gdc-common-utils-ts 2.1.0 → 2.3.0

package/dist/utils/index.js

@@ -1,4 +1,5 @@
 export * from './actor.js';
+export * from './authority-resolution.js';
 export * from './activation-policy.js';
 export * from './base-convert.js';
 export * from './baseN.js';
@@ -34,6 +35,7 @@ export * from './gw-core-path.js';
 export * from './gw-core-commercial-contract.js';
 export * from './legal-organization-verification-result.js';
 export * from './communication-fhir-r4.js';
+export * from './communication-editor.js';
 export * from './communication-document-reference.js';
 export * from './communication-bundle-document-request.js';
 export * from './communication-identity.js';
@@ -48,6 +50,7 @@ export * from './communication-didcomm-payload.js';
 export * from './confidential-storage-persistence.js';
 export * from './confidential-storage-test-data.js';
 export * from './permission-templates.js';
+export * from './client-assertion.js';
 export * from './professional-smart.js';
 export * from './related-person-list.js';
 export * from './clinical-resource-converters.js';
@@ -56,6 +59,7 @@ export * from './clinical-resource-view.js';
 export * from './fhir-validator.js';
 export * from './family-registration-test-data.js';
 export * from './individual-form-pdf.js';
+export * from './individual-smart.js';
 export * from './individual-organization-claims.js';
 export * from './inter-tenant-access-contract.js';
 export * from './legal-organization-onboarding-editor.js';
@@ -64,6 +68,7 @@ export * from './organization-did-binding.js';
 export * from './organization-authorization-urn.js';
 export * from './individual-organization-lifecycle.js';
 export * from './individual-onboarding-editor.js';
+export * from './individual-onboarding-acceptance-credential.js';
 export * from './individual-onboarding-document-reference.js';
 export * from './individual-organization-kyc.js';
 export * from './individual-bundle-vault.js';
@@ -88,12 +93,14 @@ export * from './normalize.js';
 export * from './object-convert.js';
 export * from './normalize-uuid.js';
 export * from './object-sanitize.js';
+export * from './unified-health-id.js';
 export * from './permission-templates.js';
 export * from './smart-scope.js';
 export * from './service-act-reasons.js';
 export * from './same-as.js';
 export * from './activation-request.js';
 export * from './vp-token.js';
+export * from './vital-sign-day-batch.js';
 export * from './wallet-mem.js';
 export * from './wallet-memory-queue.js';
 export * from './profile-outbox-memory-repository.js';

package/dist/utils/individual-onboarding-acceptance-credential.d.ts

@@ -0,0 +1,35 @@
+import type { VerifiableCredentialV2 } from '../models/verifiable-credential';
+/**
+ * Input for the canonical individual-onboarding acceptance credential.
+ *
+ * This helper builds the evidence object that a frontend/BFF can later sign
+ * with the user profile key pair before sending it as an attachment.
+ *
+ * Canonical semantics:
+ * - `credentialSubject.memberOf.taxID` is the organization tax identifier
+ * - `credentialSubject.hasOccupation.identifier.value` defaults to `RESPRSN`
+ * - `credentialSubject.hasCredential.material` binds the credential to the
+ *   profile signing material
+ */
+export type IndividualOnboardingAcceptanceCredentialInput = Readonly<{
+    issuerDid: string;
+    subjectDid: string;
+    organizationTaxId: string;
+    profileKeyMaterial: string;
+    validFrom: string;
+    credentialId?: string;
+    representativeIdentifier?: string;
+    representativeRoleCode?: string;
+    sameAs?: string;
+    validUntil?: string;
+    proof?: VerifiableCredentialV2['proof'];
+}>;
+/**
+ * Builds the canonical Verifiable Credential for individual onboarding
+ * acceptance.
+ *
+ * The result is unsigned by design. Callers sign it with the user profile key
+ * pair and then attach the signed VC to the `Organization/_transaction`
+ * request.
+ */
+export declare function buildIndividualOnboardingAcceptanceCredential(input: IndividualOnboardingAcceptanceCredentialInput): VerifiableCredentialV2;

package/dist/utils/individual-onboarding-acceptance-credential.js

@@ -0,0 +1,55 @@
+import { ActivationCredentialTypes, W3cCredentialContexts, W3cCredentialTypes } from '../constants/verifiable-credentials.js';
+import { ClaimsPersonSchemaorg } from '../constants/schemaorg.js';
+function normalizeText(value) {
+    return typeof value === 'string' ? value.trim() : '';
+}
+function requireText(value, fieldName) {
+    const normalized = normalizeText(value);
+    if (!normalized) {
+        throw new Error(`buildIndividualOnboardingAcceptanceCredential requires ${fieldName}.`);
+    }
+    return normalized;
+}
+/**
+ * Builds the canonical Verifiable Credential for individual onboarding
+ * acceptance.
+ *
+ * The result is unsigned by design. Callers sign it with the user profile key
+ * pair and then attach the signed VC to the `Organization/_transaction`
+ * request.
+ */
+export function buildIndividualOnboardingAcceptanceCredential(input) {
+    const issuerDid = requireText(input.issuerDid, 'issuerDid');
+    const subjectDid = requireText(input.subjectDid, 'subjectDid');
+    const organizationTaxId = requireText(input.organizationTaxId, 'organizationTaxId');
+    const profileKeyMaterial = requireText(input.profileKeyMaterial, 'profileKeyMaterial');
+    const validFrom = requireText(input.validFrom, 'validFrom');
+    const roleCode = normalizeText(input.representativeRoleCode) || 'RESPRSN';
+    return {
+        '@context': [W3cCredentialContexts.V2, 'https://schema.org'],
+        ...(normalizeText(input.credentialId) ? { id: normalizeText(input.credentialId) } : {}),
+        type: [W3cCredentialTypes.VerifiableCredential, ActivationCredentialTypes.LegalRepresentativeCredential],
+        issuer: issuerDid,
+        credentialSubject: {
+            id: subjectDid,
+            memberOf: {
+                taxID: organizationTaxId,
+            },
+            hasOccupation: {
+                identifier: {
+                    value: roleCode,
+                },
+            },
+            hasCredential: {
+                material: profileKeyMaterial,
+            },
+            ...(normalizeText(input.representativeIdentifier)
+                ? { [ClaimsPersonSchemaorg.identifierValue]: normalizeText(input.representativeIdentifier) }
+                : {}),
+            ...(normalizeText(input.sameAs) ? { sameAs: normalizeText(input.sameAs) } : {}),
+        },
+        validFrom,
+        ...(normalizeText(input.validUntil) ? { validUntil: normalizeText(input.validUntil) } : {}),
+        ...(input.proof ? { proof: input.proof } : {}),
+    };
+}

package/dist/utils/individual-smart.d.ts

@@ -0,0 +1,59 @@
+export type IndividualActorIdentityCredentialInput = Readonly<{
+    actorDid: string;
+    subjectDid?: string;
+    relationship?: string;
+    authorityBasis?: string;
+    email?: string;
+    sameAs?: string | readonly string[];
+    telephone?: string;
+    credentialMaterial?: string;
+    evidence?: readonly Record<string, unknown>[];
+    additionalCredentialSubject?: Record<string, unknown>;
+    additionalCredential?: Record<string, unknown>;
+}>;
+export type IndividualActorIdentityVpPayloadInput = Readonly<{
+    clientId: string;
+    actorDid: string;
+    subjectDid?: string;
+    relationship?: string;
+    authorityBasis?: string;
+    email?: string;
+    sameAs?: string | readonly string[];
+    telephone?: string;
+    credentialMaterial?: string;
+    evidence?: readonly Record<string, unknown>[];
+    verifiableCredential?: string | Record<string, unknown> | ReadonlyArray<string | Record<string, unknown>>;
+    additionalVp?: Record<string, unknown>;
+    additionalPayload?: Record<string, unknown>;
+}>;
+export type IndividualSubjectCredentialInput = Readonly<{
+    subjectDid: string;
+    sameAs?: string | readonly string[];
+    telephone?: string;
+    evidence?: readonly Record<string, unknown>[];
+    additionalCredentialSubject?: Record<string, unknown>;
+    additionalCredential?: Record<string, unknown>;
+}>;
+export type IndividualControllerCredentialInput = IndividualActorIdentityCredentialInput;
+export type IndividualControllerVpPayloadInput = IndividualActorIdentityVpPayloadInput;
+export type IndividualMemberCredentialInput = IndividualActorIdentityCredentialInput;
+export type IndividualMemberVpPayloadInput = IndividualActorIdentityVpPayloadInput;
+export declare function getIndividualControllerIdentitySameAs(input: Readonly<Pick<IndividualControllerCredentialInput, 'sameAs' | 'email'>>): string[];
+export declare function getIndividualControllerIdentityTelephone(input: Readonly<Pick<IndividualControllerCredentialInput, 'telephone'>>): string | undefined;
+export declare function getIndividualControllerIdentityVC(input: IndividualControllerCredentialInput): Record<string, unknown>;
+export declare function buildIndividualControllerIdentityVpPayload(input: IndividualControllerVpPayloadInput): Record<string, unknown>;
+export declare function buildUnsignedIndividualControllerIdentityVpJwt(input: IndividualControllerVpPayloadInput, options?: Readonly<{
+    nowSeconds?: number;
+    ttlSeconds?: number;
+    nonce?: string;
+}>): string;
+export declare function getIndividualSubjectVC(input: IndividualSubjectCredentialInput): Record<string, unknown>;
+export declare function getIndividualMemberIdentitySameAs(input: Readonly<Pick<IndividualMemberCredentialInput, 'sameAs' | 'email'>>): string[];
+export declare function getIndividualMemberIdentityTelephone(input: Readonly<Pick<IndividualMemberCredentialInput, 'telephone'>>): string | undefined;
+export declare function getIndividualMemberIdentityVC(input: IndividualMemberCredentialInput): Record<string, unknown>;
+export declare function buildIndividualMemberIdentityVpPayload(input: IndividualMemberVpPayloadInput): Record<string, unknown>;
+export declare function buildUnsignedIndividualMemberIdentityVpJwt(input: IndividualMemberVpPayloadInput, options?: Readonly<{
+    nowSeconds?: number;
+    ttlSeconds?: number;
+    nonce?: string;
+}>): string;

package/dist/utils/individual-smart.js

@@ -0,0 +1,135 @@
+import { ClaimsPersonSchemaorg } from '../constants/schemaorg.js';
+import { IndividualCredentialTypes, W3cCredentialTypes, } from '../constants/verifiable-credentials.js';
+import { normalizeSameAsHashCsv, normalizeSameAsHashList, normalizeTelephoneHash } from './same-as.js';
+import { buildUnsignedVpJwt } from './jwt.js';
+function getIndividualIdentitySameAs(input) {
+    const sameAsCandidates = [];
+    if (input.sameAs) {
+        sameAsCandidates.push(...normalizeSameAsHashList(input.sameAs));
+    }
+    if (input.email) {
+        sameAsCandidates.push(...normalizeSameAsHashList(input.email));
+    }
+    return [...new Set(sameAsCandidates)];
+}
+function getIndividualIdentityTelephone(input) {
+    const normalized = normalizeTelephoneHash(String(input.telephone || ''));
+    return normalized || undefined;
+}
+function buildIndividualIdentityVC(input, credentialType) {
+    const normalizedSameAs = getIndividualIdentitySameAs(input);
+    const normalizedTelephone = getIndividualIdentityTelephone(input);
+    const normalizedCredentialMaterial = String(input.credentialMaterial || '').trim();
+    const normalizedSubjectDid = String(input.subjectDid || '').trim();
+    const normalizedRelationship = String(input.relationship || '').trim();
+    const normalizedAuthorityBasis = String(input.authorityBasis || '').trim();
+    return {
+        type: [
+            W3cCredentialTypes.VerifiableCredential,
+            credentialType,
+        ],
+        credentialSubject: {
+            id: String(input.actorDid || '').trim(),
+            ...(normalizedSubjectDid ? { subject: normalizedSubjectDid } : {}),
+            ...(normalizedRelationship ? { relationship: normalizedRelationship } : {}),
+            ...(normalizedAuthorityBasis ? { authorityBasis: normalizedAuthorityBasis } : {}),
+            ...(normalizedSameAs.length
+                ? { sameAs: normalizeSameAsHashCsv(normalizedSameAs) }
+                : {}),
+            ...(normalizedTelephone
+                ? { [ClaimsPersonSchemaorg.telephone]: normalizedTelephone }
+                : {}),
+            ...(normalizedCredentialMaterial
+                ? { [ClaimsPersonSchemaorg.hasCredentialMaterial]: normalizedCredentialMaterial }
+                : {}),
+            ...(input.additionalCredentialSubject || {}),
+        },
+        ...(Array.isArray(input.evidence) && input.evidence.length
+            ? { evidence: [...input.evidence] }
+            : {}),
+        ...(input.additionalCredential || {}),
+    };
+}
+function buildIndividualIdentityVpPayload(input, credentialType) {
+    const credentials = Array.isArray(input.verifiableCredential)
+        ? [...input.verifiableCredential]
+        : input.verifiableCredential
+            ? [input.verifiableCredential]
+            : [buildIndividualIdentityVC({
+                    actorDid: input.actorDid,
+                    subjectDid: input.subjectDid,
+                    relationship: input.relationship,
+                    authorityBasis: input.authorityBasis,
+                    email: input.email,
+                    sameAs: input.sameAs,
+                    telephone: input.telephone,
+                    credentialMaterial: input.credentialMaterial,
+                    evidence: input.evidence,
+                }, credentialType)];
+    return {
+        ...(input.additionalPayload || {}),
+        vp: {
+            holder: String(input.clientId || '').trim(),
+            verifiableCredential: credentials,
+            ...(input.additionalVp || {}),
+        },
+    };
+}
+export function getIndividualControllerIdentitySameAs(input) {
+    return getIndividualIdentitySameAs(input);
+}
+export function getIndividualControllerIdentityTelephone(input) {
+    return getIndividualIdentityTelephone(input);
+}
+export function getIndividualControllerIdentityVC(input) {
+    return buildIndividualIdentityVC(input, IndividualCredentialTypes.IndividualControllerCredential);
+}
+export function buildIndividualControllerIdentityVpPayload(input) {
+    return buildIndividualIdentityVpPayload(input, IndividualCredentialTypes.IndividualControllerCredential);
+}
+export function buildUnsignedIndividualControllerIdentityVpJwt(input, options = {}) {
+    return buildUnsignedVpJwt(buildIndividualControllerIdentityVpPayload(input), options);
+}
+export function getIndividualSubjectVC(input) {
+    const normalizedSameAs = getIndividualIdentitySameAs({
+        sameAs: input.sameAs,
+    });
+    const normalizedTelephone = getIndividualIdentityTelephone({
+        telephone: input.telephone,
+    });
+    return {
+        type: [
+            W3cCredentialTypes.VerifiableCredential,
+            IndividualCredentialTypes.IndividualSubjectCredential,
+        ],
+        credentialSubject: {
+            id: String(input.subjectDid || '').trim(),
+            ...(normalizedSameAs.length
+                ? { sameAs: normalizeSameAsHashCsv(normalizedSameAs) }
+                : {}),
+            ...(normalizedTelephone
+                ? { [ClaimsPersonSchemaorg.telephone]: normalizedTelephone }
+                : {}),
+            ...(input.additionalCredentialSubject || {}),
+        },
+        ...(Array.isArray(input.evidence) && input.evidence.length
+            ? { evidence: [...input.evidence] }
+            : {}),
+        ...(input.additionalCredential || {}),
+    };
+}
+export function getIndividualMemberIdentitySameAs(input) {
+    return getIndividualIdentitySameAs(input);
+}
+export function getIndividualMemberIdentityTelephone(input) {
+    return getIndividualIdentityTelephone(input);
+}
+export function getIndividualMemberIdentityVC(input) {
+    return buildIndividualIdentityVC(input, IndividualCredentialTypes.IndividualMemberCredential);
+}
+export function buildIndividualMemberIdentityVpPayload(input) {
+    return buildIndividualIdentityVpPayload(input, IndividualCredentialTypes.IndividualMemberCredential);
+}
+export function buildUnsignedIndividualMemberIdentityVpJwt(input, options = {}) {
+    return buildUnsignedVpJwt(buildIndividualMemberIdentityVpPayload(input), options);
+}

package/dist/utils/license-list-search.d.ts

@@ -8,9 +8,11 @@ import { buildLicenseSearchEntry, type LicenseClaims, type LicenseSearchInput, t
 export type LicenseListSearchState = Readonly<{
     serialNumbers?: readonly string[];
     email?: string;
+    telephone?: string;
     role?: string;
     status?: LicenseStatus;
     subjectId?: string;
+    ownerOrganizationId?: string;
     userClass?: string;
     type?: string;
     active?: boolean;
@@ -28,6 +30,7 @@ export type LicenseListRecord = Readonly<{
     id?: string;
     status?: string;
     subjectId?: string;
+    ownerOrganizationId?: string;
     email?: string;
     role?: string;
     category?: string;
@@ -66,6 +69,8 @@ export declare class LicenseListSearchEditor {
     setRole(value: string): this;
     setStatus(value: LicenseStatus): this;
     setSubjectId(value: string): this;
+    /** Limits results to the organization that owns the seat pool. */
+    setOwnerOrganizationId(value: string): this;
     setUserClass(value: string): this;
     setAppType(value: string): this;
     setActive(value: boolean): this;

package/dist/utils/license-list-search.js

@@ -15,6 +15,7 @@ function cloneDraft(state) {
         role: normalizeText(state?.role),
         status: state?.status,
         subjectId: normalizeText(state?.subjectId),
+        ownerOrganizationId: normalizeText(state?.ownerOrganizationId),
         userClass: normalizeText(state?.userClass),
         type: normalizeText(state?.type),
         active: typeof state?.active === 'boolean' ? state.active : undefined,
@@ -71,6 +72,11 @@ export class LicenseListSearchEditor {
         this.draft = cloneDraft({ ...this.draft, subjectId: value });
         return this;
     }
+    /** Limits results to the organization that owns the seat pool. */
+    setOwnerOrganizationId(value) {
+        this.draft = cloneDraft({ ...this.draft, ownerOrganizationId: value });
+        return this;
+    }
     setUserClass(value) {
         this.draft = cloneDraft({ ...this.draft, userClass: value });
         return this;
@@ -117,6 +123,7 @@ export class LicenseListSearchEditor {
             ...(this.draft.role ? { role: this.draft.role } : {}),
             ...(resolveStatus(this.draft) ? { status: resolveStatus(this.draft) } : {}),
             ...(this.draft.subjectId ? { subjectId: this.draft.subjectId } : {}),
+            ...(this.draft.ownerOrganizationId ? { ownerOrganizationId: this.draft.ownerOrganizationId } : {}),
             additionalClaims: cloneClaims(this.draft.additionalClaims),
         };
     }
@@ -151,7 +158,9 @@ export function readLicenseListRecords(body) {
                 || entry.id),
             status: normalizeText(meta.status),
             subjectId: normalizeText(meta.subjectId),
+            ownerOrganizationId: normalizeText(meta.ownerOrganizationId || claims['License.ownerOrganizationId']),
             email: normalizeText(claims[ClaimsPersonSchemaorg.email]),
+            telephone: normalizeText(claims[ClaimsPersonSchemaorg.telephone]),
             role: normalizeText(claims[ClaimsPersonSchemaorg.hasOccupationalRoleValue]),
             category: normalizeText(claims[ClaimsIndividualProductSchemaorg.category]),
             appType: normalizeText(claims[ClaimsIndividualProductSchemaorg.additionalType]),

package/dist/utils/license.d.ts

@@ -54,11 +54,44 @@ export declare const LicenseStatuses: Readonly<{
     readonly Inactive: "inactive";
 }>;
 export type LicenseStatus = typeof LicenseStatuses[keyof typeof LicenseStatuses];
+/**
+ * Role families that decide which organization owns the actor's license.
+ *
+ * This classification is deliberately independent from Consent. A person may
+ * receive permissions in either case, but only a FHIR v3 relationship role is
+ * a member of the individual's organization and consumes its seat pool.
+ */
+export declare const LicenseRoleKinds: Readonly<{
+    readonly IndividualMember: "individual-member";
+    readonly Professional: "professional";
+    readonly Unsupported: "unsupported";
+}>;
+export type LicenseRoleKind = typeof LicenseRoleKinds[keyof typeof LicenseRoleKinds];
+/**
+ * Classifies one canonical or compatibility role token for license ownership.
+ *
+ * Rules:
+ * - FHIR/HL7 v3 `RoleCode` actors are non-employee members of the individual
+ *   organization and consume one of its licenses.
+ * - ISCO/ISCO-08 actors are professionals. Their employer/organization owns
+ *   their professional license, so a patient's individual pool is untouched.
+ * - Unknown role systems are not silently charged to either pool.
+ */
+export declare function classifyLicenseRole(role: string): LicenseRoleKind;
 export type LicenseIssueInput = Readonly<{
-    email: string;
+    email?: string;
+    telephone?: string;
     role: string;
     userClass?: DeviceUserClass;
     type?: DeviceAppType;
+    /** Individual/legal organization that owns the seat pool. */
+    ownerOrganizationId?: string;
+    /** Card/individual DID granted by the invitation after acceptance. */
+    subjectDid?: string;
+    /** Existing RelatedPerson/contact selected before the invitation. */
+    relatedPersonId?: string;
+    /** Stable invitation workflow identifier; not the license id or code. */
+    invitationId?: string;
     additionalClaims?: LicenseClaims;
 }>;
 export type LicensePurchaseInput = Readonly<{
@@ -66,6 +99,10 @@ export type LicensePurchaseInput = Readonly<{
     userClass?: DeviceUserClass;
     type?: DeviceAppType;
     serialNumbers?: readonly string[];
+    price?: number;
+    priceCurrency?: string;
+    /** Organization whose pool receives the newly materialized seats. */
+    ownerOrganizationId?: string;
     additionalClaims?: LicenseClaims;
 }>;
 export type LicenseSearchInput = Readonly<{
@@ -76,6 +113,7 @@ export type LicenseSearchInput = Readonly<{
     role?: string;
     status?: LicenseStatus;
     subjectId?: string;
+    ownerOrganizationId?: string;
     additionalClaims?: LicenseClaims;
 }>;
 /**
@@ -106,6 +144,10 @@ export declare function buildLicenseIssueEntry(input: LicenseIssueInput): {
     };
     meta: {
         claims: LicenseClaims;
+        ownerOrganizationId?: string;
+        subjectDid?: string;
+        relatedPersonId?: string;
+        invitationId?: string;
     };
 };
 /**
@@ -130,6 +172,7 @@ export declare function buildLicensePurchaseEntry(input: LicensePurchaseInput):
     };
     meta: {
         claims: LicenseClaims;
+        ownerOrganizationId?: string;
     };
 };
 /**
@@ -151,5 +194,6 @@ export declare function buildLicenseSearchEntry(input: LicenseSearchInput): {
         claims: LicenseClaims;
         status?: LicenseStatus;
         subjectId?: string;
+        ownerOrganizationId?: string;
     };
 };

package/dist/utils/license.js

@@ -52,6 +52,47 @@ export const LicenseStatuses = Object.freeze({
     Active: 'active',
     Inactive: 'inactive',
 });
+/**
+ * Role families that decide which organization owns the actor's license.
+ *
+ * This classification is deliberately independent from Consent. A person may
+ * receive permissions in either case, but only a FHIR v3 relationship role is
+ * a member of the individual's organization and consumes its seat pool.
+ */
+export const LicenseRoleKinds = Object.freeze({
+    IndividualMember: 'individual-member',
+    Professional: 'professional',
+    Unsupported: 'unsupported',
+});
+/**
+ * Classifies one canonical or compatibility role token for license ownership.
+ *
+ * Rules:
+ * - FHIR/HL7 v3 `RoleCode` actors are non-employee members of the individual
+ *   organization and consume one of its licenses.
+ * - ISCO/ISCO-08 actors are professionals. Their employer/organization owns
+ *   their professional license, so a patient's individual pool is untouched.
+ * - Unknown role systems are not silently charged to either pool.
+ */
+export function classifyLicenseRole(role) {
+    const normalized = String(role || '').trim().toLowerCase();
+    if (!normalized)
+        return LicenseRoleKinds.Unsupported;
+    const system = normalized.includes('|') ? normalized.split('|', 1)[0] : normalized;
+    if (system === 'isco'
+        || system === 'isco-08'
+        || system === 'org.ilo.isco'
+        || system === 'org.ilo.isco-08'
+        || system.endsWith('/isco-08')) {
+        return LicenseRoleKinds.Professional;
+    }
+    if (system === 'v3-rolecode'
+        || system === 'org.hl7.v3.rolecode'
+        || system.endsWith('/v3-rolecode')) {
+        return LicenseRoleKinds.IndividualMember;
+    }
+    return LicenseRoleKinds.Unsupported;
+}
 function cloneClaims(claims) {
     return { ...(claims || {}) };
 }
@@ -82,12 +123,31 @@ export function serializeLicenseSerialNumbers(serialNumbers) {
  * - seat/app semantics come from `IndividualProduct.*`
  */
 export function buildLicenseIssueClaims(input) {
+    const email = String(input.email || '').trim();
+    const telephone = String(input.telephone || '').trim();
+    if (!email && !telephone) {
+        throw new Error('License issue requires an email or telephone recipient.');
+    }
+    if (telephone && !/^\+[1-9]\d{6,14}$/.test(telephone)) {
+        throw new Error('License issue telephone must use an international ITU format beginning with +.');
+    }
+    const userClass = input.userClass || DeviceUserClasses.Employee;
+    if (userClass === DeviceUserClasses.Individual) {
+        const roleKind = classifyLicenseRole(input.role);
+        if (roleKind === LicenseRoleKinds.Professional) {
+            throw new Error('ISCO professional roles do not consume individual-member licenses.');
+        }
+        if (roleKind !== LicenseRoleKinds.IndividualMember) {
+            throw new Error('Individual-member licenses require a FHIR v3-RoleCode role.');
+        }
+    }
     const claims = {
         '@context': LicenseClaimContext.SchemaOrg,
         ...cloneClaims(input.additionalClaims),
-        [ClaimsPersonSchemaorg.email]: input.email.trim(),
+        ...(email ? { [ClaimsPersonSchemaorg.email]: email } : {}),
+        ...(telephone ? { [ClaimsPersonSchemaorg.telephone]: telephone } : {}),
         [ClaimsPersonSchemaorg.hasOccupationalRoleValue]: input.role.trim(),
-        [ClaimsIndividualProductSchemaorg.category]: mapLicenseCategoryFromUserClass(input.userClass || DeviceUserClasses.Employee),
+        [ClaimsIndividualProductSchemaorg.category]: mapLicenseCategoryFromUserClass(userClass),
         [ClaimsIndividualProductSchemaorg.additionalType]: input.type || DeviceAppTypes.Mobile,
     };
     return claims;
@@ -104,6 +164,18 @@ export function buildLicenseIssueEntry(input) {
                 ...buildLicenseIssueClaims(input),
                 '@type': LicenseEntryOperations.Issue,
             },
+            ...(String(input.ownerOrganizationId || '').trim()
+                ? { ownerOrganizationId: String(input.ownerOrganizationId).trim() }
+                : {}),
+            ...(String(input.subjectDid || '').trim()
+                ? { subjectDid: String(input.subjectDid).trim() }
+                : {}),
+            ...(String(input.relatedPersonId || '').trim()
+                ? { relatedPersonId: String(input.relatedPersonId).trim() }
+                : {}),
+            ...(String(input.invitationId || '').trim()
+                ? { invitationId: String(input.invitationId).trim() }
+                : {}),
         },
     };
 }
@@ -129,6 +201,12 @@ export function buildLicensePurchaseClaims(input) {
     if (serializedSerialNumbers) {
         claims[ClaimsOfferSchemaorg.serialNumber] = serializedSerialNumbers;
     }
+    if (typeof input.price === 'number' && Number.isFinite(input.price) && input.price >= 0) {
+        claims[ClaimsOfferSchemaorg.price] = input.price;
+    }
+    if (typeof input.priceCurrency === 'string' && input.priceCurrency.trim()) {
+        claims[ClaimsOfferSchemaorg.priceCurrency] = input.priceCurrency.trim().toUpperCase();
+    }
     return claims;
 }
 /**
@@ -144,6 +222,9 @@ export function buildLicensePurchaseEntry(input) {
                 ...buildLicensePurchaseClaims(input),
                 '@type': LicenseEntryOperations.Purchase,
             },
+            ...(String(input.ownerOrganizationId || '').trim()
+                ? { ownerOrganizationId: String(input.ownerOrganizationId).trim() }
+                : {}),
         },
     };
 }
@@ -189,6 +270,9 @@ export function buildLicenseSearchEntry(input) {
             ...(typeof input.subjectId === 'string' && input.subjectId.trim()
                 ? { subjectId: input.subjectId.trim() }
                 : {}),
+            ...(typeof input.ownerOrganizationId === 'string' && input.ownerOrganizationId.trim()
+                ? { ownerOrganizationId: input.ownerOrganizationId.trim() }
+                : {}),
         },
     };
 }