.form-group input,
+.thumbprint-row input {
+  width: 100%;
+  padding: 0.5rem;
+  border: 1px solid var(--border-color, #ddd);
+  border-radius: 4px;
+  font-size: 0.9rem;
+  box-sizing: border-box;
+}
+
+.thumbprints {
+  margin-bottom: 1rem;
+}
+
+.thumbprints label {
+  display: block;
+  font-weight: 600;
+  margin-bottom: 0.25rem;
+  font-size: 0.9rem;
+}
+
+.thumbprint-row {
+  display: flex;
+  gap: 0.5rem;
+  margin-bottom: 0.5rem;
+  align-items: center;
+}
+
+.thumbprint-row input {
+  flex: 1;
+  font-family: monospace;
+  font-size: 0.8rem;
+}
+
+.roles-grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fill, minmax(280px, 1fr));
+  gap: 0.25rem;
+}
+
+.role-checkbox {
+  display: flex;
+  align-items: center;
+  gap: 0.4rem;
+  font-weight: normal !important;
+  font-size: 0.85rem;
+  cursor: pointer;
+}
+
+.role-checkbox input[type="checkbox"] {
+  width: auto;
+}
+
+.role-label {
+  color: var(--text-color-lighter, #666);
+  font-size: 0.8rem;
+}
+
+.member-card {
+  margin-bottom: 1.5rem;
+  padding: 1rem;
+  border: 1px solid var(--border-color, #ddd);
+  border-radius: 6px;
+  background: var(--bg-color, #fff);
+}
+
+.member-header {
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+  margin-bottom: 1rem;
+}
+
+.btn-primary {
+  background: var(--theme-color, #3eaf7c);
+  color: #fff;
+  border: none;
+  padding: 0.5rem 1rem;
+  border-radius: 4px;
+  cursor: pointer;
+  font-size: 0.9rem;
+}
+
+.btn-primary:hover {
+  opacity: 0.9;
+}
+
+.btn-secondary {
+  background: var(--bg-color, #fff);
+  color: var(--text-color, #333);
+  border: 1px solid var(--border-color, #ddd);
+  padding: 0.5rem 1rem;
+  border-radius: 4px;
+  cursor: pointer;
+  font-size: 0.9rem;
+}
+
+.btn-secondary:hover {
+  background: var(--bg-color-secondary, #f5f5f5);
+}
+
+.btn-add {
+  background: none;
+  border: 1px dashed var(--border-color, #ccc);
+  padding: 0.3rem 0.8rem;
+  border-radius: 4px;
+  cursor: pointer;
+  font-size: 0.85rem;
+  color: var(--text-color-lighter, #666);
+}
+
+.btn-add:hover {
+  border-color: var(--theme-color, #3eaf7c);
+  color: var(--theme-color, #3eaf7c);
+}
+
+.btn-remove {
+  background: none;
+  border: 1px solid var(--border-color, #ddd);
+  padding: 0.2rem 0.5rem;
+  border-radius: 4px;
+  cursor: pointer;
+  color: #e53e3e;
+  font-size: 0.8rem;
+  flex-shrink: 0;
+}
+
+.btn-remove:hover {
+  background: #fed7d7;
+}
+
+.button-row {
+  display: flex;
+  gap: 0.5rem;
+  margin-bottom: 1rem;
+  flex-wrap: wrap;
+}
+
+.validation-errors {
+  background: #fff5f5;
+  border: 1px solid #fc8181;
+  border-radius: 4px;
+  padding: 0.75rem 1rem;
+  margin-bottom: 1rem;
+}
+
+.validation-errors p {
+  margin: 0.25rem 0;
+  color: #c53030;
+  font-size: 0.85rem;
+}
+
+.copy-success {
+  color: var(--theme-color, #3eaf7c);
+  font-weight: 600;
+  margin-bottom: 0.5rem;
+  font-size: 0.9rem;
+}
+
+.json-output {
+  background: var(--code-bg-color, #282c34);
+  color: var(--code-text-color, #abb2bf);
+  padding: 1rem;
+  border-radius: 6px;
+  overflow-x: auto;
+  font-size: 0.8rem;
+  max-height: 600px;
+  overflow-y: auto;
+}
+
+.json-output code {
+  background: none;
+  padding: 0;
+  color: inherit;
+}
+
+.field-hint {
+  display: block;
+  margin-top: 0.25rem;
+  font-size: 0.8rem;
+  color: var(--text-color-lighter, #888);
+}
+
+.field-hint code {
+  font-size: 0.8rem;
+  padding: 0.1rem 0.3rem;
+  background: var(--bg-color-secondary, #eee);
+  border-radius: 3px;
+}
+</style>
diff --git a/docs/src/.vuepress/sidebar/operations-v2.ts b/docs/src/.vuepress/sidebar/operations-v2.ts
index 2b329c244..a1c836a64 100644
--- a/docs/src/.vuepress/sidebar/operations-v2.ts
+++ b/docs/src/.vuepress/sidebar/operations-v2.ts
@@ -4,7 +4,7 @@ export function generate_v2_latest_sidebar() {
 		icon: "tool",
 		link: "./",
 	},
-		"release-notes", "install", "upgrade-from-2", "upgrade-from-1", "allowList-mgm", "root-certificates", "passwords-secrets", {
+		"release-notes", "install", "upgrade-from-2", "upgrade-from-1", "allowList-mgm", "allowlist-generator", "root-certificates", "passwords-secrets", {
 		text: "FHIR Reverse Proxy",
 		icon: "module",
 		children: [
diff --git a/docs/src/operations/v2.0.2/allowlist-generator.md b/docs/src/operations/v2.0.2/allowlist-generator.md
new file mode 100644
index 000000000..691e84a69
--- /dev/null
+++ b/docs/src/operations/v2.0.2/allowlist-generator.md
@@ -0,0 +1,23 @@
+---
+title: Allow List Generator
+icon: tool
+---
+
+## Overview
+
+This tool generates a FHIR R4 Bundle (type `transaction`) for deploying an Allow List to a DSF FHIR server. The bundle contains [Organization](https://dsf.dev/fhir/ImplementationGuide/dev.dsf/StructureDefinition-organization.html), [Endpoint](https://dsf.dev/fhir/ImplementationGuide/dev.dsf/StructureDefinition-endpoint.html) and [OrganizationAffiliation](https://dsf.dev/fhir/ImplementationGuide/dev.dsf/StructureDefinition-organization-affiliation.html) resources conforming to the DSF profiles.
+
+For more information about the Allow List concept, see the [Allow List documentation](/explore/concepts/allow-list.html).
+
+::: tip Certificate Thumbprints
+SHA-512 certificate thumbprints in HEX form `[a-f0-9]{128}` can be calculated using:
+```sh
+certtool --fingerprint --hash=sha512 --infile=certificate.pem
+```
+:::
+
+::: warning
+This tool generates a basic Allow List bundle. For production deployments, consider using the [Allow List Management Portal](allowList-mgm) for centralized management.
+:::
+
+<AllowListGenerator />

From 380268f5fc7b5d5226e846af9a06aeebee711265 Mon Sep 17 00:00:00 2001
From: Simon Schweizer <simon@schwzr.de>
Date: Sun, 8 Mar 2026 22:46:30 +0100
Subject: [PATCH 2/6] add basic tests

---
 docs/package-lock.json                        | 366 ++++++++++++-
 docs/package.json                             |   5 +-
 .../components/AllowListGenerator.vue         | 215 +-------
 .../.vuepress/components/allowlist-bundle.js  | 194 +++++++
 .../components/allowlist-bundle.test.js       | 497 ++++++++++++++++++
 5 files changed, 1061 insertions(+), 216 deletions(-)
 create mode 100644 docs/src/.vuepress/components/allowlist-bundle.js
 create mode 100644 docs/src/.vuepress/components/allowlist-bundle.test.js

diff --git a/docs/package-lock.json b/docs/package-lock.json
index e3eef4c20..748eaf62f 100644
--- a/docs/package-lock.json
+++ b/docs/package-lock.json
@@ -17,6 +17,7 @@
         "katex": "^0.16.28",
         "sass-embedded": "^1.97.3",
         "sass-loader": "^16.0.7",
+        "vitest": "^4.0.18",
         "vue": "^3.5.28",
         "vuepress": "2.0.0-rc.26",
         "vuepress-theme-hope": "2.0.0-rc.102"
@@ -1965,6 +1966,22 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/@standard-schema/spec": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz",
+      "integrity": "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==",
+      "dev": true
+    },
+    "node_modules/@types/chai": {
+      "version": "5.2.3",
+      "resolved": "https://registry.npmjs.org/@types/chai/-/chai-5.2.3.tgz",
+      "integrity": "sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==",
+      "dev": true,
+      "dependencies": {
+        "@types/deep-eql": "*",
+        "assertion-error": "^2.0.1"
+      }
+    },
     "node_modules/@types/debug": {
       "version": "4.1.12",
       "resolved": "https://registry.npmjs.org/@types/debug/-/debug-4.1.12.tgz",
@@ -1975,6 +1992,12 @@
         "@types/ms": "*"
       }
     },
+    "node_modules/@types/deep-eql": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/@types/deep-eql/-/deep-eql-4.0.2.tgz",
+      "integrity": "sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==",
+      "dev": true
+    },
     "node_modules/@types/estree": {
       "version": "1.0.8",
       "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.8.tgz",
@@ -2029,7 +2052,6 @@
       "resolved": "https://registry.npmjs.org/@types/markdown-it/-/markdown-it-14.1.2.tgz",
       "integrity": "sha512-promo4eFwuiW+TfGxhi+0x3czqTYJkG8qB17ZUJiVF10Xm7NLVRSLUsfRTU/6h1e24VvRnXCx+hG7li58lkzog==",
       "dev": true,
-      "peer": true,
       "dependencies": {
         "@types/linkify-it": "^5",
         "@types/mdurl": "^2"
@@ -2136,6 +2158,119 @@
         "vue": "^3.2.25"
       }
     },
+    "node_modules/@vitest/expect": {
+      "version": "4.0.18",
+      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.0.18.tgz",
+      "integrity": "sha512-8sCWUyckXXYvx4opfzVY03EOiYVxyNrHS5QxX3DAIi5dpJAAkyJezHCP77VMX4HKA2LDT/Jpfo8i2r5BE3GnQQ==",
+      "dev": true,
+      "dependencies": {
+        "@standard-schema/spec": "^1.0.0",
+        "@types/chai": "^5.2.2",
+        "@vitest/spy": "4.0.18",
+        "@vitest/utils": "4.0.18",
+        "chai": "^6.2.1",
+        "tinyrainbow": "^3.0.3"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/mocker": {
+      "version": "4.0.18",
+      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.0.18.tgz",
+      "integrity": "sha512-HhVd0MDnzzsgevnOWCBj5Otnzobjy5wLBe4EdeeFGv8luMsGcYqDuFRMcttKWZA5vVO8RFjexVovXvAM4JoJDQ==",
+      "dev": true,
+      "dependencies": {
+        "@vitest/spy": "4.0.18",
+        "estree-walker": "^3.0.3",
+        "magic-string": "^0.30.21"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "msw": "^2.4.9",
+        "vite": "^6.0.0 || ^7.0.0-0"
+      },
+      "peerDependenciesMeta": {
+        "msw": {
+          "optional": true
+        },
+        "vite": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@vitest/mocker/node_modules/estree-walker": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-3.0.3.tgz",
+      "integrity": "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==",
+      "dev": true,
+      "dependencies": {
+        "@types/estree": "^1.0.0"
+      }
+    },
+    "node_modules/@vitest/pretty-format": {
+      "version": "4.0.18",
+      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.0.18.tgz",
+      "integrity": "sha512-P24GK3GulZWC5tz87ux0m8OADrQIUVDPIjjj65vBXYG17ZeU3qD7r+MNZ1RNv4l8CGU2vtTRqixrOi9fYk/yKw==",
+      "dev": true,
+      "dependencies": {
+        "tinyrainbow": "^3.0.3"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/runner": {
+      "version": "4.0.18",
+      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.0.18.tgz",
+      "integrity": "sha512-rpk9y12PGa22Jg6g5M3UVVnTS7+zycIGk9ZNGN+m6tZHKQb7jrP7/77WfZy13Y/EUDd52NDsLRQhYKtv7XfPQw==",
+      "dev": true,
+      "dependencies": {
+        "@vitest/utils": "4.0.18",
+        "pathe": "^2.0.3"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/snapshot": {
+      "version": "4.0.18",
+      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.0.18.tgz",
+      "integrity": "sha512-PCiV0rcl7jKQjbgYqjtakly6T1uwv/5BQ9SwBLekVg/EaYeQFPiXcgrC2Y7vDMA8dM1SUEAEV82kgSQIlXNMvA==",
+      "dev": true,
+      "dependencies": {
+        "@vitest/pretty-format": "4.0.18",
+        "magic-string": "^0.30.21",
+        "pathe": "^2.0.3"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/spy": {
+      "version": "4.0.18",
+      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.0.18.tgz",
+      "integrity": "sha512-cbQt3PTSD7P2OARdVW3qWER5EGq7PHlvE+QfzSC0lbwO+xnt7+XH06ZzFjFRgzUX//JmpxrCu92VdwvEPlWSNw==",
+      "dev": true,
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/utils": {
+      "version": "4.0.18",
+      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.0.18.tgz",
+      "integrity": "sha512-msMRKLMVLWygpK3u2Hybgi4MNjcYJvwTb0Ru09+fOyCXIgT5raYP041DRRdiJiI3k/2U6SEbAETB3YtBrUkCFA==",
+      "dev": true,
+      "dependencies": {
+        "@vitest/pretty-format": "4.0.18",
+        "tinyrainbow": "^3.0.3"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
     "node_modules/@vue/compiler-core": {
       "version": "3.5.28",
       "resolved": "https://registry.npmjs.org/@vue/compiler-core/-/compiler-core-3.5.28.tgz",
@@ -2300,7 +2435,6 @@
       "integrity": "sha512-4+YfKs2iOxuVSMW+L2tFzu2+X2HiGAREpo1DbkkYVDa5GyyPR+YsSueXNZMroTdzWDk5kAUz2Z1Tz1lIu7TO2g==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@vitejs/plugin-vue": "^6.0.1",
         "@vuepress/bundlerutils": "2.0.0-rc.26",
@@ -3031,7 +3165,6 @@
       "integrity": "sha512-JliPoAf8vv0p0aow5Ug4fbYo9HapytcL17rmFmaUvOFR/G6NKCg7zSHlvAIMRCNt8AMCHXwR33jRiL7kCp4Mvg==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@vuepress/helper": "2.0.0-rc.121",
         "@vueuse/core": "^14.1.0",
@@ -3190,6 +3323,15 @@
         "sprintf-js": "~1.0.2"
       }
     },
+    "node_modules/assertion-error": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/assertion-error/-/assertion-error-2.0.1.tgz",
+      "integrity": "sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==",
+      "dev": true,
+      "engines": {
+        "node": ">=12"
+      }
+    },
     "node_modules/autoprefixer": {
       "version": "10.4.21",
       "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.4.21.tgz",
@@ -3302,7 +3444,6 @@
           "url": "https://github.com/sponsors/ai"
         }
       ],
-      "peer": true,
       "dependencies": {
         "caniuse-lite": "^1.0.30001735",
         "electron-to-chromium": "^1.5.204",
@@ -3367,6 +3508,15 @@
         "url": "https://github.com/sponsors/wooorm"
       }
     },
+    "node_modules/chai": {
+      "version": "6.2.2",
+      "resolved": "https://registry.npmjs.org/chai/-/chai-6.2.2.tgz",
+      "integrity": "sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg==",
+      "dev": true,
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/chalk": {
       "version": "5.6.2",
       "resolved": "https://registry.npmjs.org/chalk/-/chalk-5.6.2.tgz",
@@ -3827,6 +3977,12 @@
         "node": ">=4"
       }
     },
+    "node_modules/es-module-lexer": {
+      "version": "1.7.0",
+      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-1.7.0.tgz",
+      "integrity": "sha512-jEQoCwk8hyb2AZziIOLhDqpm5+2ww5uIE6lkO/6jcOCusfk6LhMHpXXfBLXTZ7Ydyt0j4VoUQv6uGNYbdW+kBA==",
+      "dev": true
+    },
     "node_modules/esbuild": {
       "version": "0.25.12",
       "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.12.tgz",
@@ -3899,6 +4055,15 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/expect-type": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/expect-type/-/expect-type-1.3.0.tgz",
+      "integrity": "sha512-knvyeauYhqjOYvQ66MznSMs83wmHrCycNEN6Ao+2AeYEfxUIkuiVxdEa1qlGEPK+We3n0THiDciYSsCcgW/DoA==",
+      "dev": true,
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
     "node_modules/extend": {
       "version": "3.0.2",
       "resolved": "https://registry.npmjs.org/extend/-/extend-3.0.2.tgz",
@@ -4399,7 +4564,6 @@
         "https://github.com/sponsors/katex"
       ],
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "commander": "^8.3.0"
       },
@@ -4517,7 +4681,6 @@
       "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.1.0.tgz",
       "integrity": "sha512-a54IwgWPaeBCAAsv13YgmALOF1elABB08FxO9i+r4VFk5Vl4pKokRPeX8u5TCgSsPi6ec1otfLjdOpVcgbpshg==",
       "dev": true,
-      "peer": true,
       "dependencies": {
         "argparse": "^2.0.1",
         "entities": "^4.4.0",
@@ -4770,6 +4933,16 @@
         "url": "https://github.com/fb55/nth-check?sponsor=1"
       }
     },
+    "node_modules/obug": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/obug/-/obug-2.1.1.tgz",
+      "integrity": "sha512-uTqF9MuPraAQ+IsnPf366RG4cP9RtUi7MLO1N3KEc+wb0a6yKpeL0lmk2IB1jY5KHPAlTc6T/JRdC/YqxHNwkQ==",
+      "dev": true,
+      "funding": [
+        "https://github.com/sponsors/sxzz",
+        "https://opencollective.com/debug"
+      ]
+    },
     "node_modules/onetime": {
       "version": "7.0.0",
       "resolved": "https://registry.npmjs.org/onetime/-/onetime-7.0.0.tgz",
@@ -4926,6 +5099,12 @@
         "node": ">=8"
       }
     },
+    "node_modules/pathe": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/pathe/-/pathe-2.0.3.tgz",
+      "integrity": "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==",
+      "dev": true
+    },
     "node_modules/perfect-debounce": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/perfect-debounce/-/perfect-debounce-2.1.0.tgz",
@@ -4991,7 +5170,6 @@
           "url": "https://github.com/sponsors/ai"
         }
       ],
-      "peer": true,
       "dependencies": {
         "nanoid": "^3.3.11",
         "picocolors": "^1.1.1",
@@ -5274,13 +5452,33 @@
       "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
       "dev": true
     },
+    "node_modules/sass": {
+      "version": "1.97.3",
+      "resolved": "https://registry.npmjs.org/sass/-/sass-1.97.3.tgz",
+      "integrity": "sha512-fDz1zJpd5GycprAbu4Q2PV/RprsRtKC/0z82z0JLgdytmcq0+ujJbJ/09bPGDxCLkKY3Np5cRAOcWiVkLXJURg==",
+      "dev": true,
+      "optional": true,
+      "dependencies": {
+        "chokidar": "^4.0.0",
+        "immutable": "^5.0.2",
+        "source-map-js": ">=0.6.2 <2.0.0"
+      },
+      "bin": {
+        "sass": "sass.js"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      },
+      "optionalDependencies": {
+        "@parcel/watcher": "^2.4.1"
+      }
+    },
     "node_modules/sass-embedded": {
       "version": "1.97.3",
       "resolved": "https://registry.npmjs.org/sass-embedded/-/sass-embedded-1.97.3.tgz",
       "integrity": "sha512-eKzFy13Nk+IRHhlAwP3sfuv+PzOrvzUkwJK2hdoCKYcWGSdmwFpeGpWmyewdw8EgBnsKaSBtgf/0b2K635ecSA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@bufbuild/protobuf": "^2.5.0",
         "colorjs.io": "^0.5.0",
@@ -5629,7 +5827,6 @@
       "integrity": "sha512-w6q+fRHourZ+e+xA1kcsF27iGM6jdB8teexYCfdUw0sYgcDNeZESnDNT9sUmmPm3ooziwUJXGwZJSTF3kOdBfA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "neo-async": "^2.6.2"
       },
@@ -5713,6 +5910,12 @@
         "@types/hast": "^3.0.4"
       }
     },
+    "node_modules/siginfo": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/siginfo/-/siginfo-2.0.0.tgz",
+      "integrity": "sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==",
+      "dev": true
+    },
     "node_modules/signal-exit": {
       "version": "4.1.0",
       "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
@@ -5792,6 +5995,18 @@
       "dev": true,
       "license": "BSD-3-Clause"
     },
+    "node_modules/stackback": {
+      "version": "0.0.2",
+      "resolved": "https://registry.npmjs.org/stackback/-/stackback-0.0.2.tgz",
+      "integrity": "sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==",
+      "dev": true
+    },
+    "node_modules/std-env": {
+      "version": "3.10.0",
+      "resolved": "https://registry.npmjs.org/std-env/-/std-env-3.10.0.tgz",
+      "integrity": "sha512-5GS12FdOZNliM5mAOxFRg7Ir0pWz8MdpYm6AY6VPkGpbA7ZzmbzNcBJQ0GPvvyWgcY7QAhCgf9Uy89I03faLkg==",
+      "dev": true
+    },
     "node_modules/stdin-discarder": {
       "version": "0.3.1",
       "resolved": "https://registry.npmjs.org/stdin-discarder/-/stdin-discarder-0.3.1.tgz",
@@ -5927,6 +6142,21 @@
         "url": "https://opencollective.com/synckit"
       }
     },
+    "node_modules/tinybench": {
+      "version": "2.9.0",
+      "resolved": "https://registry.npmjs.org/tinybench/-/tinybench-2.9.0.tgz",
+      "integrity": "sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg==",
+      "dev": true
+    },
+    "node_modules/tinyexec": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.0.2.tgz",
+      "integrity": "sha512-W/KYk+NFhkmsYpuHq5JykngiOCnxeVL8v8dFnqxSD8qEEdRfXk1SDM6JzNqcERbcGYj9tMrDQBYV9cjgnunFIg==",
+      "dev": true,
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/tinyglobby": {
       "version": "0.2.15",
       "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.15.tgz",
@@ -5968,7 +6198,6 @@
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -5976,6 +6205,15 @@
         "url": "https://github.com/sponsors/jonschlinkert"
       }
     },
+    "node_modules/tinyrainbow": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-3.0.3.tgz",
+      "integrity": "sha512-PSkbLUoxOFRzJYjjxHJt9xro7D+iilgMX/C9lawzVuYiIdcihh9DXmVibBe8lmcFrRi/VzlPjBxbN7rH24q8/Q==",
+      "dev": true,
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
     "node_modules/to-regex-range": {
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
@@ -6233,7 +6471,6 @@
       "integrity": "sha512-ZWyE8YXEXqJrrSLvYgrRP7p62OziLW7xI5HYGWFzOvupfAlrLvURSzv/FyGyy0eidogEM3ujU+kUG1zuHgb6Ug==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "esbuild": "^0.25.0",
         "fdir": "^6.5.0",
@@ -6325,7 +6562,95 @@
       "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
-      "peer": true,
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
+    "node_modules/vitest": {
+      "version": "4.0.18",
+      "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.0.18.tgz",
+      "integrity": "sha512-hOQuK7h0FGKgBAas7v0mSAsnvrIgAvWmRFjmzpJ7SwFHH3g1k2u37JtYwOwmEKhK6ZO3v9ggDBBm0La1LCK4uQ==",
+      "dev": true,
+      "dependencies": {
+        "@vitest/expect": "4.0.18",
+        "@vitest/mocker": "4.0.18",
+        "@vitest/pretty-format": "4.0.18",
+        "@vitest/runner": "4.0.18",
+        "@vitest/snapshot": "4.0.18",
+        "@vitest/spy": "4.0.18",
+        "@vitest/utils": "4.0.18",
+        "es-module-lexer": "^1.7.0",
+        "expect-type": "^1.2.2",
+        "magic-string": "^0.30.21",
+        "obug": "^2.1.1",
+        "pathe": "^2.0.3",
+        "picomatch": "^4.0.3",
+        "std-env": "^3.10.0",
+        "tinybench": "^2.9.0",
+        "tinyexec": "^1.0.2",
+        "tinyglobby": "^0.2.15",
+        "tinyrainbow": "^3.0.3",
+        "vite": "^6.0.0 || ^7.0.0",
+        "why-is-node-running": "^2.3.0"
+      },
+      "bin": {
+        "vitest": "vitest.mjs"
+      },
+      "engines": {
+        "node": "^20.0.0 || ^22.0.0 || >=24.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "@edge-runtime/vm": "*",
+        "@opentelemetry/api": "^1.9.0",
+        "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0",
+        "@vitest/browser-playwright": "4.0.18",
+        "@vitest/browser-preview": "4.0.18",
+        "@vitest/browser-webdriverio": "4.0.18",
+        "@vitest/ui": "4.0.18",
+        "happy-dom": "*",
+        "jsdom": "*"
+      },
+      "peerDependenciesMeta": {
+        "@edge-runtime/vm": {
+          "optional": true
+        },
+        "@opentelemetry/api": {
+          "optional": true
+        },
+        "@types/node": {
+          "optional": true
+        },
+        "@vitest/browser-playwright": {
+          "optional": true
+        },
+        "@vitest/browser-preview": {
+          "optional": true
+        },
+        "@vitest/browser-webdriverio": {
+          "optional": true
+        },
+        "@vitest/ui": {
+          "optional": true
+        },
+        "happy-dom": {
+          "optional": true
+        },
+        "jsdom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/vitest/node_modules/picomatch": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
+      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+      "dev": true,
       "engines": {
         "node": ">=12"
       },
@@ -6384,7 +6709,6 @@
       "integrity": "sha512-ztTS3m6Q2MAb6D26vM2UyU5nOuxIhIk37SSD3jTcKI00x4ha0FcwY3Cm0MAt6w58REBmkwNLPxN5iiulatHtbw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@vuepress/cli": "2.0.0-rc.26",
         "@vuepress/client": "2.0.0-rc.26",
@@ -6770,6 +7094,22 @@
       "dev": true,
       "license": "ISC"
     },
+    "node_modules/why-is-node-running": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/why-is-node-running/-/why-is-node-running-2.3.0.tgz",
+      "integrity": "sha512-hUrmaWBdVDcxvYqnyh09zunKzROWjbZTiNy8dBEjkS7ehEDQibXJ7XvlmtbwuTclUiIyN+CyXQD4Vmko8fNm8w==",
+      "dev": true,
+      "dependencies": {
+        "siginfo": "^2.0.0",
+        "stackback": "0.0.2"
+      },
+      "bin": {
+        "why-is-node-running": "cli.js"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/wrap-ansi": {
       "version": "6.2.0",
       "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-6.2.0.tgz",
diff --git a/docs/package.json b/docs/package.json
index df52c905b..27eb7dc10 100644
--- a/docs/package.json
+++ b/docs/package.json
@@ -8,7 +8,9 @@
     "docs:build": "vuepress build src",
     "docs:clean-dev": "vuepress dev src --clean-cache",
     "docs:dev": "vuepress dev src",
-    "docs:update-package": "npx vp-update"
+    "docs:update-package": "npx vp-update",
+    "test": "vitest run",
+    "test:watch": "vitest"
   },
   "devDependencies": {
     "@vuepress/bundler-vite": "2.0.0-rc.26",
@@ -19,6 +21,7 @@
     "katex": "^0.16.28",
     "sass-embedded": "^1.97.3",
     "sass-loader": "^16.0.7",
+    "vitest": "^4.0.18",
     "vue": "^3.5.28",
     "vuepress": "2.0.0-rc.26",
     "vuepress-theme-hope": "2.0.0-rc.102"
diff --git a/docs/src/.vuepress/components/AllowListGenerator.vue b/docs/src/.vuepress/components/AllowListGenerator.vue
index 2cfceb66f..39737d707 100644
--- a/docs/src/.vuepress/components/AllowListGenerator.vue
+++ b/docs/src/.vuepress/components/AllowListGenerator.vue
@@ -78,6 +78,11 @@
 
 <script setup>
 import { ref, reactive } from 'vue';
+import {
+  deriveEndpointIdentifier,
+  validate as validateBundle,
+  generateBundle,
+} from './allowlist-bundle.js';
 
 const availableRoles = [
   { code: 'DIC', display: 'Data Integration Center' },
@@ -107,18 +112,12 @@ function createOrg() {
   };
 }
 
-function deriveEndpointIdentifier(url) {
-  if (!url || !url.trim()) return '';
-  try {
-    const hostname = new URL(url.trim()).hostname;
-    return hostname ? hostname + '-endpoint' : '';
-  } catch {
-    return '';
-  }
-}
-
-function getEndpointIdentifier(org) {
-  return org.endpointIdentifierOverride?.trim() || deriveEndpointIdentifier(org.endpointUrl);
+function uuid() {
+  return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, c => {
+    const r = (Math.random() * 16) | 0;
+    const v = c === 'x' ? r : (r & 0x3) | 0x8;
+    return v.toString(16);
+  });
 }
 
 const parentOrg = reactive({
@@ -135,203 +134,15 @@ function addMember() {
   members.value.push(createOrg());
 }
 
-function validate() {
-  const errors = [];
-  if (!parentOrg.identifier.trim()) errors.push('Parent organization identifier is required.');
-
-  if (members.value.length === 0) errors.push('At least one member organization is required.');
-
-  members.value.forEach((m, i) => {
-    const n = i + 1;
-    if (!m.identifier.trim()) errors.push(`Member ${n}: Identifier is required.`);
-    if (!m.endpointUrl.trim()) errors.push(`Member ${n}: DSF FHIR Server Endpoint URL is required.`);
-    if (!getEndpointIdentifier(m)) errors.push(`Member ${n}: Endpoint identifier could not be derived. Please enter the URL or override manually.`);
-    const mTps = m.thumbprints.filter(t => t.trim());
-    if (mTps.length === 0) errors.push(`Member ${n}: At least one certificate thumbprint is required.`);
-    if (m.roles.length === 0) errors.push(`Member ${n}: At least one role must be selected.`);
-  });
-
-  return errors;
-}
-
-const META_TAG = {
-  system: 'http://dsf.dev/fhir/CodeSystem/read-access-tag',
-  code: 'ALL',
-};
-
-function buildParentOrganization(org) {
-  return {
-    resourceType: 'Organization',
-    meta: {
-      profile: ['http://dsf.dev/fhir/StructureDefinition/organization-parent'],
-      tag: [META_TAG],
-    },
-    active: true,
-    identifier: [{
-      system: 'http://dsf.dev/sid/organization-identifier',
-      value: org.identifier.trim(),
-    }],
-    name: org.name.trim() || undefined,
-  };
-}
-
-function buildMemberOrganization(org, endpointId) {
-  const thumbprintExtensions = org.thumbprints
-    .filter(t => t.trim())
-    .map(t => ({
-      url: 'http://dsf.dev/fhir/StructureDefinition/extension-certificate-thumbprint',
-      valueString: t.trim(),
-    }));
-
-  return {
-    resourceType: 'Organization',
-    meta: {
-      profile: ['http://dsf.dev/fhir/StructureDefinition/organization'],
-      tag: [META_TAG],
-    },
-    extension: thumbprintExtensions,
-    active: true,
-    identifier: [{
-      system: 'http://dsf.dev/sid/organization-identifier',
-      value: org.identifier.trim(),
-    }],
-    name: org.name.trim() || undefined,
-    endpoint: [{
-      reference: `urn:uuid:${endpointId}`,
-      type: 'Endpoint',
-    }],
-  };
-}
-
-function buildEndpoint(org, managingOrgId) {
-  return {
-    resourceType: 'Endpoint',
-    meta: {
-      profile: ['http://dsf.dev/fhir/StructureDefinition/endpoint'],
-      tag: [META_TAG],
-    },
-    status: 'active',
-    identifier: [{
-      system: 'http://dsf.dev/sid/endpoint-identifier',
-      value: getEndpointIdentifier(org),
-    }],
-    connectionType: {
-      system: 'http://terminology.hl7.org/CodeSystem/endpoint-connection-type',
-      code: 'hl7-fhir-rest',
-    },
-    name: `DSF Endpoint for ${org.identifier.trim()}`,
-    managingOrganization: {
-      reference: `urn:uuid:${managingOrgId}`,
-      type: 'Organization',
-    },
-    payloadType: [{
-      coding: [{
-        system: 'http://hl7.org/fhir/resource-types',
-        code: 'Task',
-      }],
-    }],
-    payloadMimeType: ['application/fhir+json', 'application/fhir+xml'],
-    address: org.endpointUrl.trim(),
-  };
-}
-
-function buildAffiliation(parentOrgId, memberOrgId, endpointId, roles) {
-  return {
-    resourceType: 'OrganizationAffiliation',
-    meta: {
-      profile: ['http://dsf.dev/fhir/StructureDefinition/organization-affiliation'],
-      tag: [META_TAG],
-    },
-    active: true,
-    organization: {
-      reference: `urn:uuid:${parentOrgId}`,
-      type: 'Organization',
-    },
-    participatingOrganization: {
-      reference: `urn:uuid:${memberOrgId}`,
-      type: 'Organization',
-    },
-    code: roles.map(r => ({
-      coding: [{
-        system: 'http://dsf.dev/fhir/CodeSystem/organization-role',
-        code: r,
-      }],
-    })),
-    endpoint: [{
-      reference: `urn:uuid:${endpointId}`,
-      type: 'Endpoint',
-    }],
-  };
-}
-
-function uuid() {
-  return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, c => {
-    const r = (Math.random() * 16) | 0;
-    const v = c === 'x' ? r : (r & 0x3) | 0x8;
-    return v.toString(16);
-  });
-}
-
 function generate() {
-  const errors = validate();
+  const errors = validateBundle(parentOrg, members.value);
   validationErrors.value = errors;
   if (errors.length > 0) {
     generatedJson.value = '';
     return;
   }
 
-  const entries = [];
-  const parentOrgId = uuid();
-
-  // Parent Organization (no endpoint, no thumbprints)
-  entries.push({
-    fullUrl: `urn:uuid:${parentOrgId}`,
-    resource: buildParentOrganization(parentOrg),
-    request: {
-      method: 'PUT',
-      url: `Organization?identifier=http://dsf.dev/sid/organization-identifier|${encodeURIComponent(parentOrg.identifier.trim())}`,
-    },
-  });
-
-  // Members
-  members.value.forEach(member => {
-    const memberOrgId = uuid();
-    const memberEndpointId = uuid();
-
-    entries.push({
-      fullUrl: `urn:uuid:${memberOrgId}`,
-      resource: buildMemberOrganization(member, memberEndpointId),
-      request: {
-        method: 'PUT',
-        url: `Organization?identifier=http://dsf.dev/sid/organization-identifier|${encodeURIComponent(member.identifier.trim())}`,
-      },
-    });
-
-    entries.push({
-      fullUrl: `urn:uuid:${memberEndpointId}`,
-      resource: buildEndpoint(member, memberOrgId),
-      request: {
-        method: 'PUT',
-        url: `Endpoint?identifier=http://dsf.dev/sid/endpoint-identifier|${encodeURIComponent(getEndpointIdentifier(member))}`,
-      },
-    });
-
-    entries.push({
-      fullUrl: `urn:uuid:${uuid()}`,
-      resource: buildAffiliation(parentOrgId, memberOrgId, memberEndpointId, member.roles),
-      request: {
-        method: 'PUT',
-        url: `OrganizationAffiliation?primary-organization:identifier=http://dsf.dev/sid/organization-identifier|${encodeURIComponent(parentOrg.identifier.trim())}&participating-organization:identifier=http://dsf.dev/sid/organization-identifier|${encodeURIComponent(member.identifier.trim())}`,
-      },
-    });
-  });
-
-  const bundle = {
-    resourceType: 'Bundle',
-    type: 'transaction',
-    entry: entries,
-  };
-
+  const bundle = generateBundle(parentOrg, members.value, uuid);
   generatedJson.value = JSON.stringify(bundle, null, 2);
 }
 
diff --git a/docs/src/.vuepress/components/allowlist-bundle.js b/docs/src/.vuepress/components/allowlist-bundle.js
new file mode 100644
index 000000000..0e95bca4a
--- /dev/null
+++ b/docs/src/.vuepress/components/allowlist-bundle.js
@@ -0,0 +1,194 @@
+const META_TAG = {
+  system: 'http://dsf.dev/fhir/CodeSystem/read-access-tag',
+  code: 'ALL',
+};
+
+export function deriveEndpointIdentifier(url) {
+  if (!url || !url.trim()) return '';
+  try {
+    const hostname = new URL(url.trim()).hostname;
+    return hostname ? hostname + '-endpoint' : '';
+  } catch {
+    return '';
+  }
+}
+
+export function getEndpointIdentifier(org) {
+  return org.endpointIdentifierOverride?.trim() || deriveEndpointIdentifier(org.endpointUrl);
+}
+
+export function validate(parentOrg, members) {
+  const errors = [];
+  if (!parentOrg.identifier.trim()) errors.push('Parent organization identifier is required.');
+
+  if (members.length === 0) errors.push('At least one member organization is required.');
+
+  members.forEach((m, i) => {
+    const n = i + 1;
+    if (!m.identifier.trim()) errors.push(`Member ${n}: Identifier is required.`);
+    if (!m.endpointUrl.trim()) errors.push(`Member ${n}: DSF FHIR Server Endpoint URL is required.`);
+    if (!getEndpointIdentifier(m)) errors.push(`Member ${n}: Endpoint identifier could not be derived. Please enter the URL or override manually.`);
+    const mTps = m.thumbprints.filter(t => t.trim());
+    if (mTps.length === 0) errors.push(`Member ${n}: At least one certificate thumbprint is required.`);
+    if (m.roles.length === 0) errors.push(`Member ${n}: At least one role must be selected.`);
+  });
+
+  return errors;
+}
+
+export function buildParentOrganization(org) {
+  return {
+    resourceType: 'Organization',
+    meta: {
+      profile: ['http://dsf.dev/fhir/StructureDefinition/organization-parent'],
+      tag: [META_TAG],
+    },
+    active: true,
+    identifier: [{
+      system: 'http://dsf.dev/sid/organization-identifier',
+      value: org.identifier.trim(),
+    }],
+    name: org.name.trim() || undefined,
+  };
+}
+
+export function buildMemberOrganization(org, endpointId) {
+  const thumbprintExtensions = org.thumbprints
+    .filter(t => t.trim())
+    .map(t => ({
+      url: 'http://dsf.dev/fhir/StructureDefinition/extension-certificate-thumbprint',
+      valueString: t.trim(),
+    }));
+
+  return {
+    resourceType: 'Organization',
+    meta: {
+      profile: ['http://dsf.dev/fhir/StructureDefinition/organization'],
+      tag: [META_TAG],
+    },
+    extension: thumbprintExtensions,
+    active: true,
+    identifier: [{
+      system: 'http://dsf.dev/sid/organization-identifier',
+      value: org.identifier.trim(),
+    }],
+    name: org.name.trim() || undefined,
+    endpoint: [{
+      reference: `urn:uuid:${endpointId}`,
+      type: 'Endpoint',
+    }],
+  };
+}
+
+export function buildEndpoint(org, managingOrgId) {
+  return {
+    resourceType: 'Endpoint',
+    meta: {
+      profile: ['http://dsf.dev/fhir/StructureDefinition/endpoint'],
+      tag: [META_TAG],
+    },
+    status: 'active',
+    identifier: [{
+      system: 'http://dsf.dev/sid/endpoint-identifier',
+      value: getEndpointIdentifier(org),
+    }],
+    connectionType: {
+      system: 'http://terminology.hl7.org/CodeSystem/endpoint-connection-type',
+      code: 'hl7-fhir-rest',
+    },
+    name: `DSF Endpoint for ${org.identifier.trim()}`,
+    managingOrganization: {
+      reference: `urn:uuid:${managingOrgId}`,
+      type: 'Organization',
+    },
+    payloadType: [{
+      coding: [{
+        system: 'http://hl7.org/fhir/resource-types',
+        code: 'Task',
+      }],
+    }],
+    payloadMimeType: ['application/fhir+json', 'application/fhir+xml'],
+    address: org.endpointUrl.trim(),
+  };
+}
+
+export function buildAffiliation(parentOrgId, memberOrgId, endpointId, roles) {
+  return {
+    resourceType: 'OrganizationAffiliation',
+    meta: {
+      profile: ['http://dsf.dev/fhir/StructureDefinition/organization-affiliation'],
+      tag: [META_TAG],
+    },
+    active: true,
+    organization: {
+      reference: `urn:uuid:${parentOrgId}`,
+      type: 'Organization',
+    },
+    participatingOrganization: {
+      reference: `urn:uuid:${memberOrgId}`,
+      type: 'Organization',
+    },
+    code: roles.map(r => ({
+      coding: [{
+        system: 'http://dsf.dev/fhir/CodeSystem/organization-role',
+        code: r,
+      }],
+    })),
+    endpoint: [{
+      reference: `urn:uuid:${endpointId}`,
+      type: 'Endpoint',
+    }],
+  };
+}
+
+export function generateBundle(parentOrg, members, uuidFn) {
+  const entries = [];
+  const parentOrgId = uuidFn();
+
+  entries.push({
+    fullUrl: `urn:uuid:${parentOrgId}`,
+    resource: buildParentOrganization(parentOrg),
+    request: {
+      method: 'PUT',
+      url: `Organization?identifier=http://dsf.dev/sid/organization-identifier|${encodeURIComponent(parentOrg.identifier.trim())}`,
+    },
+  });
+
+  members.forEach(member => {
+    const memberOrgId = uuidFn();
+    const memberEndpointId = uuidFn();
+
+    entries.push({
+      fullUrl: `urn:uuid:${memberOrgId}`,
+      resource: buildMemberOrganization(member, memberEndpointId),
+      request: {
+        method: 'PUT',
+        url: `Organization?identifier=http://dsf.dev/sid/organization-identifier|${encodeURIComponent(member.identifier.trim())}`,
+      },
+    });
+
+    entries.push({
+      fullUrl: `urn:uuid:${memberEndpointId}`,
+      resource: buildEndpoint(member, memberOrgId),
+      request: {
+        method: 'PUT',
+        url: `Endpoint?identifier=http://dsf.dev/sid/endpoint-identifier|${encodeURIComponent(getEndpointIdentifier(member))}`,
+      },
+    });
+
+    entries.push({
+      fullUrl: `urn:uuid:${uuidFn()}`,
+      resource: buildAffiliation(parentOrgId, memberOrgId, memberEndpointId, member.roles),
+      request: {
+        method: 'PUT',
+        url: `OrganizationAffiliation?primary-organization:identifier=http://dsf.dev/sid/organization-identifier|${encodeURIComponent(parentOrg.identifier.trim())}&participating-organization:identifier=http://dsf.dev/sid/organization-identifier|${encodeURIComponent(member.identifier.trim())}`,
+      },
+    });
+  });
+
+  return {
+    resourceType: 'Bundle',
+    type: 'transaction',
+    entry: entries,
+  };
+}
diff --git a/docs/src/.vuepress/components/allowlist-bundle.test.js b/docs/src/.vuepress/components/allowlist-bundle.test.js
new file mode 100644
index 000000000..30e01d532
--- /dev/null
+++ b/docs/src/.vuepress/components/allowlist-bundle.test.js
@@ -0,0 +1,497 @@
+import { describe, it, expect } from 'vitest';
+import {
+  deriveEndpointIdentifier,
+  getEndpointIdentifier,
+  validate,
+  buildParentOrganization,
+  buildMemberOrganization,
+  buildEndpoint,
+  buildAffiliation,
+  generateBundle,
+} from './allowlist-bundle.js';
+
+// -- Helper: valid member org data --
+function validMember(overrides = {}) {
+  return {
+    identifier: 'hospital.example.org',
+    name: 'Example Hospital',
+    endpointUrl: 'https://dsf.hospital.example.org/fhir',
+    endpointIdentifierOverride: '',
+    thumbprints: ['aabbccdd'],
+    roles: ['DIC'],
+    ...overrides,
+  };
+}
+
+function validParent(overrides = {}) {
+  return { identifier: 'dsf.dev', name: 'DSF Community', ...overrides };
+}
+
+// =============================================
+// deriveEndpointIdentifier
+// =============================================
+describe('deriveEndpointIdentifier', () => {
+  it('extracts hostname and appends -endpoint', () => {
+    expect(deriveEndpointIdentifier('https://dsf.hospital.example.org/fhir'))
+      .toBe('dsf.hospital.example.org-endpoint');
+  });
+
+  it('works with plain hostname URL', () => {
+    expect(deriveEndpointIdentifier('https://example.org'))
+      .toBe('example.org-endpoint');
+  });
+
+  it('returns empty string for empty input', () => {
+    expect(deriveEndpointIdentifier('')).toBe('');
+    expect(deriveEndpointIdentifier(null)).toBe('');
+    expect(deriveEndpointIdentifier(undefined)).toBe('');
+  });
+
+  it('returns empty string for invalid URL', () => {
+    expect(deriveEndpointIdentifier('not-a-url')).toBe('');
+  });
+
+  it('handles whitespace around URL', () => {
+    expect(deriveEndpointIdentifier('  https://example.org/fhir  '))
+      .toBe('example.org-endpoint');
+  });
+
+  it('handles URL with port', () => {
+    expect(deriveEndpointIdentifier('https://dsf.example.org:8443/fhir'))
+      .toBe('dsf.example.org-endpoint');
+  });
+});
+
+// =============================================
+// getEndpointIdentifier
+// =============================================
+describe('getEndpointIdentifier', () => {
+  it('uses override when provided', () => {
+    const org = { endpointUrl: 'https://example.org/fhir', endpointIdentifierOverride: 'custom-id' };
+    expect(getEndpointIdentifier(org)).toBe('custom-id');
+  });
+
+  it('derives from URL when no override', () => {
+    const org = { endpointUrl: 'https://dsf.example.org/fhir', endpointIdentifierOverride: '' };
+    expect(getEndpointIdentifier(org)).toBe('dsf.example.org-endpoint');
+  });
+
+  it('derives from URL when override is whitespace only', () => {
+    const org = { endpointUrl: 'https://dsf.example.org/fhir', endpointIdentifierOverride: '   ' };
+    expect(getEndpointIdentifier(org)).toBe('dsf.example.org-endpoint');
+  });
+
+  it('handles missing override property', () => {
+    const org = { endpointUrl: 'https://dsf.example.org/fhir' };
+    expect(getEndpointIdentifier(org)).toBe('dsf.example.org-endpoint');
+  });
+});
+
+// =============================================
+// validate
+// =============================================
+describe('validate', () => {
+  it('returns no errors for valid input', () => {
+    const errors = validate(validParent(), [validMember()]);
+    expect(errors).toEqual([]);
+  });
+
+  it('requires parent identifier', () => {
+    const errors = validate(validParent({ identifier: '' }), [validMember()]);
+    expect(errors).toContain('Parent organization identifier is required.');
+  });
+
+  it('requires at least one member', () => {
+    const errors = validate(validParent(), []);
+    expect(errors).toContain('At least one member organization is required.');
+  });
+
+  it('requires member identifier', () => {
+    const errors = validate(validParent(), [validMember({ identifier: '' })]);
+    expect(errors).toContain('Member 1: Identifier is required.');
+  });
+
+  it('requires member endpoint URL', () => {
+    const errors = validate(validParent(), [validMember({ endpointUrl: '' })]);
+    expect(errors).toContain('Member 1: DSF FHIR Server Endpoint URL is required.');
+  });
+
+  it('requires derivable endpoint identifier', () => {
+    const errors = validate(validParent(), [validMember({ endpointUrl: 'not-a-url', endpointIdentifierOverride: '' })]);
+    expect(errors).toContain('Member 1: Endpoint identifier could not be derived. Please enter the URL or override manually.');
+  });
+
+  it('accepts manual endpoint identifier override for invalid URL', () => {
+    const errors = validate(validParent(), [validMember({ endpointUrl: 'not-a-url', endpointIdentifierOverride: 'my-endpoint' })]);
+    expect(errors).not.toContain(expect.stringContaining('Endpoint identifier'));
+  });
+
+  it('requires at least one thumbprint', () => {
+    const errors = validate(validParent(), [validMember({ thumbprints: [''] })]);
+    expect(errors).toContain('Member 1: At least one certificate thumbprint is required.');
+  });
+
+  it('requires at least one role', () => {
+    const errors = validate(validParent(), [validMember({ roles: [] })]);
+    expect(errors).toContain('Member 1: At least one role must be selected.');
+  });
+
+  it('validates multiple members independently', () => {
+    const members = [
+      validMember(),
+      validMember({ identifier: '', endpointUrl: '' }),
+    ];
+    const errors = validate(validParent(), members);
+    expect(errors).toContain('Member 2: Identifier is required.');
+    expect(errors).toContain('Member 2: DSF FHIR Server Endpoint URL is required.');
+    expect(errors).not.toContain(expect.stringContaining('Member 1'));
+  });
+});
+
+// =============================================
+// buildParentOrganization
+// =============================================
+describe('buildParentOrganization', () => {
+  it('uses organization-parent profile', () => {
+    const org = buildParentOrganization(validParent());
+    expect(org.meta.profile).toEqual(['http://dsf.dev/fhir/StructureDefinition/organization-parent']);
+  });
+
+  it('sets resourceType to Organization', () => {
+    const org = buildParentOrganization(validParent());
+    expect(org.resourceType).toBe('Organization');
+  });
+
+  it('sets identifier correctly', () => {
+    const org = buildParentOrganization(validParent());
+    expect(org.identifier[0].system).toBe('http://dsf.dev/sid/organization-identifier');
+    expect(org.identifier[0].value).toBe('dsf.dev');
+  });
+
+  it('includes read-access-tag ALL', () => {
+    const org = buildParentOrganization(validParent());
+    expect(org.meta.tag).toEqual([{ system: 'http://dsf.dev/fhir/CodeSystem/read-access-tag', code: 'ALL' }]);
+  });
+
+  it('sets active to true', () => {
+    const org = buildParentOrganization(validParent());
+    expect(org.active).toBe(true);
+  });
+
+  it('includes name when provided', () => {
+    const org = buildParentOrganization(validParent({ name: 'My Consortium' }));
+    expect(org.name).toBe('My Consortium');
+  });
+
+  it('omits name when empty', () => {
+    const org = buildParentOrganization(validParent({ name: '' }));
+    expect(org.name).toBeUndefined();
+  });
+
+  it('has no endpoint reference', () => {
+    const org = buildParentOrganization(validParent());
+    expect(org.endpoint).toBeUndefined();
+  });
+
+  it('has no certificate thumbprint extensions', () => {
+    const org = buildParentOrganization(validParent());
+    expect(org.extension).toBeUndefined();
+  });
+
+  it('trims whitespace from identifier', () => {
+    const org = buildParentOrganization(validParent({ identifier: '  dsf.dev  ' }));
+    expect(org.identifier[0].value).toBe('dsf.dev');
+  });
+});
+
+// =============================================
+// buildMemberOrganization
+// =============================================
+describe('buildMemberOrganization', () => {
+  it('uses organization profile (not organization-parent)', () => {
+    const org = buildMemberOrganization(validMember(), 'ep-uuid');
+    expect(org.meta.profile).toEqual(['http://dsf.dev/fhir/StructureDefinition/organization']);
+  });
+
+  it('includes certificate thumbprint extensions', () => {
+    const org = buildMemberOrganization(validMember({ thumbprints: ['abc123', 'def456'] }), 'ep-uuid');
+    expect(org.extension).toHaveLength(2);
+    expect(org.extension[0].url).toBe('http://dsf.dev/fhir/StructureDefinition/extension-certificate-thumbprint');
+    expect(org.extension[0].valueString).toBe('abc123');
+    expect(org.extension[1].valueString).toBe('def456');
+  });
+
+  it('filters empty thumbprints', () => {
+    const org = buildMemberOrganization(validMember({ thumbprints: ['abc123', '', '  '] }), 'ep-uuid');
+    expect(org.extension).toHaveLength(1);
+  });
+
+  it('includes endpoint reference', () => {
+    const org = buildMemberOrganization(validMember(), 'my-ep-id');
+    expect(org.endpoint[0].reference).toBe('urn:uuid:my-ep-id');
+    expect(org.endpoint[0].type).toBe('Endpoint');
+  });
+
+  it('includes read-access-tag ALL', () => {
+    const org = buildMemberOrganization(validMember(), 'ep-uuid');
+    expect(org.meta.tag[0].code).toBe('ALL');
+  });
+});
+
+// =============================================
+// buildEndpoint
+// =============================================
+describe('buildEndpoint', () => {
+  it('sets resourceType to Endpoint', () => {
+    const ep = buildEndpoint(validMember(), 'org-uuid');
+    expect(ep.resourceType).toBe('Endpoint');
+  });
+
+  it('uses endpoint profile', () => {
+    const ep = buildEndpoint(validMember(), 'org-uuid');
+    expect(ep.meta.profile).toEqual(['http://dsf.dev/fhir/StructureDefinition/endpoint']);
+  });
+
+  it('derives endpoint identifier from URL', () => {
+    const ep = buildEndpoint(validMember(), 'org-uuid');
+    expect(ep.identifier[0].value).toBe('dsf.hospital.example.org-endpoint');
+    expect(ep.identifier[0].system).toBe('http://dsf.dev/sid/endpoint-identifier');
+  });
+
+  it('uses override endpoint identifier when set', () => {
+    const ep = buildEndpoint(validMember({ endpointIdentifierOverride: 'custom-ep' }), 'org-uuid');
+    expect(ep.identifier[0].value).toBe('custom-ep');
+  });
+
+  it('sets connectionType to hl7-fhir-rest', () => {
+    const ep = buildEndpoint(validMember(), 'org-uuid');
+    expect(ep.connectionType.code).toBe('hl7-fhir-rest');
+  });
+
+  it('sets address to endpoint URL', () => {
+    const ep = buildEndpoint(validMember(), 'org-uuid');
+    expect(ep.address).toBe('https://dsf.hospital.example.org/fhir');
+  });
+
+  it('references managing organization', () => {
+    const ep = buildEndpoint(validMember(), 'org-uuid-123');
+    expect(ep.managingOrganization.reference).toBe('urn:uuid:org-uuid-123');
+    expect(ep.managingOrganization.type).toBe('Organization');
+  });
+
+  it('sets payloadType to Task', () => {
+    const ep = buildEndpoint(validMember(), 'org-uuid');
+    expect(ep.payloadType[0].coding[0].code).toBe('Task');
+  });
+
+  it('includes both FHIR MIME types', () => {
+    const ep = buildEndpoint(validMember(), 'org-uuid');
+    expect(ep.payloadMimeType).toContain('application/fhir+json');
+    expect(ep.payloadMimeType).toContain('application/fhir+xml');
+  });
+
+  it('sets status to active', () => {
+    const ep = buildEndpoint(validMember(), 'org-uuid');
+    expect(ep.status).toBe('active');
+  });
+});
+
+// =============================================
+// buildAffiliation
+// =============================================
+describe('buildAffiliation', () => {
+  it('sets resourceType to OrganizationAffiliation', () => {
+    const aff = buildAffiliation('parent-id', 'member-id', 'ep-id', ['DIC']);
+    expect(aff.resourceType).toBe('OrganizationAffiliation');
+  });
+
+  it('uses organization-affiliation profile', () => {
+    const aff = buildAffiliation('parent-id', 'member-id', 'ep-id', ['DIC']);
+    expect(aff.meta.profile).toEqual(['http://dsf.dev/fhir/StructureDefinition/organization-affiliation']);
+  });
+
+  it('references parent organization', () => {
+    const aff = buildAffiliation('parent-id', 'member-id', 'ep-id', ['DIC']);
+    expect(aff.organization.reference).toBe('urn:uuid:parent-id');
+    expect(aff.organization.type).toBe('Organization');
+  });
+
+  it('references participating organization', () => {
+    const aff = buildAffiliation('parent-id', 'member-id', 'ep-id', ['DIC']);
+    expect(aff.participatingOrganization.reference).toBe('urn:uuid:member-id');
+  });
+
+  it('references endpoint', () => {
+    const aff = buildAffiliation('parent-id', 'member-id', 'ep-id', ['DIC']);
+    expect(aff.endpoint[0].reference).toBe('urn:uuid:ep-id');
+  });
+
+  it('maps roles to CodeSystem codes', () => {
+    const aff = buildAffiliation('parent-id', 'member-id', 'ep-id', ['DIC', 'TTP']);
+    expect(aff.code).toHaveLength(2);
+    expect(aff.code[0].coding[0].system).toBe('http://dsf.dev/fhir/CodeSystem/organization-role');
+    expect(aff.code[0].coding[0].code).toBe('DIC');
+    expect(aff.code[1].coding[0].code).toBe('TTP');
+  });
+
+  it('sets active to true', () => {
+    const aff = buildAffiliation('parent-id', 'member-id', 'ep-id', ['DIC']);
+    expect(aff.active).toBe(true);
+  });
+});
+
+// =============================================
+// generateBundle
+// =============================================
+describe('generateBundle', () => {
+  let uuidCounter;
+  function deterministicUuid() {
+    return `uuid-${uuidCounter++}`;
+  }
+
+  function setup() {
+    uuidCounter = 0;
+  }
+
+  it('generates a transaction bundle', () => {
+    setup();
+    const bundle = generateBundle(validParent(), [validMember()], deterministicUuid);
+    expect(bundle.resourceType).toBe('Bundle');
+    expect(bundle.type).toBe('transaction');
+  });
+
+  it('creates correct number of entries for one member', () => {
+    setup();
+    const bundle = generateBundle(validParent(), [validMember()], deterministicUuid);
+    // 1 parent org + 1 member org + 1 endpoint + 1 affiliation = 4
+    expect(bundle.entry).toHaveLength(4);
+  });
+
+  it('creates correct number of entries for two members', () => {
+    setup();
+    const bundle = generateBundle(validParent(), [validMember(), validMember({ identifier: 'other.org' })], deterministicUuid);
+    // 1 parent org + 2 * (member org + endpoint + affiliation) = 7
+    expect(bundle.entry).toHaveLength(7);
+  });
+
+  it('first entry is parent organization with organization-parent profile', () => {
+    setup();
+    const bundle = generateBundle(validParent(), [validMember()], deterministicUuid);
+    const parentEntry = bundle.entry[0];
+    expect(parentEntry.resource.resourceType).toBe('Organization');
+    expect(parentEntry.resource.meta.profile[0]).toContain('organization-parent');
+    expect(parentEntry.fullUrl).toBe('urn:uuid:uuid-0');
+  });
+
+  it('parent org has no endpoint or extensions', () => {
+    setup();
+    const bundle = generateBundle(validParent(), [validMember()], deterministicUuid);
+    const parentResource = bundle.entry[0].resource;
+    expect(parentResource.endpoint).toBeUndefined();
+    expect(parentResource.extension).toBeUndefined();
+  });
+
+  it('member organization uses organization profile', () => {
+    setup();
+    const bundle = generateBundle(validParent(), [validMember()], deterministicUuid);
+    const memberEntry = bundle.entry[1];
+    expect(memberEntry.resource.meta.profile[0]).toContain('/organization');
+    expect(memberEntry.resource.meta.profile[0]).not.toContain('organization-parent');
+  });
+
+  it('member org references its endpoint', () => {
+    setup();
+    const bundle = generateBundle(validParent(), [validMember()], deterministicUuid);
+    // uuid-0 = parent, uuid-1 = member org, uuid-2 = member endpoint
+    const memberOrg = bundle.entry[1].resource;
+    expect(memberOrg.endpoint[0].reference).toBe('urn:uuid:uuid-2');
+  });
+
+  it('endpoint references its managing organization', () => {
+    setup();
+    const bundle = generateBundle(validParent(), [validMember()], deterministicUuid);
+    const endpoint = bundle.entry[2].resource;
+    expect(endpoint.managingOrganization.reference).toBe('urn:uuid:uuid-1');
+  });
+
+  it('affiliation references parent and member', () => {
+    setup();
+    const bundle = generateBundle(validParent(), [validMember()], deterministicUuid);
+    const aff = bundle.entry[3].resource;
+    expect(aff.organization.reference).toBe('urn:uuid:uuid-0'); // parent
+    expect(aff.participatingOrganization.reference).toBe('urn:uuid:uuid-1'); // member
+    expect(aff.endpoint[0].reference).toBe('urn:uuid:uuid-2'); // endpoint
+  });
+
+  it('all PUT URLs use identifiers, not UUIDs', () => {
+    setup();
+    const bundle = generateBundle(validParent(), [validMember()], deterministicUuid);
+    bundle.entry.forEach(entry => {
+      expect(entry.request.method).toBe('PUT');
+      // No URL should contain uuid- (all should use identifier-based search)
+      expect(entry.request.url).not.toContain('uuid-');
+    });
+  });
+
+  it('parent org PUT URL uses organization identifier', () => {
+    setup();
+    const bundle = generateBundle(validParent(), [validMember()], deterministicUuid);
+    expect(bundle.entry[0].request.url).toBe(
+      'Organization?identifier=http://dsf.dev/sid/organization-identifier|dsf.dev'
+    );
+  });
+
+  it('member org PUT URL uses organization identifier', () => {
+    setup();
+    const bundle = generateBundle(validParent(), [validMember()], deterministicUuid);
+    expect(bundle.entry[1].request.url).toBe(
+      'Organization?identifier=http://dsf.dev/sid/organization-identifier|hospital.example.org'
+    );
+  });
+
+  it('endpoint PUT URL uses endpoint identifier', () => {
+    setup();
+    const bundle = generateBundle(validParent(), [validMember()], deterministicUuid);
+    expect(bundle.entry[2].request.url).toBe(
+      'Endpoint?identifier=http://dsf.dev/sid/endpoint-identifier|dsf.hospital.example.org-endpoint'
+    );
+  });
+
+  it('affiliation PUT URL uses primary and participating organization identifiers', () => {
+    setup();
+    const bundle = generateBundle(validParent(), [validMember()], deterministicUuid);
+    const affUrl = bundle.entry[3].request.url;
+    expect(affUrl).toContain('OrganizationAffiliation?');
+    expect(affUrl).toContain('primary-organization:identifier=http://dsf.dev/sid/organization-identifier|dsf.dev');
+    expect(affUrl).toContain('participating-organization:identifier=http://dsf.dev/sid/organization-identifier|hospital.example.org');
+  });
+
+  it('all resources have read-access-tag ALL', () => {
+    setup();
+    const bundle = generateBundle(validParent(), [validMember()], deterministicUuid);
+    bundle.entry.forEach(entry => {
+      const tag = entry.resource.meta.tag[0];
+      expect(tag.system).toBe('http://dsf.dev/fhir/CodeSystem/read-access-tag');
+      expect(tag.code).toBe('ALL');
+    });
+  });
+
+  it('uses endpoint identifier override in PUT URL', () => {
+    setup();
+    const bundle = generateBundle(validParent(), [validMember({ endpointIdentifierOverride: 'my-custom-ep' })], deterministicUuid);
+    expect(bundle.entry[2].request.url).toBe(
+      'Endpoint?identifier=http://dsf.dev/sid/endpoint-identifier|my-custom-ep'
+    );
+  });
+
+  it('encodes special characters in identifiers', () => {
+    setup();
+    const bundle = generateBundle(
+      validParent({ identifier: 'org with spaces' }),
+      [validMember({ identifier: 'member/special' })],
+      deterministicUuid
+    );
+    expect(bundle.entry[0].request.url).toContain(encodeURIComponent('org with spaces'));
+    expect(bundle.entry[1].request.url).toContain(encodeURIComponent('member/special'));
+  });
+});

From a2499ae5fdbad7cde090d76b359b45a58fd51f29 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20B=C3=B6hringer?= <jan.boehringer@hs-heilbronn.de>
Date: Mon, 9 Mar 2026 11:22:06 +0100
Subject: [PATCH 3/6] Now supports dark mode by using the correct vuepress
 theme variables

---
 .../components/AllowListGenerator.vue         | 43 ++++++++-----------
 1 file changed, 17 insertions(+), 26 deletions(-)

diff --git a/docs/src/.vuepress/components/AllowListGenerator.vue b/docs/src/.vuepress/components/AllowListGenerator.vue
index 39737d707..c172d1c90 100644
--- a/docs/src/.vuepress/components/AllowListGenerator.vue
+++ b/docs/src/.vuepress/components/AllowListGenerator.vue
@@ -178,21 +178,18 @@ function downloadJson() {
 <style scoped>
 .allow-list-generator {
   max-width: 900px;
+  margin-top: 50px;
 }
 
 .section {
   margin-bottom: 2rem;
-  padding: 1.5rem;
-  border: 1px solid var(--border-color, #e2e8f0);
-  border-radius: 8px;
-  background: var(--bg-color-secondary, #f8fafc);
 }
 
 .section h3 {
   margin-top: 0;
   margin-bottom: 1rem;
   padding-bottom: 0.5rem;
-  border-bottom: 2px solid var(--theme-color, #3eaf7c);
+  border-bottom: 2px solid var(--vp-c-accent, #3eaf7c);
 }
 
 .form-group {
@@ -269,7 +266,6 @@ function downloadJson() {
   padding: 1rem;
   border: 1px solid var(--border-color, #ddd);
   border-radius: 6px;
-  background: var(--bg-color, #fff);
 }
 
 .member-header {
@@ -280,8 +276,7 @@ function downloadJson() {
 }
 
 .btn-primary {
-  background: var(--theme-color, #3eaf7c);
-  color: #fff;
+  background: var(--vp-c-accent-soft, #f5f5f5);
   border: none;
   padding: 0.5rem 1rem;
   border-radius: 4px;
@@ -290,13 +285,12 @@ function downloadJson() {
 }
 
 .btn-primary:hover {
-  opacity: 0.9;
+  color: var(--vp-c-accent, #3eaf7c);
 }
 
 .btn-secondary {
-  background: var(--bg-color, #fff);
-  color: var(--text-color, #333);
-  border: 1px solid var(--border-color, #ddd);
+  background: var(--vp-c-accent-soft, #f5f5f5);
+  border: none;
   padding: 0.5rem 1rem;
   border-radius: 4px;
   cursor: pointer;
@@ -304,37 +298,35 @@ function downloadJson() {
 }
 
 .btn-secondary:hover {
-  background: var(--bg-color-secondary, #f5f5f5);
+  color: var(--vp-c-accent, #3eaf7c);
 }
 
 .btn-add {
-  background: none;
-  border: 1px dashed var(--border-color, #ccc);
+  background: var(--vp-c-accent-soft, #f5f5f5);
   padding: 0.3rem 0.8rem;
   border-radius: 4px;
   cursor: pointer;
   font-size: 0.85rem;
-  color: var(--text-color-lighter, #666);
+  border: none;
 }
 
 .btn-add:hover {
-  border-color: var(--theme-color, #3eaf7c);
-  color: var(--theme-color, #3eaf7c);
+  color: var(--vp-c-accent, #3eaf7c);
 }
 
 .btn-remove {
-  background: none;
-  border: 1px solid var(--border-color, #ddd);
+  border: none;
   padding: 0.2rem 0.5rem;
   border-radius: 4px;
   cursor: pointer;
-  color: #e53e3e;
+  color: var(--caution-c-text,#e53e3e);
   font-size: 0.8rem;
   flex-shrink: 0;
+  background: var(--caution-c-soft);
 }
 
 .btn-remove:hover {
-  background: #fed7d7;
+  background: var(--caution-c-accent);
 }
 
 .button-row {
@@ -345,8 +337,7 @@ function downloadJson() {
 }
 
 .validation-errors {
-  background: #fff5f5;
-  border: 1px solid #fc8181;
+  background: var(--caution-c-soft);
   border-radius: 4px;
   padding: 0.75rem 1rem;
   margin-bottom: 1rem;
@@ -354,12 +345,12 @@ function downloadJson() {
 
 .validation-errors p {
   margin: 0.25rem 0;
-  color: #c53030;
+  color: var(--caution-c-text,#e53e3e);
   font-size: 0.85rem;
 }
 
 .copy-success {
-  color: var(--theme-color, #3eaf7c);
+  color: var(--vp-c-accent, #3eaf7c);
   font-weight: 600;
   margin-bottom: 0.5rem;
   font-size: 0.9rem;

From 40a7d7903b3e414557c4acc24d676d81b5e95030 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20B=C3=B6hringer?= <jan.boehringer@hs-heilbronn.de>
Date: Mon, 9 Mar 2026 11:24:32 +0100
Subject: [PATCH 4/6] JSON output now also supports dark mode

---
 docs/src/.vuepress/components/AllowListGenerator.vue | 2 --
 1 file changed, 2 deletions(-)

diff --git a/docs/src/.vuepress/components/AllowListGenerator.vue b/docs/src/.vuepress/components/AllowListGenerator.vue
index c172d1c90..179b320f1 100644
--- a/docs/src/.vuepress/components/AllowListGenerator.vue
+++ b/docs/src/.vuepress/components/AllowListGenerator.vue
@@ -357,8 +357,6 @@ function downloadJson() {
 }
 
 .json-output {
-  background: var(--code-bg-color, #282c34);
-  color: var(--code-text-color, #abb2bf);
   padding: 1rem;
   border-radius: 6px;
   overflow-x: auto;

From 7a539c1a098e2a116d5a5b5287883fa6e405ea6b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20B=C3=B6hringer?= <jan.boehringer@hs-heilbronn.de>
Date: Mon, 9 Mar 2026 11:27:36 +0100
Subject: [PATCH 5/6] Component should not have max width of 900px

---
 docs/src/.vuepress/components/AllowListGenerator.vue | 1 -
 1 file changed, 1 deletion(-)

diff --git a/docs/src/.vuepress/components/AllowListGenerator.vue b/docs/src/.vuepress/components/AllowListGenerator.vue
index 179b320f1..be97d06f6 100644
--- a/docs/src/.vuepress/components/AllowListGenerator.vue
+++ b/docs/src/.vuepress/components/AllowListGenerator.vue
@@ -177,7 +177,6 @@ function downloadJson() {
 
 <style scoped>
 .allow-list-generator {
-  max-width: 900px;
   margin-top: 50px;
 }
 

From 2072ada23dd82c93be0cb3a274d85bf2483e03e5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20B=C3=B6hringer?= <jan.boehringer@hs-heilbronn.de>
Date: Mon, 9 Mar 2026 11:40:14 +0100
Subject: [PATCH 6/6] Borders and code block are now dependent on light/dark
 mode

---
 docs/src/.vuepress/components/AllowListGenerator.vue | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/docs/src/.vuepress/components/AllowListGenerator.vue b/docs/src/.vuepress/components/AllowListGenerator.vue
index be97d06f6..3300f5e71 100644
--- a/docs/src/.vuepress/components/AllowListGenerator.vue
+++ b/docs/src/.vuepress/components/AllowListGenerator.vue
@@ -206,7 +206,7 @@ function downloadJson() {
 .thumbprint-row input {
   width: 100%;
   padding: 0.5rem;
-  border: 1px solid var(--border-color, #ddd);
+  border: 1px solid var(--vp-c-border, #ddd);
   border-radius: 4px;
   font-size: 0.9rem;
   box-sizing: border-box;
@@ -263,7 +263,7 @@ function downloadJson() {
 .member-card {
   margin-bottom: 1.5rem;
   padding: 1rem;
-  border: 1px solid var(--border-color, #ddd);
+  border: 1px solid var(--vp-c-border, #ddd);
   border-radius: 6px;
 }
 
@@ -358,6 +358,7 @@ function downloadJson() {
 .json-output {
   padding: 1rem;
   border-radius: 6px;
+  border: 1px solid var(--vp-c-border);
   overflow-x: auto;
   font-size: 0.8rem;
   max-height: 600px;
@@ -374,13 +375,11 @@ function downloadJson() {
   display: block;
   margin-top: 0.25rem;
   font-size: 0.8rem;
-  color: var(--text-color-lighter, #888);
 }
 
 .field-hint code {
   font-size: 0.8rem;
   padding: 0.1rem 0.3rem;
-  background: var(--bg-color-secondary, #eee);
   border-radius: 3px;
 }
 </style>