@learncard/helpers 1.4.0 → 1.5.0

package/dist/helpers.esm.js

@@ -64,6 +64,8 @@ var require_types_cjs_development = __commonJS({
       AgeRatingValidator: /* @__PURE__ */ __name(() => AgeRatingValidator, "AgeRatingValidator"),
       AlignmentTargetTypeValidator: /* @__PURE__ */ __name(() => AlignmentTargetTypeValidator, "AlignmentTargetTypeValidator"),
       AlignmentValidator: /* @__PURE__ */ __name(() => AlignmentValidator, "AlignmentValidator"),
+      AllocateCredentialRefreshInputValidator: /* @__PURE__ */ __name(() => AllocateCredentialRefreshInputValidator, "AllocateCredentialRefreshInputValidator"),
+      AllocateCredentialRefreshResultValidator: /* @__PURE__ */ __name(() => AllocateCredentialRefreshResultValidator, "AllocateCredentialRefreshResultValidator"),
       AllocateCredentialStatusInputValidator: /* @__PURE__ */ __name(() => AllocateCredentialStatusInputValidator, "AllocateCredentialStatusInputValidator"),
       AllocatedBitstringStatusListEntryValidator: /* @__PURE__ */ __name(() => AllocatedBitstringStatusListEntryValidator, "AllocatedBitstringStatusListEntryValidator"),
       AllowConnectionRequestsEnum: /* @__PURE__ */ __name(() => AllowConnectionRequestsEnum, "AllowConnectionRequestsEnum"),
@@ -145,6 +147,16 @@ var require_types_cjs_development = __commonJS({
       CredentialInfoValidator: /* @__PURE__ */ __name(() => CredentialInfoValidator, "CredentialInfoValidator"),
       CredentialNameRefValidator: /* @__PURE__ */ __name(() => CredentialNameRefValidator, "CredentialNameRefValidator"),
       CredentialRecordValidator: /* @__PURE__ */ __name(() => CredentialRecordValidator, "CredentialRecordValidator"),
+      CredentialRefreshChallengeValidator: /* @__PURE__ */ __name(() => CredentialRefreshChallengeValidator, "CredentialRefreshChallengeValidator"),
+      CredentialRefreshFailedResultValidator: /* @__PURE__ */ __name(() => CredentialRefreshFailedResultValidator, "CredentialRefreshFailedResultValidator"),
+      CredentialRefreshFailureCodeValidator: /* @__PURE__ */ __name(() => CredentialRefreshFailureCodeValidator, "CredentialRefreshFailureCodeValidator"),
+      CredentialRefreshResponseEnvelopeValidator: /* @__PURE__ */ __name(() => CredentialRefreshResponseEnvelopeValidator, "CredentialRefreshResponseEnvelopeValidator"),
+      CredentialRefreshResultValidator: /* @__PURE__ */ __name(() => CredentialRefreshResultValidator, "CredentialRefreshResultValidator"),
+      CredentialRefreshSigningModeValidator: /* @__PURE__ */ __name(() => CredentialRefreshSigningModeValidator, "CredentialRefreshSigningModeValidator"),
+      CredentialRefreshUnchangedResultValidator: /* @__PURE__ */ __name(() => CredentialRefreshUnchangedResultValidator, "CredentialRefreshUnchangedResultValidator"),
+      CredentialRefreshUnsupportedResultValidator: /* @__PURE__ */ __name(() => CredentialRefreshUnsupportedResultValidator, "CredentialRefreshUnsupportedResultValidator"),
+      CredentialRefreshUpdatedResultValidator: /* @__PURE__ */ __name(() => CredentialRefreshUpdatedResultValidator, "CredentialRefreshUpdatedResultValidator"),
+      CredentialRefreshVersionMetadataValidator: /* @__PURE__ */ __name(() => CredentialRefreshVersionMetadataValidator, "CredentialRefreshVersionMetadataValidator"),
       CredentialSchemaValidator: /* @__PURE__ */ __name(() => CredentialSchemaValidator, "CredentialSchemaValidator"),
       CredentialStatusValidator: /* @__PURE__ */ __name(() => CredentialStatusValidator, "CredentialStatusValidator"),
       CredentialSubjectValidator: /* @__PURE__ */ __name(() => CredentialSubjectValidator, "CredentialSubjectValidator"),
@@ -165,6 +177,8 @@ var require_types_cjs_development = __commonJS({
       GeoCoordinatesValidator: /* @__PURE__ */ __name(() => GeoCoordinatesValidator, "GeoCoordinatesValidator"),
       GetCounterEventValidator: /* @__PURE__ */ __name(() => GetCounterEventValidator, "GetCounterEventValidator"),
       GetCountersEventValidator: /* @__PURE__ */ __name(() => GetCountersEventValidator, "GetCountersEventValidator"),
+      GetCredentialRefreshHistoryInputValidator: /* @__PURE__ */ __name(() => GetCredentialRefreshHistoryInputValidator, "GetCredentialRefreshHistoryInputValidator"),
+      GetCredentialRefreshHistoryResultValidator: /* @__PURE__ */ __name(() => GetCredentialRefreshHistoryResultValidator, "GetCredentialRefreshHistoryResultValidator"),
       GetFullSkillTreeInputValidator: /* @__PURE__ */ __name(() => GetFullSkillTreeInputValidator, "GetFullSkillTreeInputValidator"),
       GetFullSkillTreeResultValidator: /* @__PURE__ */ __name(() => GetFullSkillTreeResultValidator, "GetFullSkillTreeResultValidator"),
       GetSkillPathInputValidator: /* @__PURE__ */ __name(() => GetSkillPathInputValidator, "GetSkillPathInputValidator"),
@@ -189,6 +203,7 @@ var require_types_cjs_development = __commonJS({
       JWEValidator: /* @__PURE__ */ __name(() => JWEValidator2, "JWEValidator"),
       JWKValidator: /* @__PURE__ */ __name(() => JWKValidator, "JWKValidator"),
       JWKWithPrivateKeyValidator: /* @__PURE__ */ __name(() => JWKWithPrivateKeyValidator, "JWKWithPrivateKeyValidator"),
+      JweCredentialRefreshEnvelopeValidator: /* @__PURE__ */ __name(() => JweCredentialRefreshEnvelopeValidator, "JweCredentialRefreshEnvelopeValidator"),
       KnownAchievementTypeValidator: /* @__PURE__ */ __name(() => KnownAchievementTypeValidator, "KnownAchievementTypeValidator"),
       LCNAuthedProfileValidator: /* @__PURE__ */ __name(() => LCNAuthedProfileValidator, "LCNAuthedProfileValidator"),
       LCNBoostClaimLinkOptionsValidator: /* @__PURE__ */ __name(() => LCNBoostClaimLinkOptionsValidator, "LCNBoostClaimLinkOptionsValidator"),
@@ -226,7 +241,9 @@ var require_types_cjs_development = __commonJS({
       LCNSigningAuthorityValidator: /* @__PURE__ */ __name(() => LCNSigningAuthorityValidator, "LCNSigningAuthorityValidator"),
       LCNVisibleProfileValidator: /* @__PURE__ */ __name(() => LCNVisibleProfileValidator, "LCNVisibleProfileValidator"),
       LaunchTypeValidator: /* @__PURE__ */ __name(() => LaunchTypeValidator, "LaunchTypeValidator"),
+      LearnCardRefreshAuthorizationValidator: /* @__PURE__ */ __name(() => LearnCardRefreshAuthorizationValidator, "LearnCardRefreshAuthorizationValidator"),
       LinkProviderFrameworkInputValidator: /* @__PURE__ */ __name(() => LinkProviderFrameworkInputValidator, "LinkProviderFrameworkInputValidator"),
+      ManagedCredentialRefreshServiceValidator: /* @__PURE__ */ __name(() => ManagedCredentialRefreshServiceValidator, "ManagedCredentialRefreshServiceValidator"),
       PaginatedAppStoreListingsValidator: /* @__PURE__ */ __name(() => PaginatedAppStoreListingsValidator, "PaginatedAppStoreListingsValidator"),
       PaginatedBoostRecipientsValidator: /* @__PURE__ */ __name(() => PaginatedBoostRecipientsValidator, "PaginatedBoostRecipientsValidator"),
       PaginatedBoostRecipientsWithChildrenValidator: /* @__PURE__ */ __name(() => PaginatedBoostRecipientsWithChildrenValidator, "PaginatedBoostRecipientsWithChildrenValidator"),
@@ -256,6 +273,12 @@ var require_types_cjs_development = __commonJS({
       ProfileVisibilityEnum: /* @__PURE__ */ __name(() => ProfileVisibilityEnum, "ProfileVisibilityEnum"),
       PromotionLevelValidator: /* @__PURE__ */ __name(() => PromotionLevelValidator, "PromotionLevelValidator"),
       ProofValidator: /* @__PURE__ */ __name(() => ProofValidator, "ProofValidator"),
+      PublicCredentialRefreshEnvelopeValidator: /* @__PURE__ */ __name(() => PublicCredentialRefreshEnvelopeValidator, "PublicCredentialRefreshEnvelopeValidator"),
+      PublishCredentialRefreshInputValidator: /* @__PURE__ */ __name(() => PublishCredentialRefreshInputValidator, "PublishCredentialRefreshInputValidator"),
+      PublishCredentialRefreshNotificationValidator: /* @__PURE__ */ __name(() => PublishCredentialRefreshNotificationValidator, "PublishCredentialRefreshNotificationValidator"),
+      PublishCredentialRefreshResultValidator: /* @__PURE__ */ __name(() => PublishCredentialRefreshResultValidator, "PublishCredentialRefreshResultValidator"),
+      PublishIssuerSignedRefreshValidator: /* @__PURE__ */ __name(() => PublishIssuerSignedRefreshValidator, "PublishIssuerSignedRefreshValidator"),
+      PublishSigningAuthorityRefreshValidator: /* @__PURE__ */ __name(() => PublishSigningAuthorityRefreshValidator, "PublishSigningAuthorityRefreshValidator"),
       RefreshServiceValidator: /* @__PURE__ */ __name(() => RefreshServiceValidator, "RefreshServiceValidator"),
       RegExpValidator: /* @__PURE__ */ __name(() => RegExpValidator, "RegExpValidator"),
       RelatedValidator: /* @__PURE__ */ __name(() => RelatedValidator, "RelatedValidator"),
@@ -296,11 +319,13 @@ var require_types_cjs_development = __commonJS({
       SkillTreeNodeInputValidator: /* @__PURE__ */ __name(() => SkillTreeNodeInputValidator, "SkillTreeNodeInputValidator"),
       SkillTreeNodeValidator: /* @__PURE__ */ __name(() => SkillTreeNodeValidator, "SkillTreeNodeValidator"),
       SkillValidator: /* @__PURE__ */ __name(() => SkillValidator, "SkillValidator"),
+      StandardCredentialRefreshServiceValidator: /* @__PURE__ */ __name(() => StandardCredentialRefreshServiceValidator, "StandardCredentialRefreshServiceValidator"),
       StatusCheckEntryValidator: /* @__PURE__ */ __name(() => StatusCheckEntryValidator, "StatusCheckEntryValidator"),
       StoredCredentialEnvelopeValidator: /* @__PURE__ */ __name(() => StoredCredentialEnvelopeValidator, "StoredCredentialEnvelopeValidator"),
       StringQuery: /* @__PURE__ */ __name(() => StringQuery, "StringQuery"),
       SummaryCredentialDataValidator: /* @__PURE__ */ __name(() => SummaryCredentialDataValidator, "SummaryCredentialDataValidator"),
       SummaryCredentialKeywordValidator: /* @__PURE__ */ __name(() => SummaryCredentialKeywordValidator, "SummaryCredentialKeywordValidator"),
+      SupportedCredentialRefreshServiceValidator: /* @__PURE__ */ __name(() => SupportedCredentialRefreshServiceValidator2, "SupportedCredentialRefreshServiceValidator"),
       SyncFrameworkInputValidator: /* @__PURE__ */ __name(() => SyncFrameworkInputValidator, "SyncFrameworkInputValidator"),
       TagValidator: /* @__PURE__ */ __name(() => TagValidator, "TagValidator"),
       TemplateRenderMethodValidator: /* @__PURE__ */ __name(() => TemplateRenderMethodValidator, "TemplateRenderMethodValidator"),
@@ -16504,7 +16529,10 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       webhookUrl: external_exports.string().url().optional().describe("Webhook URL to receive claim notifications"),
       suppressDelivery: external_exports.boolean().optional().describe("If true, returns claimUrl without sending email/SMS"),
       branding: SendBrandingOptionsValidator.optional().describe("Branding for email/SMS delivery"),
-      guardianEmail: external_exports.string().email().optional().describe("Guardian email that must approve before student can claim")
+      guardianEmail: external_exports.string().email().optional().describe("Guardian email that must approve before student can claim"),
+      expiresInDays: external_exports.number().int().min(1).max(720).optional().describe(
+        "How many days the credential stays claimable in the Universal Inbox (default 30). Does not change the credential validity period."
+      )
     });
     var SendBoostInputValidator = external_exports.object({
       type: external_exports.literal("boost"),
@@ -16799,7 +16827,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       "APP_NOTIFICATION",
       "CREDENTIAL_REVOKED",
       "CREDENTIAL_SUSPENDED",
-      "CREDENTIAL_UNSUSPENDED"
+      "CREDENTIAL_UNSUSPENDED",
+      "CREDENTIAL_REFRESHED"
     ]);
     var LCNNotificationMessageValidator = external_exports.object({
       title: external_exports.string().optional(),
@@ -16931,12 +16960,16 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
     });
     var InboxCredentialValidator = external_exports.object({
       id: external_exports.string(),
-      credential: external_exports.string(),
+      credential: external_exports.string().optional(),
       isSigned: external_exports.boolean(),
       currentStatus: LCNInboxStatusEnumValidator,
       isAccepted: external_exports.boolean().optional(),
       expiresAt: external_exports.string(),
       createdAt: external_exports.string(),
+      finalizedAt: external_exports.string().optional(),
+      expiredAt: external_exports.string().optional(),
+      credentialName: external_exports.string().optional(),
+      achievementType: external_exports.string().optional(),
       issuerDid: external_exports.string(),
       webhookUrl: external_exports.string().optional(),
       boostUri: external_exports.string().optional(),
@@ -16990,7 +17023,9 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
           "The signing authority to use for the credential. If not provided, the users default signing authority will be used if the credential is not signed."
         ),
         webhookUrl: external_exports.string().url().optional().describe("The webhook URL to receive credential issuance events."),
-        expiresInDays: external_exports.number().min(1).max(365).optional().describe("The number of days the credential will be valid for."),
+        expiresInDays: external_exports.number().int().min(1).max(720).optional().describe(
+          "How many days the encrypted inbox payload remains claimable. This does not change the credential validity period."
+        ),
         templateData: external_exports.record(external_exports.string(), external_exports.unknown()).optional().describe(
           "Template data to render into the boost credential template using Mustache syntax. Only used when boostUri is provided."
         ),
@@ -17053,6 +17088,9 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       credential: VCValidator.or(VPValidator).or(UnsignedVCValidator).or(CredentialNameRefValidator).describe("The credential to issue, or a { name } reference to resolve a boost template."),
       configuration: external_exports.object({
         publishableKey: external_exports.string(),
+        expiresInDays: external_exports.number().int().min(1).max(720).optional().describe(
+          "Inbox claim window in days. Defaults to 720; use a shorter window for sensitive records."
+        ),
         signingAuthorityName: external_exports.string().optional(),
         listingId: external_exports.string().optional(),
         listingSlug: external_exports.string().optional()
@@ -17690,6 +17728,191 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       const result = inAppMessagesFlagValidator.safeParse(raw);
       return result.success ? result.data : EMPTY_IN_APP_MESSAGES_FLAG;
     }, "parseInAppMessagesFlag");
+    var LearnCardRefreshAuthorizationValidator = external_exports.object({ type: external_exports.literal("LearnCardDIDAuth") }).catchall(external_exports.any());
+    var ManagedCredentialRefreshServiceValidator = external_exports.object({
+      id: external_exports.string().min(1),
+      type: external_exports.literal("LearnCardCredentialRefresh2026"),
+      authorization: LearnCardRefreshAuthorizationValidator.optional()
+    }).catchall(external_exports.any());
+    var StandardCredentialRefreshServiceValidator = external_exports.object({
+      id: external_exports.string().min(1),
+      type: external_exports.literal("1EdTechCredentialRefresh")
+    }).catchall(external_exports.any());
+    var SupportedCredentialRefreshServiceValidator2 = external_exports.union([
+      ManagedCredentialRefreshServiceValidator,
+      StandardCredentialRefreshServiceValidator
+    ]);
+    var AllocateCredentialRefreshInputValidator = external_exports.object({
+      holder: external_exports.object({
+        profileId: external_exports.string().optional(),
+        did: external_exports.string().min(1)
+      }),
+      credentialId: external_exports.string().min(1)
+    });
+    var AllocateCredentialRefreshResultValidator = external_exports.object({
+      refreshId: external_exports.string().min(1),
+      refreshService: ManagedCredentialRefreshServiceValidator.extend({
+        authorization: LearnCardRefreshAuthorizationValidator
+      })
+    });
+    var CredentialRefreshSigningModeValidator = external_exports.enum(["issuer-signed", "signing-authority"]);
+    var PublishCredentialRefreshBaseFields = {
+      refreshId: external_exports.string().min(1),
+      notifyHolder: external_exports.boolean().optional(),
+      updateSummary: external_exports.string().optional(),
+      idempotencyKey: external_exports.string().optional()
+    };
+    var PublishIssuerSignedRefreshValidator = external_exports.object({
+      ...PublishCredentialRefreshBaseFields,
+      mode: external_exports.literal("issuer-signed"),
+      signedCredential: VCValidator
+    });
+    var PublishSigningAuthorityRefreshValidator = external_exports.object({
+      ...PublishCredentialRefreshBaseFields,
+      mode: external_exports.literal("signing-authority"),
+      credential: UnsignedVCValidator,
+      signingAuthority: external_exports.object({
+        type: external_exports.string().min(1)
+      }).catchall(external_exports.any())
+    });
+    var PublishCredentialRefreshInputValidator = external_exports.object({
+      ...PublishCredentialRefreshBaseFields,
+      mode: CredentialRefreshSigningModeValidator,
+      signedCredential: VCValidator.optional(),
+      credential: UnsignedVCValidator.optional(),
+      signingAuthority: external_exports.object({
+        type: external_exports.string().min(1)
+      }).catchall(external_exports.any()).optional()
+    }).superRefine((input, ctx) => {
+      if (input.mode === "issuer-signed" && !input.signedCredential) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["signedCredential"],
+          message: "signedCredential is required for issuer-signed publication"
+        });
+      }
+      if (input.mode === "issuer-signed" && (input.credential !== void 0 || input.signingAuthority !== void 0)) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["mode"],
+          message: "issuer-signed publication cannot include signing-authority fields"
+        });
+      }
+      if (input.mode === "signing-authority") {
+        if (input.signedCredential !== void 0) {
+          ctx.addIssue({
+            code: "custom",
+            path: ["signedCredential"],
+            message: "signing-authority publication cannot include signedCredential"
+          });
+        }
+        if (!input.credential) {
+          ctx.addIssue({
+            code: "custom",
+            path: ["credential"],
+            message: "credential is required for signing-authority publication"
+          });
+        }
+        if (!input.signingAuthority) {
+          ctx.addIssue({
+            code: "custom",
+            path: ["signingAuthority"],
+            message: "signingAuthority is required for signing-authority publication"
+          });
+        }
+      }
+    });
+    var PublishCredentialRefreshNotificationValidator = external_exports.enum([
+      "queued",
+      "suppressed",
+      "not-applicable",
+      /** Publication succeeded, but the post-commit notification enqueue must be retried. */
+      "delivery-failed"
+    ]);
+    var PublishCredentialRefreshResultValidator = external_exports.object({
+      refreshId: external_exports.string().min(1),
+      version: external_exports.number().int().positive(),
+      publishedAt: external_exports.string().min(1),
+      notification: PublishCredentialRefreshNotificationValidator
+    });
+    var CredentialRefreshVersionMetadataValidator = external_exports.object({
+      version: external_exports.number().int().positive(),
+      publishedAt: external_exports.string().min(1),
+      effectiveAt: external_exports.string().optional(),
+      etag: external_exports.string().optional(),
+      signingMode: CredentialRefreshSigningModeValidator.optional(),
+      updateSummary: external_exports.string().optional()
+    });
+    var GetCredentialRefreshHistoryInputValidator = external_exports.object({
+      refreshId: external_exports.string().min(1),
+      cursor: external_exports.string().optional(),
+      limit: external_exports.number().int().positive().optional()
+    });
+    var GetCredentialRefreshHistoryResultValidator = external_exports.object({
+      records: CredentialRefreshVersionMetadataValidator.array(),
+      hasMore: external_exports.boolean(),
+      cursor: external_exports.string().optional()
+    });
+    var CredentialRefreshChallengeValidator = external_exports.object({
+      challenge: external_exports.string().min(1),
+      expiresAt: external_exports.string().min(1),
+      domain: external_exports.string().optional(),
+      scheme: external_exports.literal("LearnCardDIDAuth").optional()
+    });
+    var PublicCredentialRefreshEnvelopeValidator = external_exports.object({
+      format: external_exports.literal("vc"),
+      credential: VCValidator,
+      etag: external_exports.string().optional()
+    });
+    var JweCredentialRefreshEnvelopeValidator = external_exports.object({
+      format: external_exports.literal("jwe"),
+      jwe: JWEValidator2,
+      etag: external_exports.string().optional(),
+      /** Present on LearnCard-managed endpoints; optional for interoperable JWE services. */
+      version: external_exports.number().int().positive().optional()
+    });
+    var CredentialRefreshResponseEnvelopeValidator = external_exports.discriminatedUnion("format", [
+      PublicCredentialRefreshEnvelopeValidator,
+      JweCredentialRefreshEnvelopeValidator
+    ]);
+    var CredentialRefreshFailureCodeValidator = external_exports.enum([
+      "UNAVAILABLE",
+      "TIMEOUT",
+      "UNSUPPORTED_SERVICE",
+      "UNAUTHORIZED",
+      "MALFORMED_RESPONSE",
+      "INVALID_PROOF",
+      "ISSUER_MISMATCH",
+      "ID_MISMATCH",
+      "ROLLBACK",
+      "REVOKED",
+      "UNSAFE_ENDPOINT"
+    ]);
+    var CredentialRefreshUpdatedResultValidator = external_exports.object({
+      status: external_exports.literal("updated"),
+      credential: VCValidator,
+      etag: external_exports.string().optional(),
+      managedVersion: external_exports.number().int().positive().optional()
+    });
+    var CredentialRefreshUnchangedResultValidator = external_exports.object({
+      status: external_exports.literal("unchanged"),
+      checkedAt: external_exports.string().min(1),
+      etag: external_exports.string().optional()
+    });
+    var CredentialRefreshUnsupportedResultValidator = external_exports.object({
+      status: external_exports.literal("unsupported")
+    });
+    var CredentialRefreshFailedResultValidator = external_exports.object({
+      status: external_exports.literal("failed"),
+      code: CredentialRefreshFailureCodeValidator,
+      retryable: external_exports.boolean()
+    });
+    var CredentialRefreshResultValidator = external_exports.discriminatedUnion("status", [
+      CredentialRefreshUpdatedResultValidator,
+      CredentialRefreshUnchangedResultValidator,
+      CredentialRefreshUnsupportedResultValidator,
+      CredentialRefreshFailedResultValidator
+    ]);
   }
 });
 
@@ -17706,7 +17929,7 @@ var require_dist = __commonJS({
 });
 
 // src/index.ts
-var import_types2 = __toESM(require_dist());
+var import_types3 = __toESM(require_dist());
 
 // src/images/filestack.helpers.ts
 var filestack_helpers_exports = {};
@@ -17915,11 +18138,21 @@ var generateSrcSet3 = /* @__PURE__ */ __name((url, resolutions, { fix = false }
 
 // src/images/images.helpers.ts
 var Providers = { filestack: filestack_helpers_exports, unsplash: unsplash_helpers_exports, discord: discord_helpers_exports };
+var isHostnameMatch = /* @__PURE__ */ __name((hostname, target) => {
+  return hostname === target || hostname.endsWith(`.${target}`);
+}, "isHostnameMatch");
 var getProvider = /* @__PURE__ */ __name((url) => {
-  if (url?.includes("cdn.filestackcontent.com")) return "filestack";
-  if (url?.includes("images.unsplash.com")) return "unsplash";
-  if (url?.includes("cdn.discordapp.com")) return "discord";
-  return null;
+  if (!url) return null;
+  try {
+    const normalizedUrl = url.startsWith("//") ? `https:${url}` : url;
+    const { hostname } = new URL(normalizedUrl);
+    if (isHostnameMatch(hostname, "cdn.filestackcontent.com")) return "filestack";
+    if (isHostnameMatch(hostname, "images.unsplash.com")) return "unsplash";
+    if (isHostnameMatch(hostname, "cdn.discordapp.com")) return "discord";
+    return null;
+  } catch {
+    return null;
+  }
 }, "getProvider");
 var changeQuality4 = /* @__PURE__ */ __name((url, quality) => {
   const provider = getProvider(url);
@@ -17950,6 +18183,30 @@ var getUrlsFromSrcSet = /* @__PURE__ */ __name((srcSet) => {
   }, []);
 }, "getUrlsFromSrcSet");
 
+// src/images/sanitize.helpers.ts
+var sanitizeImageUrl = /* @__PURE__ */ __name((url, options = {}) => {
+  if (!url) return void 0;
+  const { allowBlobUrls = false, allowDataUrls = false } = options;
+  try {
+    const parsed = new URL(url);
+    if (parsed.protocol === "https:" || parsed.protocol === "http:") {
+      return parsed.href;
+    }
+    if (allowBlobUrls && parsed.protocol === "blob:") {
+      return parsed.href;
+    }
+    if (allowDataUrls && parsed.protocol === "data:") {
+      if (url.startsWith("data:image/")) {
+        return url;
+      }
+      return void 0;
+    }
+    return void 0;
+  } catch {
+    return void 0;
+  }
+}, "sanitizeImageUrl");
+
 // src/types/index.ts
 var isNotMaybe = /* @__PURE__ */ __name((value) => value !== void 0 && value !== null, "isNotMaybe");
 var filterMaybes = /* @__PURE__ */ __name((array) => array?.filter(isNotMaybe) ?? [], "filterMaybes");
@@ -18518,6 +18775,53 @@ var inferW3cVersionFromContext = /* @__PURE__ */ __name((vc) => {
   return isV2 ? "w3c-vc-2.0" : "w3c-vc-1.1";
 }, "inferW3cVersionFromContext");
 
+// src/credential-refresh.ts
+var import_types2 = __toESM(require_dist());
+var getSupportedRefreshService = /* @__PURE__ */ __name((vc) => {
+  const refreshService = vc?.refreshService;
+  if (!refreshService) return void 0;
+  const services = Array.isArray(refreshService) ? refreshService : [refreshService];
+  for (const service of services) {
+    const parsed = import_types2.SupportedCredentialRefreshServiceValidator.safeParse(service);
+    if (parsed.success) return parsed.data;
+  }
+  return void 0;
+}, "getSupportedRefreshService");
+var getCredentialIssuerId = /* @__PURE__ */ __name((vc) => {
+  const issuer = vc?.issuer;
+  if (!issuer) return void 0;
+  if (typeof issuer === "string") return issuer;
+  return typeof issuer.id === "string" ? issuer.id : void 0;
+}, "getCredentialIssuerId");
+var getCredentialEffectiveTime = /* @__PURE__ */ __name((vc) => {
+  const raw = vc?.validFrom ?? vc?.issuanceDate;
+  if (typeof raw !== "string" || raw.length === 0) return void 0;
+  const parsed = Date.parse(raw);
+  return Number.isNaN(parsed) ? void 0 : parsed;
+}, "getCredentialEffectiveTime");
+var canonicalizeCredentialContent = /* @__PURE__ */ __name((value) => {
+  if (Array.isArray(value)) {
+    return value.map((entry) => canonicalizeCredentialContent(entry));
+  }
+  if (value !== null && typeof value === "object") {
+    const source = value;
+    const sorted = {};
+    for (const key of Object.keys(source).sort()) {
+      sorted[key] = canonicalizeCredentialContent(source[key]);
+    }
+    return sorted;
+  }
+  return value;
+}, "canonicalizeCredentialContent");
+var canonicalizeCredentialJson = /* @__PURE__ */ __name((value) => JSON.stringify(canonicalizeCredentialContent(value)), "canonicalizeCredentialJson");
+var credentialContentsEqual = /* @__PURE__ */ __name((first, second) => {
+  const stripProof = /* @__PURE__ */ __name((vc) => {
+    const { proof: _proof, ...rest } = vc ?? {};
+    return rest;
+  }, "stripProof");
+  return canonicalizeCredentialJson(stripProof(first)) === canonicalizeCredentialJson(stripProof(second));
+}, "credentialContentsEqual");
+
 // src/did.ts
 var getDidWeb = /* @__PURE__ */ __name((domain, profileId) => {
   let decodedDomain = domain;
@@ -18581,7 +18885,7 @@ var parseEnvironment = /* @__PURE__ */ __name((schema, raw, context) => {
 // src/index.ts
 var isHex = /* @__PURE__ */ __name((str) => /^[0-9a-f]+$/i.test(str), "isHex");
 var isEncrypted = /* @__PURE__ */ __name((item) => {
-  return import_types2.JWEValidator.safeParse(item).success;
+  return import_types3.JWEValidator.safeParse(item).success;
 }, "isEncrypted");
 var RegExpTransformer = {
   serialize(object) {
@@ -18634,9 +18938,12 @@ export {
   ImageWithLoadingStateValdator,
   RegExpTransformer,
   calculateAgeFromDob,
+  canonicalizeCredentialContent,
+  canonicalizeCredentialJson,
   capitalizeFirstLetter,
   changeQuality4 as changeQuality,
   checkAppInstallEligibility,
+  credentialContentsEqual,
   curriedArraySlice,
   curriedInnerImmerOuterImmer,
   curriedInnerImmerOuterReact,
@@ -18657,9 +18964,12 @@ export {
   getBitstringStatusListBit,
   getBitstringStatusListEntries,
   getBitstringStatusListEntryForPurpose,
+  getCredentialEffectiveTime,
+  getCredentialIssuerId,
   getCredentialStatusArray,
   getDidWeb,
   getProvider,
+  getSupportedRefreshService,
   getUrlsFromSrcSet,
   immerArraySlice,
   innerImmerOuterImmer,
@@ -18683,6 +18993,7 @@ export {
   requiredEnvironmentString,
   resizeAndChangeQuality4 as resizeAndChangeQuality,
   resolveStorageReadResult,
+  sanitizeImageUrl,
   setBitstringStatusListBit,
   stripSdJwtReservedClaims,
   synthesizeDidJwk,