@learncard/network-brain-service 3.18.0 → 3.19.1

package/.env.example

@@ -6,8 +6,13 @@ PORT=3000
 SEED=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
 NEO4J_URI=bolt://localhost:7687
 NEO4J_USERNAME=neo4j
-NEO4J_PASSWORD=password
-DOMAIN_NAME=
+NEO4J_PASSWORD=this-is-the-password
+DOMAIN_NAME=localhost%3A4000
+MONGO_URI=mongodb://localhost:27017/?replicaSet=rs0
+MONGO_DB_NAME=lca-api
+# Required by the sample-persona seeder. Use a disposable seed only for local development.
+DEMO_PERSONA_SIGNING_AUTHORITY_ENDPOINT=http://localhost:5100/api
+DEMO_PERSONA_SA_SEED=
 CLIENT_APP_DOMAIN_NAME=
 CLIENT_APP_PORT=3000
 LOGIN_PROVIDER_DID=
@@ -22,6 +27,10 @@ OIDC_EXPECTED_AUDIENCE=
 
 AWS_REGION=
 NOTIFICATIONS_QUEUE_URL=
+INBOX_QUEUE_URL=
+INBOX_DEAD_LETTER_QUEUE_URL=
+# Set only for a local SQS emulator; production uses the AWS endpoint and IAM role.
+INBOX_QUEUE_ENDPOINT=
 NOTIFICATIONS_QUEUE_POLL_URL=
 NOTIFICATIONS_SERVICE_WEBHOOK_URL=
 NOTIFICATIONS_SERVICE_PORT=5100
@@ -88,3 +97,30 @@ CREDENTIAL_REFRESH_ENABLED=false
 CREDENTIAL_REFRESH_DIGEST_SECRET=
 # Hours during which repeat refresh notifications collapse into one unread record.
 CREDENTIAL_REFRESH_NOTIFICATION_WINDOW_HOURS=24
+
+# LC-2187 service wiring and automatic recovery/cleanup maintenance.
+# Supply an explicit namespace, trusted LearnCloud origin and audience;
+# malformed values fail closed without graph/remote/signing work.
+SHARE_LINK_MAINTENANCE_NAMESPACE=
+SHARE_LINK_MAINTENANCE_ORIGIN=
+SHARE_LINK_MAINTENANCE_AUDIENCE=
+SHARE_LINK_MAINTENANCE_ALLOW_INSECURE_LOOPBACK=false
+SHARE_LINK_MAINTENANCE_CLAIMANT=brain-share-link-maintenance
+SHARE_LINK_MAINTENANCE_RECOVERY_LIMIT=25
+SHARE_LINK_MAINTENANCE_CLEANUP_LIMIT=25
+SHARE_LINK_MAINTENANCE_LEASE_MS=120000
+SHARE_LINK_MAINTENANCE_CLAIM_MS=300000
+SHARE_LINK_MAINTENANCE_BUDGET_MS=60000
+SHARE_LINK_MAINTENANCE_INTERVAL_MS=300000
+SHARE_LINK_MAINTENANCE_REQUEST_TIMEOUT_MS=10000
+SHARE_LINK_MAINTENANCE_FINALIZE_RESERVE_MS=5000
+SHARE_LINK_MAINTENANCE_GRAPH_TIMEOUT_MS=15000
+
+# Owner/public APIs and maintenance are available once the service wiring above
+# is valid. UI rollout is controlled only by LaunchDarkly share-links-enabled.
+# Optional owner namespace override must match SHARE_LINK_MAINTENANCE_NAMESPACE.
+SHARE_LINK_OWNER_API_NAMESPACE=
+# Independent 32+ byte secret, identical on all Brain instances and stable across
+# deployments. Required when the owner API is enabled; test runs use a test-only key.
+SHARE_LINK_REQUEST_HASH_SECRET=
+# Production unknown-age policy defaults to 30 days and does not count views.

package/CHANGELOG.md

@@ -1,5 +1,123 @@
 # @learncard/network-brain-service
 
+## 3.19.1
+
+### Patch Changes
+
+- [#1607](https://github.com/learningeconomy/LearnCard/pull/1607) [`b184f5552abf37a11468d435e5cea07fc35e1993`](https://github.com/learningeconomy/LearnCard/commit/b184f5552abf37a11468d435e5cea07fc35e1993) Thanks [@goblincore](https://github.com/goblincore)! - Make `acceptPresentation` idempotent so retries of a saved collection do not create duplicate relationships. New or replacement share-link passcodes require at least eight characters; existing shorter passcodes remain valid for recipients. Public share resolution can now return `try_later` when passcode verification is unavailable or throttled.
+
+- [#1624](https://github.com/learningeconomy/LearnCard/pull/1624) [`7e5c2b9ce9fabbd5635cf17a2c6eea5c3ce692fa`](https://github.com/learningeconomy/LearnCard/commit/7e5c2b9ce9fabbd5635cf17a2c6eea5c3ce692fa) Thanks [@Custard7](https://github.com/Custard7)! - fix: Stop treating service profiles as child accounts and fix managed-child claim email template
+
+- [#1529](https://github.com/learningeconomy/LearnCard/pull/1529) [`0e262737aafb8248e88e05039c83a3f30be6750f`](https://github.com/learningeconomy/LearnCard/commit/0e262737aafb8248e88e05039c83a3f30be6750f) Thanks [@Custard7](https://github.com/Custard7)! - SSS prod hardening: confirmed recovery enrollment, lost-login identity rebind, and an isolated email relay.
+
+    - Recovery methods now carry `confirmedAt` and must be proven before they count (email confirmation code, phrase challenge words, backup re-decrypt, passkey round trip). New SSS accounts are `active` immediately; web3auth migrations stay `provisional` until a method is confirmed.
+    - New recovery-session flow lets a user whose sign-in identity is gone recover via a verified personal email and bind a new sign-in.
+    - Email recovery shares are encrypted on the client to an isolated relay's public key; `lca-api` never sees plaintext. Provider tokens move from query strings to the `X-Auth-Token` header.
+    - Sensitive key routes require a single-use DID challenge; key records are keyed by immutable provider ID.
+    - `recovery-key` email template now requires `confirmationCode`.
+    - Auth-share initialization requires the provider uniqueness index before inserting, preventing competing first writes from creating duplicate accounts. Existing records with missing or BSON-null auth material retain atomic update protection.
+    - Automatic stale-key cleanup preserves unresolved pending shares for delayed commits; explicit device forgetting still removes them. Custom SSS storage adapters now implement `deleteDeviceShare(id?)` to remove only the selected share and its version.
+
+- [#1614](https://github.com/learningeconomy/LearnCard/pull/1614) [`ae10525fbd0ef284aabe1b03d12db147a1922f2c`](https://github.com/learningeconomy/LearnCard/commit/ae10525fbd0ef284aabe1b03d12db147a1922f2c) Thanks [@smurflo2](https://github.com/smurflo2)! - feat: [LC-2191] Replace Demo School with standards-pure sample personas, including plain OBv3 ConsentFlow issuance without proprietary `boostId` fields.
+
+- Updated dependencies [[`4b83aa9ee802f0d7a54adc5f053a7376fa103cdd`](https://github.com/learningeconomy/LearnCard/commit/4b83aa9ee802f0d7a54adc5f053a7376fa103cdd), [`2ebda517e9468476f22d3ae3b4ebddf67e8aca78`](https://github.com/learningeconomy/LearnCard/commit/2ebda517e9468476f22d3ae3b4ebddf67e8aca78), [`0e9dd47f4451d776ad1787d0a35dbd54141b9fe3`](https://github.com/learningeconomy/LearnCard/commit/0e9dd47f4451d776ad1787d0a35dbd54141b9fe3), [`b184f5552abf37a11468d435e5cea07fc35e1993`](https://github.com/learningeconomy/LearnCard/commit/b184f5552abf37a11468d435e5cea07fc35e1993), [`0e262737aafb8248e88e05039c83a3f30be6750f`](https://github.com/learningeconomy/LearnCard/commit/0e262737aafb8248e88e05039c83a3f30be6750f), [`ae10525fbd0ef284aabe1b03d12db147a1922f2c`](https://github.com/learningeconomy/LearnCard/commit/ae10525fbd0ef284aabe1b03d12db147a1922f2c), [`d436c39e00994e6d8c77e7b94985a51fe1f42adb`](https://github.com/learningeconomy/LearnCard/commit/d436c39e00994e6d8c77e7b94985a51fe1f42adb)]:
+    - @learncard/types@5.22.0
+    - @learncard/credential-library@2.0.5
+    - @learncard/email-templates@1.2.0
+    - @learncard/helpers@1.6.1
+    - @learncard/core@9.4.37
+    - @learncard/did-web-plugin@1.1.37
+    - @learncard/didkey-plugin@1.1.37
+    - @learncard/didkit-plugin@1.10.2
+    - @learncard/didkit-plugin-node@0.3.2
+    - @learncard/encryption-plugin@1.1.37
+    - @learncard/learn-card-plugin@1.2.37
+    - @learncard/vc-plugin@1.6.3
+    - @learncard/vc-templates-plugin@1.1.37
+    - @learncard/crypto-plugin@1.1.37
+    - @learncard/dynamic-loader-plugin@1.1.37
+    - @learncard/expiration-plugin@1.2.37
+
+## 3.19.0
+
+### Minor Changes
+
+- [#1585](https://github.com/learningeconomy/LearnCard/pull/1585) [`0c1bf9a8a33e6392d5fd279479d9ab4fb0449b5e`](https://github.com/learningeconomy/LearnCard/commit/0c1bf9a8a33e6392d5fd279479d9ab4fb0449b5e) Thanks [@goblincore](https://github.com/goblincore)! - Send managed credential update emails to a bound holder's verified email (or a verified manager for managed accounts). Include the issuer display name and a bounded credential title, with a translated link to app notifications; exclude grades, subject data, and update summaries. Keep email failures independent of publication and in-app notifications, and persist a single delivery attempt per publication notification window so retries cannot send duplicate email.
+
+    Email delivery is best effort: a failed or ambiguous provider attempt is recorded and not retried within that window. A later material update in a new window can send another email. There is no background email retry worker.
+
+    Existing verified Universal Inbox recipients also receive an initial email pointing to their app notifications when delivery is not suppressed. Local claim and update links use the frontend address.
+
+    Preserve recipient profile identities when local webhook delivery normalizes notification DIDs, so the subsequent update-email lookup can still find verified contacts.
+
+- [#1591](https://github.com/learningeconomy/LearnCard/pull/1591) [`928e587378b3674766cf58a8bbe1cbd4d66d3a9f`](https://github.com/learningeconomy/LearnCard/commit/928e587378b3674766cf58a8bbe1cbd4d66d3a9f) Thanks [@gerardopar](https://github.com/gerardopar)! - Add Universal Inbox batch issuance through `sendCredentialsViaInbox`, tRPC
+  `inbox.issueBatch`, and `POST /inbox/issue-batch`, with public batch input and result
+  validators/types, shared configuration defaults, ordered per-item outcomes, and
+  24-hour issuer-scoped idempotency keys. Later duplicate keys in one batch conflict
+  deterministically. Completed issuances include reconciliation IDs if replay storage
+  cannot be confirmed; side-effect-free preflight failures release their keys.
+
+    Enforce a 4 MiB JSON payload budget and atomic batch quota admission without
+    charging rejected batches. Batch submission returns HTTP 202 with a durable
+    receipt. Poll `GET /inbox/batches/{batchId}` or
+    `getInboxCredentialBatch` for ordered progress and outcomes. Batch-level request IDs
+    make submission retries safe. Jobs, quota admission, dispatch records, and encrypted
+    results are stored in Neo4j; a dedicated SQS queue processes items independently of
+    notifications. Submission retries report the current batch state. Transient preparation
+    and signing failures retry before delivery. Terminal batches release their original
+    payload and remain available for 30 days, including uncertain outcomes; unresolved
+    client-keyed replay reservations stay blocked for reconciliation after job expiry.
+    Orphaned internal reservations for unkeyed items are collected after job pruning.
+    Container-backed tests exercise Neo4j, Redis, and an SQS emulator, including worker
+    recovery, duplicate delivery, polling authorization, and submission replay.
+
+    The existing single-issue route now accepts `configuration.guardianEmail`, exposing
+    guardian approval to single-issue clients. Both routes reject guardian self-approval
+    case-insensitively. Rate-limit errors use `TOO_MANY_REQUESTS` (HTTP 429); remove stale
+    TypeScript casts to `BAD_REQUEST` from existing callers. Those casts did not change
+    the runtime status code.
+
+### Patch Changes
+
+- [#1585](https://github.com/learningeconomy/LearnCard/pull/1585) [`0c1bf9a8a33e6392d5fd279479d9ab4fb0449b5e`](https://github.com/learningeconomy/LearnCard/commit/0c1bf9a8a33e6392d5fd279479d9ab4fb0449b5e) Thanks [@goblincore](https://github.com/goblincore)! - Managed refreshable sends through the standard send paths (LC-2198). `send({ type: 'boost', refresh: true })` now issues refreshable credentials for profile/DID recipients: with local signing the SDK asks the server to run every managed-send guard, create or reuse the boost and allocate the managed refresh service in one step, injects the service (with its inline JSON-LD context) before signing, and hands the signed credential to the server's unified send so activity/contract behavior and the canonical receipt are preserved; without local signing the request is served by the signing-authority path. Email/phone recipients now use Universal Inbox deferred issuance: allocate a stable refresh service at issue, queue unsigned updates in encrypted inbox escrow, and bind/sign the latest content at verified claim. The deferred receipt is returned at `inbox.refresh`; direct `inbox/issue` returns it at `refresh`.
+
+    `sendBoost` with literal `{ enableRefresh: true }` now returns `{ credentialUri, refresh }` instead of a plain URI string, where `refresh` is the metadata-only issuance receipt (refreshId, refreshService, credentialId, issuerDid, holderDid, credentialStatus) needed to publish future versions via `publishCredentialRefresh`. Legacy callers — boolean options, omitted options, or object options without `enableRefresh` — still receive the credential URI string; a dynamically typed `enableRefresh` degrades the result to `string | { credentialUri, refresh }`. Delivered managed credentials remain holder-encrypted even when `encrypt: false`. Pending Inbox content uses the existing service-readable encrypted escrow until claim, when it is wiped.
+
+    `@learncard/types` adds the `ManagedCredentialRefreshReceipt` validator plus optional `refresh` on the unified send input/response validators; `@learncard/helpers` adds the shared managed context preparation helpers (`prepareManagedRefreshContext`, `injectManagedRefreshService`) now also used by SDK `issueCredential` signing.
+
+    Refreshable `send` accepts an optional `idempotencyKey` so a whole call can be retried without duplicating the boost, refresh allocation or delivery.
+
+    Completed-send comparisons canonicalize nested result keys so equivalent receipts remain idempotent regardless of property insertion order. Keyed sends reuse the recipient validation already performed in the request.
+
+    Keyed pre-signed retries now recover the original result when delivery bound successfully but its intent result was not recorded, matching preparation and signing-authority retries. Pending receipt fallbacks use the holder's network profile DID consistently.
+
+    Signing a credential with a managed refresh service now rejects conflicting inline JSON-LD term definitions (including `authorization`) instead of producing a credential whose refresh terms are not correctly signed. Credentials without a managed service are unaffected.
+
+    Managed send and refresh publication recover from a stale local issuer DID document after signing-authority registration: if proof verification fails, the server refreshes the authenticated issuer's document and verifies once more without relaxing signature checks.
+
+    Universal Inbox accepts `refresh: true` and an issuance `idempotencyKey`; both claim paths bind the latest revision atomically. Publication keys survive claim, and issuer `getInboxCredential` exposes the metadata-only receipt with its bound holder DID.
+
+- [#1585](https://github.com/learningeconomy/LearnCard/pull/1585) [`0c1bf9a8a33e6392d5fd279479d9ab4fb0449b5e`](https://github.com/learningeconomy/LearnCard/commit/0c1bf9a8a33e6392d5fd279479d9ab4fb0449b5e) Thanks [@goblincore](https://github.com/goblincore)! - Honor delegated boost issuance permissions for managed refresh delivery. Expire saved post-login destinations after 30 minutes, discard legacy untimed destinations, and clear superseded claim redirects during sign-in.
+
+- [#1591](https://github.com/learningeconomy/LearnCard/pull/1591) [`928e587378b3674766cf58a8bbe1cbd4d66d3a9f`](https://github.com/learningeconomy/LearnCard/commit/928e587378b3674766cf58a8bbe1cbd4d66d3a9f) Thanks [@gerardopar](https://github.com/gerardopar)! - Support managed refresh through batch and item configuration, with item overrides including explicit false. Forward refresh options and template anchors to issuance, preserve caller permissions for background processing, and return refresh receipts in item results and replays.
+
+- Updated dependencies [[`2991bd32b03e26736239dd8e586e2f720d9bcd45`](https://github.com/learningeconomy/LearnCard/commit/2991bd32b03e26736239dd8e586e2f720d9bcd45), [`0c1bf9a8a33e6392d5fd279479d9ab4fb0449b5e`](https://github.com/learningeconomy/LearnCard/commit/0c1bf9a8a33e6392d5fd279479d9ab4fb0449b5e), [`0c1bf9a8a33e6392d5fd279479d9ab4fb0449b5e`](https://github.com/learningeconomy/LearnCard/commit/0c1bf9a8a33e6392d5fd279479d9ab4fb0449b5e), [`3174c09b97fde6f7b5251390245038cf6b7ea9ba`](https://github.com/learningeconomy/LearnCard/commit/3174c09b97fde6f7b5251390245038cf6b7ea9ba), [`928e587378b3674766cf58a8bbe1cbd4d66d3a9f`](https://github.com/learningeconomy/LearnCard/commit/928e587378b3674766cf58a8bbe1cbd4d66d3a9f), [`928e587378b3674766cf58a8bbe1cbd4d66d3a9f`](https://github.com/learningeconomy/LearnCard/commit/928e587378b3674766cf58a8bbe1cbd4d66d3a9f)]:
+    - @learncard/types@5.21.0
+    - @learncard/helpers@1.6.0
+    - @learncard/vc-plugin@1.6.2
+    - @learncard/email-templates@1.1.0
+    - @learncard/core@9.4.36
+    - @learncard/did-web-plugin@1.1.36
+    - @learncard/didkey-plugin@1.1.36
+    - @learncard/didkit-plugin@1.10.1
+    - @learncard/didkit-plugin-node@0.3.1
+    - @learncard/encryption-plugin@1.1.36
+    - @learncard/learn-card-plugin@1.2.36
+    - @learncard/vc-templates-plugin@1.1.36
+    - @learncard/crypto-plugin@1.1.36
+    - @learncard/dynamic-loader-plugin@1.1.36
+    - @learncard/expiration-plugin@1.2.36
+
 ## 3.18.0
 
 ### Minor Changes

package/README.md

@@ -29,6 +29,48 @@ Deploy this producer before an AI Passport consumer that requires the new guardi
 - **Default environment**: if you omit the stage, the command defaults to `local` and prints a note.
 - **Production safety**: the manual seed command still refuses to run in production unless `--force` is provided.
 
+## Sample persona seeding
+
+Sample personas are ordered credential-library bundles published as idempotent
+consent-flow contracts. The seeder uses every target value from
+`services/learn-card-network/brain-service/.env`; verify them before running it.
+Do not overwrite an existing `.env` or assume it points to local services.
+
+For the local LearnCard App Compose stack, use explicit host-side values:
+
+```dotenv
+NEO4J_URI=bolt://localhost:7687
+NEO4J_USERNAME=neo4j
+NEO4J_PASSWORD=this-is-the-password
+MONGO_URI=mongodb://localhost:27017/?replicaSet=rs0
+MONGO_DB_NAME=lca-api
+REDIS_HOST=localhost
+REDIS_PORT=6379
+DOMAIN_NAME=localhost%3A4000
+DEMO_PERSONA_SIGNING_AUTHORITY_ENDPOINT=http://localhost:5100/api
+# Disposable local-only seed. Never reuse this value in a shared environment.
+DEMO_PERSONA_SA_SEED=dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd
+```
+
+Start the stack, then publish the bundle from `apps/learn-card-app`:
+
+```bash
+bun run seed:demo-persona student
+```
+
+Staging and production require their own secret 64-character hexadecimal
+`DEMO_PERSONA_SA_SEED`, the matching LCA API endpoint, and explicit Neo4j, MongoDB,
+Redis, and domain settings. Deploy the brain service first, run the seeder against
+the intended environment, verify the printed contract URI, and only then deploy app
+configuration that references it.
+
+The root seed deterministically derives a distinct signing identity for every
+configured sample issuer. The command updates issuer profiles, unsigned credential
+templates, and auto-boost relationships in place, then prints the stable contract URI
+to record in that tenant's `features.samplePersonas`. Running it again publishes
+credential-library content changes without duplicating profiles, Boosts, signing
+authorities, or contracts.
+
 ## Notes
 
 - The default fixture is idempotent by framework and skill ID, so running the seed command multiple times does not duplicate data.

package/compose.inbox.yml

@@ -0,0 +1,7 @@
+services:
+    inbox-sqs:
+        image: softwaremill/elasticmq-native:1.6.15
+        ports:
+            - '9324:9324'
+        volumes:
+            - ./inbox-elasticmq.conf:/opt/elasticmq.conf:ro

package/dist/accesslayer/auth-grant/read.d.ts

@@ -12,5 +12,6 @@ export declare const isAuthGrantAssociatedWithProfile: (authGrantId: string, pro
 export declare const isAuthGrantChallengeValidForDID: (challenge: string, did: string) => Promise<{
     isChallengeValid: boolean;
     scope: string;
+    actAs?: string;
 }>;
 //# sourceMappingURL=read.d.ts.map

package/dist/accesslayer/auth-grant/read.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../../src/accesslayer/auth-grant/read.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,aAAa,EAA4B,MAAM,kBAAkB,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAU5C,eAAO,MAAM,gBAAgB,GAAU,IAAI,MAAM,KAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAgB/E,CAAC;AAEF,eAAO,MAAM,uBAAuB,GAChC,SAAS,WAAW,EACpB,uCAIG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,cAAc,CAAA;CAAE,KAC9D,OAAO,CAAC,KAAK,CAAC,aAAa,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAiCpD,CAAC;AAEF,eAAO,MAAM,gCAAgC,GACzC,aAAa,MAAM,EACnB,WAAW,MAAM,KAClB,OAAO,CAAC,OAAO,CAmBjB,CAAC;AAEF,eAAO,MAAM,+BAA+B,GACxC,WAAW,MAAM,EACjB,KAAK,MAAM,KACZ,OAAO,CAAC;IAAE,gBAAgB,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CA6BtD,CAAC"}
+{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../../src/accesslayer/auth-grant/read.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,aAAa,EAA4B,MAAM,kBAAkB,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAU5C,eAAO,MAAM,gBAAgB,GAAU,IAAI,MAAM,KAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAgB/E,CAAC;AAEF,eAAO,MAAM,uBAAuB,GAChC,SAAS,WAAW,EACpB,uCAIG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,cAAc,CAAA;CAAE,KAC9D,OAAO,CAAC,KAAK,CAAC,aAAa,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAiCpD,CAAC;AAEF,eAAO,MAAM,gCAAgC,GACzC,aAAa,MAAM,EACnB,WAAW,MAAM,KAClB,OAAO,CAAC,OAAO,CAmBjB,CAAC;AAEF,eAAO,MAAM,+BAA+B,GACxC,WAAW,MAAM,EACjB,KAAK,MAAM,KACZ,OAAO,CAAC;IAAE,gBAAgB,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CA8BtE,CAAC"}

package/dist/accesslayer/consentflowcontract/relationships/create.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../../src/accesslayer/consentflowcontract/relationships/create.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,gBAAgB,IAAI,oBAAoB,EAExC,2BAA2B,EAE3B,UAAU,EAGb,MAAM,kBAAkB,CAAC;AAS1B,OAAO,EAAE,cAAc,EAAmB,MAAM,2BAA2B,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAiBxC,eAAO,MAAM,qBAAqB,GAAU,UAAU,cAAc,EAAE,SAAS,UAAU,oBAQxF,CAAC;AAEF,eAAO,MAAM,uBAAuB,GAChC,UAAU,cAAc,EACxB,OAAO,SAAS,EAChB,kBAAkB;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACpD,SAAS,MAAM,oBAWlB,CAAC;AAEF,eAAO,MAAM,0BAA0B,GACnC,UAAU,cAAc,EACxB,OAAO,SAAS,KACjB,OAAO,CAAC,IAAI,CAKd,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAC1B,WAAW,UAAU,EACrB,6BAA6B;IAAE,QAAQ,EAAE,cAAc,CAAC;IAAC,aAAa,EAAE,UAAU,CAAA;CAAE,EACpF,0DAKG;IACC,KAAK,EAAE,oBAAoB,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;CAClD,EACD,QAAQ,MAAM,qBAgRjB,CAAC"}
+{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../../src/accesslayer/consentflowcontract/relationships/create.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,gBAAgB,IAAI,oBAAoB,EAExC,2BAA2B,EAE3B,UAAU,EAGb,MAAM,kBAAkB,CAAC;AAS1B,OAAO,EAAE,cAAc,EAAmB,MAAM,2BAA2B,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAiBxC,eAAO,MAAM,qBAAqB,GAAU,UAAU,cAAc,EAAE,SAAS,UAAU,oBAQxF,CAAC;AAEF,eAAO,MAAM,uBAAuB,GAChC,UAAU,cAAc,EACxB,OAAO,SAAS,EAChB,kBAAkB;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACpD,SAAS,MAAM,oBAWlB,CAAC;AAEF,eAAO,MAAM,0BAA0B,GACnC,UAAU,cAAc,EACxB,OAAO,SAAS,KACjB,OAAO,CAAC,IAAI,CAKd,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAC1B,WAAW,UAAU,EACrB,6BAA6B;IAAE,QAAQ,EAAE,cAAc,CAAC;IAAC,aAAa,EAAE,UAAU,CAAA;CAAE,EACpF,0DAKG;IACC,KAAK,EAAE,oBAAoB,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;CAClD,EACD,QAAQ,MAAM,qBAyQjB,CAAC"}

package/dist/accesslayer/consentflowcontract/relationships/update.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../../src/accesslayer/consentflowcontract/relationships/update.ts"],"names":[],"mappings":"AAEA,OAAO,EACH,gBAAgB,IAAI,oBAAoB,EAExC,2BAA2B,EAE3B,UAAU,EAGb,MAAM,kBAAkB,CAAC;AAO1B,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AASxE,eAAO,MAAM,cAAc,GACvB,cAAc;IACV,KAAK,EAAE,WAAW,CAAC;IACnB,SAAS,EAAE,UAAU,CAAC;IACtB,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,EAAE,UAAU,CAAC;CAC7B,EACD,kDAKG;IACC,KAAK,EAAE,oBAAoB,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;CAClD,EACD,QAAQ,MAAM,KACf,OAAO,CAAC,OAAO,CA8MjB,CAAC;AAEF,eAAO,MAAM,WAAW,GACpB,cAAc;IACV,KAAK,EAAE,WAAW,CAAC;IACnB,SAAS,EAAE,UAAU,CAAC;IACtB,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,EAAE,UAAU,CAAC;CAC7B,EACD,kDAKG;IACC,KAAK,EAAE,oBAAoB,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;CAClD,EACD,QAAQ,MAAM,KACf,OAAO,CAAC,OAAO,CAiNjB,CAAC;AAEF,eAAO,MAAM,aAAa,GAAU,cAAc;IAC9C,KAAK,EAAE,WAAW,CAAC;IACnB,SAAS,EAAE,UAAU,CAAC;IACtB,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,EAAE,UAAU,CAAC;CAC7B,KAAG,OAAO,CAAC,OAAO,CAqDlB,CAAC;AAEF,eAAO,MAAM,yBAAyB,GAClC,cAAc;IACV,KAAK,EAAE,WAAW,CAAC;IACnB,SAAS,EAAE,UAAU,CAAC;IACtB,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,EAAE,UAAU,CAAC;CAC7B,EACD,YAAY,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,KACrC,OAAO,CAAC,OAAO,CAoHjB,CAAC;AAEF,eAAO,MAAM,gCAAgC,GACzC,OAAO,WAAW,EAClB,aAAa,MAAM,EAAE,KACtB,OAAO,CAAC,MAAM,CAkEhB,CAAC;AAEF,eAAO,MAAM,gCAAgC,GACzC,IAAI,MAAM,EACV,WAAW,MAAM,EACjB,QAAQ,SAAS,GAAG,UAAU,GAAG,QAAQ,KAC1C,OAAO,CAAC,IAAI,CAOd,CAAC;AAEF,eAAO,MAAM,8BAA8B,GACvC,IAAI,MAAM,EACV,WAAW,MAAM,EACjB,SAAS,SAAS,GAAG,UAAU,GAAG,QAAQ,EAC1C,aAAa,MAAM,GAAG,QAAQ,GAAG,IAAI,kBAgBxC,CAAC"}
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../../src/accesslayer/consentflowcontract/relationships/update.ts"],"names":[],"mappings":"AAEA,OAAO,EACH,gBAAgB,IAAI,oBAAoB,EAExC,2BAA2B,EAE3B,UAAU,EAGb,MAAM,kBAAkB,CAAC;AAO1B,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAUxE,eAAO,MAAM,cAAc,GACvB,cAAc;IACV,KAAK,EAAE,WAAW,CAAC;IACnB,SAAS,EAAE,UAAU,CAAC;IACtB,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,EAAE,UAAU,CAAC;CAC7B,EACD,kDAKG;IACC,KAAK,EAAE,oBAAoB,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;CAClD,EACD,QAAQ,MAAM,KACf,OAAO,CAAC,OAAO,CAuMjB,CAAC;AAEF,eAAO,MAAM,WAAW,GACpB,cAAc;IACV,KAAK,EAAE,WAAW,CAAC;IACnB,SAAS,EAAE,UAAU,CAAC;IACtB,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,EAAE,UAAU,CAAC;CAC7B,EACD,kDAKG;IACC,KAAK,EAAE,oBAAoB,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;CAClD,EACD,QAAQ,MAAM,KACf,OAAO,CAAC,OAAO,CA0MjB,CAAC;AAEF,eAAO,MAAM,aAAa,GAAU,cAAc;IAC9C,KAAK,EAAE,WAAW,CAAC;IACnB,SAAS,EAAE,UAAU,CAAC;IACtB,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,EAAE,UAAU,CAAC;CAC7B,KAAG,OAAO,CAAC,OAAO,CAqDlB,CAAC;AAEF,eAAO,MAAM,yBAAyB,GAClC,cAAc;IACV,KAAK,EAAE,WAAW,CAAC;IACnB,SAAS,EAAE,UAAU,CAAC;IACtB,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,EAAE,UAAU,CAAC;CAC7B,EACD,YAAY,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,KACrC,OAAO,CAAC,OAAO,CAoHjB,CAAC;AAEF,eAAO,MAAM,gCAAgC,GACzC,OAAO,WAAW,EAClB,aAAa,MAAM,EAAE,KACtB,OAAO,CAAC,MAAM,CAkEhB,CAAC;AAEF,eAAO,MAAM,gCAAgC,GACzC,IAAI,MAAM,EACV,WAAW,MAAM,EACjB,QAAQ,SAAS,GAAG,UAAU,GAAG,QAAQ,KAC1C,OAAO,CAAC,IAAI,CAOd,CAAC;AAEF,eAAO,MAAM,8BAA8B,GACvC,IAAI,MAAM,EACV,WAAW,MAAM,EACjB,SAAS,SAAS,GAAG,UAAU,GAAG,QAAQ,EAC1C,aAAa,MAAM,GAAG,QAAQ,GAAG,IAAI,kBAgBxC,CAAC"}

package/dist/accesslayer/credential-activity/create.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../src/accesslayer/credential-activity/create.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAQ7D,eAAO,MAAM,wBAAwB,GACjC,QAAQ,2BAA2B,KACpC,OAAO,CAAC,MAAM,CAoDhB,CAAC"}
+{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../src/accesslayer/credential-activity/create.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAQ7D,eAAO,MAAM,wBAAwB,GACjC,QAAQ,2BAA2B,KACpC,OAAO,CAAC,MAAM,CAqDhB,CAAC"}

package/dist/accesslayer/credential-refresh/email-delivery.d.ts

@@ -0,0 +1,18 @@
+export type CredentialRefreshEmailDeliveryState = 'claimed' | 'delivered' | 'failed';
+export declare const claimCredentialRefreshEmailDelivery: (params: {
+    refreshId: string;
+    windowKey: string;
+}) => Promise<"claimed" | "duplicate">;
+export declare const finalizeCredentialRefreshEmailDelivery: (params: {
+    refreshId: string;
+    windowKey: string;
+    state: Extract<CredentialRefreshEmailDeliveryState, "delivered" | "failed">;
+}) => Promise<void>;
+export declare const getCredentialRefreshEmailDelivery: (refreshId: string, windowKey: string) => Promise<{
+    deliveryKey: string;
+    refreshId: string;
+    windowKey: string;
+    state: CredentialRefreshEmailDeliveryState;
+    attempts: number;
+} | null>;
+//# sourceMappingURL=email-delivery.d.ts.map

package/dist/accesslayer/credential-refresh/email-delivery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-delivery.d.ts","sourceRoot":"","sources":["../../../src/accesslayer/credential-refresh/email-delivery.ts"],"names":[],"mappings":"AAkBA,MAAM,MAAM,mCAAmC,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;AAkBrF,eAAO,MAAM,mCAAmC,GAAU,QAAQ;IAC9D,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACrB,KAAG,OAAO,CAAC,SAAS,GAAG,WAAW,CA6BlC,CAAC;AAGF,eAAO,MAAM,sCAAsC,GAAU,QAAQ;IACjE,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC,mCAAmC,EAAE,WAAW,GAAG,QAAQ,CAAC,CAAC;CAC/E,KAAG,OAAO,CAAC,IAAI,CASf,CAAC;AAGF,eAAO,MAAM,iCAAiC,GAC1C,WAAW,MAAM,EACjB,WAAW,MAAM,KAClB,OAAO,CAAC;IACP,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,mCAAmC,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CACpB,GAAG,IAAI,CAmBP,CAAC"}

package/dist/accesslayer/credential-refresh/index.d.ts

@@ -1,4 +1,5 @@
 export * from './create';
+export * from './email-delivery';
 export * from './read';
 export * from './update';
 //# sourceMappingURL=index.d.ts.map

package/dist/accesslayer/credential-refresh/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/accesslayer/credential-refresh/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,QAAQ,CAAC;AACvB,cAAc,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/accesslayer/credential-refresh/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,kBAAkB,CAAC;AACjC,cAAc,QAAQ,CAAC;AACvB,cAAc,UAAU,CAAC"}

package/dist/accesslayer/credential-refresh/read.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../../src/accesslayer/credential-refresh/read.ts"],"names":[],"mappings":"AAGA,OAAO,EACH,uBAAuB,EAEvB,4BAA4B,EAE5B,8BAA8B,EAEjC,MAAM,0BAA0B,CAAC;AAgBlC,eAAO,MAAM,oBAAoB,GAC7B,WAAW,MAAM,KAClB,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAWxC,CAAC;AAGF,eAAO,MAAM,wBAAwB,GACjC,WAAW,MAAM,KAClB,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAY7C,CAAC;AAGF,eAAO,MAAM,2BAA2B,GACpC,WAAW,MAAM,EACjB,SAAS,MAAM,KAChB,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAY7C,CAAC;AAGF,eAAO,MAAM,2CAA2C,GACpD,WAAW,MAAM,EACjB,gBAAgB,MAAM,KACvB,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAW7C,CAAC;AAEF,MAAM,MAAM,mCAAmC,GAAG;IAE9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAG;IAC7C,OAAO,EAAE,8BAA8B,EAAE,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,iCAAiC,CAAC,CAAC,IAC3C;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC;AAkBxF,eAAO,MAAM,iCAAiC,GAC1C,WAAW,MAAM,KAClB,OAAO,CAAC,iCAAiC,CAAC,4BAA4B,CAAC,CAqBzE,CAAC;AAGF,eAAO,MAAM,oCAAoC,GAC7C,WAAW,MAAM,EACjB,SAAS,MAAM,KAChB,OAAO,CAAC,iCAAiC,CAAC,4BAA4B,CAAC,CAqBzE,CAAC;AAGF,eAAO,MAAM,qCAAqC,GAC9C,WAAW,MAAM,EACjB,UAAS,mCAAwC,KAClD,OAAO,CAAC,iCAAiC,CAAC,kCAAkC,CAAC,CA6D/E,CAAC;AAMF,eAAO,MAAM,4BAA4B,GACrC,WAAW,MAAM,EACjB,UAAS,mCAAwC,KAClD,OAAO,CAAC,kCAAkC,CAoD5C,CAAC;AAEF,MAAM,MAAM,mCAAmC,GAAG;IAE9C,QAAQ,EAAE,OAAO,CAAC;IAElB,OAAO,EAAE,OAAO,CAAC;CACpB,CAAC;AAUF,eAAO,MAAM,sCAAsC,GAC/C,WAAW,MAAM,KAClB,OAAO,CAAC,mCAAmC,GAAG,IAAI,CAoBpD,CAAC"}
+{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../../src/accesslayer/credential-refresh/read.ts"],"names":[],"mappings":"AAGA,OAAO,EACH,uBAAuB,EAEvB,4BAA4B,EAE5B,8BAA8B,EAEjC,MAAM,0BAA0B,CAAC;AAgBlC,eAAO,MAAM,oBAAoB,GAC7B,WAAW,MAAM,KAClB,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAWxC,CAAC;AAGF,eAAO,MAAM,wBAAwB,GACjC,WAAW,MAAM,KAClB,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAY7C,CAAC;AAGF,eAAO,MAAM,2BAA2B,GACpC,WAAW,MAAM,EACjB,SAAS,MAAM,KAChB,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAY7C,CAAC;AAGF,eAAO,MAAM,2CAA2C,GACpD,WAAW,MAAM,EACjB,gBAAgB,MAAM,KACvB,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAW7C,CAAC;AAEF,MAAM,MAAM,mCAAmC,GAAG;IAE9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAG;IAC7C,OAAO,EAAE,8BAA8B,EAAE,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,iCAAiC,CAAC,CAAC,IAC3C;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC;AAkBxF,eAAO,MAAM,iCAAiC,GAC1C,WAAW,MAAM,KAClB,OAAO,CAAC,iCAAiC,CAAC,4BAA4B,CAAC,CAqBzE,CAAC;AAGF,eAAO,MAAM,oCAAoC,GAC7C,WAAW,MAAM,EACjB,SAAS,MAAM,KAChB,OAAO,CAAC,iCAAiC,CAAC,4BAA4B,CAAC,CAqBzE,CAAC;AAGF,eAAO,MAAM,qCAAqC,GAC9C,WAAW,MAAM,EACjB,UAAS,mCAAwC,KAClD,OAAO,CAAC,iCAAiC,CAAC,kCAAkC,CAAC,CA6D/E,CAAC;AAMF,eAAO,MAAM,4BAA4B,GACrC,WAAW,MAAM,EACjB,UAAS,mCAAwC,KAClD,OAAO,CAAC,kCAAkC,CA0D5C,CAAC;AAEF,MAAM,MAAM,mCAAmC,GAAG;IAE9C,QAAQ,EAAE,OAAO,CAAC;IAElB,OAAO,EAAE,OAAO,CAAC;CACpB,CAAC;AAUF,eAAO,MAAM,sCAAsC,GAC/C,WAAW,MAAM,KAClB,OAAO,CAAC,mCAAmC,GAAG,IAAI,CAoBpD,CAAC"}

package/dist/accesslayer/credential-refresh/update.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../src/accesslayer/credential-refresh/update.ts"],"names":[],"mappings":"AAGA,OAAO,EACH,kCAAkC,EAElC,kCAAkC,EAClC,uBAAuB,EAEvB,sBAAsB,EACzB,MAAM,0BAA0B,CAAC;AAuDlC,eAAO,MAAM,4BAA4B,GACrC,QAAQ,kCAAkC,KAC3C,OAAO,CAAC,kCAAkC,CAuK5C,CAAC;AASF,eAAO,MAAM,mCAAmC,GAAU,QAAQ;IAC9D,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAEhB,cAAc,EAAE,MAAM,CAAC;IAEvB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACtB,KAAG,OAAO,CAAC,IAAI,CAyBf,CAAC;AAGF,eAAO,MAAM,yBAAyB,GAClC,WAAW,MAAM,EACjB,OAAO,sBAAsB,EAC7B,gBAAgB,sBAAsB,KACvC,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAgBxC,CAAC;AAWF,eAAO,MAAM,8CAA8C,GACvD,kBAAkB,MAAM,EACxB,iBAAiB,MAAM,KACxB,OAAO,CAAC,OAAO,CAYjB,CAAC;AAOF,eAAO,MAAM,oCAAoC,GAC7C,kBAAkB,MAAM,KACzB,OAAO,CAAC,OAAO,CAYjB,CAAC"}
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../src/accesslayer/credential-refresh/update.ts"],"names":[],"mappings":"AAGA,OAAO,EACH,kCAAkC,EAElC,kCAAkC,EAClC,uBAAuB,EAEvB,sBAAsB,EACzB,MAAM,0BAA0B,CAAC;AAuDlC,eAAO,MAAM,4BAA4B,GACrC,QAAQ,kCAAkC,KAC3C,OAAO,CAAC,kCAAkC,CA2K5C,CAAC;AASF,eAAO,MAAM,mCAAmC,GAAU,QAAQ;IAC9D,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAEhB,cAAc,EAAE,MAAM,CAAC;IAEvB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACtB,KAAG,OAAO,CAAC,IAAI,CAyBf,CAAC;AAGF,eAAO,MAAM,yBAAyB,GAClC,WAAW,MAAM,EACjB,OAAO,sBAAsB,EAC7B,gBAAgB,sBAAsB,KACvC,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAgBxC,CAAC;AAWF,eAAO,MAAM,8CAA8C,GACvD,kBAAkB,MAAM,EACxB,iBAAiB,MAAM,KACxB,OAAO,CAAC,OAAO,CAYjB,CAAC;AAOF,eAAO,MAAM,oCAAoC,GAC7C,kBAAkB,MAAM,KACzB,OAAO,CAAC,OAAO,CAYjB,CAAC"}

package/dist/accesslayer/inbox-batch/store.d.ts

@@ -0,0 +1,33 @@
+import type { InboxBatchReceipt, IssueInboxCredentialBatchItemResult } from '@learncard/types';
+import type { BatchItem, BatchJob, BatchReplayStore, InboxDispatchLease } from '../../types/inbox-batch';
+export declare const DAY = 86400000;
+export declare const LEASE_MS = 360000;
+export declare const ensureInboxBatchConstraints: () => Promise<void>;
+export declare const createBatchJob: (input: {
+    issuer: string;
+    requestId?: string;
+    requestHash: string;
+    payload: string;
+    items: {
+        replayKey: string;
+        duplicate: boolean;
+        correlation?: string;
+    }[];
+    limit: number;
+}) => Promise<InboxBatchReceipt>;
+export declare const readBatchJob: (id: string, issuer: string) => Promise<{
+    job: BatchJob;
+    items: BatchItem[];
+}>;
+export declare const claimBatchItem: (id: string, owner: string) => Promise<{
+    job: BatchJob;
+    item: BatchItem;
+} | undefined>;
+export declare const markBatchIssuanceStarted: (id: string, owner: string) => Promise<void>;
+export declare const batchReplayStore: (itemId: string, owner: string, replayKey: string) => BatchReplayStore;
+export declare const finishBatchItem: (id: string, owner: string, result: IssueInboxCredentialBatchItemResult) => Promise<void>;
+export declare const takeInboxDispatches: () => Promise<InboxDispatchLease[]>;
+export declare const acknowledgeInboxDispatches: (leases: InboxDispatchLease[]) => Promise<void>;
+export declare const deadLetterBatchItem: (id: string) => Promise<void>;
+export declare const recoverInboxJobs: (deadline?: number) => Promise<void>;
+//# sourceMappingURL=store.d.ts.map

package/dist/accesslayer/inbox-batch/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/accesslayer/inbox-batch/store.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,mCAAmC,EAAE,MAAM,kBAAkB,CAAC;AAG/F,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAGnG,eAAO,MAAM,GAAG,WAAa,CAAC;AAC9B,eAAO,MAAM,QAAQ,SAAU,CAAC;AAIhC,eAAO,MAAM,2BAA2B,QAAO,OAAO,CAAC,IAAI,CAoC1D,CAAC;AAaF,eAAO,MAAM,cAAc,GAAU,OAAO;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACzE,KAAK,EAAE,MAAM,CAAC;CACjB,KAAG,OAAO,CAAC,iBAAiB,CAkE5B,CAAC;AAEF,eAAO,MAAM,YAAY,GACrB,IAAI,MAAM,EACV,QAAQ,MAAM,KACf,OAAO,CAAC;IAAE,GAAG,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,SAAS,EAAE,CAAA;CAAE,CAW/C,CAAC;AAGF,eAAO,MAAM,cAAc,GACvB,IAAI,MAAM,EACV,OAAO,MAAM,KACd,OAAO,CAAC;IAAE,GAAG,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAAG,SAAS,CAgBnD,CAAC;AAsBP,eAAO,MAAM,wBAAwB,GAAU,IAAI,MAAM,EAAE,OAAO,MAAM,KAAG,OAAO,CAAC,IAAI,CAIjF,CAAC;AAMP,eAAO,MAAM,gBAAgB,GACzB,QAAQ,MAAM,EACd,OAAO,MAAM,EACb,WAAW,MAAM,KAClB,gBA2DD,CAAC;AAgBH,eAAO,MAAM,eAAe,GACxB,IAAI,MAAM,EACV,OAAO,MAAM,EACb,QAAQ,mCAAmC,KAC5C,OAAO,CAAC,IAAI,CA+Bd,CAAC;AAGF,eAAO,MAAM,mBAAmB,QAAa,OAAO,CAAC,kBAAkB,EAAE,CAanE,CAAC;AAEP,eAAO,MAAM,0BAA0B,GAAU,QAAQ,kBAAkB,EAAE,KAAG,OAAO,CAAC,IAAI,CAQ3F,CAAC;AAGF,eAAO,MAAM,mBAAmB,GAAU,IAAI,MAAM,KAAG,OAAO,CAAC,IAAI,CA8B7D,CAAC;AAGP,eAAO,MAAM,gBAAgB,GAAU,iBAA8B,KAAG,OAAO,CAAC,IAAI,CAsFnF,CAAC"}

package/dist/accesslayer/inbox-credential/create.d.ts

@@ -3,6 +3,11 @@ import { ProfileType } from '../../types/profile';
 export declare const DEFAULT_INBOX_EXPIRY_DAYS = 30;
 export declare const createInboxCredential: (input: {
     credential: string;
+    refresh?: {
+        aggregate: Record<string, unknown>;
+        issueKey: string;
+        requestDigest: string;
+    };
     delivered?: boolean;
     isSigned: boolean;
     isAccepted?: boolean;

package/dist/accesslayer/inbox-credential/create.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../src/accesslayer/inbox-credential/create.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAK/E,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAI5C,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAE5C,eAAO,MAAM,qBAAqB,GAAU,OAAO;IAC/C,UAAU,EAAE,MAAM,CAAC;IAEnB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,sBAAsB,CAAC;IAClC,aAAa,EAAE,WAAW,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,mBAAmB,GAAG,mBAAmB,GAAG,mBAAmB,CAAC;CACpF,KAAG,OAAO,CAAC,mBAAmB,CAsG9B,CAAC"}
+{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../src/accesslayer/inbox-credential/create.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAK/E,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAK5C,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAE5C,eAAO,MAAM,qBAAqB,GAAU,OAAO;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IAE1F,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,sBAAsB,CAAC;IAClC,aAAa,EAAE,WAAW,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,mBAAmB,GAAG,mBAAmB,GAAG,mBAAmB,CAAC;CACpF,KAAG,OAAO,CAAC,mBAAmB,CAoI9B,CAAC"}

package/dist/accesslayer/inbox-credential/refresh.d.ts

@@ -0,0 +1,71 @@
+import type { InboxCredentialType, PublishCredentialRefreshResult } from '@learncard/types';
+export declare const getInboxRefreshIssue: (issueKey: string) => Promise<{
+    inbox: InboxCredentialType;
+    requestDigest: string;
+    claimUrl?: string;
+} | null>;
+export declare const createPendingInboxRefresh: (params: {
+    inbox: Record<string, unknown>;
+    aggregate: Record<string, unknown>;
+    issueKey: string;
+    requestDigest: string;
+}) => Promise<InboxCredentialType>;
+export declare const getPendingInboxPublication: (refreshId: string, idempotencyKey?: string) => Promise<PublishCredentialRefreshResult | null>;
+export declare const advancePendingInboxRefresh: (params: {
+    refreshId: string;
+    expectedVersion: number;
+    credential: string;
+    credentialName?: string;
+    materialDigest: string;
+    idempotencyKey?: string;
+    updateSummary?: string;
+}) => Promise<PublishCredentialRefreshResult | null>;
+export declare const bindPendingInboxRefresh: (params: {
+    inboxId: string;
+    refreshId: string;
+    expectedVersion: number;
+    holderDid: string;
+    holderProfileId?: string;
+    issuerProfileId: string;
+    root: Record<string, unknown>;
+    aggregate: Record<string, unknown>;
+    deliveryCredential: string;
+    deliveryExpiresAt: string;
+    accepted: boolean;
+    boostId?: string;
+}) => Promise<boolean>;
+export declare const getInboxRefreshSnapshot: (inboxId: string) => Promise<{
+    inbox: any;
+    aggregate: {
+        refreshId: string;
+        issuerProfileId: string;
+        issuerDid: string;
+        credentialId: string;
+        state: "active" | "revoked" | "pending_holder" | "awaiting_claim";
+        currentVersion: number;
+        createdAt: string;
+        updatedAt: string;
+        inboxCredentialId?: string | undefined;
+        inboxCredentialStatus?: string | undefined;
+        holderProfileId?: string | undefined;
+        holderDid?: string | undefined;
+        etag?: string | undefined;
+        materialDigest?: string | undefined;
+        rootMaterialDigest?: string | undefined;
+        credentialStatusDigest?: string | undefined;
+        credentialSubjectDigest?: string | undefined;
+        boostId?: string | undefined;
+        signingMode?: "issuer-signed" | "signing-authority" | undefined;
+        idempotencyKey?: string | undefined;
+        updateSummary?: string | undefined;
+        credentialDisplayName?: string | undefined;
+        lastPublishedAt?: string | undefined;
+        notificationWindowKey?: string | undefined;
+        lastNotificationId?: string | undefined;
+        lastNotificationAt?: string | undefined;
+        initialNotificationSentAt?: string | undefined;
+        initialNotificationSuppressed?: boolean | undefined;
+    };
+} | null>;
+export declare const recordInboxRefreshClaimUrl: (id: string, claimUrl: string) => Promise<string>;
+//# sourceMappingURL=refresh.d.ts.map

package/dist/accesslayer/inbox-credential/refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../src/accesslayer/inbox-credential/refresh.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,mBAAmB,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAG5F,eAAO,MAAM,oBAAoB,GAC7B,UAAU,MAAM,KACjB,OAAO,CAAC;IACP,KAAK,EAAE,mBAAmB,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,IAAI,CAaP,CAAC;AAGF,eAAO,MAAM,yBAAyB,GAAU,QAAQ;IACpD,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACzB,KAAG,OAAO,CAAC,mBAAmB,CAuB9B,CAAC;AAGF,eAAO,MAAM,0BAA0B,GACnC,WAAW,MAAM,EACjB,iBAAiB,MAAM,KACxB,OAAO,CAAC,8BAA8B,GAAG,IAAI,CAe/C,CAAC;AAGF,eAAO,MAAM,0BAA0B,GAAU,QAAQ;IACrD,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B,KAAG,OAAO,CAAC,8BAA8B,GAAG,IAAI,CA6ChD,CAAC;AAGF,eAAO,MAAM,uBAAuB,GAAU,QAAQ;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,KAAG,OAAO,CAAC,OAAO,CAwClB,CAAC;AAGF,eAAO,MAAM,uBAAuB,GAAU,SAAS,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SAiB5D,CAAC;AAEF,eAAO,MAAM,0BAA0B,GAAU,IAAI,MAAM,EAAE,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,CAQ7F,CAAC"}

package/dist/accesslayer/inbox-credential/update.d.ts

@@ -1,6 +1,6 @@
 import { InboxCredentialType } from '@learncard/types';
 import { InboxDelivery } from '../../types/inbox-delivery';
-export declare const updateInboxCredential: (id: string, updates: Partial<Omit<InboxCredentialType, "id" | "createdAt" | "credential">>) => Promise<InboxCredentialType | null>;
+export declare const updateInboxCredential: (id: string, updates: Partial<Omit<InboxCredentialType, "id" | "createdAt" | "credential" | "refresh">>) => Promise<InboxCredentialType | null>;
 export declare const finalizeAndWipeInboxCredential: (id: string, delivery: InboxDelivery, { isAccepted }?: {
     isAccepted?: boolean;
 }) => Promise<InboxCredentialType | null>;

package/dist/accesslayer/inbox-credential/update.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../src/accesslayer/inbox-credential/update.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EACH,aAAa,EAGhB,MAAM,sBAAsB,CAAC;AAE9B,eAAO,MAAM,qBAAqB,GAC9B,IAAI,MAAM,EACV,SAAS,OAAO,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,GAAG,WAAW,GAAG,YAAY,CAAC,CAAC,KAC/E,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAcpC,CAAC;AAGF,eAAO,MAAM,8BAA8B,GACvC,IAAI,MAAM,EACV,UAAU,aAAa,EACvB,iBAAuB;IAAE,UAAU,CAAC,EAAE,OAAO,CAAA;CAAO,KACrD,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAsCpC,CAAC;AAEF,eAAO,MAAM,sBAAsB,GAC/B,cAAoC,KACrC,OAAO,CAAC,MAAM,CAyBhB,CAAC;AAKF,eAAO,MAAM,0BAA0B,GACnC,cAAoC,KACrC,OAAO,CAAC,MAAM,CAWhB,CAAC"}
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../src/accesslayer/inbox-credential/update.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EACH,aAAa,EAGhB,MAAM,sBAAsB,CAAC;AAE9B,eAAO,MAAM,qBAAqB,GAC9B,IAAI,MAAM,EACV,SAAS,OAAO,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,GAAG,WAAW,GAAG,YAAY,GAAG,SAAS,CAAC,CAAC,KAC3F,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAcpC,CAAC;AAGF,eAAO,MAAM,8BAA8B,GACvC,IAAI,MAAM,EACV,UAAU,aAAa,EACvB,iBAAuB;IAAE,UAAU,CAAC,EAAE,OAAO,CAAA;CAAO,KACrD,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAsCpC,CAAC;AAEF,eAAO,MAAM,sBAAsB,GAC/B,cAAoC,KACrC,OAAO,CAAC,MAAM,CAyBhB,CAAC;AAKF,eAAO,MAAM,0BAA0B,GACnC,cAAoC,KACrC,OAAO,CAAC,MAAM,CAWhB,CAAC"}

package/dist/accesslayer/presentation/read.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../../src/accesslayer/presentation/read.ts"],"names":[],"mappings":"AACA,OAAO,EAEH,oBAAoB,EAIvB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAKtD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAI5C,eAAO,MAAM,mBAAmB,GAAU,IAAI,MAAM,KAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAEzF,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAAU,KAAK,MAAM,KAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAI3F,CAAC;AAEF,eAAO,MAAM,kCAAkC,GAC3C,QAAQ,MAAM,EACd,SAAS,WAAW,EACpB,kBAGG;IACC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB,KACF,OAAO,CAAC,kBAAkB,EAAE,CAsC9B,CAAC;AAEF,eAAO,MAAM,8BAA8B,GACvC,QAAQ,MAAM,EACd,SAAS,WAAW,EACpB,gBAGG;IACC,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB,KACF,OAAO,CAAC,kBAAkB,EAAE,CA8C9B,CAAC;AAEF,eAAO,MAAM,kCAAkC,GAC3C,QAAQ,MAAM,EACd,SAAS,WAAW,EACpB,kBAGG;IACC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB,KACF,OAAO,CAAC,kBAAkB,EAAE,CAuC9B,CAAC"}
+{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../../src/accesslayer/presentation/read.ts"],"names":[],"mappings":"AACA,OAAO,EAEH,oBAAoB,EAIvB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAKtD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAU5C,eAAO,MAAM,mBAAmB,GAAU,IAAI,MAAM,KAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAEzF,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAAU,KAAK,MAAM,KAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAI3F,CAAC;AAEF,eAAO,MAAM,kCAAkC,GAC3C,QAAQ,MAAM,EACd,SAAS,WAAW,EACpB,kBAGG;IACC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB,KACF,OAAO,CAAC,kBAAkB,EAAE,CA+C9B,CAAC;AAEF,eAAO,MAAM,8BAA8B,GACvC,QAAQ,MAAM,EACd,SAAS,WAAW,EACpB,gBAGG;IACC,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB,KACF,OAAO,CAAC,kBAAkB,EAAE,CAuD9B,CAAC;AAEF,eAAO,MAAM,kCAAkC,GAC3C,QAAQ,MAAM,EACd,SAAS,WAAW,EACpB,kBAGG;IACC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB,KACF,OAAO,CAAC,kBAAkB,EAAE,CA+C9B,CAAC"}

package/dist/accesslayer/presentation/relationships/create.d.ts

@@ -1,5 +1,5 @@
 import { PresentationInstance } from '../../.././models/index';
 import { ProfileType } from '../../../types/profile';
-export declare const createSentPresentationRelationship: (from: ProfileType, to: ProfileType, presentation: PresentationInstance) => Promise<void>;
-export declare const createReceivedPresentationRelationship: (to: ProfileType, from: ProfileType, presentation: PresentationInstance) => Promise<void>;
+export declare const createSentPresentationRelationship: (from: ProfileType, to: ProfileType, presentation: PresentationInstance, metadata?: Record<string, unknown>) => Promise<void>;
+export declare const createReceivedPresentationRelationship: (to: ProfileType, from: ProfileType, presentation: PresentationInstance, metadata?: Record<string, unknown>) => Promise<void>;
 //# sourceMappingURL=create.d.ts.map

package/dist/accesslayer/presentation/relationships/create.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../../src/accesslayer/presentation/relationships/create.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAW,MAAM,SAAS,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE5C,eAAO,MAAM,kCAAkC,GAC3C,MAAM,WAAW,EACjB,IAAI,WAAW,EACf,cAAc,oBAAoB,KACnC,OAAO,CAAC,IAAI,CAMd,CAAC;AAEF,eAAO,MAAM,sCAAsC,GAC/C,IAAI,WAAW,EACf,MAAM,WAAW,EACjB,cAAc,oBAAoB,KACnC,OAAO,CAAC,IAAI,CAMd,CAAC"}
+{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../../src/accesslayer/presentation/relationships/create.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,oBAAoB,EAAW,MAAM,SAAS,CAAC;AAEtE,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE5C,eAAO,MAAM,kCAAkC,GAC3C,MAAM,WAAW,EACjB,IAAI,WAAW,EACf,cAAc,oBAAoB,EAClC,WAAW,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KACnC,OAAO,CAAC,IAAI,CAyBd,CAAC;AAEF,eAAO,MAAM,sCAAsC,GAC/C,IAAI,WAAW,EACf,MAAM,WAAW,EACjB,cAAc,oBAAoB,EAClC,WAAW,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KACnC,OAAO,CAAC,IAAI,CAyBd,CAAC"}

package/dist/accesslayer/presentation/relationships/read.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../../../src/accesslayer/presentation/relationships/read.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,oBAAoB,EAAW,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAC5F,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE5C,eAAO,MAAM,4BAA4B,GACrC,IAAI,MAAM,EACV,IAAI,WAAW,KAChB,OAAO,CACJ;IACE,MAAM,EAAE,WAAW,CAAC;IACpB,YAAY,EAAE,oBAAoB,CAAC,kBAAkB,CAAC,CAAC,wBAAwB,CAAC,CAAC;IACjF,MAAM,EAAE,oBAAoB,CAAC;CAChC,GACC,SAAS,CAYd,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAC7B,cAAc,oBAAoB,KACnC,OAAO,CAAC,WAAW,GAAG,SAAS,CAajC,CAAC;AAEF,eAAO,MAAM,gCAAgC,GACzC,gBAAgB,MAAM,EACtB,SAAS,WAAW,KACrB,OAAO,CAAC,OAAO,CAUjB,CAAC"}
+{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../../../src/accesslayer/presentation/relationships/read.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,oBAAoB,EAAW,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAC5F,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAa5C,eAAO,MAAM,4BAA4B,GACrC,IAAI,MAAM,EACV,IAAI,WAAW,KAChB,OAAO,CACJ;IACI,MAAM,EAAE,WAAW,CAAC;IACpB,YAAY,EAAE,oBAAoB,CAAC,kBAAkB,CAAC,CAAC,wBAAwB,CAAC,CAAC;IACjF,MAAM,EAAE,oBAAoB,CAAC;CAChC,GACD,SAAS,CAgBd,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAC7B,cAAc,oBAAoB,KACnC,OAAO,CAAC,WAAW,GAAG,SAAS,CAajC,CAAC;AAEF,eAAO,MAAM,gCAAgC,GACzC,gBAAgB,MAAM,EACtB,SAAS,WAAW,KACrB,OAAO,CAAC,OAAO,CAUjB,CAAC"}

package/dist/accesslayer/share-link/abandon.d.ts

@@ -0,0 +1,3 @@
+import type { AbandonReservationInput, AbandonReservationResult } from './types';
+export declare const abandonReservation: (input: AbandonReservationInput) => Promise<AbandonReservationResult>;
+//# sourceMappingURL=abandon.d.ts.map

package/dist/accesslayer/share-link/abandon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"abandon.d.ts","sourceRoot":"","sources":["../../../src/accesslayer/share-link/abandon.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAC;AAcjF,eAAO,MAAM,kBAAkB,GAC3B,OAAO,uBAAuB,KAC/B,OAAO,CAAC,wBAAwB,CAuElC,CAAC"}

package/dist/accesslayer/share-link/cleanup.d.ts

@@ -0,0 +1,6 @@
+import type { ClaimCleanupJobsInput, ClaimCleanupJobsResult, CompleteCleanupJobInput, CompleteCleanupJobResult, ShareContentCleanupJobRecord } from './types';
+export declare const claimCleanupJobs: (input: ClaimCleanupJobsInput) => Promise<ClaimCleanupJobsResult>;
+export declare const completeCleanupJob: (input: CompleteCleanupJobInput) => Promise<CompleteCleanupJobResult>;
+export declare const getCleanupJob: (objectRef: string) => Promise<ShareContentCleanupJobRecord | null>;
+export declare const listCleanupJobsForShare: (shareId: string) => Promise<ShareContentCleanupJobRecord[]>;
+//# sourceMappingURL=cleanup.d.ts.map

package/dist/accesslayer/share-link/cleanup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cleanup.d.ts","sourceRoot":"","sources":["../../../src/accesslayer/share-link/cleanup.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EACR,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,EACvB,wBAAwB,EACxB,4BAA4B,EAC/B,MAAM,SAAS,CAAC;AA2DjB,eAAO,MAAM,gBAAgB,GACzB,OAAO,qBAAqB,KAC7B,OAAO,CAAC,sBAAsB,CAkEhC,CAAC;AAOF,eAAO,MAAM,kBAAkB,GAC3B,OAAO,uBAAuB,KAC/B,OAAO,CAAC,wBAAwB,CAgFlC,CAAC;AAGF,eAAO,MAAM,aAAa,GACtB,WAAW,MAAM,KAClB,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAQ7C,CAAC;AAGF,eAAO,MAAM,uBAAuB,GAChC,SAAS,MAAM,KAChB,OAAO,CAAC,4BAA4B,EAAE,CAaxC,CAAC"}

package/dist/accesslayer/share-link/errors.d.ts

@@ -0,0 +1,8 @@
+export type ShareLinkRepositoryErrorCode = 'NOT_FOUND' | 'CONFLICT' | 'OPERATION_IN_FLIGHT' | 'LEASE_EXPIRED' | 'STALE_GENERATION' | 'PRECONDITION_FAILED' | 'INVALID_INPUT';
+export declare class ShareLinkRepositoryError extends Error {
+    readonly code: ShareLinkRepositoryErrorCode;
+    constructor(code: ShareLinkRepositoryErrorCode, message: string);
+}
+export declare const isShareLinkRepositoryError: (error: unknown) => error is ShareLinkRepositoryError;
+export declare function failShareLink(code: ShareLinkRepositoryErrorCode, message: string): never;
+//# sourceMappingURL=errors.d.ts.map

package/dist/accesslayer/share-link/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/accesslayer/share-link/errors.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,4BAA4B,GAClC,WAAW,GACX,UAAU,GACV,qBAAqB,GACrB,eAAe,GACf,kBAAkB,GAClB,qBAAqB,GACrB,eAAe,CAAC;AAEtB,qBAAa,wBAAyB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,IAAI,EAAE,4BAA4B,CAAC;gBAEhC,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,MAAM;CAKlE;AAED,eAAO,MAAM,0BAA0B,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,wBACxB,CAAC;AAE9C,wBAAgB,aAAa,CAAC,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,MAAM,GAAG,KAAK,CAExF"}

package/dist/accesslayer/share-link/finalize.d.ts

@@ -0,0 +1,3 @@
+import type { FinalizeReservationInput, FinalizeReservationResult } from './types';
+export declare const finalizeReservation: (input: FinalizeReservationInput) => Promise<FinalizeReservationResult>;
+//# sourceMappingURL=finalize.d.ts.map

package/dist/accesslayer/share-link/finalize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"finalize.d.ts","sourceRoot":"","sources":["../../../src/accesslayer/share-link/finalize.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,SAAS,CAAC;AAqBnF,eAAO,MAAM,mBAAmB,GAC5B,OAAO,wBAAwB,KAChC,OAAO,CAAC,yBAAyB,CA6NnC,CAAC"}