From e0a80db116be5c31a369eeb6d9894f56dfc7a7c0 Mon Sep 17 00:00:00 2001
From: Simon Schweizer <simon@schwzr.de>
Date: Sun, 8 Mar 2026 22:32:29 +0100
Subject: [PATCH 1/7] minimal allowlist generator

---
 docs/src/.vuepress/client.ts                  |   2 +
 .../components/AllowListGenerator.vue         | 587 ++++++++++++++++++
 docs/src/.vuepress/sidebar/operations-v2.ts   |   2 +-
 .../operations/v2.1.0/allowlist-generator.md  |  23 +
 4 files changed, 613 insertions(+), 1 deletion(-)
 create mode 100644 docs/src/.vuepress/components/AllowListGenerator.vue
 create mode 100644 docs/src/operations/v2.1.0/allowlist-generator.md

diff --git a/docs/src/.vuepress/client.ts b/docs/src/.vuepress/client.ts
index 7ee02bc47..9bb3e64a0 100644
--- a/docs/src/.vuepress/client.ts
+++ b/docs/src/.vuepress/client.ts
@@ -4,12 +4,14 @@ import { Layout as ParentLayout } from "vuepress-theme-hope/client";
 import Layout from './layouts/PageLayout.vue'
 import NotFoundLayout from './layouts/NotFoundLayout.vue'
 import BlogLayout from './layouts/BlogLayout.vue';
+import AllowListGenerator from './components/AllowListGenerator.vue';
 
 import OldVersions from './components/OldVersions.vue';
 
 export default defineClientConfig({
     enhance({ app }) {
     app.component('OldVersions', OldVersions);
+    app.component('AllowListGenerator', AllowListGenerator);
   },
   layouts: {
     ParentLayout,
diff --git a/docs/src/.vuepress/components/AllowListGenerator.vue b/docs/src/.vuepress/components/AllowListGenerator.vue
new file mode 100644
index 000000000..2cfceb66f
--- /dev/null
+++ b/docs/src/.vuepress/components/AllowListGenerator.vue
@@ -0,0 +1,587 @@
+<template>
+  <div class="allow-list-generator">
+    <!-- Parent Organization -->
+    <div class="section">
+      <h3>Parent Organization (Consortium / Project)</h3>
+      <div class="form-group">
+        <label>Identifier</label>
+        <input v-model="parentOrg.identifier" placeholder="e.g. dsf.dev" />
+      </div>
+      <div class="form-group">
+        <label>Name</label>
+        <input v-model="parentOrg.name" placeholder="e.g. DSF Community" />
+      </div>
+    </div>
+
+    <!-- Member Organizations -->
+    <div class="section">
+      <h3>Member Organizations</h3>
+      <div v-for="(org, idx) in members" :key="'org-' + idx" class="member-card">
+        <div class="member-header">
+          <strong>Organization {{ idx + 1 }}</strong>
+          <button class="btn-remove" @click="members.splice(idx, 1)" title="Remove Organization">&#x2715;</button>
+        </div>
+        <div class="form-group">
+          <label>Identifier</label>
+          <input v-model="org.identifier" placeholder="e.g. hospital.example.org" />
+        </div>
+        <div class="form-group">
+          <label>Name</label>
+          <input v-model="org.name" placeholder="e.g. Example Hospital" />
+        </div>
+        <div class="form-group">
+          <label>DSF FHIR Server Endpoint URL</label>
+          <input v-model="org.endpointUrl" placeholder="https://dsf.hospital.example.org/fhir" />
+        </div>
+        <div class="form-group">
+          <label>Endpoint Identifier</label>
+          <input v-model="org.endpointIdentifierOverride" :placeholder="deriveEndpointIdentifier(org.endpointUrl)" />
+          <span class="field-hint" v-if="!org.endpointIdentifierOverride && deriveEndpointIdentifier(org.endpointUrl)">Auto-generated from URL: <code>{{ deriveEndpointIdentifier(org.endpointUrl) }}</code></span>
+        </div>
+        <div class="thumbprints">
+          <label>Certificate Thumbprints (SHA-512 hex)</label>
+          <div v-for="(tp, i) in org.thumbprints" :key="'member-' + idx + '-tp-' + i" class="thumbprint-row">
+            <input v-model="org.thumbprints[i]" placeholder="SHA-512 thumbprint (128 hex characters)" />
+            <button class="btn-remove" @click="org.thumbprints.splice(i, 1)" v-if="org.thumbprints.length > 1" title="Remove">&#x2715;</button>
+          </div>
+          <button class="btn-add" @click="org.thumbprints.push('')">+ Add Thumbprint</button>
+        </div>
+        <div class="form-group">
+          <label>Roles</label>
+          <div class="roles-grid">
+            <label v-for="role in availableRoles" :key="role.code" class="role-checkbox">
+              <input type="checkbox" :value="role.code" v-model="org.roles" />
+              {{ role.code }} <span class="role-label">{{ role.display }}</span>
+            </label>
+          </div>
+        </div>
+      </div>
+      <button class="btn-primary" @click="addMember">+ Add Member Organization</button>
+    </div>
+
+    <!-- Generate -->
+    <div class="section">
+      <h3>Generated Bundle</h3>
+      <div class="button-row">
+        <button class="btn-primary" @click="generate">Generate FHIR Bundle</button>
+        <button class="btn-secondary" @click="copyToClipboard" v-if="generatedJson">Copy to Clipboard</button>
+        <button class="btn-secondary" @click="downloadJson" v-if="generatedJson">Download JSON</button>
+      </div>
+      <div v-if="validationErrors.length" class="validation-errors">
+        <p v-for="(err, i) in validationErrors" :key="i">{{ err }}</p>
+      </div>
+      <div v-if="copySuccess" class="copy-success">Copied to clipboard!</div>
+      <pre v-if="generatedJson" class="json-output"><code>{{ generatedJson }}</code></pre>
+    </div>
+  </div>
+</template>
+
+<script setup>
+import { ref, reactive } from 'vue';
+
+const availableRoles = [
+  { code: 'DIC', display: 'Data Integration Center' },
+  { code: 'DTS', display: 'Data Transfer Site' },
+  { code: 'DMS', display: 'Data Management Site' },
+  { code: 'COS', display: 'Coordinating Site' },
+  { code: 'CRR', display: 'Central Research Repository' },
+  { code: 'HRP', display: 'Health Research Platform' },
+  { code: 'TTP', display: 'Trusted Third Party' },
+  { code: 'UAC', display: 'Use-and-Access Committee' },
+  { code: 'AMS', display: 'Allowlist Management Site' },
+  { code: 'ASP', display: 'Analysis Service Provider' },
+  { code: 'SPR', display: 'Service Provider Registry' },
+  { code: 'TSP', display: 'Terminology Service Provider' },
+  { code: 'PPH', display: 'Process Plugin Hub' },
+  { code: 'BIO', display: 'Biobank' },
+];
+
+function createOrg() {
+  return {
+    identifier: '',
+    name: '',
+    endpointUrl: '',
+    endpointIdentifierOverride: '',
+    thumbprints: [''],
+    roles: [],
+  };
+}
+
+function deriveEndpointIdentifier(url) {
+  if (!url || !url.trim()) return '';
+  try {
+    const hostname = new URL(url.trim()).hostname;
+    return hostname ? hostname + '-endpoint' : '';
+  } catch {
+    return '';
+  }
+}
+
+function getEndpointIdentifier(org) {
+  return org.endpointIdentifierOverride?.trim() || deriveEndpointIdentifier(org.endpointUrl);
+}
+
+const parentOrg = reactive({
+  identifier: '',
+  name: '',
+});
+
+const members = ref([createOrg()]);
+const generatedJson = ref('');
+const validationErrors = ref([]);
+const copySuccess = ref(false);
+
+function addMember() {
+  members.value.push(createOrg());
+}
+
+function validate() {
+  const errors = [];
+  if (!parentOrg.identifier.trim()) errors.push('Parent organization identifier is required.');
+
+  if (members.value.length === 0) errors.push('At least one member organization is required.');
+
+  members.value.forEach((m, i) => {
+    const n = i + 1;
+    if (!m.identifier.trim()) errors.push(`Member ${n}: Identifier is required.`);
+    if (!m.endpointUrl.trim()) errors.push(`Member ${n}: DSF FHIR Server Endpoint URL is required.`);
+    if (!getEndpointIdentifier(m)) errors.push(`Member ${n}: Endpoint identifier could not be derived. Please enter the URL or override manually.`);
+    const mTps = m.thumbprints.filter(t => t.trim());
+    if (mTps.length === 0) errors.push(`Member ${n}: At least one certificate thumbprint is required.`);
+    if (m.roles.length === 0) errors.push(`Member ${n}: At least one role must be selected.`);
+  });
+
+  return errors;
+}
+
+const META_TAG = {
+  system: 'http://dsf.dev/fhir/CodeSystem/read-access-tag',
+  code: 'ALL',
+};
+
+function buildParentOrganization(org) {
+  return {
+    resourceType: 'Organization',
+    meta: {
+      profile: ['http://dsf.dev/fhir/StructureDefinition/organization-parent'],
+      tag: [META_TAG],
+    },
+    active: true,
+    identifier: [{
+      system: 'http://dsf.dev/sid/organization-identifier',
+      value: org.identifier.trim(),
+    }],
+    name: org.name.trim() || undefined,
+  };
+}
+
+function buildMemberOrganization(org, endpointId) {
+  const thumbprintExtensions = org.thumbprints
+    .filter(t => t.trim())
+    .map(t => ({
+      url: 'http://dsf.dev/fhir/StructureDefinition/extension-certificate-thumbprint',
+      valueString: t.trim(),
+    }));
+
+  return {
+    resourceType: 'Organization',
+    meta: {
+      profile: ['http://dsf.dev/fhir/StructureDefinition/organization'],
+      tag: [META_TAG],
+    },
+    extension: thumbprintExtensions,
+    active: true,
+    identifier: [{
+      system: 'http://dsf.dev/sid/organization-identifier',
+      value: org.identifier.trim(),
+    }],
+    name: org.name.trim() || undefined,
+    endpoint: [{
+      reference: `urn:uuid:${endpointId}`,
+      type: 'Endpoint',
+    }],
+  };
+}
+
+function buildEndpoint(org, managingOrgId) {
+  return {
+    resourceType: 'Endpoint',
+    meta: {
+      profile: ['http://dsf.dev/fhir/StructureDefinition/endpoint'],
+      tag: [META_TAG],
+    },
+    status: 'active',
+    identifier: [{
+      system: 'http://dsf.dev/sid/endpoint-identifier',
+      value: getEndpointIdentifier(org),
+    }],
+    connectionType: {
+      system: 'http://terminology.hl7.org/CodeSystem/endpoint-connection-type',
+      code: 'hl7-fhir-rest',
+    },
+    name: `DSF Endpoint for ${org.identifier.trim()}`,
+    managingOrganization: {
+      reference: `urn:uuid:${managingOrgId}`,
+      type: 'Organization',
+    },
+    payloadType: [{
+      coding: [{
+        system: 'http://hl7.org/fhir/resource-types',
+        code: 'Task',
+      }],
+    }],
+    payloadMimeType: ['application/fhir+json', 'application/fhir+xml'],
+    address: org.endpointUrl.trim(),
+  };
+}
+
+function buildAffiliation(parentOrgId, memberOrgId, endpointId, roles) {
+  return {
+    resourceType: 'OrganizationAffiliation',
+    meta: {
+      profile: ['http://dsf.dev/fhir/StructureDefinition/organization-affiliation'],
+      tag: [META_TAG],
+    },
+    active: true,
+    organization: {
+      reference: `urn:uuid:${parentOrgId}`,
+      type: 'Organization',
+    },
+    participatingOrganization: {
+      reference: `urn:uuid:${memberOrgId}`,
+      type: 'Organization',
+    },
+    code: roles.map(r => ({
+      coding: [{
+        system: 'http://dsf.dev/fhir/CodeSystem/organization-role',
+        code: r,
+      }],
+    })),
+    endpoint: [{
+      reference: `urn:uuid:${endpointId}`,
+      type: 'Endpoint',
+    }],
+  };
+}
+
+function uuid() {
+  return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, c => {
+    const r = (Math.random() * 16) | 0;
+    const v = c === 'x' ? r : (r & 0x3) | 0x8;
+    return v.toString(16);
+  });
+}
+
+function generate() {
+  const errors = validate();
+  validationErrors.value = errors;
+  if (errors.length > 0) {
+    generatedJson.value = '';
+    return;
+  }
+
+  const entries = [];
+  const parentOrgId = uuid();
+
+  // Parent Organization (no endpoint, no thumbprints)
+  entries.push({
+    fullUrl: `urn:uuid:${parentOrgId}`,
+    resource: buildParentOrganization(parentOrg),
+    request: {
+      method: 'PUT',
+      url: `Organization?identifier=http://dsf.dev/sid/organization-identifier|${encodeURIComponent(parentOrg.identifier.trim())}`,
+    },
+  });
+
+  // Members
+  members.value.forEach(member => {
+    const memberOrgId = uuid();
+    const memberEndpointId = uuid();
+
+    entries.push({
+      fullUrl: `urn:uuid:${memberOrgId}`,
+      resource: buildMemberOrganization(member, memberEndpointId),
+      request: {
+        method: 'PUT',
+        url: `Organization?identifier=http://dsf.dev/sid/organization-identifier|${encodeURIComponent(member.identifier.trim())}`,
+      },
+    });
+
+    entries.push({
+      fullUrl: `urn:uuid:${memberEndpointId}`,
+      resource: buildEndpoint(member, memberOrgId),
+      request: {
+        method: 'PUT',
+        url: `Endpoint?identifier=http://dsf.dev/sid/endpoint-identifier|${encodeURIComponent(getEndpointIdentifier(member))}`,
+      },
+    });
+
+    entries.push({
+      fullUrl: `urn:uuid:${uuid()}`,
+      resource: buildAffiliation(parentOrgId, memberOrgId, memberEndpointId, member.roles),
+      request: {
+        method: 'PUT',
+        url: `OrganizationAffiliation?primary-organization:identifier=http://dsf.dev/sid/organization-identifier|${encodeURIComponent(parentOrg.identifier.trim())}&participating-organization:identifier=http://dsf.dev/sid/organization-identifier|${encodeURIComponent(member.identifier.trim())}`,
+      },
+    });
+  });
+
+  const bundle = {
+    resourceType: 'Bundle',
+    type: 'transaction',
+    entry: entries,
+  };
+
+  generatedJson.value = JSON.stringify(bundle, null, 2);
+}
+
+async function copyToClipboard() {
+  try {
+    await navigator.clipboard.writeText(generatedJson.value);
+    copySuccess.value = true;
+    setTimeout(() => { copySuccess.value = false; }, 2000);
+  } catch {
+    // fallback
+    const el = document.createElement('textarea');
+    el.value = generatedJson.value;
+    document.body.appendChild(el);
+    el.select();
+    document.execCommand('copy');
+    document.body.removeChild(el);
+    copySuccess.value = true;
+    setTimeout(() => { copySuccess.value = false; }, 2000);
+  }
+}
+
+function downloadJson() {
+  const blob = new Blob([generatedJson.value], { type: 'application/json' });
+  const url = URL.createObjectURL(blob);
+  const a = document.createElement('a');
+  a.href = url;
+  a.download = 'allowlist-bundle.json';
+  a.click();
+  URL.revokeObjectURL(url);
+}
+</script>
+
+<style scoped>
+.allow-list-generator {
+  max-width: 900px;
+}
+
+.section {
+  margin-bottom: 2rem;
+  padding: 1.5rem;
+  border: 1px solid var(--border-color, #e2e8f0);
+  border-radius: 8px;
+  background: var(--bg-color-secondary, #f8fafc);
+}
+
+.section h3 {
+  margin-top: 0;
+  margin-bottom: 1rem;
+  padding-bottom: 0.5rem;
+  border-bottom: 2px solid var(--theme-color, #3eaf7c);
+}
+
+.form-group {
+  margin-bottom: 1rem;
+}
+
+.form-group label {
+  display: block;
+  font-weight: 600;
+  margin-bottom: 0.25rem;
+  font-size: 0.9rem;
+}
+
+.form-group input,
+.thumbprint-row input {
+  width: 100%;
+  padding: 0.5rem;
+  border: 1px solid var(--border-color, #ddd);
+  border-radius: 4px;
+  font-size: 0.9rem;
+  box-sizing: border-box;
+}
+
+.thumbprints {
+  margin-bottom: 1rem;
+}
+
+.thumbprints label {
+  display: block;
+  font-weight: 600;
+  margin-bottom: 0.25rem;
+  font-size: 0.9rem;
+}
+
+.thumbprint-row {
+  display: flex;
+  gap: 0.5rem;
+  margin-bottom: 0.5rem;
+  align-items: center;
+}
+
+.thumbprint-row input {
+  flex: 1;
+  font-family: monospace;
+  font-size: 0.8rem;
+}
+
+.roles-grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fill, minmax(280px, 1fr));
+  gap: 0.25rem;
+}
+
+.role-checkbox {
+  display: flex;
+  align-items: center;
+  gap: 0.4rem;
+  font-weight: normal !important;
+  font-size: 0.85rem;
+  cursor: pointer;
+}
+
+.role-checkbox input[type="checkbox"] {
+  width: auto;
+}
+
+.role-label {
+  color: var(--text-color-lighter, #666);
+  font-size: 0.8rem;
+}
+
+.member-card {
+  margin-bottom: 1.5rem;
+  padding: 1rem;
+  border: 1px solid var(--border-color, #ddd);
+  border-radius: 6px;
+  background: var(--bg-color, #fff);
+}
+
+.member-header {
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+  margin-bottom: 1rem;
+}
+
+.btn-primary {
+  background: var(--theme-color, #3eaf7c);
+  color: #fff;
+  border: none;
+  padding: 0.5rem 1rem;
+  border-radius: 4px;
+  cursor: pointer;
+  font-size: 0.9rem;
+}
+
+.btn-primary:hover {
+  opacity: 0.9;
+}
+
+.btn-secondary {
+  background: var(--bg-color, #fff);
+  color: var(--text-color, #333);
+  border: 1px solid var(--border-color, #ddd);
+  padding: 0.5rem 1rem;
+  border-radius: 4px;
+  cursor: pointer;
+  font-size: 0.9rem;
+}
+
+.btn-secondary:hover {
+  background: var(--bg-color-secondary, #f5f5f5);
+}
+
+.btn-add {
+  background: none;
+  border: 1px dashed var(--border-color, #ccc);
+  padding: 0.3rem 0.8rem;
+  border-radius: 4px;
+  cursor: pointer;
+  font-size: 0.85rem;
+  color: var(--text-color-lighter, #666);
+}
+
+.btn-add:hover {
+  border-color: var(--theme-color, #3eaf7c);
+  color: var(--theme-color, #3eaf7c);
+}
+
+.btn-remove {
+  background: none;
+  border: 1px solid var(--border-color, #ddd);
+  padding: 0.2rem 0.5rem;
+  border-radius: 4px;
+  cursor: pointer;
+  color: #e53e3e;
+  font-size: 0.8rem;
+  flex-shrink: 0;
+}
+
+.btn-remove:hover {
+  background: #fed7d7;
+}
+
+.button-row {
+  display: flex;
+  gap: 0.5rem;
+  margin-bottom: 1rem;
+  flex-wrap: wrap;
+}
+
+.validation-errors {
+  background: #fff5f5;
+  border: 1px solid #fc8181;
+  border-radius: 4px;
+  padding: 0.75rem 1rem;
+  margin-bottom: 1rem;
+}
+
+.validation-errors p {
+  margin: 0.25rem 0;
+  color: #c53030;
+  font-size: 0.85rem;
+}
+
+.copy-success {
+  color: var(--theme-color, #3eaf7c);
+  font-weight: 600;
+  margin-bottom: 0.5rem;
+  font-size: 0.9rem;
+}
+
+.json-output {
+  background: var(--code-bg-color, #282c34);
+  color: var(--code-text-color, #abb2bf);
+  padding: 1rem;
+  border-radius: 6px;
+  overflow-x: auto;
+  font-size: 0.8rem;
+  max-height: 600px;
+  overflow-y: auto;
+}
+
+.json-output code {
+  background: none;
+  padding: 0;
+  color: inherit;
+}
+
+.field-hint {
+  display: block;
+  margin-top: 0.25rem;
+  font-size: 0.8rem;
+  color: var(--text-color-lighter, #888);
+}
+
+.field-hint code {
+  font-size: 0.8rem;
+  padding: 0.1rem 0.3rem;
+  background: var(--bg-color-secondary, #eee);
+  border-radius: 3px;
+}
+</style>
diff --git a/docs/src/.vuepress/sidebar/operations-v2.ts b/docs/src/.vuepress/sidebar/operations-v2.ts
index 55f018c27..2a5090e1b 100644
--- a/docs/src/.vuepress/sidebar/operations-v2.ts
+++ b/docs/src/.vuepress/sidebar/operations-v2.ts
@@ -4,7 +4,7 @@ export function generate_v2_latest_sidebar() {
 		icon: "tool",
 		link: "./",
 	},
-		"release-notes", "install", "upgrade-from-2", "upgrade-from-1", "allowList-mgm", "root-certificates", "passwords-secrets", "image-verification", "hardening-measures", {
+		"release-notes", "install", "upgrade-from-2", "upgrade-from-1", "allowList-mgm", "allowlist-generator", "root-certificates", "passwords-secrets", "image-verification", "hardening-measures", {
 		text: "FHIR Reverse Proxy",
 		icon: "module",
 		prefix: "fhir-reverse-proxy/",
diff --git a/docs/src/operations/v2.1.0/allowlist-generator.md b/docs/src/operations/v2.1.0/allowlist-generator.md
new file mode 100644
index 000000000..691e84a69
--- /dev/null
+++ b/docs/src/operations/v2.1.0/allowlist-generator.md
@@ -0,0 +1,23 @@
+---
+title: Allow List Generator
+icon: tool
+---
+
+## Overview
+
+This tool generates a FHIR R4 Bundle (type `transaction`) for deploying an Allow List to a DSF FHIR server. The bundle contains [Organization](https://dsf.dev/fhir/ImplementationGuide/dev.dsf/StructureDefinition-organization.html), [Endpoint](https://dsf.dev/fhir/ImplementationGuide/dev.dsf/StructureDefinition-endpoint.html) and [OrganizationAffiliation](https://dsf.dev/fhir/ImplementationGuide/dev.dsf/StructureDefinition-organization-affiliation.html) resources conforming to the DSF profiles.
+
+For more information about the Allow List concept, see the [Allow List documentation](/explore/concepts/allow-list.html).
+
+::: tip Certificate Thumbprints
+SHA-512 certificate thumbprints in HEX form `[a-f0-9]{128}` can be calculated using:
+```sh
+certtool --fingerprint --hash=sha512 --infile=certificate.pem
+```
+:::
+
+::: warning
+This tool generates a basic Allow List bundle. For production deployments, consider using the [Allow List Management Portal](allowList-mgm) for centralized management.
+:::
+
+<AllowListGenerator />

From bc64d0a388622fa2b92c8c847b0ab93950e9b715 Mon Sep 17 00:00:00 2001
From: Simon Schweizer <simon@schwzr.de>
Date: Sun, 8 Mar 2026 22:46:30 +0100
Subject: [PATCH 2/7] add basic tests

---
 docs/package-lock.json                        | 342 +++++++++++-
 docs/package.json                             |   5 +-
 .../components/AllowListGenerator.vue         | 215 +-------
 .../.vuepress/components/allowlist-bundle.js  | 194 +++++++
 .../components/allowlist-bundle.test.js       | 497 ++++++++++++++++++
 5 files changed, 1045 insertions(+), 208 deletions(-)
 create mode 100644 docs/src/.vuepress/components/allowlist-bundle.js
 create mode 100644 docs/src/.vuepress/components/allowlist-bundle.test.js

diff --git a/docs/package-lock.json b/docs/package-lock.json
index 9e3f833c1..55dab20bc 100644
--- a/docs/package-lock.json
+++ b/docs/package-lock.json
@@ -14,15 +14,16 @@
         "@vuepress/plugin-markdown-math": "2.0.0-rc.121",
         "@vuepress/plugin-markdown-tab": "2.0.0-rc.121",
         "@vuepress/plugin-slimsearch": "2.0.0-rc.121",
-        "katex": "^0.16.28",
-        "sass-embedded": "^1.97.3",
-        "sass-loader": "^16.0.7",
-        "vue": "^3.5.28",
+        "katex": "0.16.28",
+        "sass-embedded": "1.97.3",
+        "sass-loader": "16.0.7",
+        "vitest": "4.0.18",
+        "vue": "3.5.28",
         "vuepress": "2.0.0-rc.26",
         "vuepress-theme-hope": "2.0.0-rc.102"
       },
       "optionalDependencies": {
-        "@rollup/rollup-linux-x64-gnu": "^4.57.1"
+        "@rollup/rollup-linux-x64-gnu": "4.59.0"
       }
     },
     "node_modules/@babel/helper-string-parser": {
@@ -1965,6 +1966,22 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/@standard-schema/spec": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz",
+      "integrity": "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==",
+      "dev": true
+    },
+    "node_modules/@types/chai": {
+      "version": "5.2.3",
+      "resolved": "https://registry.npmjs.org/@types/chai/-/chai-5.2.3.tgz",
+      "integrity": "sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==",
+      "dev": true,
+      "dependencies": {
+        "@types/deep-eql": "*",
+        "assertion-error": "^2.0.1"
+      }
+    },
     "node_modules/@types/debug": {
       "version": "4.1.12",
       "resolved": "https://registry.npmjs.org/@types/debug/-/debug-4.1.12.tgz",
@@ -1975,6 +1992,12 @@
         "@types/ms": "*"
       }
     },
+    "node_modules/@types/deep-eql": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/@types/deep-eql/-/deep-eql-4.0.2.tgz",
+      "integrity": "sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==",
+      "dev": true
+    },
     "node_modules/@types/estree": {
       "version": "1.0.8",
       "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.8.tgz",
@@ -2135,6 +2158,119 @@
         "vue": "^3.2.25"
       }
     },
+    "node_modules/@vitest/expect": {
+      "version": "4.0.18",
+      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.0.18.tgz",
+      "integrity": "sha512-8sCWUyckXXYvx4opfzVY03EOiYVxyNrHS5QxX3DAIi5dpJAAkyJezHCP77VMX4HKA2LDT/Jpfo8i2r5BE3GnQQ==",
+      "dev": true,
+      "dependencies": {
+        "@standard-schema/spec": "^1.0.0",
+        "@types/chai": "^5.2.2",
+        "@vitest/spy": "4.0.18",
+        "@vitest/utils": "4.0.18",
+        "chai": "^6.2.1",
+        "tinyrainbow": "^3.0.3"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/mocker": {
+      "version": "4.0.18",
+      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.0.18.tgz",
+      "integrity": "sha512-HhVd0MDnzzsgevnOWCBj5Otnzobjy5wLBe4EdeeFGv8luMsGcYqDuFRMcttKWZA5vVO8RFjexVovXvAM4JoJDQ==",
+      "dev": true,
+      "dependencies": {
+        "@vitest/spy": "4.0.18",
+        "estree-walker": "^3.0.3",
+        "magic-string": "^0.30.21"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "msw": "^2.4.9",
+        "vite": "^6.0.0 || ^7.0.0-0"
+      },
+      "peerDependenciesMeta": {
+        "msw": {
+          "optional": true
+        },
+        "vite": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@vitest/mocker/node_modules/estree-walker": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-3.0.3.tgz",
+      "integrity": "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==",
+      "dev": true,
+      "dependencies": {
+        "@types/estree": "^1.0.0"
+      }
+    },
+    "node_modules/@vitest/pretty-format": {
+      "version": "4.0.18",
+      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.0.18.tgz",
+      "integrity": "sha512-P24GK3GulZWC5tz87ux0m8OADrQIUVDPIjjj65vBXYG17ZeU3qD7r+MNZ1RNv4l8CGU2vtTRqixrOi9fYk/yKw==",
+      "dev": true,
+      "dependencies": {
+        "tinyrainbow": "^3.0.3"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/runner": {
+      "version": "4.0.18",
+      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.0.18.tgz",
+      "integrity": "sha512-rpk9y12PGa22Jg6g5M3UVVnTS7+zycIGk9ZNGN+m6tZHKQb7jrP7/77WfZy13Y/EUDd52NDsLRQhYKtv7XfPQw==",
+      "dev": true,
+      "dependencies": {
+        "@vitest/utils": "4.0.18",
+        "pathe": "^2.0.3"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/snapshot": {
+      "version": "4.0.18",
+      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.0.18.tgz",
+      "integrity": "sha512-PCiV0rcl7jKQjbgYqjtakly6T1uwv/5BQ9SwBLekVg/EaYeQFPiXcgrC2Y7vDMA8dM1SUEAEV82kgSQIlXNMvA==",
+      "dev": true,
+      "dependencies": {
+        "@vitest/pretty-format": "4.0.18",
+        "magic-string": "^0.30.21",
+        "pathe": "^2.0.3"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/spy": {
+      "version": "4.0.18",
+      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.0.18.tgz",
+      "integrity": "sha512-cbQt3PTSD7P2OARdVW3qWER5EGq7PHlvE+QfzSC0lbwO+xnt7+XH06ZzFjFRgzUX//JmpxrCu92VdwvEPlWSNw==",
+      "dev": true,
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/utils": {
+      "version": "4.0.18",
+      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.0.18.tgz",
+      "integrity": "sha512-msMRKLMVLWygpK3u2Hybgi4MNjcYJvwTb0Ru09+fOyCXIgT5raYP041DRRdiJiI3k/2U6SEbAETB3YtBrUkCFA==",
+      "dev": true,
+      "dependencies": {
+        "@vitest/pretty-format": "4.0.18",
+        "tinyrainbow": "^3.0.3"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
     "node_modules/@vue/compiler-core": {
       "version": "3.5.28",
       "resolved": "https://registry.npmjs.org/@vue/compiler-core/-/compiler-core-3.5.28.tgz",
@@ -3187,6 +3323,15 @@
         "sprintf-js": "~1.0.2"
       }
     },
+    "node_modules/assertion-error": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/assertion-error/-/assertion-error-2.0.1.tgz",
+      "integrity": "sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==",
+      "dev": true,
+      "engines": {
+        "node": ">=12"
+      }
+    },
     "node_modules/autoprefixer": {
       "version": "10.4.21",
       "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.4.21.tgz",
@@ -3363,6 +3508,15 @@
         "url": "https://github.com/sponsors/wooorm"
       }
     },
+    "node_modules/chai": {
+      "version": "6.2.2",
+      "resolved": "https://registry.npmjs.org/chai/-/chai-6.2.2.tgz",
+      "integrity": "sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg==",
+      "dev": true,
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/chalk": {
       "version": "5.6.2",
       "resolved": "https://registry.npmjs.org/chalk/-/chalk-5.6.2.tgz",
@@ -3823,6 +3977,12 @@
         "node": ">=4"
       }
     },
+    "node_modules/es-module-lexer": {
+      "version": "1.7.0",
+      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-1.7.0.tgz",
+      "integrity": "sha512-jEQoCwk8hyb2AZziIOLhDqpm5+2ww5uIE6lkO/6jcOCusfk6LhMHpXXfBLXTZ7Ydyt0j4VoUQv6uGNYbdW+kBA==",
+      "dev": true
+    },
     "node_modules/esbuild": {
       "version": "0.25.12",
       "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.12.tgz",
@@ -3895,6 +4055,15 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/expect-type": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/expect-type/-/expect-type-1.3.0.tgz",
+      "integrity": "sha512-knvyeauYhqjOYvQ66MznSMs83wmHrCycNEN6Ao+2AeYEfxUIkuiVxdEa1qlGEPK+We3n0THiDciYSsCcgW/DoA==",
+      "dev": true,
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
     "node_modules/extend": {
       "version": "3.0.2",
       "resolved": "https://registry.npmjs.org/extend/-/extend-3.0.2.tgz",
@@ -4766,6 +4935,16 @@
         "url": "https://github.com/fb55/nth-check?sponsor=1"
       }
     },
+    "node_modules/obug": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/obug/-/obug-2.1.1.tgz",
+      "integrity": "sha512-uTqF9MuPraAQ+IsnPf366RG4cP9RtUi7MLO1N3KEc+wb0a6yKpeL0lmk2IB1jY5KHPAlTc6T/JRdC/YqxHNwkQ==",
+      "dev": true,
+      "funding": [
+        "https://github.com/sponsors/sxzz",
+        "https://opencollective.com/debug"
+      ]
+    },
     "node_modules/onetime": {
       "version": "7.0.0",
       "resolved": "https://registry.npmjs.org/onetime/-/onetime-7.0.0.tgz",
@@ -4922,6 +5101,12 @@
         "node": ">=8"
       }
     },
+    "node_modules/pathe": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/pathe/-/pathe-2.0.3.tgz",
+      "integrity": "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==",
+      "dev": true
+    },
     "node_modules/perfect-debounce": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/perfect-debounce/-/perfect-debounce-2.1.0.tgz",
@@ -5728,6 +5913,12 @@
         "@types/hast": "^3.0.4"
       }
     },
+    "node_modules/siginfo": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/siginfo/-/siginfo-2.0.0.tgz",
+      "integrity": "sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==",
+      "dev": true
+    },
     "node_modules/signal-exit": {
       "version": "4.1.0",
       "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
@@ -5807,6 +5998,18 @@
       "dev": true,
       "license": "BSD-3-Clause"
     },
+    "node_modules/stackback": {
+      "version": "0.0.2",
+      "resolved": "https://registry.npmjs.org/stackback/-/stackback-0.0.2.tgz",
+      "integrity": "sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==",
+      "dev": true
+    },
+    "node_modules/std-env": {
+      "version": "3.10.0",
+      "resolved": "https://registry.npmjs.org/std-env/-/std-env-3.10.0.tgz",
+      "integrity": "sha512-5GS12FdOZNliM5mAOxFRg7Ir0pWz8MdpYm6AY6VPkGpbA7ZzmbzNcBJQ0GPvvyWgcY7QAhCgf9Uy89I03faLkg==",
+      "dev": true
+    },
     "node_modules/stdin-discarder": {
       "version": "0.3.1",
       "resolved": "https://registry.npmjs.org/stdin-discarder/-/stdin-discarder-0.3.1.tgz",
@@ -5942,6 +6145,21 @@
         "url": "https://opencollective.com/synckit"
       }
     },
+    "node_modules/tinybench": {
+      "version": "2.9.0",
+      "resolved": "https://registry.npmjs.org/tinybench/-/tinybench-2.9.0.tgz",
+      "integrity": "sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg==",
+      "dev": true
+    },
+    "node_modules/tinyexec": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.2.4.tgz",
+      "integrity": "sha512-SHf/r48b7vOrjve9PxJo3MN5v5yuyjHvdUcrQffT3WXMUfnGmHDVbC4k3sHJaJTgZCwpUplIaAo5ANtMyp3YHg==",
+      "dev": true,
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/tinyglobby": {
       "version": "0.2.15",
       "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.15.tgz",
@@ -5990,6 +6208,15 @@
         "url": "https://github.com/sponsors/jonschlinkert"
       }
     },
+    "node_modules/tinyrainbow": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-3.1.0.tgz",
+      "integrity": "sha512-Bf+ILmBgretUrdJxzXM0SgXLZ3XfiaUuOj/IKQHuTXip+05Xn+uyEYdVg0kYDipTBcLrCVyUzAPz7QmArb0mmw==",
+      "dev": true,
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
     "node_modules/to-regex-range": {
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
@@ -6345,6 +6572,95 @@
         "url": "https://github.com/sponsors/jonschlinkert"
       }
     },
+    "node_modules/vitest": {
+      "version": "4.0.18",
+      "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.0.18.tgz",
+      "integrity": "sha512-hOQuK7h0FGKgBAas7v0mSAsnvrIgAvWmRFjmzpJ7SwFHH3g1k2u37JtYwOwmEKhK6ZO3v9ggDBBm0La1LCK4uQ==",
+      "dev": true,
+      "dependencies": {
+        "@vitest/expect": "4.0.18",
+        "@vitest/mocker": "4.0.18",
+        "@vitest/pretty-format": "4.0.18",
+        "@vitest/runner": "4.0.18",
+        "@vitest/snapshot": "4.0.18",
+        "@vitest/spy": "4.0.18",
+        "@vitest/utils": "4.0.18",
+        "es-module-lexer": "^1.7.0",
+        "expect-type": "^1.2.2",
+        "magic-string": "^0.30.21",
+        "obug": "^2.1.1",
+        "pathe": "^2.0.3",
+        "picomatch": "^4.0.3",
+        "std-env": "^3.10.0",
+        "tinybench": "^2.9.0",
+        "tinyexec": "^1.0.2",
+        "tinyglobby": "^0.2.15",
+        "tinyrainbow": "^3.0.3",
+        "vite": "^6.0.0 || ^7.0.0",
+        "why-is-node-running": "^2.3.0"
+      },
+      "bin": {
+        "vitest": "vitest.mjs"
+      },
+      "engines": {
+        "node": "^20.0.0 || ^22.0.0 || >=24.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "@edge-runtime/vm": "*",
+        "@opentelemetry/api": "^1.9.0",
+        "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0",
+        "@vitest/browser-playwright": "4.0.18",
+        "@vitest/browser-preview": "4.0.18",
+        "@vitest/browser-webdriverio": "4.0.18",
+        "@vitest/ui": "4.0.18",
+        "happy-dom": "*",
+        "jsdom": "*"
+      },
+      "peerDependenciesMeta": {
+        "@edge-runtime/vm": {
+          "optional": true
+        },
+        "@opentelemetry/api": {
+          "optional": true
+        },
+        "@types/node": {
+          "optional": true
+        },
+        "@vitest/browser-playwright": {
+          "optional": true
+        },
+        "@vitest/browser-preview": {
+          "optional": true
+        },
+        "@vitest/browser-webdriverio": {
+          "optional": true
+        },
+        "@vitest/ui": {
+          "optional": true
+        },
+        "happy-dom": {
+          "optional": true
+        },
+        "jsdom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/vitest/node_modules/picomatch": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
+      "dev": true,
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
     "node_modules/vue": {
       "version": "3.5.28",
       "resolved": "https://registry.npmjs.org/vue/-/vue-3.5.28.tgz",
@@ -6781,6 +7097,22 @@
       "dev": true,
       "license": "ISC"
     },
+    "node_modules/why-is-node-running": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/why-is-node-running/-/why-is-node-running-2.3.0.tgz",
+      "integrity": "sha512-hUrmaWBdVDcxvYqnyh09zunKzROWjbZTiNy8dBEjkS7ehEDQibXJ7XvlmtbwuTclUiIyN+CyXQD4Vmko8fNm8w==",
+      "dev": true,
+      "dependencies": {
+        "siginfo": "^2.0.0",
+        "stackback": "0.0.2"
+      },
+      "bin": {
+        "why-is-node-running": "cli.js"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/wrap-ansi": {
       "version": "6.2.0",
       "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-6.2.0.tgz",
diff --git a/docs/package.json b/docs/package.json
index b9182f9c0..ed2cd33d0 100644
--- a/docs/package.json
+++ b/docs/package.json
@@ -8,7 +8,9 @@
     "docs:build": "vuepress build src",
     "docs:clean-dev": "vuepress dev src --clean-cache",
     "docs:dev": "vuepress dev src",
-    "docs:update-package": "npx vp-update"
+    "docs:update-package": "npx vp-update",
+    "test": "vitest run",
+    "test:watch": "vitest"
   },
   "devDependencies": {
     "@vuepress/bundler-vite": "2.0.0-rc.26",
@@ -19,6 +21,7 @@
     "katex": "0.16.28",
     "sass-embedded": "1.97.3",
     "sass-loader": "16.0.7",
+    "vitest": "4.0.18",
     "vue": "3.5.28",
     "vuepress": "2.0.0-rc.26",
     "vuepress-theme-hope": "2.0.0-rc.102"
diff --git a/docs/src/.vuepress/components/AllowListGenerator.vue b/docs/src/.vuepress/components/AllowListGenerator.vue
index 2cfceb66f..39737d707 100644
--- a/docs/src/.vuepress/components/AllowListGenerator.vue
+++ b/docs/src/.vuepress/components/AllowListGenerator.vue
@@ -78,6 +78,11 @@
 
 <script setup>
 import { ref, reactive } from 'vue';
+import {
+  deriveEndpointIdentifier,
+  validate as validateBundle,
+  generateBundle,
+} from './allowlist-bundle.js';
 
 const availableRoles = [
   { code: 'DIC', display: 'Data Integration Center' },
@@ -107,18 +112,12 @@ function createOrg() {
   };
 }
 
-function deriveEndpointIdentifier(url) {
-  if (!url || !url.trim()) return '';
-  try {
-    const hostname = new URL(url.trim()).hostname;
-    return hostname ? hostname + '-endpoint' : '';
-  } catch {
-    return '';
-  }
-}
-
-function getEndpointIdentifier(org) {
-  return org.endpointIdentifierOverride?.trim() || deriveEndpointIdentifier(org.endpointUrl);
+function uuid() {
+  return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, c => {
+    const r = (Math.random() * 16) | 0;
+    const v = c === 'x' ? r : (r & 0x3) | 0x8;
+    return v.toString(16);
+  });
 }
 
 const parentOrg = reactive({
@@ -135,203 +134,15 @@ function addMember() {
   members.value.push(createOrg());
 }
 
-function validate() {
-  const errors = [];
-  if (!parentOrg.identifier.trim()) errors.push('Parent organization identifier is required.');
-
-  if (members.value.length === 0) errors.push('At least one member organization is required.');
-
-  members.value.forEach((m, i) => {
-    const n = i + 1;
-    if (!m.identifier.trim()) errors.push(`Member ${n}: Identifier is required.`);
-    if (!m.endpointUrl.trim()) errors.push(`Member ${n}: DSF FHIR Server Endpoint URL is required.`);
-    if (!getEndpointIdentifier(m)) errors.push(`Member ${n}: Endpoint identifier could not be derived. Please enter the URL or override manually.`);
-    const mTps = m.thumbprints.filter(t => t.trim());
-    if (mTps.length === 0) errors.push(`Member ${n}: At least one certificate thumbprint is required.`);
-    if (m.roles.length === 0) errors.push(`Member ${n}: At least one role must be selected.`);
-  });
-
-  return errors;
-}
-
-const META_TAG = {
-  system: 'http://dsf.dev/fhir/CodeSystem/read-access-tag',
-  code: 'ALL',
-};
-
-function buildParentOrganization(org) {
-  return {
-    resourceType: 'Organization',
-    meta: {
-      profile: ['http://dsf.dev/fhir/StructureDefinition/organization-parent'],
-      tag: [META_TAG],
-    },
-    active: true,
-    identifier: [{
-      system: 'http://dsf.dev/sid/organization-identifier',
-      value: org.identifier.trim(),
-    }],
-    name: org.name.trim() || undefined,
-  };
-}
-
-function buildMemberOrganization(org, endpointId) {
-  const thumbprintExtensions = org.thumbprints
-    .filter(t => t.trim())
-    .map(t => ({
-      url: 'http://dsf.dev/fhir/StructureDefinition/extension-certificate-thumbprint',
-      valueString: t.trim(),
-    }));
-
-  return {
-    resourceType: 'Organization',
-    meta: {
-      profile: ['http://dsf.dev/fhir/StructureDefinition/organization'],
-      tag: [META_TAG],
-    },
-    extension: thumbprintExtensions,
-    active: true,
-    identifier: [{
-      system: 'http://dsf.dev/sid/organization-identifier',
-      value: org.identifier.trim(),
-    }],
-    name: org.name.trim() || undefined,
-    endpoint: [{
-      reference: `urn:uuid:${endpointId}`,
-      type: 'Endpoint',
-    }],
-  };
-}
-
-function buildEndpoint(org, managingOrgId) {
-  return {
-    resourceType: 'Endpoint',
-    meta: {
-      profile: ['http://dsf.dev/fhir/StructureDefinition/endpoint'],
-      tag: [META_TAG],
-    },
-    status: 'active',
-    identifier: [{
-      system: 'http://dsf.dev/sid/endpoint-identifier',
-      value: getEndpointIdentifier(org),
-    }],
-    connectionType: {
-      system: 'http://terminology.hl7.org/CodeSystem/endpoint-connection-type',
-      code: 'hl7-fhir-rest',
-    },
-    name: `DSF Endpoint for ${org.identifier.trim()}`,
-    managingOrganization: {
-      reference: `urn:uuid:${managingOrgId}`,
-      type: 'Organization',
-    },
-    payloadType: [{
-      coding: [{
-        system: 'http://hl7.org/fhir/resource-types',
-        code: 'Task',
-      }],
-    }],
-    payloadMimeType: ['application/fhir+json', 'application/fhir+xml'],
-    address: org.endpointUrl.trim(),
-  };
-}
-
-function buildAffiliation(parentOrgId, memberOrgId, endpointId, roles) {
-  return {
-    resourceType: 'OrganizationAffiliation',
-    meta: {
-      profile: ['http://dsf.dev/fhir/StructureDefinition/organization-affiliation'],
-      tag: [META_TAG],
-    },
-    active: true,
-    organization: {
-      reference: `urn:uuid:${parentOrgId}`,
-      type: 'Organization',
-    },
-    participatingOrganization: {
-      reference: `urn:uuid:${memberOrgId}`,
-      type: 'Organization',
-    },
-    code: roles.map(r => ({
-      coding: [{
-        system: 'http://dsf.dev/fhir/CodeSystem/organization-role',
-        code: r,
-      }],
-    })),
-    endpoint: [{
-      reference: `urn:uuid:${endpointId}`,
-      type: 'Endpoint',
-    }],
-  };
-}
-
-function uuid() {
-  return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, c => {
-    const r = (Math.random() * 16) | 0;
-    const v = c === 'x' ? r : (r & 0x3) | 0x8;
-    return v.toString(16);
-  });
-}
-
 function generate() {
-  const errors = validate();
+  const errors = validateBundle(parentOrg, members.value);
   validationErrors.value = errors;
   if (errors.length > 0) {
     generatedJson.value = '';
     return;
   }
 
-  const entries = [];
-  const parentOrgId = uuid();
-
-  // Parent Organization (no endpoint, no thumbprints)
-  entries.push({
-    fullUrl: `urn:uuid:${parentOrgId}`,
-    resource: buildParentOrganization(parentOrg),
-    request: {
-      method: 'PUT',
-      url: `Organization?identifier=http://dsf.dev/sid/organization-identifier|${encodeURIComponent(parentOrg.identifier.trim())}`,
-    },
-  });
-
-  // Members
-  members.value.forEach(member => {
-    const memberOrgId = uuid();
-    const memberEndpointId = uuid();
-
-    entries.push({
-      fullUrl: `urn:uuid:${memberOrgId}`,
-      resource: buildMemberOrganization(member, memberEndpointId),
-      request: {
-        method: 'PUT',
-        url: `Organization?identifier=http://dsf.dev/sid/organization-identifier|${encodeURIComponent(member.identifier.trim())}`,
-      },
-    });
-
-    entries.push({
-      fullUrl: `urn:uuid:${memberEndpointId}`,
-      resource: buildEndpoint(member, memberOrgId),
-      request: {
-        method: 'PUT',
-        url: `Endpoint?identifier=http://dsf.dev/sid/endpoint-identifier|${encodeURIComponent(getEndpointIdentifier(member))}`,
-      },
-    });
-
-    entries.push({
-      fullUrl: `urn:uuid:${uuid()}`,
-      resource: buildAffiliation(parentOrgId, memberOrgId, memberEndpointId, member.roles),
-      request: {
-        method: 'PUT',
-        url: `OrganizationAffiliation?primary-organization:identifier=http://dsf.dev/sid/organization-identifier|${encodeURIComponent(parentOrg.identifier.trim())}&participating-organization:identifier=http://dsf.dev/sid/organization-identifier|${encodeURIComponent(member.identifier.trim())}`,
-      },
-    });
-  });
-
-  const bundle = {
-    resourceType: 'Bundle',
-    type: 'transaction',
-    entry: entries,
-  };
-
+  const bundle = generateBundle(parentOrg, members.value, uuid);
   generatedJson.value = JSON.stringify(bundle, null, 2);
 }
 
diff --git a/docs/src/.vuepress/components/allowlist-bundle.js b/docs/src/.vuepress/components/allowlist-bundle.js
new file mode 100644
index 000000000..0e95bca4a
--- /dev/null
+++ b/docs/src/.vuepress/components/allowlist-bundle.js
@@ -0,0 +1,194 @@
+const META_TAG = {
+  system: 'http://dsf.dev/fhir/CodeSystem/read-access-tag',
+  code: 'ALL',
+};
+
+export function deriveEndpointIdentifier(url) {
+  if (!url || !url.trim()) return '';
+  try {
+    const hostname = new URL(url.trim()).hostname;
+    return hostname ? hostname + '-endpoint' : '';
+  } catch {
+    return '';
+  }
+}
+
+export function getEndpointIdentifier(org) {
+  return org.endpointIdentifierOverride?.trim() || deriveEndpointIdentifier(org.endpointUrl);
+}
+
+export function validate(parentOrg, members) {
+  const errors = [];
+  if (!parentOrg.identifier.trim()) errors.push('Parent organization identifier is required.');
+
+  if (members.length === 0) errors.push('At least one member organization is required.');
+
+  members.forEach((m, i) => {
+    const n = i + 1;
+    if (!m.identifier.trim()) errors.push(`Member ${n}: Identifier is required.`);
+    if (!m.endpointUrl.trim()) errors.push(`Member ${n}: DSF FHIR Server Endpoint URL is required.`);
+    if (!getEndpointIdentifier(m)) errors.push(`Member ${n}: Endpoint identifier could not be derived. Please enter the URL or override manually.`);
+    const mTps = m.thumbprints.filter(t => t.trim());
+    if (mTps.length === 0) errors.push(`Member ${n}: At least one certificate thumbprint is required.`);
+    if (m.roles.length === 0) errors.push(`Member ${n}: At least one role must be selected.`);
+  });
+
+  return errors;
+}
+
+export function buildParentOrganization(org) {
+  return {
+    resourceType: 'Organization',
+    meta: {
+      profile: ['http://dsf.dev/fhir/StructureDefinition/organization-parent'],
+      tag: [META_TAG],
+    },
+    active: true,
+    identifier: [{
+      system: 'http://dsf.dev/sid/organization-identifier',
+      value: org.identifier.trim(),
+    }],
+    name: org.name.trim() || undefined,
+  };
+}
+
+export function buildMemberOrganization(org, endpointId) {
+  const thumbprintExtensions = org.thumbprints
+    .filter(t => t.trim())
+    .map(t => ({
+      url: 'http://dsf.dev/fhir/StructureDefinition/extension-certificate-thumbprint',
+      valueString: t.trim(),
+    }));
+
+  return {
+    resourceType: 'Organization',
+    meta: {
+      profile: ['http://dsf.dev/fhir/StructureDefinition/organization'],
+      tag: [META_TAG],
+    },
+    extension: thumbprintExtensions,
+    active: true,
+    identifier: [{
+      system: 'http://dsf.dev/sid/organization-identifier',
+      value: org.identifier.trim(),
+    }],
+    name: org.name.trim() || undefined,
+    endpoint: [{
+      reference: `urn:uuid:${endpointId}`,
+      type: 'Endpoint',
+    }],
+  };
+}
+
+export function buildEndpoint(org, managingOrgId) {
+  return {
+    resourceType: 'Endpoint',
+    meta: {
+      profile: ['http://dsf.dev/fhir/StructureDefinition/endpoint'],
+      tag: [META_TAG],
+    },
+    status: 'active',
+    identifier: [{
+      system: 'http://dsf.dev/sid/endpoint-identifier',
+      value: getEndpointIdentifier(org),
+    }],
+    connectionType: {
+      system: 'http://terminology.hl7.org/CodeSystem/endpoint-connection-type',
+      code: 'hl7-fhir-rest',
+    },
+    name: `DSF Endpoint for ${org.identifier.trim()}`,
+    managingOrganization: {
+      reference: `urn:uuid:${managingOrgId}`,
+      type: 'Organization',
+    },
+    payloadType: [{
+      coding: [{
+        system: 'http://hl7.org/fhir/resource-types',
+        code: 'Task',
+      }],
+    }],
+    payloadMimeType: ['application/fhir+json', 'application/fhir+xml'],
+    address: org.endpointUrl.trim(),
+  };
+}
+
+export function buildAffiliation(parentOrgId, memberOrgId, endpointId, roles) {
+  return {
+    resourceType: 'OrganizationAffiliation',
+    meta: {
+      profile: ['http://dsf.dev/fhir/StructureDefinition/organization-affiliation'],
+      tag: [META_TAG],
+    },
+    active: true,
+    organization: {
+      reference: `urn:uuid:${parentOrgId}`,
+      type: 'Organization',
+    },
+    participatingOrganization: {
+      reference: `urn:uuid:${memberOrgId}`,
+      type: 'Organization',
+    },
+    code: roles.map(r => ({
+      coding: [{
+        system: 'http://dsf.dev/fhir/CodeSystem/organization-role',
+        code: r,
+      }],
+    })),
+    endpoint: [{
+      reference: `urn:uuid:${endpointId}`,
+      type: 'Endpoint',
+    }],
+  };
+}
+
+export function generateBundle(parentOrg, members, uuidFn) {
+  const entries = [];
+  const parentOrgId = uuidFn();
+
+  entries.push({
+    fullUrl: `urn:uuid:${parentOrgId}`,
+    resource: buildParentOrganization(parentOrg),
+    request: {
+      method: 'PUT',
+      url: `Organization?identifier=http://dsf.dev/sid/organization-identifier|${encodeURIComponent(parentOrg.identifier.trim())}`,
+    },
+  });
+
+  members.forEach(member => {
+    const memberOrgId = uuidFn();
+    const memberEndpointId = uuidFn();
+
+    entries.push({
+      fullUrl: `urn:uuid:${memberOrgId}`,
+      resource: buildMemberOrganization(member, memberEndpointId),
+      request: {
+        method: 'PUT',
+        url: `Organization?identifier=http://dsf.dev/sid/organization-identifier|${encodeURIComponent(member.identifier.trim())}`,
+      },
+    });
+
+    entries.push({
+      fullUrl: `urn:uuid:${memberEndpointId}`,
+      resource: buildEndpoint(member, memberOrgId),
+      request: {
+        method: 'PUT',
+        url: `Endpoint?identifier=http://dsf.dev/sid/endpoint-identifier|${encodeURIComponent(getEndpointIdentifier(member))}`,
+      },
+    });
+
+    entries.push({
+      fullUrl: `urn:uuid:${uuidFn()}`,
+      resource: buildAffiliation(parentOrgId, memberOrgId, memberEndpointId, member.roles),
+      request: {
+        method: 'PUT',
+        url: `OrganizationAffiliation?primary-organization:identifier=http://dsf.dev/sid/organization-identifier|${encodeURIComponent(parentOrg.identifier.trim())}&participating-organization:identifier=http://dsf.dev/sid/organization-identifier|${encodeURIComponent(member.identifier.trim())}`,
+      },
+    });
+  });
+
+  return {
+    resourceType: 'Bundle',
+    type: 'transaction',
+    entry: entries,
+  };
+}
diff --git a/docs/src/.vuepress/components/allowlist-bundle.test.js b/docs/src/.vuepress/components/allowlist-bundle.test.js
new file mode 100644
index 000000000..30e01d532
--- /dev/null
+++ b/docs/src/.vuepress/components/allowlist-bundle.test.js
@@ -0,0 +1,497 @@
+import { describe, it, expect } from 'vitest';
+import {
+  deriveEndpointIdentifier,
+  getEndpointIdentifier,
+  validate,
+  buildParentOrganization,
+  buildMemberOrganization,
+  buildEndpoint,
+  buildAffiliation,
+  generateBundle,
+} from './allowlist-bundle.js';
+
+// -- Helper: valid member org data --
+function validMember(overrides = {}) {
+  return {
+    identifier: 'hospital.example.org',
+    name: 'Example Hospital',
+    endpointUrl: 'https://dsf.hospital.example.org/fhir',
+    endpointIdentifierOverride: '',
+    thumbprints: ['aabbccdd'],
+    roles: ['DIC'],
+    ...overrides,
+  };
+}
+
+function validParent(overrides = {}) {
+  return { identifier: 'dsf.dev', name: 'DSF Community', ...overrides };
+}
+
+// =============================================
+// deriveEndpointIdentifier
+// =============================================
+describe('deriveEndpointIdentifier', () => {
+  it('extracts hostname and appends -endpoint', () => {
+    expect(deriveEndpointIdentifier('https://dsf.hospital.example.org/fhir'))
+      .toBe('dsf.hospital.example.org-endpoint');
+  });
+
+  it('works with plain hostname URL', () => {
+    expect(deriveEndpointIdentifier('https://example.org'))
+      .toBe('example.org-endpoint');
+  });
+
+  it('returns empty string for empty input', () => {
+    expect(deriveEndpointIdentifier('')).toBe('');
+    expect(deriveEndpointIdentifier(null)).toBe('');
+    expect(deriveEndpointIdentifier(undefined)).toBe('');
+  });
+
+  it('returns empty string for invalid URL', () => {
+    expect(deriveEndpointIdentifier('not-a-url')).toBe('');
+  });
+
+  it('handles whitespace around URL', () => {
+    expect(deriveEndpointIdentifier('  https://example.org/fhir  '))
+      .toBe('example.org-endpoint');
+  });
+
+  it('handles URL with port', () => {
+    expect(deriveEndpointIdentifier('https://dsf.example.org:8443/fhir'))
+      .toBe('dsf.example.org-endpoint');
+  });
+});
+
+// =============================================
+// getEndpointIdentifier
+// =============================================
+describe('getEndpointIdentifier', () => {
+  it('uses override when provided', () => {
+    const org = { endpointUrl: 'https://example.org/fhir', endpointIdentifierOverride: 'custom-id' };
+    expect(getEndpointIdentifier(org)).toBe('custom-id');
+  });
+
+  it('derives from URL when no override', () => {
+    const org = { endpointUrl: 'https://dsf.example.org/fhir', endpointIdentifierOverride: '' };
+    expect(getEndpointIdentifier(org)).toBe('dsf.example.org-endpoint');
+  });
+
+  it('derives from URL when override is whitespace only', () => {
+    const org = { endpointUrl: 'https://dsf.example.org/fhir', endpointIdentifierOverride: '   ' };
+    expect(getEndpointIdentifier(org)).toBe('dsf.example.org-endpoint');
+  });
+
+  it('handles missing override property', () => {
+    const org = { endpointUrl: 'https://dsf.example.org/fhir' };
+    expect(getEndpointIdentifier(org)).toBe('dsf.example.org-endpoint');
+  });
+});
+
+// =============================================
+// validate
+// =============================================
+describe('validate', () => {
+  it('returns no errors for valid input', () => {
+    const errors = validate(validParent(), [validMember()]);
+    expect(errors).toEqual([]);
+  });
+
+  it('requires parent identifier', () => {
+    const errors = validate(validParent({ identifier: '' }), [validMember()]);
+    expect(errors).toContain('Parent organization identifier is required.');
+  });
+
+  it('requires at least one member', () => {
+    const errors = validate(validParent(), []);
+    expect(errors).toContain('At least one member organization is required.');
+  });
+
+  it('requires member identifier', () => {
+    const errors = validate(validParent(), [validMember({ identifier: '' })]);
+    expect(errors).toContain('Member 1: Identifier is required.');
+  });
+
+  it('requires member endpoint URL', () => {
+    const errors = validate(validParent(), [validMember({ endpointUrl: '' })]);
+    expect(errors).toContain('Member 1: DSF FHIR Server Endpoint URL is required.');
+  });
+
+  it('requires derivable endpoint identifier', () => {
+    const errors = validate(validParent(), [validMember({ endpointUrl: 'not-a-url', endpointIdentifierOverride: '' })]);
+    expect(errors).toContain('Member 1: Endpoint identifier could not be derived. Please enter the URL or override manually.');
+  });
+
+  it('accepts manual endpoint identifier override for invalid URL', () => {
+    const errors = validate(validParent(), [validMember({ endpointUrl: 'not-a-url', endpointIdentifierOverride: 'my-endpoint' })]);
+    expect(errors).not.toContain(expect.stringContaining('Endpoint identifier'));
+  });
+
+  it('requires at least one thumbprint', () => {
+    const errors = validate(validParent(), [validMember({ thumbprints: [''] })]);
+    expect(errors).toContain('Member 1: At least one certificate thumbprint is required.');
+  });
+
+  it('requires at least one role', () => {
+    const errors = validate(validParent(), [validMember({ roles: [] })]);
+    expect(errors).toContain('Member 1: At least one role must be selected.');
+  });
+
+  it('validates multiple members independently', () => {
+    const members = [
+      validMember(),
+      validMember({ identifier: '', endpointUrl: '' }),
+    ];
+    const errors = validate(validParent(), members);
+    expect(errors).toContain('Member 2: Identifier is required.');
+    expect(errors).toContain('Member 2: DSF FHIR Server Endpoint URL is required.');
+    expect(errors).not.toContain(expect.stringContaining('Member 1'));
+  });
+});
+
+// =============================================
+// buildParentOrganization
+// =============================================
+describe('buildParentOrganization', () => {
+  it('uses organization-parent profile', () => {
+    const org = buildParentOrganization(validParent());
+    expect(org.meta.profile).toEqual(['http://dsf.dev/fhir/StructureDefinition/organization-parent']);
+  });
+
+  it('sets resourceType to Organization', () => {
+    const org = buildParentOrganization(validParent());
+    expect(org.resourceType).toBe('Organization');
+  });
+
+  it('sets identifier correctly', () => {
+    const org = buildParentOrganization(validParent());
+    expect(org.identifier[0].system).toBe('http://dsf.dev/sid/organization-identifier');
+    expect(org.identifier[0].value).toBe('dsf.dev');
+  });
+
+  it('includes read-access-tag ALL', () => {
+    const org = buildParentOrganization(validParent());
+    expect(org.meta.tag).toEqual([{ system: 'http://dsf.dev/fhir/CodeSystem/read-access-tag', code: 'ALL' }]);
+  });
+
+  it('sets active to true', () => {
+    const org = buildParentOrganization(validParent());
+    expect(org.active).toBe(true);
+  });
+
+  it('includes name when provided', () => {
+    const org = buildParentOrganization(validParent({ name: 'My Consortium' }));
+    expect(org.name).toBe('My Consortium');
+  });
+
+  it('omits name when empty', () => {
+    const org = buildParentOrganization(validParent({ name: '' }));
+    expect(org.name).toBeUndefined();
+  });
+
+  it('has no endpoint reference', () => {
+    const org = buildParentOrganization(validParent());
+    expect(org.endpoint).toBeUndefined();
+  });
+
+  it('has no certificate thumbprint extensions', () => {
+    const org = buildParentOrganization(validParent());
+    expect(org.extension).toBeUndefined();
+  });
+
+  it('trims whitespace from identifier', () => {
+    const org = buildParentOrganization(validParent({ identifier: '  dsf.dev  ' }));
+    expect(org.identifier[0].value).toBe('dsf.dev');
+  });
+});
+
+// =============================================
+// buildMemberOrganization
+// =============================================
+describe('buildMemberOrganization', () => {
+  it('uses organization profile (not organization-parent)', () => {
+    const org = buildMemberOrganization(validMember(), 'ep-uuid');
+    expect(org.meta.profile).toEqual(['http://dsf.dev/fhir/StructureDefinition/organization']);
+  });
+
+  it('includes certificate thumbprint extensions', () => {
+    const org = buildMemberOrganization(validMember({ thumbprints: ['abc123', 'def456'] }), 'ep-uuid');
+    expect(org.extension).toHaveLength(2);
+    expect(org.extension[0].url).toBe('http://dsf.dev/fhir/StructureDefinition/extension-certificate-thumbprint');
+    expect(org.extension[0].valueString).toBe('abc123');
+    expect(org.extension[1].valueString).toBe('def456');
+  });
+
+  it('filters empty thumbprints', () => {
+    const org = buildMemberOrganization(validMember({ thumbprints: ['abc123', '', '  '] }), 'ep-uuid');
+    expect(org.extension).toHaveLength(1);
+  });
+
+  it('includes endpoint reference', () => {
+    const org = buildMemberOrganization(validMember(), 'my-ep-id');
+    expect(org.endpoint[0].reference).toBe('urn:uuid:my-ep-id');
+    expect(org.endpoint[0].type).toBe('Endpoint');
+  });
+
+  it('includes read-access-tag ALL', () => {
+    const org = buildMemberOrganization(validMember(), 'ep-uuid');
+    expect(org.meta.tag[0].code).toBe('ALL');
+  });
+});
+
+// =============================================
+// buildEndpoint
+// =============================================
+describe('buildEndpoint', () => {
+  it('sets resourceType to Endpoint', () => {
+    const ep = buildEndpoint(validMember(), 'org-uuid');
+    expect(ep.resourceType).toBe('Endpoint');
+  });
+
+  it('uses endpoint profile', () => {
+    const ep = buildEndpoint(validMember(), 'org-uuid');
+    expect(ep.meta.profile).toEqual(['http://dsf.dev/fhir/StructureDefinition/endpoint']);
+  });
+
+  it('derives endpoint identifier from URL', () => {
+    const ep = buildEndpoint(validMember(), 'org-uuid');
+    expect(ep.identifier[0].value).toBe('dsf.hospital.example.org-endpoint');
+    expect(ep.identifier[0].system).toBe('http://dsf.dev/sid/endpoint-identifier');
+  });
+
+  it('uses override endpoint identifier when set', () => {
+    const ep = buildEndpoint(validMember({ endpointIdentifierOverride: 'custom-ep' }), 'org-uuid');
+    expect(ep.identifier[0].value).toBe('custom-ep');
+  });
+
+  it('sets connectionType to hl7-fhir-rest', () => {
+    const ep = buildEndpoint(validMember(), 'org-uuid');
+    expect(ep.connectionType.code).toBe('hl7-fhir-rest');
+  });
+
+  it('sets address to endpoint URL', () => {
+    const ep = buildEndpoint(validMember(), 'org-uuid');
+    expect(ep.address).toBe('https://dsf.hospital.example.org/fhir');
+  });
+
+  it('references managing organization', () => {
+    const ep = buildEndpoint(validMember(), 'org-uuid-123');
+    expect(ep.managingOrganization.reference).toBe('urn:uuid:org-uuid-123');
+    expect(ep.managingOrganization.type).toBe('Organization');
+  });
+
+  it('sets payloadType to Task', () => {
+    const ep = buildEndpoint(validMember(), 'org-uuid');
+    expect(ep.payloadType[0].coding[0].code).toBe('Task');
+  });
+
+  it('includes both FHIR MIME types', () => {
+    const ep = buildEndpoint(validMember(), 'org-uuid');
+    expect(ep.payloadMimeType).toContain('application/fhir+json');
+    expect(ep.payloadMimeType).toContain('application/fhir+xml');
+  });
+
+  it('sets status to active', () => {
+    const ep = buildEndpoint(validMember(), 'org-uuid');
+    expect(ep.status).toBe('active');
+  });
+});
+
+// =============================================
+// buildAffiliation
+// =============================================
+describe('buildAffiliation', () => {
+  it('sets resourceType to OrganizationAffiliation', () => {
+    const aff = buildAffiliation('parent-id', 'member-id', 'ep-id', ['DIC']);
+    expect(aff.resourceType).toBe('OrganizationAffiliation');
+  });
+
+  it('uses organization-affiliation profile', () => {
+    const aff = buildAffiliation('parent-id', 'member-id', 'ep-id', ['DIC']);
+    expect(aff.meta.profile).toEqual(['http://dsf.dev/fhir/StructureDefinition/organization-affiliation']);
+  });
+
+  it('references parent organization', () => {
+    const aff = buildAffiliation('parent-id', 'member-id', 'ep-id', ['DIC']);
+    expect(aff.organization.reference).toBe('urn:uuid:parent-id');
+    expect(aff.organization.type).toBe('Organization');
+  });
+
+  it('references participating organization', () => {
+    const aff = buildAffiliation('parent-id', 'member-id', 'ep-id', ['DIC']);
+    expect(aff.participatingOrganization.reference).toBe('urn:uuid:member-id');
+  });
+
+  it('references endpoint', () => {
+    const aff = buildAffiliation('parent-id', 'member-id', 'ep-id', ['DIC']);
+    expect(aff.endpoint[0].reference).toBe('urn:uuid:ep-id');
+  });
+
+  it('maps roles to CodeSystem codes', () => {
+    const aff = buildAffiliation('parent-id', 'member-id', 'ep-id', ['DIC', 'TTP']);
+    expect(aff.code).toHaveLength(2);
+    expect(aff.code[0].coding[0].system).toBe('http://dsf.dev/fhir/CodeSystem/organization-role');
+    expect(aff.code[0].coding[0].code).toBe('DIC');
+    expect(aff.code[1].coding[0].code).toBe('TTP');
+  });
+
+  it('sets active to true', () => {
+    const aff = buildAffiliation('parent-id', 'member-id', 'ep-id', ['DIC']);
+    expect(aff.active).toBe(true);
+  });
+});
+
+// =============================================
+// generateBundle
+// =============================================
+describe('generateBundle', () => {
+  let uuidCounter;
+  function deterministicUuid() {
+    return `uuid-${uuidCounter++}`;
+  }
+
+  function setup() {
+    uuidCounter = 0;
+  }
+
+  it('generates a transaction bundle', () => {
+    setup();
+    const bundle = generateBundle(validParent(), [validMember()], deterministicUuid);
+    expect(bundle.resourceType).toBe('Bundle');
+    expect(bundle.type).toBe('transaction');
+  });
+
+  it('creates correct number of entries for one member', () => {
+    setup();
+    const bundle = generateBundle(validParent(), [validMember()], deterministicUuid);
+    // 1 parent org + 1 member org + 1 endpoint + 1 affiliation = 4
+    expect(bundle.entry).toHaveLength(4);
+  });
+
+  it('creates correct number of entries for two members', () => {
+    setup();
+    const bundle = generateBundle(validParent(), [validMember(), validMember({ identifier: 'other.org' })], deterministicUuid);
+    // 1 parent org + 2 * (member org + endpoint + affiliation) = 7
+    expect(bundle.entry).toHaveLength(7);
+  });
+
+  it('first entry is parent organization with organization-parent profile', () => {
+    setup();
+    const bundle = generateBundle(validParent(), [validMember()], deterministicUuid);
+    const parentEntry = bundle.entry[0];
+    expect(parentEntry.resource.resourceType).toBe('Organization');
+    expect(parentEntry.resource.meta.profile[0]).toContain('organization-parent');
+    expect(parentEntry.fullUrl).toBe('urn:uuid:uuid-0');
+  });
+
+  it('parent org has no endpoint or extensions', () => {
+    setup();
+    const bundle = generateBundle(validParent(), [validMember()], deterministicUuid);
+    const parentResource = bundle.entry[0].resource;
+    expect(parentResource.endpoint).toBeUndefined();
+    expect(parentResource.extension).toBeUndefined();
+  });
+
+  it('member organization uses organization profile', () => {
+    setup();
+    const bundle = generateBundle(validParent(), [validMember()], deterministicUuid);
+    const memberEntry = bundle.entry[1];
+    expect(memberEntry.resource.meta.profile[0]).toContain('/organization');
+    expect(memberEntry.resource.meta.profile[0]).not.toContain('organization-parent');
+  });
+
+  it('member org references its endpoint', () => {
+    setup();
+    const bundle = generateBundle(validParent(), [validMember()], deterministicUuid);
+    // uuid-0 = parent, uuid-1 = member org, uuid-2 = member endpoint
+    const memberOrg = bundle.entry[1].resource;
+    expect(memberOrg.endpoint[0].reference).toBe('urn:uuid:uuid-2');
+  });
+
+  it('endpoint references its managing organization', () => {
+    setup();
+    const bundle = generateBundle(validParent(), [validMember()], deterministicUuid);
+    const endpoint = bundle.entry[2].resource;
+    expect(endpoint.managingOrganization.reference).toBe('urn:uuid:uuid-1');
+  });
+
+  it('affiliation references parent and member', () => {
+    setup();
+    const bundle = generateBundle(validParent(), [validMember()], deterministicUuid);
+    const aff = bundle.entry[3].resource;
+    expect(aff.organization.reference).toBe('urn:uuid:uuid-0'); // parent
+    expect(aff.participatingOrganization.reference).toBe('urn:uuid:uuid-1'); // member
+    expect(aff.endpoint[0].reference).toBe('urn:uuid:uuid-2'); // endpoint
+  });
+
+  it('all PUT URLs use identifiers, not UUIDs', () => {
+    setup();
+    const bundle = generateBundle(validParent(), [validMember()], deterministicUuid);
+    bundle.entry.forEach(entry => {
+      expect(entry.request.method).toBe('PUT');
+      // No URL should contain uuid- (all should use identifier-based search)
+      expect(entry.request.url).not.toContain('uuid-');
+    });
+  });
+
+  it('parent org PUT URL uses organization identifier', () => {
+    setup();
+    const bundle = generateBundle(validParent(), [validMember()], deterministicUuid);
+    expect(bundle.entry[0].request.url).toBe(
+      'Organization?identifier=http://dsf.dev/sid/organization-identifier|dsf.dev'
+    );
+  });
+
+  it('member org PUT URL uses organization identifier', () => {
+    setup();
+    const bundle = generateBundle(validParent(), [validMember()], deterministicUuid);
+    expect(bundle.entry[1].request.url).toBe(
+      'Organization?identifier=http://dsf.dev/sid/organization-identifier|hospital.example.org'
+    );
+  });
+
+  it('endpoint PUT URL uses endpoint identifier', () => {
+    setup();
+    const bundle = generateBundle(validParent(), [validMember()], deterministicUuid);
+    expect(bundle.entry[2].request.url).toBe(
+      'Endpoint?identifier=http://dsf.dev/sid/endpoint-identifier|dsf.hospital.example.org-endpoint'
+    );
+  });
+
+  it('affiliation PUT URL uses primary and participating organization identifiers', () => {
+    setup();
+    const bundle = generateBundle(validParent(), [validMember()], deterministicUuid);
+    const affUrl = bundle.entry[3].request.url;
+    expect(affUrl).toContain('OrganizationAffiliation?');
+    expect(affUrl).toContain('primary-organization:identifier=http://dsf.dev/sid/organization-identifier|dsf.dev');
+    expect(affUrl).toContain('participating-organization:identifier=http://dsf.dev/sid/organization-identifier|hospital.example.org');
+  });
+
+  it('all resources have read-access-tag ALL', () => {
+    setup();
+    const bundle = generateBundle(validParent(), [validMember()], deterministicUuid);
+    bundle.entry.forEach(entry => {
+      const tag = entry.resource.meta.tag[0];
+      expect(tag.system).toBe('http://dsf.dev/fhir/CodeSystem/read-access-tag');
+      expect(tag.code).toBe('ALL');
+    });
+  });
+
+  it('uses endpoint identifier override in PUT URL', () => {
+    setup();
+    const bundle = generateBundle(validParent(), [validMember({ endpointIdentifierOverride: 'my-custom-ep' })], deterministicUuid);
+    expect(bundle.entry[2].request.url).toBe(
+      'Endpoint?identifier=http://dsf.dev/sid/endpoint-identifier|my-custom-ep'
+    );
+  });
+
+  it('encodes special characters in identifiers', () => {
+    setup();
+    const bundle = generateBundle(
+      validParent({ identifier: 'org with spaces' }),
+      [validMember({ identifier: 'member/special' })],
+      deterministicUuid
+    );
+    expect(bundle.entry[0].request.url).toContain(encodeURIComponent('org with spaces'));
+    expect(bundle.entry[1].request.url).toContain(encodeURIComponent('member/special'));
+  });
+});

From 5e5005b34584c6d43504f7330247c81037efa118 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20B=C3=B6hringer?= <jan.boehringer@hs-heilbronn.de>
Date: Mon, 9 Mar 2026 11:22:06 +0100
Subject: [PATCH 3/7] Now supports dark mode by using the correct vuepress
 theme variables

---
 .../components/AllowListGenerator.vue         | 43 ++++++++-----------
 1 file changed, 17 insertions(+), 26 deletions(-)

diff --git a/docs/src/.vuepress/components/AllowListGenerator.vue b/docs/src/.vuepress/components/AllowListGenerator.vue
index 39737d707..c172d1c90 100644
--- a/docs/src/.vuepress/components/AllowListGenerator.vue
+++ b/docs/src/.vuepress/components/AllowListGenerator.vue
@@ -178,21 +178,18 @@ function downloadJson() {
 <style scoped>
 .allow-list-generator {
   max-width: 900px;
+  margin-top: 50px;
 }
 
 .section {
   margin-bottom: 2rem;
-  padding: 1.5rem;
-  border: 1px solid var(--border-color, #e2e8f0);
-  border-radius: 8px;
-  background: var(--bg-color-secondary, #f8fafc);
 }
 
 .section h3 {
   margin-top: 0;
   margin-bottom: 1rem;
   padding-bottom: 0.5rem;
-  border-bottom: 2px solid var(--theme-color, #3eaf7c);
+  border-bottom: 2px solid var(--vp-c-accent, #3eaf7c);
 }
 
 .form-group {
@@ -269,7 +266,6 @@ function downloadJson() {
   padding: 1rem;
   border: 1px solid var(--border-color, #ddd);
   border-radius: 6px;
-  background: var(--bg-color, #fff);
 }
 
 .member-header {
@@ -280,8 +276,7 @@ function downloadJson() {
 }
 
 .btn-primary {
-  background: var(--theme-color, #3eaf7c);
-  color: #fff;
+  background: var(--vp-c-accent-soft, #f5f5f5);
   border: none;
   padding: 0.5rem 1rem;
   border-radius: 4px;
@@ -290,13 +285,12 @@ function downloadJson() {
 }
 
 .btn-primary:hover {
-  opacity: 0.9;
+  color: var(--vp-c-accent, #3eaf7c);
 }
 
 .btn-secondary {
-  background: var(--bg-color, #fff);
-  color: var(--text-color, #333);
-  border: 1px solid var(--border-color, #ddd);
+  background: var(--vp-c-accent-soft, #f5f5f5);
+  border: none;
   padding: 0.5rem 1rem;
   border-radius: 4px;
   cursor: pointer;
@@ -304,37 +298,35 @@ function downloadJson() {
 }
 
 .btn-secondary:hover {
-  background: var(--bg-color-secondary, #f5f5f5);
+  color: var(--vp-c-accent, #3eaf7c);
 }
 
 .btn-add {
-  background: none;
-  border: 1px dashed var(--border-color, #ccc);
+  background: var(--vp-c-accent-soft, #f5f5f5);
   padding: 0.3rem 0.8rem;
   border-radius: 4px;
   cursor: pointer;
   font-size: 0.85rem;
-  color: var(--text-color-lighter, #666);
+  border: none;
 }
 
 .btn-add:hover {
-  border-color: var(--theme-color, #3eaf7c);
-  color: var(--theme-color, #3eaf7c);
+  color: var(--vp-c-accent, #3eaf7c);
 }
 
 .btn-remove {
-  background: none;
-  border: 1px solid var(--border-color, #ddd);
+  border: none;
   padding: 0.2rem 0.5rem;
   border-radius: 4px;
   cursor: pointer;
-  color: #e53e3e;
+  color: var(--caution-c-text,#e53e3e);
   font-size: 0.8rem;
   flex-shrink: 0;
+  background: var(--caution-c-soft);
 }
 
 .btn-remove:hover {
-  background: #fed7d7;
+  background: var(--caution-c-accent);
 }
 
 .button-row {
@@ -345,8 +337,7 @@ function downloadJson() {
 }
 
 .validation-errors {
-  background: #fff5f5;
-  border: 1px solid #fc8181;
+  background: var(--caution-c-soft);
   border-radius: 4px;
   padding: 0.75rem 1rem;
   margin-bottom: 1rem;
@@ -354,12 +345,12 @@ function downloadJson() {
 
 .validation-errors p {
   margin: 0.25rem 0;
-  color: #c53030;
+  color: var(--caution-c-text,#e53e3e);
   font-size: 0.85rem;
 }
 
 .copy-success {
-  color: var(--theme-color, #3eaf7c);
+  color: var(--vp-c-accent, #3eaf7c);
   font-weight: 600;
   margin-bottom: 0.5rem;
   font-size: 0.9rem;

From e1e481159ecb4f3341322eb22ac8cd6b6966c87c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20B=C3=B6hringer?= <jan.boehringer@hs-heilbronn.de>
Date: Mon, 9 Mar 2026 11:24:32 +0100
Subject: [PATCH 4/7] JSON output now also supports dark mode

---
 docs/src/.vuepress/components/AllowListGenerator.vue | 2 --
 1 file changed, 2 deletions(-)

diff --git a/docs/src/.vuepress/components/AllowListGenerator.vue b/docs/src/.vuepress/components/AllowListGenerator.vue
index c172d1c90..179b320f1 100644
--- a/docs/src/.vuepress/components/AllowListGenerator.vue
+++ b/docs/src/.vuepress/components/AllowListGenerator.vue
@@ -357,8 +357,6 @@ function downloadJson() {
 }
 
 .json-output {
-  background: var(--code-bg-color, #282c34);
-  color: var(--code-text-color, #abb2bf);
   padding: 1rem;
   border-radius: 6px;
   overflow-x: auto;

From f066c42f5b1ff87e7faa48760e1df245bdc1d1b3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20B=C3=B6hringer?= <jan.boehringer@hs-heilbronn.de>
Date: Mon, 9 Mar 2026 11:27:36 +0100
Subject: [PATCH 5/7] Component should not have max width of 900px

---
 docs/src/.vuepress/components/AllowListGenerator.vue | 1 -
 1 file changed, 1 deletion(-)

diff --git a/docs/src/.vuepress/components/AllowListGenerator.vue b/docs/src/.vuepress/components/AllowListGenerator.vue
index 179b320f1..be97d06f6 100644
--- a/docs/src/.vuepress/components/AllowListGenerator.vue
+++ b/docs/src/.vuepress/components/AllowListGenerator.vue
@@ -177,7 +177,6 @@ function downloadJson() {
 
 <style scoped>
 .allow-list-generator {
-  max-width: 900px;
   margin-top: 50px;
 }
 

From f183a2efa02cbb91283d1c43a01d087253aa84f2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20B=C3=B6hringer?= <jan.boehringer@hs-heilbronn.de>
Date: Mon, 9 Mar 2026 11:40:14 +0100
Subject: [PATCH 6/7] Borders and code block are now dependent on light/dark
 mode

---
 docs/src/.vuepress/components/AllowListGenerator.vue | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/docs/src/.vuepress/components/AllowListGenerator.vue b/docs/src/.vuepress/components/AllowListGenerator.vue
index be97d06f6..3300f5e71 100644
--- a/docs/src/.vuepress/components/AllowListGenerator.vue
+++ b/docs/src/.vuepress/components/AllowListGenerator.vue
@@ -206,7 +206,7 @@ function downloadJson() {
 .thumbprint-row input {
   width: 100%;
   padding: 0.5rem;
-  border: 1px solid var(--border-color, #ddd);
+  border: 1px solid var(--vp-c-border, #ddd);
   border-radius: 4px;
   font-size: 0.9rem;
   box-sizing: border-box;
@@ -263,7 +263,7 @@ function downloadJson() {
 .member-card {
   margin-bottom: 1.5rem;
   padding: 1rem;
-  border: 1px solid var(--border-color, #ddd);
+  border: 1px solid var(--vp-c-border, #ddd);
   border-radius: 6px;
 }
 
@@ -358,6 +358,7 @@ function downloadJson() {
 .json-output {
   padding: 1rem;
   border-radius: 6px;
+  border: 1px solid var(--vp-c-border);
   overflow-x: auto;
   font-size: 0.8rem;
   max-height: 600px;
@@ -374,13 +375,11 @@ function downloadJson() {
   display: block;
   margin-top: 0.25rem;
   font-size: 0.8rem;
-  color: var(--text-color-lighter, #888);
 }
 
 .field-hint code {
   font-size: 0.8rem;
   padding: 0.1rem 0.3rem;
-  background: var(--bg-color-secondary, #eee);
   border-radius: 3px;
 }
 </style>

From a8e1b52f4e0fddbcb963f6f99a19b3fd18568f25 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20B=C3=B6hringer?= <jan.boehringer@gmx.de>
Date: Mon, 1 Jun 2026 16:28:20 +0200
Subject: [PATCH 7/7] Regenerate llms.txt

---
 docs/src/.vuepress/public/llms-full.txt | 194 ++++++++++++++++++++++--
 1 file changed, 181 insertions(+), 13 deletions(-)

diff --git a/docs/src/.vuepress/public/llms-full.txt b/docs/src/.vuepress/public/llms-full.txt
index 419f480a1..13352a176 100644
--- a/docs/src/.vuepress/public/llms-full.txt
+++ b/docs/src/.vuepress/public/llms-full.txt
@@ -2306,13 +2306,6 @@ Source: https://dsf.dev/operations/latest/fhir-reverse-proxy/configuration.html
 - **Example:** `/run/secrets/ssl_certificate_chain_file.pem`
 
 
-### SSL_CERTIFICATE_CHAIN_FILE
-- **Required:** No
-- **Description:** Certificate chain file, PEM encoded, must contain all certificates between the server certificate and the root ca certificate (excluding the root ca certificate), sets the apache httpd parameter `SSLCertificateChainFile`; can be omitted if either no chain is needed (self signed server certificate) or the file specified via *SSL_CERTIFICATE_FILE* contains the certificate chain
-- **Recommendation:** Use docker secret file to configure
-- **Example:** `/run/secrets/ssl_certificate_chain_file.pem`
-
-
 ### SSL_CERTIFICATE_FILE
 - **Required:** Yes
 - **Description:** Server certificate file, PEM encoded, sets the apache httpd parameter `SSLCertificateFile`, may contain all certificates between the server certificate and the root ca certificate (excluding the root ca certificate). Omit *SSL_CERTIFICATE_CHAIN_FILE* if chain included
@@ -5146,7 +5139,7 @@ All other elements can technically be omitted. Still, the following elements are
 </details>
 
 ## Related Topics
-[ActivityDefinition](../fhir/activitydefinition.md), [Creating CodeSystems for DSF Processes](creating-codesystems-for-dsf-processes.md), [Creating ValueSets for DSF Processes](creating-valuesets-for-dsf-processes.md), [Task](../fhir/task.md)
+[ActivityDefinition](../fhir/activitydefinition.md), [Creating CodeSystems for DSF Processes](creating-codesystems-for-dsf-processes.md), [Creating ValueSets for DSF Processes](creating-valuesets-for-dsf-processes.md), [Requester and Recipient Examples](../dsf/requester-and-recipient.md), [Task](../fhir/task.md), [Understanding the Process Authorization Extension](../dsf/understanding-the-process-authorization-extension.md)
 
 ---
 
@@ -6026,7 +6019,7 @@ Below is a template for a [Questionnaire](https://www.hl7.org/fhir/R4/questionna
 ```xml
 <Questionnaire xmlns="http://hl7.org/fhir">
     <meta>
-        <profile value="http://dsf.dev/fhir/StructureDefinition/questionnaire"/>
+        <profile value="http://dsf.dev/fhir/StructureDefinition/questionnaire|2.0.0"/>
         <tag>
             <system value="http://dsf.dev/fhir/CodeSystem/read-access-tag"/>
             <code value="ALL"/>
@@ -7017,6 +7010,28 @@ The linter performs comprehensive validation on BPMN 2.0 process definitions usi
   - The process engine only deploys and executes processes marked as executable
   - Non-executable processes are typically used for documentation or as templates
 
+##### Process Version Tag Validation
+
+- **Requirement**:
+  - Process must define `camunda:versionTag`
+  - Expected placeholder value in DSF process plugins: `#{version}`
+  - Error: `BPMN_PROCESS_VERSION_TAG_MISSING_OR_EMPTY` (missing, empty/blank, or literal `"null"`)
+  - Warning: `BPMN_PROCESS_VERSION_TAG_NO_PLACEHOLDER` (present but without `#{version}`)
+  - Success: `SUCCESS` when `camunda:versionTag` contains `#{version}`
+
+- **Valid Example**:
+  - ✅ `<process id="example_process" isExecutable="true" camunda:versionTag="#{version}">`
+
+- **Error Examples**:
+  - ❌ `<process id="example_process" isExecutable="true">` (missing `camunda:versionTag`)
+  - ❌ `<process id="example_process" isExecutable="true" camunda:versionTag="">` (empty value)
+  - ❌ `<process id="example_process" isExecutable="true" camunda:versionTag="null">` (literal `null`)
+
+- **Warning Examples**:
+  - ⚠️ `<process id="example_process" isExecutable="true" camunda:versionTag="1.0.0">`
+  - ⚠️ `<process id="example_process" isExecutable="true" camunda:versionTag="some-fixed-version">`
+
+
 #### Task Validation
 
 ##### Service Tasks
@@ -7543,9 +7558,51 @@ Task resources are validated against the DSF Task base profile (`http://dsf.dev/
   - Error: `FHIR_TASK_INPUT_SLICE_COUNT_BELOW_SLICE_MIN`
   - Error: `FHIR_TASK_INPUT_SLICE_COUNT_EXCEEDS_SLICE_MAX`
 
-- **Terminology Validation**:
-  - Code/system combinations validated against DSF CodeSystems
-  - Error: `FHIR_TASK_UNKNOWN_CODE`
+  - **Terminology Validation**:
+    - Generic coding validation (outside `Task.input.type.coding`) checks code/system pairs against known DSF CodeSystems
+    - Error: `FHIR_TASK_UNKNOWN_CODE`
+
+- **Task.input.type.coding Terminology Validation (binding-driven)**:
+    - Validation for `Task.input.type.coding` is performed in three strict, ordered checks:
+        1. **Known CodeSystem check**:
+            - `Task.input.type.coding.system` must be a known CodeSystem URI
+            - Error: `FHIR_TASK_INPUT_CODING_SYSTEM_UNKNOWN`
+            - If this check fails, subsequent checks for that input are skipped
+        2. **Binding context check**:
+            - The system must be allowed by the slice-specific binding context from the referenced `StructureDefinition`
+            - Resolution order:
+                - `fixedUri` on `Task.input:sliceName.type.coding.system` (exact match required)
+                - `binding.valueSet` on `Task.input:sliceName.type` (fallback: `...type.coding`) and membership in `ValueSet.compose.include.system`
+            - Error: `FHIR_TASK_INPUT_CODING_SYSTEM_NOT_IN_VALUE_SET`
+            - If this check fails, code validation for that input is skipped
+        3. **Code-in-system check**:
+            - `Task.input.type.coding.code` must exist in the specified CodeSystem
+            - Error: `FHIR_TASK_INPUT_CODING_CODE_UNKNOWN_FOR_SYSTEM`
+
+- **Binding Resolution Notes**:
+    - ValueSet checks are strict and context-aware; no permissive fallback to unrelated ValueSets is used
+    - If a slice declares `binding.valueSet` but the ValueSet is not loaded into the cache, validation fails explicitly with:
+      `FHIR_TASK_INPUT_CODING_SYSTEM_NOT_IN_VALUE_SET`
+    - If no resolvable binding context exists for a slice (`fixedUri` and `binding.valueSet` both missing), validation fails explicitly with:
+      `FHIR_TASK_INPUT_CODING_SYSTEM_NOT_IN_VALUE_SET`
+    - Inputs already failing structural checks (`FHIR_TASK_INPUT_REQUIRED_CODING_SYSTEM_AND_CODING_CODE`) are not re-reported by terminology checks
+
+- **Task.input Fixed Constraint Validation (`fixedUri` / `fixedCode`)**:
+    - Validates actual `Task.input.type.coding.system` and `Task.input.type.coding.code` pairs against fixed constraints declared in the referenced `StructureDefinition` slices
+    - Validation direction is **Task → StructureDefinition** (actual instance values are checked against allowed fixed pairs)
+    - **System mismatch for existing code**:
+        - If a Task input code exists in SD constraints, but with a different system
+        - Error: `FHIR_TASK_INPUT_FIXED_URI_MISMATCH`
+    - **Code mismatch for existing system**:
+        - If a Task input system exists in SD constraints, but with a different code
+        - Error: `FHIR_TASK_INPUT_FIXED_CODE_MISMATCH`
+    - **Pair not allowed by SD constraints**:
+        - If a non-BPMN Task input `(system, code)` pair is not defined by any SD `fixedUri/fixedCode` constraint
+        - Error: `FHIR_TASK_INPUT_PAIR_NOT_ALLOWED_BY_SD`
+    - **Validation Behavior**:
+        - Check runs only when profile can be resolved and fixed constraints are extractable from the referenced `StructureDefinition`
+        - BPMN message inputs (`http://dsf.dev/fhir/CodeSystem/bpmn-message`) are excluded from this specific pair-not-allowed check because they are validated in dedicated Task input rules
+
 
 #### StructureDefinition Resources
 
@@ -7607,6 +7664,24 @@ According to FHIR profiling specification §5.1.0.14:
   - No individual slice's maximum cardinality may exceed base element's maximum
   - Error: `STRUCTURE_DEFINITION_SLICE_MAX_TOO_HIGH`
 
+##### Binding and Fixed Coding Validation
+- **`binding.valueSet` Reference Validation**:
+    - Checks whether `binding.valueSet` URLs in differential elements can be resolved to a known ValueSet in project resources
+    - For unresolved references with `strength="required"`:
+        - Warning: `STRUCTURE_DEFINITION_BINDING_VALUESET_UNRESOLVED`
+    - For unresolved references with non-required strengths (`extensible`, `preferred`, `example`):
+        - Info: `STRUCTURE_DEFINITION_BINDING_VALUESET_UNRESOLVED_NON_REQUIRED`
+    - Success: `SUCCESS` when the referenced ValueSet is resolvable
+- **`fixedUri` / `fixedCode` Validation Against CodeSystems**:
+    - For differential elements using `fixedUri` on `*.system`, verifies that the referenced CodeSystem exists in project terminology cache
+    - If referenced CodeSystem is unknown:
+        - Info: `STRUCTURE_DEFINITION_FIXED_URI_CODESYSTEM_NOT_FOUND`
+        - Note: `fixedCode` validation is skipped for this path when CodeSystem is unknown
+    - If `fixedCode` is present and the CodeSystem is known, verifies that the code exists in that CodeSystem
+        - Error: `STRUCTURE_DEFINITION_FIXED_CODE_NOT_IN_CODESYSTEM`
+    - Success: `SUCCESS` when `fixedUri` resolves (and `fixedCode`, if present, is valid)
+
+
 #### ValueSet Resources
 
 ValueSet resources are validated against the DSF ValueSet base profile.
@@ -7928,6 +8003,99 @@ ValueSet resources are validated against the DSF ValueSet base profile.
   - `dsf-bpe/dsf-bpe-process-api-v2/src/main/java/dev/dsf/bpe/v2/ProcessPluginDefinition.java`
   - The `getResourceVersion()` method extracts the resource version from the plugin version
 
+#### Spring Configuration Registration
+
+In the DSF runtime, the Camunda engine does not instantiate Java delegate or
+listener classes directly. Spring creates those instances via `@Bean` methods
+declared in `@Configuration` classes. For those beans to be available to the
+BPE at runtime, the corresponding `@Configuration` classes must be explicitly
+returned by `ProcessPluginDefinition#getSpringConfigurations()`. Forgetting
+to add a `@Bean` for a BPMN-referenced class typically surfaces as a
+`BeanCreationException` or `ClassNotFoundException` only at deployment time.
+
+- **Every BPMN-referenced class must be provided as a `@Bean`**:
+    - The linter collects every `camunda:class` reference used by
+      `serviceTask`, `sendTask`, `messageEventDefinition`,
+      `camunda:executionListener` and `camunda:taskListener` elements in the
+      plugin's BPMN files (List 1).
+    - The linter calls `getSpringConfigurations()` to get the registered
+      `@Configuration` classes and inspects the return types of their
+      `@Bean` methods (List 2).
+    - For every class in List 1, the linter checks whether it is provided
+      as a `@Bean` (exact type or supertype) in any `@Configuration` from
+      List 2.
+    - If a BPMN-referenced class has **no matching `@Bean`** in any
+      registered configuration, this is reported as an error.
+    - Error: `PLUGIN_DEFINITION_SPRING_CONFIGURATION_MISSING`
+    - Success: `SUCCESS` when all BPMN delegate/listener references are
+      covered by a `@Bean` in a registered `@Configuration`, or when no
+      BPMN delegate/listener references exist.
+
+- **Code Example**:
+  ```java
+  @Override
+  public List<Class<?>> getSpringConfigurations() {
+      return List.of(DataSharingConfig.class, DataSharingVariablesConfig.class);
+  }
+  ```
+  ```java
+  @Configuration
+  public class DataSharingConfig {
+
+      // Every class referenced via camunda:class in the BPMN must have
+      // a corresponding @Bean here (or in another registered @Configuration).
+      @Bean
+      public SelectDicTargets selectDicTargets() {
+          return new SelectDicTargets(api);
+      }
+
+      @Bean
+      public SelectDmsTarget selectDmsTarget() {
+          return new SelectDmsTarget(api);
+      }
+  }
+  ```
+#### Spring Bean Scope (`SpringConfigurationLinter`)
+
+In Camunda and the Data Sharing Framework (DSF), Spring beans that act as delegates, execution listeners, or task listeners should usually be configured with **prototype** scope (`SCOPE_PROTOTYPE`). If the `@Scope` annotation is omitted, Spring defaults to **singleton**. That can be acceptable for strictly stateless classes; as soon as someone adds mutable instance state, the risk of race conditions and hard-to-debug concurrency bugs rises sharply—often only visible under load.
+
+After a BPMN-referenced class is **covered** by a `@Bean` in a registered `@Configuration` (see [Spring Configuration Registration](#spring-configuration-registration)), the linter inspects the covering `@Bean` method for `@Scope` and the referenced implementation class for **mutable** instance fields (not `static`, not `final`). Emitted rules:
+
+   - **Success** – `SPRING_BEAN_SCOPE_PROTOTYPE`: `@Scope` is **prototype** (e.g. `ConfigurableBeanFactory.SCOPE_PROTOTYPE` or `@Scope("prototype")`). No further scope items for that reference in this pass.
+   - **Error** – `SPRING_BEAN_SCOPE_MUTABLE_SINGLETON`: The bean is **effectively singleton** (missing `@Scope` *or* explicit non-prototype scope such as `singleton`) **and** the referenced class has **mutable** instance fields. Emitted **once** per reference before the following warnings.
+   - **Warning** – `SPRING_BEAN_SCOPE_MISSING`: The covering `@Bean` has **no** `@Scope` (Spring’s default is singleton, which is risky for Camunda hooks unless the implementation is provably stateless).
+   - **Warning** – `SPRING_BEAN_SCOPE_SINGLETON_EXPLICIT`: `@Scope` is **explicitly** set to a **non-prototype** value (typically `singleton`); the developer should verify that the delegate or listener is safe to share across process instances.
+
+  **Why this matters:** The rule stays aligned with DSF wiring (only configurations from `getSpringConfigurations()`) and surfaces dangerous combinations—singleton or default-singleton scope plus mutable instance state—before they appear in production.
+
+  **Example scenarios**
+
+   *Missing `@Scope` → warning (and error if the delegate/listener class has mutable instance fields)*
+
+  ```java
+  @Bean
+  // Missing @Scope annotation
+  public SetCorrelationKeyListener setCorrelationKeyListener() {
+      return new SetCorrelationKeyListener(api);
+  }
+  ```
+
+  *Explicit singleton → warning (and error if mutable instance fields exist)*
+  ```java
+  @Bean
+  @Scope(ConfigurableBeanFactory.SCOPE_SINGLETON) // or @Scope("singleton")
+  public SetCorrelationKeyListener setCorrelationKeyListener() {
+  return new SetCorrelationKeyListener(api);
+  }
+  ```
+  *Prototype (recommended) → success*
+  ```java 
+  @Bean
+  @Scope(ConfigurableBeanFactory.SCOPE_PROTOTYPE) // or @Scope("prototype")
+  public SetCorrelationKeyListener setCorrelationKeyListener() {
+  return new SetCorrelationKeyListener(api);
+  }
+  ```
 #### Leftover Resource Detection
 
 The linter performs project-level analysis to identify unreferenced resources:
@@ -10910,7 +11078,7 @@ The `recipeint` element uses one of the following Codings:
 
 
 ## Related Topics
-[ActivityDefinition](../fhir/activitydefinition.md)
+[ActivityDefinition](../fhir/activitydefinition.md), [Understanding the Process Authorization Extension](./understanding-the-process-authorization-extension.md)
 
 ---