@learncard/learn-cloud-service 2.5.33 → 2.5.35

package/dist/models/ShareContent.d.ts

@@ -0,0 +1,160 @@
+import { z } from 'zod';
+import { type ShareEnvelope, type ShareOwnerRecovery } from '@learncard/types';
+export declare const SHARE_CONTENT_COLLECTION = "share_content";
+export declare const ShareContentNamespaceValidator: z.ZodString;
+export type ShareContentNamespace = z.infer<typeof ShareContentNamespaceValidator>;
+export declare const ShareContentOwnerProfileIdValidator: z.ZodString;
+export type ShareContentOwnerProfileId = z.infer<typeof ShareContentOwnerProfileIdValidator>;
+export declare const ShareContentObjectIdValidator: z.ZodString;
+export type ShareContentObjectId = z.infer<typeof ShareContentObjectIdValidator>;
+export declare const ShareContentOperationIdValidator: z.ZodString;
+export type ShareContentOperationId = z.infer<typeof ShareContentOperationIdValidator>;
+export declare const ShareContentVersionValidator: z.ZodNumber & z.ZodType<number, number, z.core.$ZodTypeInternals<number, number>>;
+export type ShareContentContentVersion = z.infer<typeof ShareContentVersionValidator>;
+export declare const ShareContentHashValidator: z.ZodString;
+export type ShareContentHash = z.infer<typeof ShareContentHashValidator>;
+export declare const ShareContentOwnerRecoveryValidator: z.ZodObject<{
+    protected: z.ZodString;
+    iv: z.ZodString;
+    ciphertext: z.ZodString;
+    tag: z.ZodString;
+    aad: z.ZodOptional<z.ZodString>;
+    recipients: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        header: z.ZodObject<{
+            alg: z.ZodString;
+            iv: z.ZodString;
+            tag: z.ZodString;
+            epk: z.ZodOptional<z.ZodObject<{
+                kty: z.ZodOptional<z.ZodString>;
+                crv: z.ZodOptional<z.ZodString>;
+                x: z.ZodOptional<z.ZodString>;
+                y: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+                n: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+                d: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+            }, z.core.$strip>>;
+            kid: z.ZodOptional<z.ZodString>;
+            apv: z.ZodOptional<z.ZodString>;
+            apu: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+        encrypted_key: z.ZodString;
+    }, z.core.$strip>>>;
+}, z.core.$strict>;
+export type ShareContentOwnerRecovery = z.infer<typeof ShareContentOwnerRecoveryValidator>;
+export declare const ShareContentObjectBindingValidator: z.ZodObject<{
+    namespace: z.ZodString;
+    ownerProfileId: z.ZodString;
+    shareId: z.ZodString;
+    contentVersion: z.ZodNumber & z.ZodType<number, number, z.core.$ZodTypeInternals<number, number>>;
+    objectId: z.ZodString;
+    operationId: z.ZodString;
+}, z.core.$strict>;
+export type ShareContentObjectBinding = z.infer<typeof ShareContentObjectBindingValidator>;
+export declare const ShareContentPutInputValidator: z.ZodObject<{
+    namespace: z.ZodString;
+    ownerProfileId: z.ZodString;
+    shareId: z.ZodString;
+    contentVersion: z.ZodNumber & z.ZodType<number, number, z.core.$ZodTypeInternals<number, number>>;
+    objectId: z.ZodString;
+    operationId: z.ZodString;
+    envelope: z.ZodObject<{
+        v: z.ZodLiteral<1>;
+        alg: z.ZodLiteral<"A256GCM">;
+        iv: z.ZodString;
+        ct: z.ZodString;
+    }, z.core.$strict>;
+    ownerEncryptedRecovery: z.ZodObject<{
+        protected: z.ZodString;
+        iv: z.ZodString;
+        ciphertext: z.ZodString;
+        tag: z.ZodString;
+        aad: z.ZodOptional<z.ZodString>;
+        recipients: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            header: z.ZodObject<{
+                alg: z.ZodString;
+                iv: z.ZodString;
+                tag: z.ZodString;
+                epk: z.ZodOptional<z.ZodObject<{
+                    kty: z.ZodOptional<z.ZodString>;
+                    crv: z.ZodOptional<z.ZodString>;
+                    x: z.ZodOptional<z.ZodString>;
+                    y: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+                    n: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+                    d: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+                }, z.core.$strip>>;
+                kid: z.ZodOptional<z.ZodString>;
+                apv: z.ZodOptional<z.ZodString>;
+                apu: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>;
+            encrypted_key: z.ZodString;
+        }, z.core.$strip>>>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type ShareContentPutInput = z.infer<typeof ShareContentPutInputValidator>;
+export declare const computeShareContentHash: (input: ShareContentPutInput) => string;
+export declare const computeSharePayloadHash: (input: Pick<ShareContentPutInput, "envelope" | "ownerEncryptedRecovery">) => string;
+export declare const measureShareContentPayload: (input: Pick<ShareContentPutInput, "envelope" | "ownerEncryptedRecovery">) => {
+    ciphertextBytes: number;
+    recoveryBytes: number;
+};
+export declare const MongoShareContentActiveValidator: z.ZodObject<{
+    namespace: z.ZodString;
+    ownerProfileId: z.ZodString;
+    shareId: z.ZodString;
+    contentVersion: z.ZodNumber & z.ZodType<number, number, z.core.$ZodTypeInternals<number, number>>;
+    objectId: z.ZodString;
+    operationId: z.ZodString;
+    kind: z.ZodLiteral<"active">;
+    contentHash: z.ZodString;
+    payloadHash: z.ZodString;
+    envelope: z.ZodObject<{
+        v: z.ZodLiteral<1>;
+        alg: z.ZodLiteral<"A256GCM">;
+        iv: z.ZodString;
+        ct: z.ZodString;
+    }, z.core.$strict>;
+    ownerEncryptedRecovery: z.ZodObject<{
+        protected: z.ZodString;
+        iv: z.ZodString;
+        ciphertext: z.ZodString;
+        tag: z.ZodString;
+        aad: z.ZodOptional<z.ZodString>;
+        recipients: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            header: z.ZodObject<{
+                alg: z.ZodString;
+                iv: z.ZodString;
+                tag: z.ZodString;
+                epk: z.ZodOptional<z.ZodObject<{
+                    kty: z.ZodOptional<z.ZodString>;
+                    crv: z.ZodOptional<z.ZodString>;
+                    x: z.ZodOptional<z.ZodString>;
+                    y: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+                    n: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+                    d: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+                }, z.core.$strip>>;
+                kid: z.ZodOptional<z.ZodString>;
+                apv: z.ZodOptional<z.ZodString>;
+                apu: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>;
+            encrypted_key: z.ZodString;
+        }, z.core.$strip>>>;
+    }, z.core.$strict>;
+    ciphertextBytes: z.ZodNumber;
+    recoveryBytes: z.ZodNumber;
+    createdAt: z.ZodDate;
+}, z.core.$strict>;
+export type MongoShareContentActive = z.infer<typeof MongoShareContentActiveValidator>;
+export declare const MongoShareContentTombstoneValidator: z.ZodObject<{
+    namespace: z.ZodString;
+    ownerProfileId: z.ZodString;
+    shareId: z.ZodString;
+    contentVersion: z.ZodNumber & z.ZodType<number, number, z.core.$ZodTypeInternals<number, number>>;
+    objectId: z.ZodString;
+    operationId: z.ZodString;
+    kind: z.ZodLiteral<"tombstone">;
+    contentHash: z.ZodOptional<z.ZodString>;
+    deletedAt: z.ZodDate;
+}, z.core.$strict>;
+export type MongoShareContentTombstone = z.infer<typeof MongoShareContentTombstoneValidator>;
+export type MongoShareContentDocument = MongoShareContentActive | MongoShareContentTombstone;
+export type { ShareEnvelope, ShareOwnerRecovery };
+//# sourceMappingURL=ShareContent.d.ts.map

package/dist/models/ShareContent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ShareContent.d.ts","sourceRoot":"","sources":["../../src/models/ShareContent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAQH,KAAK,aAAa,EAClB,KAAK,kBAAkB,EAE1B,MAAM,kBAAkB,CAAC;AAkC1B,eAAO,MAAM,wBAAwB,kBAAkB,CAAC;AAWxD,eAAO,MAAM,8BAA8B,aAAgC,CAAC;AAC5E,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAGnF,eAAO,MAAM,mCAAmC,aAAqC,CAAC;AACtF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAG7F,eAAO,MAAM,6BAA6B,aAA+B,CAAC;AAC1E,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAGjF,eAAO,MAAM,gCAAgC,aAAkC,CAAC;AAChF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAGvF,eAAO,MAAM,4BAA4B,mFAEmD,CAAC;AAC7F,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAGtF,eAAO,MAAM,yBAAyB,aAEyD,CAAC;AAChG,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAQzE,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;kBAG9C,CAAC;AACF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAM3F,eAAO,MAAM,kCAAkC;;;;;;;kBASlC,CAAC;AACd,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAM3F,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAG/B,CAAC;AACZ,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAQjF,eAAO,MAAM,uBAAuB,GAAI,OAAO,oBAAoB,KAAG,MAUhE,CAAC;AAGP,eAAO,MAAM,uBAAuB,GAChC,OAAO,IAAI,CAAC,oBAAoB,EAAE,UAAU,GAAG,wBAAwB,CAAC,KACzE,MAIG,CAAC;AAMP,eAAO,MAAM,0BAA0B,GACnC,OAAO,IAAI,CAAC,oBAAoB,EAAE,UAAU,GAAG,wBAAwB,CAAC,KACzE;IAAE,eAAe,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAWlD,CAAC;AAGF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBASlC,CAAC;AACZ,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAOvF,eAAO,MAAM,mCAAmC;;;;;;;;;;kBAIrC,CAAC;AACZ,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAG7F,MAAM,MAAM,yBAAyB,GAAG,uBAAuB,GAAG,0BAA0B,CAAC;AAG7F,YAAY,EAAE,aAAa,EAAE,kBAAkB,EAAE,CAAC"}

package/dist/models/index.d.ts

@@ -1,5 +1,6 @@
 export * from './Credential';
 export * from './CredentialRecord';
 export * from './CustomDocument';
+export * from './ShareContent';
 export * from './User';
 //# sourceMappingURL=index.d.ts.map

package/dist/models/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/models/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,QAAQ,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/models/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,QAAQ,CAAC"}

package/dist/share-content/config.d.ts

@@ -0,0 +1,28 @@
+import { type ShareContentTrustConfig } from '../helpers/share-content-auth';
+import { type ShareContentPluginOptions } from './types';
+export type ShareContentNamespacePolicy = {
+    isAllowed: (serviceDid: string, namespace: string) => boolean;
+    allowedNamespacesFor: (serviceDid: string) => readonly string[];
+};
+export type ResolvedShareContentConfig = {
+    status: 'disabled';
+} | {
+    status: 'invalid';
+    errors: readonly string[];
+} | {
+    status: 'enabled';
+    trustConfig: ShareContentTrustConfig;
+    namespacePolicy: ShareContentNamespacePolicy;
+};
+export declare const parseShareContentNamespaceBindings: (value: unknown) => Map<string, readonly string[]> | null;
+export declare const resolveShareContentConfig: (raw: unknown) => ResolvedShareContentConfig;
+export declare const getShareContentRawConfig: (environment: {
+    SHARE_CONTENT_AUDIENCE?: string;
+    SHARE_CONTENT_SERVICE_DIDS?: string;
+    SHARE_CONTENT_VERIFICATION_METHODS?: string;
+    SHARE_CONTENT_NAMESPACE_BINDINGS?: string;
+}) => Record<string, unknown>;
+export declare const toShareContentPluginOptions: (config: Extract<ResolvedShareContentConfig, {
+    status: "enabled";
+}>, dependencies: Pick<ShareContentPluginOptions, "verifier" | "repository">) => ShareContentPluginOptions;
+//# sourceMappingURL=config.d.ts.map

package/dist/share-content/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/share-content/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAGH,KAAK,uBAAuB,EAC/B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAmC,KAAK,yBAAyB,EAAE,MAAM,SAAS,CAAC;AAY1F,MAAM,MAAM,2BAA2B,GAAG;IAEtC,SAAS,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;IAE9D,oBAAoB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,CAAC;CACnE,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAChC;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,GACtB;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAChD;IACI,MAAM,EAAE,SAAS,CAAC;IAClB,WAAW,EAAE,uBAAuB,CAAC;IACrC,eAAe,EAAE,2BAA2B,CAAC;CAChD,CAAC;AAwBR,eAAO,MAAM,kCAAkC,GAC3C,OAAO,OAAO,KACf,GAAG,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,GAAG,IA0BnC,CAAC;AAwBF,eAAO,MAAM,yBAAyB,GAAI,KAAK,OAAO,KAAG,0BAgExD,CAAC;AAMF,eAAO,MAAM,wBAAwB,GAAI,aAAa;IAClD,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,kCAAkC,CAAC,EAAE,MAAM,CAAC;IAC5C,gCAAgC,CAAC,EAAE,MAAM,CAAC;CAC7C,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAKxB,CAAC;AAGH,eAAO,MAAM,2BAA2B,GACpC,QAAQ,OAAO,CAAC,0BAA0B,EAAE;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC,EAClE,cAAc,IAAI,CAAC,yBAAyB,EAAE,UAAU,GAAG,YAAY,CAAC,KACzE,yBAID,CAAC"}

package/dist/share-content/index.d.ts

@@ -0,0 +1,6 @@
+export * from './types';
+export * from './config';
+export * from './plugin';
+export * from './runtime';
+export * from './production';
+//# sourceMappingURL=index.d.ts.map

package/dist/share-content/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/share-content/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC;AACzB,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC"}

package/dist/share-content/plugin.d.ts

@@ -0,0 +1,5 @@
+import type { FastifyPluginAsync } from 'fastify';
+import { type ShareContentPluginOptions } from './types';
+export declare const shareContentFastifyPlugin: FastifyPluginAsync<ShareContentPluginOptions>;
+export default shareContentFastifyPlugin;
+//# sourceMappingURL=plugin.d.ts.map

package/dist/share-content/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/share-content/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAmB,kBAAkB,EAAgC,MAAM,SAAS,CAAC;AAejG,OAAO,EAGH,KAAK,yBAAyB,EAEjC,MAAM,SAAS,CAAC;AAgPjB,eAAO,MAAM,yBAAyB,EAAE,kBAAkB,CAAC,yBAAyB,CAsDnF,CAAC;AAEF,eAAe,yBAAyB,CAAC"}

package/dist/share-content/production.d.ts

@@ -0,0 +1,15 @@
+import { type ShareContentRepository } from '../accesslayer/share-content';
+import { type ReplayStore } from '../helpers/share-content-auth';
+import { type ShareContentRuntime } from './runtime';
+export type ShareContentReplayStoreHandle = {
+    store: ReplayStore;
+    close: () => Promise<void>;
+};
+export declare const createShareContentRedisReplayStore: (options: {
+    host: string;
+    port: number;
+}) => ShareContentReplayStoreHandle;
+export declare const createMongoShareContentRepository: () => Promise<ShareContentRepository>;
+export declare const createShareContentRuntimeFromEnvironment: () => Promise<ShareContentRuntime>;
+export declare const assertShareContentEnvironmentConfiguration: () => void;
+//# sourceMappingURL=production.d.ts.map

package/dist/share-content/production.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"production.d.ts","sourceRoot":"","sources":["../../src/share-content/production.ts"],"names":[],"mappings":"AAGA,OAAO,EAGH,KAAK,sBAAsB,EAC9B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAgC,KAAK,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAI7F,OAAO,EAA4B,KAAK,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAY/E,MAAM,MAAM,6BAA6B,GAAG;IACxC,KAAK,EAAE,WAAW,CAAC;IACnB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B,CAAC;AAEF,eAAO,MAAM,kCAAkC,GAAI,SAAS;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CAChB,KAAG,6BAkCH,CAAC;AAEF,eAAO,MAAM,iCAAiC,QAAa,OAAO,CAAC,sBAAsB,CAIxF,CAAC;AAcF,eAAO,MAAM,wCAAwC,QAAa,OAAO,CAAC,mBAAmB,CAKvF,CAAC;AAOP,eAAO,MAAM,0CAA0C,QAAO,IAQ7D,CAAC"}

package/dist/share-content/runtime.d.ts

@@ -0,0 +1,23 @@
+import type { FastifyInstance } from 'fastify';
+import type { ShareContentRepository } from '../accesslayer/share-content';
+import { type LearnCardLike, type ReplayStore } from '../helpers/share-content-auth';
+import { type ShareContentPluginOptions } from './types';
+export type ShareContentRuntimeDependencies = {
+    getLearnCard: () => Promise<LearnCardLike>;
+    createReplayStore: () => {
+        store: ReplayStore;
+        close: () => Promise<void>;
+    };
+    getRepository: () => Promise<ShareContentRepository>;
+};
+export type EnabledShareContentRuntime = {
+    enabled: true;
+    pluginOptions: ShareContentPluginOptions;
+    close: () => Promise<void>;
+};
+export type ShareContentRuntime = {
+    enabled: false;
+} | EnabledShareContentRuntime;
+export declare const buildShareContentRuntime: (rawConfig: unknown, dependencies: ShareContentRuntimeDependencies) => Promise<ShareContentRuntime>;
+export declare const registerShareContentRoutes: (fastify: FastifyInstance, runtime: EnabledShareContentRuntime) => Promise<void>;
+//# sourceMappingURL=runtime.d.ts.map

package/dist/share-content/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/share-content/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAE/C,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAGH,KAAK,aAAa,EAClB,KAAK,WAAW,EACnB,MAAM,6BAA6B,CAAC;AAIrC,OAAO,EAA+B,KAAK,yBAAyB,EAAE,MAAM,SAAS,CAAC;AAatF,MAAM,MAAM,+BAA+B,GAAG;IAE1C,YAAY,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;IAE3C,iBAAiB,EAAE,MAAM;QAAE,KAAK,EAAE,WAAW,CAAC;QAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;IAE5E,aAAa,EAAE,MAAM,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACxD,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACrC,OAAO,EAAE,IAAI,CAAC;IACd,aAAa,EAAE,yBAAyB,CAAC;IAEzC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAAE,OAAO,EAAE,KAAK,CAAA;CAAE,GAAG,0BAA0B,CAAC;AAElF,eAAO,MAAM,wBAAwB,GACjC,WAAW,OAAO,EAClB,cAAc,+BAA+B,KAC9C,OAAO,CAAC,mBAAmB,CAgC7B,CAAC;AAGF,eAAO,MAAM,0BAA0B,GACnC,SAAS,eAAe,EACxB,SAAS,0BAA0B,KACpC,OAAO,CAAC,IAAI,CAKd,CAAC"}

package/dist/share-content/types.d.ts

@@ -0,0 +1,23 @@
+import type { ShareContentRepository } from '../accesslayer/share-content';
+import type { ReplayStore, ShareContentAuthorizationVerifier } from '../helpers/share-content-auth';
+import type { ShareContentNamespacePolicy } from './config';
+export declare const SHARE_CONTENT_PLUGIN_PREFIX = "/internal/share-content";
+export type ShareContentRouteOperation = 'put' | 'get' | 'stat' | 'delete' | 'readRecovery';
+export declare const SHARE_CONTENT_MAX_REQUEST_BYTES: number;
+export declare const SHARE_CONTENT_ERROR_CODES: readonly ["UNAUTHORIZED", "INVALID_INPUT", "PAYLOAD_TOO_LARGE", "NOT_FOUND", "CONFLICT", "UNAVAILABLE"];
+export type ShareContentErrorCode = (typeof SHARE_CONTENT_ERROR_CODES)[number];
+export type ShareContentErrorBody = {
+    ok: false;
+    error: ShareContentErrorCode;
+};
+export type ShareContentPluginOptions = {
+    verifier: ShareContentAuthorizationVerifier;
+    repository: ShareContentRepository;
+    namespacePolicy: ShareContentNamespacePolicy;
+    maxRequestBytes?: number;
+};
+export type ShareContentReplayStoreFactory = () => {
+    store: ReplayStore;
+    close: () => Promise<void>;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/share-content/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/share-content/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,iCAAiC,EAAE,MAAM,6BAA6B,CAAC;AAElG,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,UAAU,CAAC;AAa5D,eAAO,MAAM,2BAA2B,4BAA4B,CAAC;AAGrE,MAAM,MAAM,0BAA0B,GAAG,KAAK,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,cAAc,CAAC;AAG5F,eAAO,MAAM,+BAA+B,QAAc,CAAC;AAM3D,eAAO,MAAM,yBAAyB,yGAO5B,CAAC;AAEX,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/E,MAAM,MAAM,qBAAqB,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,qBAAqB,CAAA;CAAE,CAAC;AAOhF,MAAM,MAAM,yBAAyB,GAAG;IACpC,QAAQ,EAAE,iCAAiC,CAAC;IAC5C,UAAU,EAAE,sBAAsB,CAAC;IACnC,eAAe,EAAE,2BAA2B,CAAC;IAE7C,eAAe,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAGF,MAAM,MAAM,8BAA8B,GAAG,MAAM;IAC/C,KAAK,EAAE,WAAW,CAAC;IACnB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B,CAAC"}

package/lambda.ts

@@ -2,6 +2,7 @@ import serverlessHttp from 'serverless-http';
 import type { Context, APIGatewayProxyResultV2, APIGatewayProxyEventV2 } from 'aws-lambda';
 import { awsLambdaRequestHandler } from '@trpc/server/adapters/aws-lambda';
 import * as Sentry from '@sentry/serverless';
+import Fastify, { type FastifyInstance } from 'fastify';
 
 import app from './src/openapi';
 import { appRouter, createContext } from './src/app';
@@ -13,6 +14,11 @@ import {
 } from './src/helpers/sentry.helpers';
 import { environment } from './src/config/environment';
 import { toServerlessApplication } from './src/helpers/serverlessApplication';
+import {
+    assertShareContentEnvironmentConfiguration,
+    createShareContentRuntimeFromEnvironment,
+    registerShareContentRoutes,
+} from './src/share-content';
 
 Sentry.AWSLambda.init({
     dsn: environment.SENTRY_DSN,
@@ -28,6 +34,61 @@ Sentry.AWSLambda.init({
     ],
 });
 
+// Fail the cold start on an enabled-but-invalid LC-2187 share-content
+// configuration; a disabled configuration is a no-op.
+assertShareContentEnvironmentConfiguration();
+
+let shareContentProxyPromise: Promise<ReturnType<typeof serverlessHttp> | null> | null = null;
+
+/**
+ * Lazy per-container boot for the LC-2187 service routes. Resolving the runtime
+ * awaits repository index initialization and opens Redis only when enabled, so a
+ * disabled deployment installs nothing and returns 404 for every internal path.
+ */
+const getShareContentProxy = async (): Promise<ReturnType<typeof serverlessHttp> | null> => {
+    if (!shareContentProxyPromise) {
+        shareContentProxyPromise = (async () => {
+            const runtime = await createShareContentRuntimeFromEnvironment();
+
+            if (!runtime.enabled) return null;
+
+            const shareContentApp: FastifyInstance = Fastify({ maxParamLength: 5000 });
+            await registerShareContentRoutes(shareContentApp, runtime);
+            await shareContentApp.ready();
+
+            return serverlessHttp(toServerlessApplication(shareContentApp.server));
+        })();
+    }
+
+    return shareContentProxyPromise;
+};
+
+export const shareContentHandler = async (
+    event: APIGatewayProxyEventV2,
+    context: Context
+): Promise<APIGatewayProxyResultV2> => {
+    let proxy: ReturnType<typeof serverlessHttp> | null;
+
+    try {
+        proxy = await getShareContentProxy();
+    } catch {
+        // Never return a raw boot error. Allow a later invocation to retry.
+        shareContentProxyPromise = null;
+
+        return {
+            statusCode: 503,
+            headers: { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' },
+            body: JSON.stringify({ ok: false, error: 'UNAVAILABLE' }),
+        };
+    }
+
+    if (!proxy) {
+        return { statusCode: 404, headers: { 'Cache-Control': 'no-store' }, body: '' };
+    }
+
+    return proxy(event, context);
+};
+
 export const swaggerUiHandler = serverlessHttp(toServerlessApplication(app), {
     basePath: '/docs',
 });

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@learncard/learn-cloud-service",
-    "version": "2.5.33",
+    "version": "2.5.35",
     "description": "",
     "engines": {
         "node": ">=24.12 <25"
@@ -68,19 +68,19 @@
         "@fastify/cors": "^11.2.0",
         "@fastify/rate-limit": "^10.2.0",
         "@fastify/static": "^10.1.1",
-        "@learncard/core": "9.4.35",
-        "@learncard/crypto-plugin": "1.1.35",
-        "@learncard/did-web-plugin": "1.1.35",
-        "@learncard/didkey-plugin": "1.1.35",
-        "@learncard/didkit-plugin": "^1.10.0",
-        "@learncard/didkit-plugin-node": "0.3.0",
-        "@learncard/encryption-plugin": "1.1.35",
-        "@learncard/expiration-plugin": "1.2.35",
-        "@learncard/helpers": "1.5.1",
-        "@learncard/learn-card-plugin": "1.2.35",
-        "@learncard/types": "5.20.0",
-        "@learncard/vc-plugin": "1.6.1",
-        "@learncard/vc-templates-plugin": "1.1.35",
+        "@learncard/core": "9.4.37",
+        "@learncard/crypto-plugin": "1.1.37",
+        "@learncard/did-web-plugin": "1.1.37",
+        "@learncard/didkey-plugin": "1.1.37",
+        "@learncard/didkit-plugin": "^1.10.2",
+        "@learncard/didkit-plugin-node": "0.3.2",
+        "@learncard/encryption-plugin": "1.1.37",
+        "@learncard/expiration-plugin": "1.2.37",
+        "@learncard/helpers": "1.6.1",
+        "@learncard/learn-card-plugin": "1.2.37",
+        "@learncard/types": "5.22.0",
+        "@learncard/vc-plugin": "1.6.3",
+        "@learncard/vc-templates-plugin": "1.1.37",
         "@sentry/serverless": "7.61.0",
         "@trpc/server": "11.8.0",
         "@types/lodash": "^4.14.191",

package/serverless.yml

@@ -140,6 +140,13 @@ provider:
             'Fn::GetAtt': [ElasticCacheCluster, RedisEndpoint.Address]
         REDIS_PORT:
             'Fn::GetAtt': [ElasticCacheCluster, RedisEndpoint.Port]
+        # LC-2187 service-only share-content routes. Require an explicit
+        # audience, service DID/key-method allowlists and
+        # per-service namespace bindings. No secret material is passed here.
+        SHARE_CONTENT_AUDIENCE: ${env:SHARE_CONTENT_AUDIENCE, ''}
+        SHARE_CONTENT_SERVICE_DIDS: ${env:SHARE_CONTENT_SERVICE_DIDS, ''}
+        SHARE_CONTENT_VERIFICATION_METHODS: ${env:SHARE_CONTENT_VERIFICATION_METHODS, ''}
+        SHARE_CONTENT_NAMESPACE_BINDINGS: ${env:SHARE_CONTENT_NAMESPACE_BINDINGS, ''}
     tracing:
         apiGateway: true
         lambda: true
@@ -170,6 +177,24 @@ functions:
         events:
             - httpApi: ANY /api/{trpc+}
 
+    # LC-2187 service-only share-content transport. The handler returns 404
+    # for every path until configured with a
+    # complete configuration. Events are the exact reviewed operations; there is
+    # no wildcard/wildcard enumeration surface.
+    shareContent:
+        handler: lambda.shareContentHandler
+        vpc:
+            securityGroupIds:
+                - 'Fn::GetAtt': [ServerlessSecurityGroup, GroupId]
+            subnetIds:
+                - Ref: PrivateSubnetA
+        events:
+            - httpApi: POST /internal/share-content/put
+            - httpApi: POST /internal/share-content/get
+            - httpApi: POST /internal/share-content/stat
+            - httpApi: POST /internal/share-content/delete
+            - httpApi: POST /internal/share-content/readRecovery
+
     didWeb:
         handler: didWebLambda.didWebHandler
         vpc:

package/src/accesslayer/share-content/delete.ts

@@ -0,0 +1,124 @@
+import type { Collection } from 'mongodb';
+
+import type { MongoShareContentDocument } from '@models';
+
+import {
+    MAX_SHARE_CONTENT_ATTEMPTS,
+    bindingMatchesDocument,
+    parseShareContentBinding,
+    shareContentBindingFilter,
+    shareContentIdentityFilter,
+    toTombstoneSummary,
+} from './internal';
+import type { ShareContentRepositoryResult, ShareContentTombstoneSummary } from './types';
+
+/**
+ * Atomically tombstone the exact object.
+ *
+ * The active -> tombstone transition is a single atomic `findOneAndUpdate` that
+ * also removes the ciphertext/recovery fields, so once it returns the payload is
+ * gone. If the identity does not exist yet, a tombstone is inserted with an
+ * atomic `$setOnInsert` upsert (delete-before-put), so a late concurrent put can
+ * never resurrect the identity. The loop only re-runs when a racing writer
+ * changed the document between the two atomic steps; active documents are
+ * otherwise immutable and tombstones are permanent, so it always settles.
+ *
+ * A binding mismatch (including another owner's object at the same identity)
+ * never modifies the stored document and returns `BINDING_MISMATCH`.
+ */
+export const deleteShareContent = async (
+    collection: Collection<MongoShareContentDocument>,
+    rawBinding: unknown
+): Promise<ShareContentRepositoryResult<ShareContentTombstoneSummary>> => {
+    const binding = parseShareContentBinding(rawBinding);
+
+    if (binding === null) return { ok: false, error: 'INVALID_INPUT' };
+
+    const exactFilter = shareContentBindingFilter(binding);
+    const identityFilter = shareContentIdentityFilter(binding);
+
+    for (let attempt = 0; attempt < MAX_SHARE_CONTENT_ATTEMPTS; attempt += 1) {
+        // 1. Atomic active -> tombstone, dropping the payload in the same update.
+        const deletedAt = new Date();
+
+        const replaced = await collection.findOneAndUpdate(
+            { ...exactFilter, kind: 'active' },
+            {
+                $set: { kind: 'tombstone', deletedAt },
+                $unset: {
+                    payloadHash: '',
+                    envelope: '',
+                    ownerEncryptedRecovery: '',
+                    ciphertextBytes: '',
+                    recoveryBytes: '',
+                    createdAt: '',
+                },
+            },
+            { returnDocument: 'after' }
+        );
+
+        if (replaced !== null) {
+            if (replaced.kind === 'tombstone') {
+                return { ok: true, value: toTombstoneSummary(replaced) };
+            }
+
+            // Unreachable under the `kind: 'active'` filter; a racing writer
+            // changed the document. Re-classify rather than trust the shape.
+            continue;
+        }
+
+        // 2. Delete-before-put: create a permanent tombstone only if absent.
+        const inserted = await collection.updateOne(
+            identityFilter,
+            {
+                $setOnInsert: {
+                    kind: 'tombstone',
+                    namespace: binding.namespace,
+                    ownerProfileId: binding.ownerProfileId,
+                    shareId: binding.shareId,
+                    contentVersion: binding.contentVersion,
+                    objectId: binding.objectId,
+                    operationId: binding.operationId,
+                    deletedAt,
+                },
+            },
+            { upsert: true }
+        );
+
+        if (inserted.upsertedCount === 1) {
+            return {
+                ok: true,
+                value: {
+                    kind: 'tombstone',
+                    namespace: binding.namespace,
+                    ownerProfileId: binding.ownerProfileId,
+                    shareId: binding.shareId,
+                    contentVersion: binding.contentVersion,
+                    objectId: binding.objectId,
+                    operationId: binding.operationId,
+                    deletedAt,
+                },
+            };
+        }
+
+        // 3. The identity exists but was not replaced: classify and fail closed.
+        const existing = await collection.findOne(identityFilter);
+
+        if (existing === null) continue;
+
+        if (existing.kind === 'tombstone') {
+            return bindingMatchesDocument(existing, binding)
+                ? { ok: true, value: toTombstoneSummary(existing) }
+                : { ok: false, error: 'BINDING_MISMATCH' };
+        }
+
+        if (!bindingMatchesDocument(existing, binding)) {
+            return { ok: false, error: 'BINDING_MISMATCH' };
+        }
+
+        // Exact active document: a concurrent writer slipped in between the two
+        // atomic steps; retry the replacement.
+    }
+
+    return { ok: false, error: 'CONFLICT' };
+};