@learncard/learn-cloud-plugin 2.3.50 → 2.3.52

package/dist/learn-cloud-plugin.cjs.development.cjs

@@ -27117,12 +27117,46 @@ var StringQuery = external_exports.union([
     $or: BaseStringQuery.array()
   })
 ]);
+var BITSTRING_STATUS_PURPOSES = ["revocation", "suspension"];
+var BitstringStatusPurposeValidator = external_exports.enum(BITSTRING_STATUS_PURPOSES);
+var BitstringStatusListEntryValidator = external_exports.object({
+  id: external_exports.string().optional(),
+  type: external_exports.literal("BitstringStatusListEntry"),
+  statusPurpose: BitstringStatusPurposeValidator,
+  statusListIndex: external_exports.string().or(external_exports.number().int().nonnegative()),
+  statusListCredential: external_exports.string()
+});
+var AllocatedBitstringStatusListEntryValidator = BitstringStatusListEntryValidator.extend({
+  id: external_exports.string()
+});
+var BitstringStatusListCredentialSubjectValidator = external_exports.object({
+  id: external_exports.string().optional(),
+  type: external_exports.literal("BitstringStatusList"),
+  statusPurpose: BitstringStatusPurposeValidator,
+  encodedList: external_exports.string()
+});
+var AllocateCredentialStatusInputValidator = external_exports.object({
+  statusPurposes: external_exports.array(BitstringStatusPurposeValidator).optional(),
+  listSize: external_exports.number().int().positive().optional()
+}).default({});
+var AttachCredentialRefreshStatusEntriesInputValidator = external_exports.object({
+  refreshId: external_exports.string().min(1),
+  credentialStatus: CredentialStatusValidator.or(CredentialStatusValidator.array()).nullable()
+});
 var LearnCardRefreshAuthorizationValidator = external_exports.object({ type: external_exports.literal("LearnCardDIDAuth") }).catchall(external_exports.any());
 var ManagedCredentialRefreshServiceValidator = external_exports.object({
   id: external_exports.string().min(1),
   type: external_exports.literal("LearnCardCredentialRefresh2026"),
   authorization: LearnCardRefreshAuthorizationValidator.optional()
 }).catchall(external_exports.any());
+var ManagedCredentialRefreshBindingValidator = ManagedCredentialRefreshServiceValidator.or(
+  RefreshServiceValidator.array().refine(
+    (services) => services.some(
+      (service) => ManagedCredentialRefreshServiceValidator.safeParse(service).success
+    ),
+    "A managed refresh service is required"
+  )
+);
 var StandardCredentialRefreshServiceValidator = external_exports.object({
   id: external_exports.string().min(1),
   type: external_exports.literal("1EdTechCredentialRefresh")
@@ -27146,7 +27180,9 @@ var AllocateCredentialRefreshResultValidator = external_exports.object({
 });
 var ManagedCredentialRefreshReceiptValidator = external_exports.object({
   refreshId: external_exports.string().min(1),
-  refreshService: ManagedCredentialRefreshServiceValidator,
+  refreshService: ManagedCredentialRefreshBindingValidator,
+  /** Legacy receipts authenticate only the allocated managed entry, not other services. */
+  refreshServiceBinding: external_exports.literal("managed-entry").optional(),
   credentialId: external_exports.string().min(1),
   issuerDid: external_exports.string().min(1),
   holderDid: external_exports.string().min(1),
@@ -27154,14 +27190,43 @@ var ManagedCredentialRefreshReceiptValidator = external_exports.object({
     CredentialStatusValidator.array()
   ).optional()
 }).strip();
+var GetCredentialRefreshReceiptInputValidator = external_exports.object({ uri: external_exports.string().min(1) });
+var CredentialRefreshReceiptValidator = ManagedCredentialRefreshReceiptValidator.extend({
+  encryptionMode: external_exports.enum(["network", "holder"])
+});
+var HolderEncryptedHandoffValidator = external_exports.object({
+  refreshId: external_exports.string().min(1),
+  credentialId: external_exports.string().min(1),
+  holderDid: external_exports.string().min(1),
+  issuerDid: external_exports.string().min(1),
+  credentialStatus: CredentialStatusValidator.or(CredentialStatusValidator.array()),
+  refreshService: ManagedCredentialRefreshBindingValidator.optional(),
+  jwe: JWEValidator
+}).strict();
+var SendHolderEncryptedRefreshableInputValidator = external_exports.object({
+  handoff: HolderEncryptedHandoffValidator,
+  idempotencyKey: external_exports.string().min(1).optional(),
+  boostUri: external_exports.string().optional(),
+  skipNotification: external_exports.boolean().optional()
+});
+var GetEncryptionRecipientsInputValidator = external_exports.object({ refreshId: external_exports.string().min(1) });
+var EncryptionRecipientsResultValidator = external_exports.object({
+  recipientKeyIds: external_exports.array(external_exports.string())
+});
 var InboxCredentialRefreshReceiptValidator = ManagedCredentialRefreshReceiptValidator.omit(
   { holderDid: true }
 ).extend({ holderDid: external_exports.string().min(1).optional() });
 var CredentialRefreshSigningModeValidator = external_exports.enum(["issuer-signed", "signing-authority"]);
+var CredentialRefreshUpdateReasonValidator = external_exports.enum(["corrected", "updated", "reissued"]);
 var PublishCredentialRefreshBaseFields = {
   refreshId: external_exports.string().min(1),
   notifyHolder: external_exports.boolean().optional(),
-  updateSummary: external_exports.string().optional(),
+  updateSummary: external_exports.string().max(280).optional().describe(
+    "Public legacy update summary. Do not include private claims; prefer updateReason."
+  ),
+  updateReason: CredentialRefreshUpdateReasonValidator.optional().describe(
+    "Public reason for this update"
+  ),
   idempotencyKey: external_exports.string().optional()
 };
 var PublishIssuerSignedRefreshValidator = external_exports.object({
@@ -27237,13 +27302,25 @@ var PublishCredentialRefreshResultValidator = external_exports.object({
   publishedAt: external_exports.string().min(1),
   notification: PublishCredentialRefreshNotificationValidator
 });
+var PublishHolderEncryptedRefreshInputValidator = external_exports.object({
+  handoff: HolderEncryptedHandoffValidator,
+  notify: external_exports.boolean(),
+  updateSummary: external_exports.string().max(280).optional().describe(
+    "Public legacy update summary. Do not include private claims; prefer updateReason."
+  ),
+  updateReason: CredentialRefreshUpdateReasonValidator.optional().describe(
+    "Public reason for this update"
+  ),
+  idempotencyKey: external_exports.string().optional()
+});
 var CredentialRefreshVersionMetadataValidator = external_exports.object({
   version: external_exports.number().int().positive(),
   publishedAt: external_exports.string().min(1),
   effectiveAt: external_exports.string().optional(),
   etag: external_exports.string().optional(),
   signingMode: CredentialRefreshSigningModeValidator.optional(),
-  updateSummary: external_exports.string().optional()
+  updateSummary: external_exports.string().optional(),
+  updateReason: CredentialRefreshUpdateReasonValidator.optional()
 });
 var GetCredentialRefreshHistoryInputValidator = external_exports.object({
   refreshId: external_exports.string().min(1),
@@ -27286,6 +27363,7 @@ var CredentialRefreshFailureCodeValidator = external_exports.enum([
   "INVALID_PROOF",
   "ISSUER_MISMATCH",
   "ID_MISMATCH",
+  "BINDING_MISMATCH",
   "ROLLBACK",
   "REVOKED",
   "UNSAFE_ENDPOINT"
@@ -27610,6 +27688,11 @@ var AutoBoostConfigValidator = external_exports.object({
     name: external_exports.string()
   })
 });
+var CredentialDisplayValidator = external_exports.object({
+  name: external_exports.string().trim().min(1).max(280).optional(),
+  category: external_exports.string().max(280).optional(),
+  image: external_exports.string().max(2048).url().refine((url2) => url2.startsWith("https://"), { message: "Image URL must use https" }).optional()
+});
 var SendBoostTemplateValidator = BoostValidator.partial().omit({ uri: true, claimPermissions: true }).extend({
   credential: VCValidator.or(UnsignedVCValidator),
   claimPermissions: BoostPermissionsValidator.partial().optional(),
@@ -27648,6 +27731,10 @@ var SendBoostInputValidator = external_exports.object({
   templateUri: external_exports.string().optional(),
   template: SendBoostTemplateValidator.optional(),
   signedCredential: VCValidator.optional(),
+  display: CredentialDisplayValidator.optional().describe(
+    "Public display metadata for managed and signed-only sends. Nothing is inferred from credential content; omitted names use generic copy. The exception is category: when display.category is omitted for an inline template, the template's category is copied, since consent-flow write authorization is keyed on it."
+  ),
+  statusPurposes: external_exports.array(BitstringStatusPurposeValidator).optional(),
   options: SendOptionsValidator.optional().describe(
     "Options for email/phone recipients (Universal Inbox)"
   ),
@@ -27686,7 +27773,10 @@ var SendInboxResponseValidator = external_exports.object({
     "Present when guardianEmail was specified"
   )
 });
+var StatusManagementValidator = external_exports.enum(["network", "external", "mixed", "none"]);
 var SendBoostResponseValidator = external_exports.object({
+  /** Public status providers for a managed send; external entries require provider-side updates. */
+  statusManagement: StatusManagementValidator.optional(),
   type: external_exports.literal("boost"),
   credentialUri: external_exports.string(),
   uri: external_exports.string(),
@@ -27699,19 +27789,33 @@ var SendBoostResponseValidator = external_exports.object({
   )
 });
 var PrepareRefreshableSendInputValidator = external_exports.object({
+  /** Opt in to signing the server-bound statusEntries; omission preserves client allocation. */
+  statusBinding: external_exports.literal("server").optional(),
+  statusPurposes: external_exports.array(BitstringStatusPurposeValidator).optional(),
   recipient: external_exports.string(),
   templateUri: external_exports.string().optional(),
   template: SendBoostTemplateValidator.optional(),
+  display: CredentialDisplayValidator.optional().describe("Public display metadata only"),
   contractUri: external_exports.string().optional(),
   templateData: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
   integrationId: external_exports.string().optional(),
   /** Credential ID to allocate for; generated server-side when omitted. */
   credentialId: external_exports.string().min(1).optional(),
-  idempotencyKey: external_exports.string().min(1).max(200).optional()
-}).refine((data) => Boolean(data.templateUri) !== Boolean(data.template), {
-  message: "Provide exactly one of templateUri or template."
+  idempotencyKey: external_exports.string().min(1).max(200).optional(),
+  /**
+   * `'holder'` requests student-only encryption (LC-2345): the SDK signs and
+   * encrypts locally and the server never receives plaintext. Requires a
+   * profile or DID recipient; rejected for signedCredential-only sends and for
+   * inbox (email/phone) recipients. Defaults to `'network'`.
+   */
+  encryption: external_exports.enum(["network", "holder"]).optional()
+}).refine((data) => !(data.templateUri && data.template), {
+  message: "Provide at most one of templateUri or template."
 });
 var PrepareRefreshableSendResultValidator = external_exports.object({
+  /** Public status providers known at preparation; final send reports the signed entries. */
+  statusManagement: StatusManagementValidator.optional(),
+  statusEntries: external_exports.array(BitstringStatusListEntryValidator).optional(),
   boostUri: external_exports.string(),
   credentialId: external_exports.string(),
   refreshId: external_exports.string(),
@@ -27719,11 +27823,110 @@ var PrepareRefreshableSendResultValidator = external_exports.object({
   /** The DID to use as credentialSubject.id (recipient DID, or the profile's did:web). */
   holderDid: external_exports.string(),
   /** Present when this idempotencyKey already completed: return it without signing. */
-  completed: SendBoostResponseValidator.optional()
+  completed: SendBoostResponseValidator.optional(),
+  /**
+   * Present only when `encryption: 'holder'` was requested: the exact
+   * key-agreement verification-method ids (holder + current managers) the SDK
+   * must encrypt to. Recomputed on every call, so a later manager change can
+   * make a previously-prepared set stale (see `credentialRefresh.sendHolderEncryptedRefreshable`
+   * and `credentialRefresh.getEncryptionRecipients`).
+   */
+  recipientKeyIds: external_exports.array(external_exports.string()).optional()
 });
 var SendInputValidator = external_exports.discriminatedUnion("type", [SendBoostInputValidator]);
 var SendResponseValidator = external_exports.discriminatedUnion("type", [SendBoostResponseValidator]);
-var ConsentFlowTermsStatusValidator = external_exports.enum(["live", "stale", "withdrawn"]);
+var ConsentFlowTermsStatusValidator = external_exports.enum([
+  "live",
+  "consumed",
+  "withdrawn",
+  "needs_reconsent",
+  "suspended"
+]);
+var ConsentFlowContractChangeKindValidator = external_exports.enum([
+  "relaxed",
+  "expanded_optional",
+  "requires_consent"
+]);
+var ConsentFlowContractScopeValidator = external_exports.object({
+  area: external_exports.enum(["read", "write"]),
+  type: external_exports.enum(["credential", "personal"]),
+  key: external_exports.string(),
+  required: external_exports.boolean(),
+  reason: external_exports.string().optional()
+});
+var ConsentFlowContractDetailValueValidator = external_exports.union([
+  external_exports.string(),
+  external_exports.boolean(),
+  external_exports.string().array()
+]);
+var ConsentFlowContractDetailChangeValidator = external_exports.object({
+  field: external_exports.enum([
+    "name",
+    "subtitle",
+    "description",
+    "reasonForAccessing",
+    "image",
+    "needsGuardianConsent",
+    "redirectUrl",
+    "frontDoorBoostUri",
+    "expiresAt",
+    "writers",
+    "autoboosts"
+  ]),
+  before: ConsentFlowContractDetailValueValidator.optional(),
+  after: ConsentFlowContractDetailValueValidator.optional()
+});
+var ConsentFlowContractDiffValidator = external_exports.object({
+  added: ConsentFlowContractScopeValidator.array(),
+  removed: ConsentFlowContractScopeValidator.array(),
+  changed: ConsentFlowContractScopeValidator.array(),
+  details: ConsentFlowContractDetailChangeValidator.array().optional()
+});
+var ConsentFlowContractUpdatePreviewValidator = external_exports.object({
+  headline: external_exports.string(),
+  subhead: external_exports.string(),
+  rows: external_exports.array(
+    external_exports.object({
+      scope: ConsentFlowContractScopeValidator,
+      change: external_exports.enum(["added", "removed", "changed"]),
+      label: external_exports.string(),
+      subtitle: external_exports.string()
+    })
+  ),
+  primaryLabel: external_exports.string()
+});
+var ConsentFlowContractStatusValidator = external_exports.enum(["active", "retired"]);
+var ConsentFlowContractVersionValidator = external_exports.object({
+  version: external_exports.number().int().positive(),
+  createdAt: external_exports.string(),
+  reason: external_exports.string().optional(),
+  kind: ConsentFlowContractChangeKindValidator.optional()
+});
+var ConsentFlowContractUpdateResultValidator = external_exports.object({
+  version: external_exports.number().int().positive(),
+  kind: ConsentFlowContractChangeKindValidator,
+  affectedUsers: external_exports.number().int().nonnegative(),
+  preview: ConsentFlowContractUpdatePreviewValidator
+});
+var ConsentFlowConsentStatusValidator = external_exports.object({
+  status: ConsentFlowTermsStatusValidator.or(external_exports.literal("not_consented")),
+  consentedVersion: external_exports.number().int().positive().optional(),
+  currentVersion: external_exports.number().int().positive(),
+  needsReconsent: external_exports.boolean(),
+  reviewUrl: external_exports.string().optional()
+});
+var ConsentFlowContractNotificationDataValidator = external_exports.object({
+  contractUri: external_exports.string(),
+  contractName: external_exports.string().optional(),
+  fromVersion: external_exports.number().int().positive(),
+  toVersion: external_exports.number().int().positive(),
+  kind: ConsentFlowContractChangeKindValidator,
+  reason: external_exports.string().optional(),
+  diff: ConsentFlowContractDiffValidator,
+  reconsentDeadline: external_exports.string().optional(),
+  reviewUrl: external_exports.string(),
+  preview: ConsentFlowContractUpdatePreviewValidator.optional()
+});
 var ConsentFlowContractValidator = external_exports.object({
   read: external_exports.object({
     anonymize: external_exports.boolean().optional(),
@@ -27732,13 +27935,18 @@ var ConsentFlowContractValidator = external_exports.object({
         external_exports.string(),
         external_exports.object({
           required: external_exports.boolean(),
-          defaultEnabled: external_exports.boolean().optional()
+          defaultEnabled: external_exports.boolean().optional(),
+          reason: external_exports.string().optional()
         })
       ).default({})
     }).prefault({ categories: {} }),
     personal: external_exports.record(
       external_exports.string(),
-      external_exports.object({ required: external_exports.boolean(), defaultEnabled: external_exports.boolean().optional() })
+      external_exports.object({
+        required: external_exports.boolean(),
+        defaultEnabled: external_exports.boolean().optional(),
+        reason: external_exports.string().optional()
+      })
     ).default({})
   }).prefault({ credentials: { categories: {} }, personal: {} }),
   write: external_exports.object({
@@ -27747,16 +27955,55 @@ var ConsentFlowContractValidator = external_exports.object({
         external_exports.string(),
         external_exports.object({
           required: external_exports.boolean(),
-          defaultEnabled: external_exports.boolean().optional()
+          defaultEnabled: external_exports.boolean().optional(),
+          reason: external_exports.string().optional()
         })
       ).default({})
     }).prefault({ categories: {} }),
     personal: external_exports.record(
       external_exports.string(),
-      external_exports.object({ required: external_exports.boolean(), defaultEnabled: external_exports.boolean().optional() })
+      external_exports.object({
+        required: external_exports.boolean(),
+        defaultEnabled: external_exports.boolean().optional(),
+        reason: external_exports.string().optional()
+      })
     ).default({})
   }).prefault({ credentials: { categories: {} }, personal: {} })
 });
+var ConsentFlowContractScopePatchValidator = external_exports.object({
+  required: external_exports.boolean(),
+  defaultEnabled: external_exports.boolean().optional(),
+  reason: external_exports.string().optional()
+}).nullable();
+var ConsentFlowContractChangesValidator = external_exports.object({
+  contract: external_exports.object({
+    read: external_exports.object({
+      anonymize: external_exports.boolean().optional(),
+      credentials: external_exports.object({
+        categories: external_exports.record(external_exports.string(), ConsentFlowContractScopePatchValidator).optional()
+      }).optional(),
+      personal: external_exports.record(external_exports.string(), ConsentFlowContractScopePatchValidator).optional()
+    }).optional(),
+    write: external_exports.object({
+      credentials: external_exports.object({
+        categories: external_exports.record(external_exports.string(), ConsentFlowContractScopePatchValidator).optional()
+      }).optional(),
+      personal: external_exports.record(external_exports.string(), ConsentFlowContractScopePatchValidator).optional()
+    }).optional()
+  }).optional(),
+  name: external_exports.string().optional(),
+  subtitle: external_exports.string().optional(),
+  description: external_exports.string().optional(),
+  reasonForAccessing: external_exports.string().optional(),
+  image: external_exports.string().optional(),
+  needsGuardianConsent: external_exports.boolean().optional(),
+  redirectUrl: external_exports.string().optional(),
+  frontDoorBoostUri: external_exports.string().optional(),
+  expiresAt: external_exports.string().nullable().optional(),
+  autoboosts: AutoBoostConfigValidator.array().optional(),
+  writers: external_exports.string().array().optional(),
+  recipients: external_exports.string().array().optional()
+});
 var ConsentFlowContractDetailsValidator = external_exports.object({
   contract: ConsentFlowContractValidator,
   owner: LCNProfileValidator,
@@ -27775,7 +28022,19 @@ var ConsentFlowContractDetailsValidator = external_exports.object({
   autoBoosts: external_exports.string().array().optional(),
   writers: external_exports.array(LCNProfileValidator).optional(),
   recipients: external_exports.array(LCNPublicProfileValidator.extend({ did: external_exports.string() })).optional(),
-  audienceVersion: external_exports.number().int().nonnegative().optional()
+  audienceVersion: external_exports.number().int().nonnegative().optional(),
+  version: external_exports.number().int().positive(),
+  status: ConsentFlowContractStatusValidator.optional(),
+  latestUpdate: external_exports.object({
+    fromVersion: external_exports.number().int().positive(),
+    toVersion: external_exports.number().int().positive(),
+    kind: ConsentFlowContractChangeKindValidator,
+    reason: external_exports.string().optional(),
+    diff: ConsentFlowContractDiffValidator,
+    reconsentDeadline: external_exports.string().optional(),
+    createdAt: external_exports.string(),
+    preview: ConsentFlowContractUpdatePreviewValidator
+  }).optional()
 });
 var ConsentFlowContractRequestStatusValidator = external_exports.enum(["pending", "accepted", "denied", "cancelled"]).nullable();
 var ConsentFlowContractRequestReadStatusValidator = external_exports.enum(["unseen", "seen"]).nullable();
@@ -27864,7 +28123,12 @@ var PaginatedConsentFlowTermsValidator = PaginationResponseValidator.extend({
     contract: ConsentFlowContractDetailsValidator,
     uri: external_exports.string(),
     consenter: LCNProfileValidator,
-    status: ConsentFlowTermsStatusValidator
+    status: ConsentFlowTermsStatusValidator,
+    consentedVersion: external_exports.number().int().positive(),
+    lastReviewedVersion: external_exports.number().int().positive().optional(),
+    reconsentDeadline: external_exports.string().optional(),
+    newOptionsUntil: external_exports.string().optional(),
+    cumulativeUpdate: ConsentFlowContractDetailsValidator.shape.latestUpdate
   }).array()
 });
 var ConsentFlowGuardianApprovalValidator = external_exports.object({
@@ -27940,7 +28204,8 @@ var ConsentFlowTransactionActionValidator = external_exports.enum([
   "update",
   "sync",
   "withdraw",
-  "write"
+  "write",
+  "reconsent"
 ]);
 var ConsentFlowTransactionsQueryValidator = external_exports.object({
   terms: ConsentFlowTermsQueryValidator.optional(),
@@ -27959,8 +28224,12 @@ var ConsentFlowTransactionValidator = external_exports.object({
   referral: ConsentFlowReferralValidator.optional(),
   id: external_exports.string(),
   action: ConsentFlowTransactionActionValidator,
+  kind: ConsentFlowContractChangeKindValidator.optional(),
   date: external_exports.string(),
-  uris: external_exports.string().array().optional()
+  uris: external_exports.string().array().optional(),
+  consentedVersion: external_exports.number().int().positive().optional(),
+  reconsentDeadline: external_exports.string().optional(),
+  newOptionsUntil: external_exports.string().optional()
 });
 var HolderExportConsentRecordValidator = external_exports.object({
   termsUri: external_exports.string(),
@@ -27968,6 +28237,10 @@ var HolderExportConsentRecordValidator = external_exports.object({
   contract: ConsentFlowContractDetailsValidator,
   terms: ConsentFlowTermsValidator,
   referral: ConsentFlowReferralValidator.optional(),
+  consentedVersion: external_exports.number().int().positive(),
+  reconsentDeadline: external_exports.string().optional(),
+  newOptionsUntil: external_exports.string().optional(),
+  cumulativeUpdate: ConsentFlowContractDetailsValidator.shape.latestUpdate,
   transactions: ConsentFlowTransactionValidator.array()
 });
 var HolderExportMetadataValidator = external_exports.object({
@@ -28028,10 +28301,12 @@ var LCNNotificationTypeEnumValidator = external_exports.enum([
   "GUARDIAN_APPROVED",
   "GUARDIAN_REJECTED",
   "APP_NOTIFICATION",
+  "ANNOUNCEMENT",
   "CREDENTIAL_REVOKED",
   "CREDENTIAL_SUSPENDED",
   "CREDENTIAL_UNSUSPENDED",
-  "CREDENTIAL_REFRESHED"
+  "CREDENTIAL_REFRESHED",
+  "CONSENT_FLOW_CONTRACT_UPDATED"
 ]);
 var LCNNotificationMessageValidator = external_exports.object({
   title: external_exports.string().optional(),
@@ -28060,12 +28335,26 @@ var LCNNotificationInboxValidator = external_exports.object({
   timestamp: external_exports.iso.datetime().optional()
 });
 var LCNNotificationMetadataValidator = external_exports.object({
-  connectionPrompt: LCNConnectionPromptMetadataValidator.optional()
+  connectionPrompt: LCNConnectionPromptMetadataValidator.optional(),
+  campaignId: external_exports.string().regex(/^[a-z0-9-]{3,64}$/).optional(),
+  campaignCreatedAt: external_exports.iso.datetime().optional(),
+  campaignHasInApp: external_exports.boolean().optional(),
+  campaignTestId: external_exports.uuid().optional()
 }).catchall(external_exports.unknown());
 var LCNNotificationDataValidator = external_exports.object({
   vcUris: external_exports.array(external_exports.string()).optional(),
   vpUris: external_exports.array(external_exports.string()).optional(),
   transaction: ConsentFlowTransactionValidator.optional(),
+  contractUri: external_exports.string().optional(),
+  contractName: external_exports.string().optional(),
+  fromVersion: external_exports.number().int().positive().optional(),
+  toVersion: external_exports.number().int().positive().optional(),
+  kind: ConsentFlowContractChangeKindValidator.optional(),
+  reason: external_exports.string().optional(),
+  diff: ConsentFlowContractDiffValidator.optional(),
+  reconsentDeadline: external_exports.string().optional(),
+  reviewUrl: external_exports.string().optional(),
+  preview: ConsentFlowContractUpdatePreviewValidator.optional(),
   inbox: LCNNotificationInboxValidator.optional(),
   metadata: LCNNotificationMetadataValidator.optional()
 }).loose();
@@ -29163,28 +29452,6 @@ var EscrowPinStatusValidator = external_exports.object({
    */
   wrongAttempts: external_exports.number().int().nonnegative().optional()
 });
-var BITSTRING_STATUS_PURPOSES = ["revocation", "suspension"];
-var BitstringStatusPurposeValidator = external_exports.enum(BITSTRING_STATUS_PURPOSES);
-var BitstringStatusListEntryValidator = external_exports.object({
-  id: external_exports.string().optional(),
-  type: external_exports.literal("BitstringStatusListEntry"),
-  statusPurpose: BitstringStatusPurposeValidator,
-  statusListIndex: external_exports.string().or(external_exports.number().int().nonnegative()),
-  statusListCredential: external_exports.string()
-});
-var AllocatedBitstringStatusListEntryValidator = BitstringStatusListEntryValidator.extend({
-  id: external_exports.string()
-});
-var BitstringStatusListCredentialSubjectValidator = external_exports.object({
-  id: external_exports.string().optional(),
-  type: external_exports.literal("BitstringStatusList"),
-  statusPurpose: BitstringStatusPurposeValidator,
-  encodedList: external_exports.string()
-});
-var AllocateCredentialStatusInputValidator = external_exports.object({
-  statusPurposes: external_exports.array(BitstringStatusPurposeValidator).optional(),
-  listSize: external_exports.number().int().positive().optional()
-}).default({});
 var isSafeInAppMessagePath = /* @__PURE__ */ __name2((path) => {
   let decoded = path;
   for (let depth = 0; depth < 5; depth += 1) {
@@ -29465,24 +29732,46 @@ var inAppMessagesFlagEnvelopeValidator = external_exports.object({
 }).passthrough();
 var CampaignIdValidator = external_exports.string().regex(/^[a-z0-9-]{3,64}$/);
 var CampaignStatusValidator = external_exports.enum(["draft", "live", "paused", "archived"]);
-var CampaignChannelValidator = external_exports.enum(["inApp", "notify"]);
+var CampaignChannelValidator = external_exports.enum(["inApp", "notify", "email"]);
 var CampaignEventValidator = external_exports.enum(["shown", "clicked", "dismissed", "converted"]);
-var timestamp = external_exports.iso.datetime({ offset: true }).overwrite((value) => new Date(value).toISOString());
+var timestamp = external_exports.iso.datetime({ offset: true }).overwrite((value) => {
+  const date5 = new Date(value);
+  return Number.isFinite(date5.getTime()) ? date5.toISOString() : value;
+});
 var notification = external_exports.object({ title: external_exports.string().min(1), body: external_exports.string().min(1) }).strict();
-var channels = external_exports.array(CampaignChannelValidator).min(1).max(2).refine((values) => new Set(values).size === values.length, "Channels must be unique");
+var CampaignEmailValidator = external_exports.object({
+  subject: external_exports.string().trim().min(1).max(200).regex(/^[^\r\n]+$/),
+  title: external_exports.string().trim().min(1).max(200),
+  body: external_exports.string().trim().min(1).max(2e4),
+  heroImageUrl: external_exports.url().startsWith("https://").max(2048).optional(),
+  ctaLabel: external_exports.string().trim().min(1).max(100)
+}).strict();
+var AnnouncementPreferencesValidator = external_exports.object({
+  announcementEmailOptOut: external_exports.boolean(),
+  announcementPushOptOut: external_exports.boolean()
+}).strict();
+var channels = external_exports.array(CampaignChannelValidator).min(1).max(3).refine((values) => new Set(values).size === values.length, "Channels must be unique");
 var campaignDefinition = external_exports.object({
   id: CampaignIdValidator,
   name: external_exports.string().trim().min(1).max(200),
   status: CampaignStatusValidator.default("draft"),
   channels,
-  message: inAppMessageValidator,
+  message: inAppMessageValidator.optional(),
   notification: notification.optional(),
+  email: CampaignEmailValidator.optional(),
   startsAt: timestamp.optional(),
   endsAt: timestamp.optional(),
   excludeMinors: external_exports.boolean().default(true),
   selfEnroll: external_exports.boolean().default(false)
 }).strict();
 var validDefinition = /* @__PURE__ */ __name2((value, ctx) => {
+  if (value.channels.includes("inApp") && !value.message) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["message"],
+      message: "In-app requires a message"
+    });
+  }
   if (value.channels.includes("notify") && !value.notification) {
     ctx.addIssue({
       code: "custom",
@@ -29490,15 +29779,23 @@ var validDefinition = /* @__PURE__ */ __name2((value, ctx) => {
       message: "Notify requires a title and body"
     });
   }
+  if (value.channels.includes("email") && !value.email) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["email"],
+      message: "Email requires announcement content"
+    });
+  }
   if (value.startsAt && value.endsAt && value.startsAt >= value.endsAt) {
     ctx.addIssue({ code: "custom", path: ["endsAt"], message: "End must be after start" });
   }
 }, "validDefinition");
 var CampaignValidator = campaignDefinition.extend({
+  tenantId: external_exports.string().optional(),
   createdAt: timestamp,
   updatedAt: timestamp
 }).superRefine(validDefinition).superRefine((value, ctx) => {
-  if (value.message.id !== value.id) {
+  if (value.message && value.message.id !== value.id) {
     ctx.addIssue({
       code: "custom",
       path: ["message", "id"],
@@ -29507,21 +29804,23 @@ var CampaignValidator = campaignDefinition.extend({
   }
 });
 var CreateCampaignInputValidator = campaignDefinition.extend({
-  message: inAppMessageAuthoringValidator
+  message: inAppMessageAuthoringValidator.optional()
 }).superRefine(validDefinition);
 var CampaignUpdatesValidator = campaignDefinition.omit({ id: true }).partial().extend({
   // A PATCH must not apply creation defaults to fields the caller omitted.
   status: CampaignStatusValidator.optional(),
   excludeMinors: external_exports.boolean().optional(),
   selfEnroll: external_exports.boolean().optional(),
-  message: inAppMessageAuthoringValidator.optional(),
+  message: inAppMessageAuthoringValidator.nullable().optional(),
   notification: notification.nullable().optional(),
+  email: CampaignEmailValidator.nullable().optional(),
   startsAt: timestamp.nullable().optional(),
   endsAt: timestamp.nullable().optional()
 }).strict();
 var UpdateCampaignInputValidator = external_exports.object({
   campaignId: CampaignIdValidator,
-  updates: CampaignUpdatesValidator
+  updates: CampaignUpdatesValidator,
+  expectedUpdatedAt: timestamp.optional()
 }).strict();
 var identifier = external_exports.string().trim().min(1).max(2048);
 var metadataKey = external_exports.string().regex(/^[a-zA-Z_][a-zA-Z0-9_.-]{0,63}$/).refine(
@@ -29573,7 +29872,8 @@ var CampaignUserStateValidator = external_exports.object({
   clickedAt: timestamp.optional(),
   dismissedAt: timestamp.optional(),
   convertedAt: timestamp.optional(),
-  notifiedAt: timestamp.optional()
+  notifiedAt: timestamp.optional(),
+  emailedAt: timestamp.optional()
 });
 var MyCampaignValidator = external_exports.object({
   campaign: campaignDefinition.pick({
@@ -29582,12 +29882,19 @@ var MyCampaignValidator = external_exports.object({
     startsAt: true,
     endsAt: true,
     selfEnroll: true
-  }),
-  state: CampaignUserStateValidator
+  }).extend({ message: inAppMessageValidator }),
+  state: CampaignUserStateValidator,
+  testId: external_exports.uuid().optional()
+});
+var CampaignTestValidator = external_exports.object({
+  id: external_exports.uuid(),
+  campaignId: CampaignIdValidator,
+  message: inAppMessageValidator
 });
 var CampaignStatsValidator = external_exports.object({
   audience: external_exports.number().int().nonnegative(),
   notified: external_exports.number().int().nonnegative(),
+  emailed: external_exports.number().int().nonnegative(),
   shown: external_exports.number().int().nonnegative(),
   clicked: external_exports.number().int().nonnegative(),
   dismissed: external_exports.number().int().nonnegative(),
@@ -29614,6 +29921,31 @@ var PaginatedCampaignAudienceValidator = external_exports.object({
   hasMore: external_exports.boolean(),
   cursor: external_exports.string().optional()
 });
+var CampaignDispatchPreviewValidator = external_exports.object({
+  campaignId: CampaignIdValidator,
+  audienceCount: external_exports.number().int().nonnegative(),
+  alreadyNotifiedCount: external_exports.number().int().nonnegative(),
+  recipientCount: external_exports.number().int().nonnegative(),
+  notificationRecipientCount: external_exports.number().int().nonnegative().optional(),
+  emailRecipientCount: external_exports.number().int().nonnegative().optional(),
+  previewToken: external_exports.string().regex(/^[a-f0-9]{64}$/),
+  blockedReason: external_exports.enum([
+    "not_live",
+    "notify_disabled",
+    "email_confirmation_required",
+    "not_started",
+    "ended",
+    "no_recipients"
+  ]).optional()
+});
+var CampaignDispatchOptionsValidator = external_exports.object({
+  expectedPreviewToken: CampaignDispatchPreviewValidator.shape.previewToken.optional()
+}).strict();
+var CampaignAudienceResultValidator = external_exports.object({
+  count: external_exports.number().int().nonnegative(),
+  added: external_exports.number().int().nonnegative(),
+  notFound: external_exports.array(external_exports.string())
+});
 var SHARE_LINK_ID_BYTES = 16;
 var SHARE_CONTENT_KEY_BYTES = 32;
 var SHARE_IV_BYTES = 12;
@@ -30137,6 +30469,217 @@ var SkillIconNamesValidator = external_exports.array(external_exports.string().n
   }
 );
 var GenerateSkillIconsInputValidator = external_exports.object({ names: SkillIconNamesValidator });
+var RoleValidator = external_exports.enum(["user", "assistant", "tool", "system"]);
+var AiSessionMode = {
+  tutor: "ai-tutor",
+  insights: "ai-insights"
+};
+var AiSessionModeValidator = external_exports.enum([AiSessionMode.tutor, AiSessionMode.insights]);
+var StructuredResponseValidator = external_exports.object({
+  notes: external_exports.string().optional(),
+  questions: external_exports.array(external_exports.string())
+});
+var IntroStreamModeValidator = external_exports.enum(["formatted", "structured"]);
+var ChatMessageValidator = external_exports.object({
+  role: RoleValidator,
+  content: external_exports.string().nullable(),
+  tool_call_id: external_exports.string().optional(),
+  tool_calls: external_exports.array(
+    external_exports.object({
+      id: external_exports.string(),
+      type: external_exports.literal("function"),
+      function: external_exports.object({
+        name: external_exports.string(),
+        arguments: external_exports.string()
+      })
+    })
+  ).optional()
+});
+var InsightArtifactValidator = external_exports.object({
+  title: external_exports.string(),
+  summary: external_exports.string(),
+  category: external_exports.string(),
+  question: external_exports.string(),
+  narrative: external_exports.string()
+});
+var ArtifactSuggestionValidator = external_exports.object({
+  artifact: InsightArtifactValidator,
+  source_text: external_exports.string().optional(),
+  created_at: external_exports.string()
+});
+var ThreadCredentialContextValidator = external_exports.object({
+  uri: external_exports.string(),
+  type: external_exports.string(),
+  context: external_exports.string(),
+  score: external_exports.number(),
+  strongestScore: external_exports.number().optional(),
+  averageScore: external_exports.number().optional(),
+  matchCount: external_exports.number().optional(),
+  title: external_exports.string().optional()
+});
+var ThreadValidator = external_exports.object({
+  id: external_exports.string(),
+  did: external_exports.string(),
+  topicCredentialUri: external_exports.string().nullable().optional(),
+  title: external_exports.string(),
+  created_at: external_exports.string(),
+  last_message_at: external_exports.string(),
+  active: external_exports.boolean().optional(),
+  ended_at: external_exports.string().optional(),
+  plan_started_at: external_exports.string().optional(),
+  summaries: external_exports.array(
+    external_exports.object({
+      summary_data: external_exports.string(),
+      credential_uri: external_exports.string(),
+      created_at: external_exports.string()
+    })
+  ).optional(),
+  plans: external_exports.array(
+    external_exports.object({
+      plan_data: external_exports.string(),
+      created_at: external_exports.string(),
+      consentRevision: external_exports.string().optional()
+    })
+  ).optional(),
+  credentials: external_exports.array(ThreadCredentialContextValidator).optional(),
+  credentialSearchTopic: external_exports.string().optional(),
+  credentialContextStatus: external_exports.enum(["pending", "ready", "empty", "error"]).optional(),
+  mode: AiSessionModeValidator.optional(),
+  artifactSuggestions: external_exports.array(ArtifactSuggestionValidator).optional()
+});
+var CredentialVerificationMetadataValidator = external_exports.object({
+  credentialUri: external_exports.string(),
+  contentHash: external_exports.string().regex(/^[a-f0-9]{64}$/),
+  status: external_exports.enum(["valid", "invalid"]),
+  checkedAt: external_exports.string().datetime(),
+  verifier: external_exports.object({
+    name: external_exports.string(),
+    version: external_exports.string()
+  }),
+  verifiedPayload: external_exports.enum(["credential", "boostCredential"]),
+  checks: external_exports.array(external_exports.string()),
+  errors: external_exports.array(external_exports.string()),
+  warnings: external_exports.array(external_exports.string()),
+  provenance: external_exports.object({
+    source: external_exports.enum(["wallet", "generated"]),
+    retrievedAt: external_exports.string().datetime()
+  }),
+  consent: external_exports.object({
+    contractUri: external_exports.string(),
+    receiptId: external_exports.string().min(1),
+    grantedAt: external_exports.string().datetime().optional(),
+    updatedAt: external_exports.string().datetime(),
+    contractUpdatedAt: external_exports.string().min(1),
+    status: external_exports.literal("live"),
+    expiresAt: external_exports.string().datetime().optional(),
+    contractExpiresAt: external_exports.string().datetime().optional(),
+    categories: external_exports.array(external_exports.string()),
+    credentialUris: external_exports.array(external_exports.string()),
+    personalFields: external_exports.array(external_exports.string()),
+    purpose: external_exports.enum(["credential-ingestion", "model-inference", "embedding"]),
+    revision: external_exports.string().min(1),
+    guardian: external_exports.object({ required: external_exports.boolean(), approved: external_exports.boolean() })
+  })
+});
+var ModelSafeCredentialFactValidator = external_exports.object({
+  kind: external_exports.enum([
+    "skill",
+    "goal",
+    "achievement",
+    "course",
+    "experience",
+    "competency",
+    "title",
+    "summary",
+    "assessment",
+    "grade",
+    "date",
+    "alignment",
+    "criteria",
+    "pathway",
+    "topic"
+  ]),
+  value: external_exports.string().min(1).max(240),
+  label: external_exports.string().min(1).max(120).optional()
+});
+var ModelSafeCredentialProjectionValidator = external_exports.object({
+  schemaVersion: external_exports.literal("1"),
+  category: external_exports.string().min(1).max(120),
+  credentialTypes: external_exports.array(external_exports.string().min(1).max(120)).max(20),
+  facts: external_exports.array(ModelSafeCredentialFactValidator).max(100),
+  // Present only on credentials that are past their expiry, so the model can
+  // tell a lapsed credential from a current one.
+  expired: external_exports.literal(true).optional(),
+  expirationDate: external_exports.string().datetime().optional()
+});
+var AIPassportCredentialRecordValidator = external_exports.object({
+  id: external_exports.string(),
+  uri: external_exports.string(),
+  category: external_exports.string(),
+  credential: VCValidator,
+  aiContext: external_exports.string(),
+  generalSummary: external_exports.string().optional(),
+  createdAt: external_exports.string(),
+  verification: CredentialVerificationMetadataValidator.optional(),
+  projection: ModelSafeCredentialProjectionValidator.optional()
+});
+var AuthenticatedMessageValidator = external_exports.object({
+  message: ChatMessageValidator.optional(),
+  threadId: external_exports.string().optional(),
+  selectedQuestion: external_exports.string().optional(),
+  action: external_exports.enum([
+    "start_topic",
+    "continue_plan",
+    "start_topic_uri",
+    "start_learning_pathway",
+    "start_insights_session",
+    "close_insights_session",
+    "artifact_suggestion"
+  ]).optional(),
+  topic: external_exports.string().optional(),
+  topicUri: external_exports.string().optional(),
+  pathwayUri: external_exports.string().optional(),
+  mode: AiSessionModeValidator.optional(),
+  introStreamMode: IntroStreamModeValidator.optional(),
+  // BCP-47 language for AI responses (LC-1901). This has to live on the
+  // validator, not just the inferred type — z.object strips unknown keys, so an
+  // undeclared `locale` would be dropped before the WS handler ever saw it.
+  locale: external_exports.string().nullish()
+});
+var DebugInfoValidator = external_exports.object({
+  operation: external_exports.string(),
+  collection: external_exports.string(),
+  input: external_exports.unknown().optional(),
+  output: external_exports.unknown().optional(),
+  timestamp: external_exports.string(),
+  duration: external_exports.number().optional()
+});
+var TimingEventValidator = external_exports.object({
+  event: external_exports.literal("timing"),
+  operation: external_exports.string(),
+  phase: external_exports.enum(["start", "end", "complete"]),
+  duration: external_exports.number().optional(),
+  metadata: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
+  timestamp: external_exports.string()
+});
+var LearningPathwayValidator = external_exports.object({
+  id: external_exports.string(),
+  learningPathway: external_exports.object({
+    stepIndex: external_exports.number(),
+    step: external_exports.object({
+      title: external_exports.string(),
+      description: external_exports.string(),
+      summary: external_exports.string(),
+      learned: external_exports.array(external_exports.string()),
+      skills: external_exports.array(
+        external_exports.object({
+          title: external_exports.string(),
+          description: external_exports.string()
+        })
+      )
+    })
+  })
+});
 
 // src/helpers.ts
 var import_json_stringify_deterministic = __toESM(require_lib(), 1);
@@ -30273,13 +30816,20 @@ var getLearnCloudPlugin = /* @__PURE__ */ __name(async (initialLearnCard, url2,
   }, "loadDids");
   const otherClients = /* @__PURE__ */ new Map();
   const learnCloudDids = /* @__PURE__ */ new WeakMap();
-  const getLearnCloudDid = /* @__PURE__ */ __name((currentClient) => {
+  const getLearnCloudDid = /* @__PURE__ */ __name(async (currentClient) => {
     let learnCloudDid = learnCloudDids.get(currentClient);
     if (!learnCloudDid) {
       learnCloudDid = currentClient.utilities.getDid.query();
       learnCloudDids.set(currentClient, learnCloudDid);
     }
-    return learnCloudDid;
+    try {
+      return await learnCloudDid;
+    } catch (error62) {
+      if (learnCloudDids.get(currentClient) === learnCloudDid) {
+        learnCloudDids.delete(currentClient);
+      }
+      throw error62;
+    }
   }, "getLearnCloudDid");
   const getOtherClient = /* @__PURE__ */ __name(async (otherUrl, _learnCard) => {
     const key = `${_learnCard.id.did()}\0${otherUrl}`;
@@ -30626,6 +31176,8 @@ var getLearnCloudPlugin = /* @__PURE__ */ __name(async (initialLearnCard, url2,
         _learnCard.debug?.("LearnCloud index.getPaginated", query, paginationOptions);
         const options = {
           ...paginationOptions,
+          // JSON-persisted infinite-query page parameters may restore as null.
+          cursor: paginationOptions?.cursor ?? void 0,
           sort: ["newestFirst", "oldestFirst"].includes(paginationOptions?.sort ?? "") ? paginationOptions?.sort : void 0
         };
         if (!query) {