@learncard/network-plugin 2.13.16 → 2.14.0

package/dist/lcn-plugin.esm.js

@@ -15873,7 +15873,10 @@ var SendOptionsValidator = external_exports.object({
   webhookUrl: external_exports.string().url().optional().describe("Webhook URL to receive claim notifications"),
   suppressDelivery: external_exports.boolean().optional().describe("If true, returns claimUrl without sending email/SMS"),
   branding: SendBrandingOptionsValidator.optional().describe("Branding for email/SMS delivery"),
-  guardianEmail: external_exports.string().email().optional().describe("Guardian email that must approve before student can claim")
+  guardianEmail: external_exports.string().email().optional().describe("Guardian email that must approve before student can claim"),
+  expiresInDays: external_exports.number().int().min(1).max(720).optional().describe(
+    "How many days the credential stays claimable in the Universal Inbox (default 30). Does not change the credential validity period."
+  )
 });
 var SendBoostInputValidator = external_exports.object({
   type: external_exports.literal("boost"),
@@ -16168,7 +16171,8 @@ var LCNNotificationTypeEnumValidator = external_exports.enum([
   "APP_NOTIFICATION",
   "CREDENTIAL_REVOKED",
   "CREDENTIAL_SUSPENDED",
-  "CREDENTIAL_UNSUSPENDED"
+  "CREDENTIAL_UNSUSPENDED",
+  "CREDENTIAL_REFRESHED"
 ]);
 var LCNNotificationMessageValidator = external_exports.object({
   title: external_exports.string().optional(),
@@ -16300,12 +16304,16 @@ var CreateContactMethodSessionResponseValidator = external_exports.object({
 });
 var InboxCredentialValidator = external_exports.object({
   id: external_exports.string(),
-  credential: external_exports.string(),
+  credential: external_exports.string().optional(),
   isSigned: external_exports.boolean(),
   currentStatus: LCNInboxStatusEnumValidator,
   isAccepted: external_exports.boolean().optional(),
   expiresAt: external_exports.string(),
   createdAt: external_exports.string(),
+  finalizedAt: external_exports.string().optional(),
+  expiredAt: external_exports.string().optional(),
+  credentialName: external_exports.string().optional(),
+  achievementType: external_exports.string().optional(),
   issuerDid: external_exports.string(),
   webhookUrl: external_exports.string().optional(),
   boostUri: external_exports.string().optional(),
@@ -16359,7 +16367,9 @@ var IssueInboxCredentialValidator = external_exports.object({
       "The signing authority to use for the credential. If not provided, the users default signing authority will be used if the credential is not signed."
     ),
     webhookUrl: external_exports.string().url().optional().describe("The webhook URL to receive credential issuance events."),
-    expiresInDays: external_exports.number().min(1).max(365).optional().describe("The number of days the credential will be valid for."),
+    expiresInDays: external_exports.number().int().min(1).max(720).optional().describe(
+      "How many days the encrypted inbox payload remains claimable. This does not change the credential validity period."
+    ),
     templateData: external_exports.record(external_exports.string(), external_exports.unknown()).optional().describe(
       "Template data to render into the boost credential template using Mustache syntax. Only used when boostUri is provided."
     ),
@@ -16422,6 +16432,9 @@ var ClaimInboxCredentialValidator = external_exports.object({
   credential: VCValidator.or(VPValidator).or(UnsignedVCValidator).or(CredentialNameRefValidator).describe("The credential to issue, or a { name } reference to resolve a boost template."),
   configuration: external_exports.object({
     publishableKey: external_exports.string(),
+    expiresInDays: external_exports.number().int().min(1).max(720).optional().describe(
+      "Inbox claim window in days. Defaults to 720; use a shorter window for sensitive records."
+    ),
     signingAuthorityName: external_exports.string().optional(),
     listingId: external_exports.string().optional(),
     listingSlug: external_exports.string().optional()
@@ -17048,6 +17061,191 @@ var inAppMessagesFlagValidator = external_exports.object({
   version: external_exports.number().default(1),
   messages: external_exports.array(inAppMessageValidator).default([])
 }).passthrough();
+var LearnCardRefreshAuthorizationValidator = external_exports.object({ type: external_exports.literal("LearnCardDIDAuth") }).catchall(external_exports.any());
+var ManagedCredentialRefreshServiceValidator = external_exports.object({
+  id: external_exports.string().min(1),
+  type: external_exports.literal("LearnCardCredentialRefresh2026"),
+  authorization: LearnCardRefreshAuthorizationValidator.optional()
+}).catchall(external_exports.any());
+var StandardCredentialRefreshServiceValidator = external_exports.object({
+  id: external_exports.string().min(1),
+  type: external_exports.literal("1EdTechCredentialRefresh")
+}).catchall(external_exports.any());
+var SupportedCredentialRefreshServiceValidator = external_exports.union([
+  ManagedCredentialRefreshServiceValidator,
+  StandardCredentialRefreshServiceValidator
+]);
+var AllocateCredentialRefreshInputValidator = external_exports.object({
+  holder: external_exports.object({
+    profileId: external_exports.string().optional(),
+    did: external_exports.string().min(1)
+  }),
+  credentialId: external_exports.string().min(1)
+});
+var AllocateCredentialRefreshResultValidator = external_exports.object({
+  refreshId: external_exports.string().min(1),
+  refreshService: ManagedCredentialRefreshServiceValidator.extend({
+    authorization: LearnCardRefreshAuthorizationValidator
+  })
+});
+var CredentialRefreshSigningModeValidator = external_exports.enum(["issuer-signed", "signing-authority"]);
+var PublishCredentialRefreshBaseFields = {
+  refreshId: external_exports.string().min(1),
+  notifyHolder: external_exports.boolean().optional(),
+  updateSummary: external_exports.string().optional(),
+  idempotencyKey: external_exports.string().optional()
+};
+var PublishIssuerSignedRefreshValidator = external_exports.object({
+  ...PublishCredentialRefreshBaseFields,
+  mode: external_exports.literal("issuer-signed"),
+  signedCredential: VCValidator
+});
+var PublishSigningAuthorityRefreshValidator = external_exports.object({
+  ...PublishCredentialRefreshBaseFields,
+  mode: external_exports.literal("signing-authority"),
+  credential: UnsignedVCValidator,
+  signingAuthority: external_exports.object({
+    type: external_exports.string().min(1)
+  }).catchall(external_exports.any())
+});
+var PublishCredentialRefreshInputValidator = external_exports.object({
+  ...PublishCredentialRefreshBaseFields,
+  mode: CredentialRefreshSigningModeValidator,
+  signedCredential: VCValidator.optional(),
+  credential: UnsignedVCValidator.optional(),
+  signingAuthority: external_exports.object({
+    type: external_exports.string().min(1)
+  }).catchall(external_exports.any()).optional()
+}).superRefine((input, ctx) => {
+  if (input.mode === "issuer-signed" && !input.signedCredential) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["signedCredential"],
+      message: "signedCredential is required for issuer-signed publication"
+    });
+  }
+  if (input.mode === "issuer-signed" && (input.credential !== void 0 || input.signingAuthority !== void 0)) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["mode"],
+      message: "issuer-signed publication cannot include signing-authority fields"
+    });
+  }
+  if (input.mode === "signing-authority") {
+    if (input.signedCredential !== void 0) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["signedCredential"],
+        message: "signing-authority publication cannot include signedCredential"
+      });
+    }
+    if (!input.credential) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["credential"],
+        message: "credential is required for signing-authority publication"
+      });
+    }
+    if (!input.signingAuthority) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["signingAuthority"],
+        message: "signingAuthority is required for signing-authority publication"
+      });
+    }
+  }
+});
+var PublishCredentialRefreshNotificationValidator = external_exports.enum([
+  "queued",
+  "suppressed",
+  "not-applicable",
+  /** Publication succeeded, but the post-commit notification enqueue must be retried. */
+  "delivery-failed"
+]);
+var PublishCredentialRefreshResultValidator = external_exports.object({
+  refreshId: external_exports.string().min(1),
+  version: external_exports.number().int().positive(),
+  publishedAt: external_exports.string().min(1),
+  notification: PublishCredentialRefreshNotificationValidator
+});
+var CredentialRefreshVersionMetadataValidator = external_exports.object({
+  version: external_exports.number().int().positive(),
+  publishedAt: external_exports.string().min(1),
+  effectiveAt: external_exports.string().optional(),
+  etag: external_exports.string().optional(),
+  signingMode: CredentialRefreshSigningModeValidator.optional(),
+  updateSummary: external_exports.string().optional()
+});
+var GetCredentialRefreshHistoryInputValidator = external_exports.object({
+  refreshId: external_exports.string().min(1),
+  cursor: external_exports.string().optional(),
+  limit: external_exports.number().int().positive().optional()
+});
+var GetCredentialRefreshHistoryResultValidator = external_exports.object({
+  records: CredentialRefreshVersionMetadataValidator.array(),
+  hasMore: external_exports.boolean(),
+  cursor: external_exports.string().optional()
+});
+var CredentialRefreshChallengeValidator = external_exports.object({
+  challenge: external_exports.string().min(1),
+  expiresAt: external_exports.string().min(1),
+  domain: external_exports.string().optional(),
+  scheme: external_exports.literal("LearnCardDIDAuth").optional()
+});
+var PublicCredentialRefreshEnvelopeValidator = external_exports.object({
+  format: external_exports.literal("vc"),
+  credential: VCValidator,
+  etag: external_exports.string().optional()
+});
+var JweCredentialRefreshEnvelopeValidator = external_exports.object({
+  format: external_exports.literal("jwe"),
+  jwe: JWEValidator,
+  etag: external_exports.string().optional(),
+  /** Present on LearnCard-managed endpoints; optional for interoperable JWE services. */
+  version: external_exports.number().int().positive().optional()
+});
+var CredentialRefreshResponseEnvelopeValidator = external_exports.discriminatedUnion("format", [
+  PublicCredentialRefreshEnvelopeValidator,
+  JweCredentialRefreshEnvelopeValidator
+]);
+var CredentialRefreshFailureCodeValidator = external_exports.enum([
+  "UNAVAILABLE",
+  "TIMEOUT",
+  "UNSUPPORTED_SERVICE",
+  "UNAUTHORIZED",
+  "MALFORMED_RESPONSE",
+  "INVALID_PROOF",
+  "ISSUER_MISMATCH",
+  "ID_MISMATCH",
+  "ROLLBACK",
+  "REVOKED",
+  "UNSAFE_ENDPOINT"
+]);
+var CredentialRefreshUpdatedResultValidator = external_exports.object({
+  status: external_exports.literal("updated"),
+  credential: VCValidator,
+  etag: external_exports.string().optional(),
+  managedVersion: external_exports.number().int().positive().optional()
+});
+var CredentialRefreshUnchangedResultValidator = external_exports.object({
+  status: external_exports.literal("unchanged"),
+  checkedAt: external_exports.string().min(1),
+  etag: external_exports.string().optional()
+});
+var CredentialRefreshUnsupportedResultValidator = external_exports.object({
+  status: external_exports.literal("unsupported")
+});
+var CredentialRefreshFailedResultValidator = external_exports.object({
+  status: external_exports.literal("failed"),
+  code: CredentialRefreshFailureCodeValidator,
+  retryable: external_exports.boolean()
+});
+var CredentialRefreshResultValidator = external_exports.discriminatedUnion("status", [
+  CredentialRefreshUpdatedResultValidator,
+  CredentialRefreshUnchangedResultValidator,
+  CredentialRefreshUnsupportedResultValidator,
+  CredentialRefreshFailedResultValidator
+]);
 
 // src/plugin.ts
 import {
@@ -17528,6 +17726,56 @@ mustache.Writer = Writer;
 var mustache_default = mustache;
 
 // src/plugin.ts
+var LEARNCARD_DOMAIN_SUFFIXES = [".learncard.com", ".learncard.app", ".learncard.ai"];
+var isLearnCardDomain = /* @__PURE__ */ __name((host) => {
+  return LEARNCARD_DOMAIN_SUFFIXES.some(
+    (suffix) => host === suffix.replace(/^\./, "") || host.endsWith(suffix)
+  );
+}, "isLearnCardDomain");
+var isLocalhostHost = /* @__PURE__ */ __name((host) => {
+  const lower = host.toLowerCase();
+  return lower === "localhost" || lower === "127.0.0.1";
+}, "isLocalhostHost");
+var validateFederationUrl = /* @__PURE__ */ __name((userProvidedUrl, config2) => {
+  let parsed;
+  try {
+    parsed = new URL(userProvidedUrl);
+  } catch {
+    throw new Error(`Invalid federation endpoint URL: ${userProvidedUrl}`);
+  }
+  if (config2.serviceOrigin) {
+    const endpointOrigin = parsed.origin;
+    if (endpointOrigin === config2.serviceOrigin) {
+      return parsed.href;
+    }
+  }
+  const host = parsed.hostname.toLowerCase();
+  const isLocalhost = isLocalhostHost(host);
+  if (isLocalhost) {
+    if (!config2.allowLocalhostFederation) {
+      throw new Error(
+        `Localhost federation is disabled. Set allowLocalhostFederation: true for development.`
+      );
+    }
+    if (parsed.protocol === "https:") {
+      parsed.protocol = "http:";
+    }
+    return parsed.href;
+  }
+  if (parsed.protocol !== "https:") {
+    throw new Error(`Federation requires HTTPS for non-localhost hosts: ${userProvidedUrl}`);
+  }
+  if (config2.trustedFederationHosts !== void 0) {
+    const trustedHosts = new Set(config2.trustedFederationHosts);
+    const allowAnyHost = trustedHosts.has("*");
+    if (!allowAnyHost && !isLearnCardDomain(host) && !trustedHosts.has(host)) {
+      throw new Error(
+        `Federation host '${host}' is not trusted. Add it to trustedFederationHosts or use '*' to allow any host.`
+      );
+    }
+  }
+  return parsed.href;
+}, "validateFederationUrl");
 var uint8ArrayToBase64Url = /* @__PURE__ */ __name((bytes) => {
   let binary = "";
   for (let i = 0; i < bytes.length; i += 1) binary += String.fromCharCode(bytes[i]);
@@ -17619,10 +17867,43 @@ var issueCredentialWithNetworkStatus = /* @__PURE__ */ __name(async (learnCard,
     await appendNetworkCredentialStatus(client, credential, statusPurposes)
   );
 }, "issueCredentialWithNetworkStatus");
+var MANAGED_REFRESH_SERVICE_CONTEXT = {
+  "LearnCardCredentialRefresh2026": "https://learncard.com/refresh#LearnCardCredentialRefresh2026",
+  authorization: {
+    "@id": "https://purl.imsglobal.org/spec/ob/v3p0#authorization",
+    "@context": {
+      LearnCardDIDAuth: "https://docs.learncard.com/definitions#LearnCardDIDAuth"
+    }
+  }
+};
+var injectManagedRefreshService = /* @__PURE__ */ __name((credential, refreshService) => {
+  const existingContext = credential["@context"];
+  const contextList = Array.isArray(existingContext) ? existingContext : [existingContext];
+  const hasMapping = contextList.some(
+    (entry) => !!entry && typeof entry === "object" && "LearnCardCredentialRefresh2026" in entry
+  );
+  return {
+    ...credential,
+    "@context": hasMapping ? contextList : [...contextList, MANAGED_REFRESH_SERVICE_CONTEXT],
+    refreshService
+  };
+}, "injectManagedRefreshService");
 async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, options) {
   const apiToken = typeof apiTokenOrOptions === "string" ? apiTokenOrOptions : void 0;
-  const guardianApprovalGetter = (typeof apiTokenOrOptions === "object" ? apiTokenOrOptions?.guardianApprovalGetter : void 0) ?? options?.guardianApprovalGetter;
-  const extraHeaders = (typeof apiTokenOrOptions === "object" ? apiTokenOrOptions?.extraHeaders : void 0) ?? options?.extraHeaders;
+  const resolvedOptions = (typeof apiTokenOrOptions === "object" ? apiTokenOrOptions : options) ?? {};
+  const {
+    guardianApprovalGetter,
+    extraHeaders,
+    trustedFederationHosts,
+    allowLocalhostFederation
+  } = resolvedOptions;
+  const serviceUrl = new URL(url2);
+  const serviceIsLocalhost = isLocalhostHost(serviceUrl.hostname);
+  const federationConfig = {
+    trustedFederationHosts,
+    allowLocalhostFederation: allowLocalhostFederation ?? serviceIsLocalhost,
+    serviceOrigin: serviceUrl.origin
+  };
   let did = "";
   try {
     const idPlane = learnCard?.id;
@@ -17691,8 +17972,8 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
     }
   }, "getBoostTemplateForIssuance");
   const getInboxEndpointForDid = /* @__PURE__ */ __name(async (_learnCard, recipientDid) => {
-    const serviceUrl = new URL(url2);
-    const serviceDomain = `${serviceUrl.hostname}${serviceUrl.port ? `%3A${serviceUrl.port}` : ""}`;
+    const serviceUrl2 = new URL(url2);
+    const serviceDomain = `${serviceUrl2.hostname}${serviceUrl2.port ? `%3A${serviceUrl2.port}` : ""}`;
     const localServiceDid = `did:web:${serviceDomain}`;
     const getInferredServiceDid = /* @__PURE__ */ __name((did2) => {
       if (!did2.startsWith("did:web:")) return null;
@@ -17713,12 +17994,12 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
     }), "getInboxService");
     const inferredServiceDid = getInferredServiceDid(recipientDid);
     if (inferredServiceDid === localServiceDid) {
-      return `${serviceUrl.origin}/api/inbox/receive`;
+      return `${serviceUrl2.origin}/api/inbox/receive`;
     }
     const didDoc = await _learnCard.invoke.resolveDid(recipientDid);
     const inboxService = getInboxService(didDoc);
     if ((inboxService?.serviceDid || inferredServiceDid) === localServiceDid) {
-      return `${serviceUrl.origin}/api/inbox/receive`;
+      return `${serviceUrl2.origin}/api/inbox/receive`;
     }
     if (!inboxService?.serviceEndpoint) {
       throw new Error(
@@ -17880,7 +18161,8 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
         return client.profileManager.updateProfileManager.mutate(manager);
       }, "updateProfileManagerProfile"),
       deleteProfile: /* @__PURE__ */ __name(async () => {
-        if (!userData) throw new Error("Account does not exist!");
+        await initialQuery;
+        if (!apiToken) await ensureUser();
         const result = await client.profile.deleteProfile.mutate();
         if (result) {
           userData = void 0;
@@ -18031,11 +18313,10 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
             proofFormat: "jwt",
             challenge: `inbox-federation-${crypto.randomUUID()}`
           });
-          let receiveUrl = inboxEndpoint;
-          if (receiveUrl.includes("localhost")) {
-            receiveUrl = receiveUrl.replace("https://", "http://");
-          }
+          const receiveUrl = validateFederationUrl(inboxEndpoint, federationConfig);
           const response = await fetch(receiveUrl, {
+            // A redirect must not bypass endpoint validation or forward credentials.
+            redirect: "error",
             method: "POST",
             headers: {
               "Content-Type": "application/json",
@@ -18368,6 +18649,27 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
         await ensureUser();
         return client.boost.allocateCredentialStatus.mutate(options2);
       }, "allocateCredentialStatus"),
+      allocateCredentialRefresh: /* @__PURE__ */ __name(async (_learnCard, input) => {
+        await ensureUser();
+        return client.credentialRefresh.allocateCredentialRefresh.mutate(input);
+      }, "allocateCredentialRefresh"),
+      sendRefreshableCredential: /* @__PURE__ */ __name(async (_learnCard, refreshId, credential, boostUri, skipNotification) => {
+        await ensureUser();
+        return client.credentialRefresh.sendRefreshableCredential.mutate({
+          refreshId,
+          credential,
+          boostUri,
+          ...skipNotification ? { skipNotification: true } : {}
+        });
+      }, "sendRefreshableCredential"),
+      publishCredentialRefresh: /* @__PURE__ */ __name(async (_learnCard, input) => {
+        await ensureUser();
+        return client.credentialRefresh.publishCredentialRefresh.mutate(input);
+      }, "publishCredentialRefresh"),
+      getCredentialRefreshHistory: /* @__PURE__ */ __name(async (_learnCard, input) => {
+        await ensureUser();
+        return client.credentialRefresh.getCredentialRefreshHistory.query(input);
+      }, "getCredentialRefreshHistory"),
       revokeBoostRecipient: /* @__PURE__ */ __name(async (_learnCard, boostUri, recipientProfileId, credentialUri) => {
         await ensureUser();
         const input = { boostUri, recipientProfileId };
@@ -18434,6 +18736,17 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
         if (typeof options2 === "object" && options2.overideFn) {
           boost = options2.overideFn(boost);
         }
+        const enableRefresh = typeof options2 === "object" && options2.enableRefresh === true;
+        let managedRefreshId;
+        if (enableRefresh) {
+          if (!boost.id) boost.id = `urn:uuid:${crypto.randomUUID()}`;
+          const allocation = await client.credentialRefresh.allocateCredentialRefresh.mutate({
+            holder: { profileId, did: targetProfile.did },
+            credentialId: boost.id
+          });
+          managedRefreshId = allocation.refreshId;
+          boost = injectManagedRefreshService(boost, allocation.refreshService);
+        }
         const statusPurposes = typeof options2 === "object" ? options2.statusPurposes : void 0;
         const vc = await issueCredentialWithNetworkStatus(
           _learnCard,
@@ -18441,6 +18754,14 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
           boost,
           statusPurposes
         );
+        if (managedRefreshId) {
+          return client.credentialRefresh.sendRefreshableCredential.mutate({
+            refreshId: managedRefreshId,
+            credential: vc,
+            boostUri,
+            ...typeof options2 === "object" && options2.skipNotification ? { skipNotification: true } : {}
+          });
+        }
         if (typeof options2 === "object" && !options2.encrypt || !options2) {
           return client.boost.sendBoost.mutate({
             profileId,
@@ -18510,8 +18831,8 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
           const isDid = recipient.startsWith("did:");
           const isEmail = /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(recipient);
           const isPhone = /^\+?[\d\s-]{10,}$/.test(recipient.replace(/[\s-]/g, ""));
-          const serviceUrl = new URL(url2);
-          const serviceDomain = `${serviceUrl.hostname}${serviceUrl.port ? `%3A${serviceUrl.port}` : ""}`;
+          const serviceUrl2 = new URL(url2);
+          const serviceDomain = `${serviceUrl2.hostname}${serviceUrl2.port ? `%3A${serviceUrl2.port}` : ""}`;
           const recipientDomain = recipient.startsWith("did:web:") ? recipient.split(":")[2] : void 0;
           const isRemoteDidWebRecipient = recipient.startsWith("did:web:") && recipientDomain !== serviceDomain;
           if (isRemoteDidWebRecipient && input.templateUri) {
@@ -18923,6 +19244,23 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
         await ensureUser();
         return client.inbox.finalize.mutate();
       }, "finalizeInboxCredentials"),
+      recoverInboxCredentials: /* @__PURE__ */ __name(async (learnCard2, options2 = {}) => {
+        const result = await client.inbox.getMyInboxDeliveries.query(options2);
+        const results = await Promise.allSettled(
+          result.records.map(async (record2) => ({
+            ...record2,
+            credential: VCValidator.parse(
+              await learnCard2.invoke.decryptDagJwe(record2.credential, [
+                learnCard2.id.keypair()
+              ])
+            )
+          }))
+        );
+        const records = results.flatMap(
+          (record2) => record2.status === "fulfilled" ? [record2.value] : []
+        );
+        return { ...result, records, failed: results.length - records.length };
+      }, "recoverInboxCredentials"),
       sendGuardianApprovalEmail: /* @__PURE__ */ __name(async (_learnCard, options2) => {
         await ensureUser();
         return client.inbox.sendGuardianApprovalEmail.mutate(options2);