@learncard/network-plugin 2.13.17 → 2.14.0

package/dist/lcn-plugin.esm.js

@@ -15873,7 +15873,10 @@ var SendOptionsValidator = external_exports.object({
   webhookUrl: external_exports.string().url().optional().describe("Webhook URL to receive claim notifications"),
   suppressDelivery: external_exports.boolean().optional().describe("If true, returns claimUrl without sending email/SMS"),
   branding: SendBrandingOptionsValidator.optional().describe("Branding for email/SMS delivery"),
-  guardianEmail: external_exports.string().email().optional().describe("Guardian email that must approve before student can claim")
+  guardianEmail: external_exports.string().email().optional().describe("Guardian email that must approve before student can claim"),
+  expiresInDays: external_exports.number().int().min(1).max(720).optional().describe(
+    "How many days the credential stays claimable in the Universal Inbox (default 30). Does not change the credential validity period."
+  )
 });
 var SendBoostInputValidator = external_exports.object({
   type: external_exports.literal("boost"),
@@ -16168,7 +16171,8 @@ var LCNNotificationTypeEnumValidator = external_exports.enum([
   "APP_NOTIFICATION",
   "CREDENTIAL_REVOKED",
   "CREDENTIAL_SUSPENDED",
-  "CREDENTIAL_UNSUSPENDED"
+  "CREDENTIAL_UNSUSPENDED",
+  "CREDENTIAL_REFRESHED"
 ]);
 var LCNNotificationMessageValidator = external_exports.object({
   title: external_exports.string().optional(),
@@ -16300,12 +16304,16 @@ var CreateContactMethodSessionResponseValidator = external_exports.object({
 });
 var InboxCredentialValidator = external_exports.object({
   id: external_exports.string(),
-  credential: external_exports.string(),
+  credential: external_exports.string().optional(),
   isSigned: external_exports.boolean(),
   currentStatus: LCNInboxStatusEnumValidator,
   isAccepted: external_exports.boolean().optional(),
   expiresAt: external_exports.string(),
   createdAt: external_exports.string(),
+  finalizedAt: external_exports.string().optional(),
+  expiredAt: external_exports.string().optional(),
+  credentialName: external_exports.string().optional(),
+  achievementType: external_exports.string().optional(),
   issuerDid: external_exports.string(),
   webhookUrl: external_exports.string().optional(),
   boostUri: external_exports.string().optional(),
@@ -16359,7 +16367,9 @@ var IssueInboxCredentialValidator = external_exports.object({
       "The signing authority to use for the credential. If not provided, the users default signing authority will be used if the credential is not signed."
     ),
     webhookUrl: external_exports.string().url().optional().describe("The webhook URL to receive credential issuance events."),
-    expiresInDays: external_exports.number().min(1).max(365).optional().describe("The number of days the credential will be valid for."),
+    expiresInDays: external_exports.number().int().min(1).max(720).optional().describe(
+      "How many days the encrypted inbox payload remains claimable. This does not change the credential validity period."
+    ),
     templateData: external_exports.record(external_exports.string(), external_exports.unknown()).optional().describe(
       "Template data to render into the boost credential template using Mustache syntax. Only used when boostUri is provided."
     ),
@@ -16422,6 +16432,9 @@ var ClaimInboxCredentialValidator = external_exports.object({
   credential: VCValidator.or(VPValidator).or(UnsignedVCValidator).or(CredentialNameRefValidator).describe("The credential to issue, or a { name } reference to resolve a boost template."),
   configuration: external_exports.object({
     publishableKey: external_exports.string(),
+    expiresInDays: external_exports.number().int().min(1).max(720).optional().describe(
+      "Inbox claim window in days. Defaults to 720; use a shorter window for sensitive records."
+    ),
     signingAuthorityName: external_exports.string().optional(),
     listingId: external_exports.string().optional(),
     listingSlug: external_exports.string().optional()
@@ -17048,6 +17061,191 @@ var inAppMessagesFlagValidator = external_exports.object({
   version: external_exports.number().default(1),
   messages: external_exports.array(inAppMessageValidator).default([])
 }).passthrough();
+var LearnCardRefreshAuthorizationValidator = external_exports.object({ type: external_exports.literal("LearnCardDIDAuth") }).catchall(external_exports.any());
+var ManagedCredentialRefreshServiceValidator = external_exports.object({
+  id: external_exports.string().min(1),
+  type: external_exports.literal("LearnCardCredentialRefresh2026"),
+  authorization: LearnCardRefreshAuthorizationValidator.optional()
+}).catchall(external_exports.any());
+var StandardCredentialRefreshServiceValidator = external_exports.object({
+  id: external_exports.string().min(1),
+  type: external_exports.literal("1EdTechCredentialRefresh")
+}).catchall(external_exports.any());
+var SupportedCredentialRefreshServiceValidator = external_exports.union([
+  ManagedCredentialRefreshServiceValidator,
+  StandardCredentialRefreshServiceValidator
+]);
+var AllocateCredentialRefreshInputValidator = external_exports.object({
+  holder: external_exports.object({
+    profileId: external_exports.string().optional(),
+    did: external_exports.string().min(1)
+  }),
+  credentialId: external_exports.string().min(1)
+});
+var AllocateCredentialRefreshResultValidator = external_exports.object({
+  refreshId: external_exports.string().min(1),
+  refreshService: ManagedCredentialRefreshServiceValidator.extend({
+    authorization: LearnCardRefreshAuthorizationValidator
+  })
+});
+var CredentialRefreshSigningModeValidator = external_exports.enum(["issuer-signed", "signing-authority"]);
+var PublishCredentialRefreshBaseFields = {
+  refreshId: external_exports.string().min(1),
+  notifyHolder: external_exports.boolean().optional(),
+  updateSummary: external_exports.string().optional(),
+  idempotencyKey: external_exports.string().optional()
+};
+var PublishIssuerSignedRefreshValidator = external_exports.object({
+  ...PublishCredentialRefreshBaseFields,
+  mode: external_exports.literal("issuer-signed"),
+  signedCredential: VCValidator
+});
+var PublishSigningAuthorityRefreshValidator = external_exports.object({
+  ...PublishCredentialRefreshBaseFields,
+  mode: external_exports.literal("signing-authority"),
+  credential: UnsignedVCValidator,
+  signingAuthority: external_exports.object({
+    type: external_exports.string().min(1)
+  }).catchall(external_exports.any())
+});
+var PublishCredentialRefreshInputValidator = external_exports.object({
+  ...PublishCredentialRefreshBaseFields,
+  mode: CredentialRefreshSigningModeValidator,
+  signedCredential: VCValidator.optional(),
+  credential: UnsignedVCValidator.optional(),
+  signingAuthority: external_exports.object({
+    type: external_exports.string().min(1)
+  }).catchall(external_exports.any()).optional()
+}).superRefine((input, ctx) => {
+  if (input.mode === "issuer-signed" && !input.signedCredential) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["signedCredential"],
+      message: "signedCredential is required for issuer-signed publication"
+    });
+  }
+  if (input.mode === "issuer-signed" && (input.credential !== void 0 || input.signingAuthority !== void 0)) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["mode"],
+      message: "issuer-signed publication cannot include signing-authority fields"
+    });
+  }
+  if (input.mode === "signing-authority") {
+    if (input.signedCredential !== void 0) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["signedCredential"],
+        message: "signing-authority publication cannot include signedCredential"
+      });
+    }
+    if (!input.credential) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["credential"],
+        message: "credential is required for signing-authority publication"
+      });
+    }
+    if (!input.signingAuthority) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["signingAuthority"],
+        message: "signingAuthority is required for signing-authority publication"
+      });
+    }
+  }
+});
+var PublishCredentialRefreshNotificationValidator = external_exports.enum([
+  "queued",
+  "suppressed",
+  "not-applicable",
+  /** Publication succeeded, but the post-commit notification enqueue must be retried. */
+  "delivery-failed"
+]);
+var PublishCredentialRefreshResultValidator = external_exports.object({
+  refreshId: external_exports.string().min(1),
+  version: external_exports.number().int().positive(),
+  publishedAt: external_exports.string().min(1),
+  notification: PublishCredentialRefreshNotificationValidator
+});
+var CredentialRefreshVersionMetadataValidator = external_exports.object({
+  version: external_exports.number().int().positive(),
+  publishedAt: external_exports.string().min(1),
+  effectiveAt: external_exports.string().optional(),
+  etag: external_exports.string().optional(),
+  signingMode: CredentialRefreshSigningModeValidator.optional(),
+  updateSummary: external_exports.string().optional()
+});
+var GetCredentialRefreshHistoryInputValidator = external_exports.object({
+  refreshId: external_exports.string().min(1),
+  cursor: external_exports.string().optional(),
+  limit: external_exports.number().int().positive().optional()
+});
+var GetCredentialRefreshHistoryResultValidator = external_exports.object({
+  records: CredentialRefreshVersionMetadataValidator.array(),
+  hasMore: external_exports.boolean(),
+  cursor: external_exports.string().optional()
+});
+var CredentialRefreshChallengeValidator = external_exports.object({
+  challenge: external_exports.string().min(1),
+  expiresAt: external_exports.string().min(1),
+  domain: external_exports.string().optional(),
+  scheme: external_exports.literal("LearnCardDIDAuth").optional()
+});
+var PublicCredentialRefreshEnvelopeValidator = external_exports.object({
+  format: external_exports.literal("vc"),
+  credential: VCValidator,
+  etag: external_exports.string().optional()
+});
+var JweCredentialRefreshEnvelopeValidator = external_exports.object({
+  format: external_exports.literal("jwe"),
+  jwe: JWEValidator,
+  etag: external_exports.string().optional(),
+  /** Present on LearnCard-managed endpoints; optional for interoperable JWE services. */
+  version: external_exports.number().int().positive().optional()
+});
+var CredentialRefreshResponseEnvelopeValidator = external_exports.discriminatedUnion("format", [
+  PublicCredentialRefreshEnvelopeValidator,
+  JweCredentialRefreshEnvelopeValidator
+]);
+var CredentialRefreshFailureCodeValidator = external_exports.enum([
+  "UNAVAILABLE",
+  "TIMEOUT",
+  "UNSUPPORTED_SERVICE",
+  "UNAUTHORIZED",
+  "MALFORMED_RESPONSE",
+  "INVALID_PROOF",
+  "ISSUER_MISMATCH",
+  "ID_MISMATCH",
+  "ROLLBACK",
+  "REVOKED",
+  "UNSAFE_ENDPOINT"
+]);
+var CredentialRefreshUpdatedResultValidator = external_exports.object({
+  status: external_exports.literal("updated"),
+  credential: VCValidator,
+  etag: external_exports.string().optional(),
+  managedVersion: external_exports.number().int().positive().optional()
+});
+var CredentialRefreshUnchangedResultValidator = external_exports.object({
+  status: external_exports.literal("unchanged"),
+  checkedAt: external_exports.string().min(1),
+  etag: external_exports.string().optional()
+});
+var CredentialRefreshUnsupportedResultValidator = external_exports.object({
+  status: external_exports.literal("unsupported")
+});
+var CredentialRefreshFailedResultValidator = external_exports.object({
+  status: external_exports.literal("failed"),
+  code: CredentialRefreshFailureCodeValidator,
+  retryable: external_exports.boolean()
+});
+var CredentialRefreshResultValidator = external_exports.discriminatedUnion("status", [
+  CredentialRefreshUpdatedResultValidator,
+  CredentialRefreshUnchangedResultValidator,
+  CredentialRefreshUnsupportedResultValidator,
+  CredentialRefreshFailedResultValidator
+]);
 
 // src/plugin.ts
 import {
@@ -17669,6 +17867,27 @@ var issueCredentialWithNetworkStatus = /* @__PURE__ */ __name(async (learnCard,
     await appendNetworkCredentialStatus(client, credential, statusPurposes)
   );
 }, "issueCredentialWithNetworkStatus");
+var MANAGED_REFRESH_SERVICE_CONTEXT = {
+  "LearnCardCredentialRefresh2026": "https://learncard.com/refresh#LearnCardCredentialRefresh2026",
+  authorization: {
+    "@id": "https://purl.imsglobal.org/spec/ob/v3p0#authorization",
+    "@context": {
+      LearnCardDIDAuth: "https://docs.learncard.com/definitions#LearnCardDIDAuth"
+    }
+  }
+};
+var injectManagedRefreshService = /* @__PURE__ */ __name((credential, refreshService) => {
+  const existingContext = credential["@context"];
+  const contextList = Array.isArray(existingContext) ? existingContext : [existingContext];
+  const hasMapping = contextList.some(
+    (entry) => !!entry && typeof entry === "object" && "LearnCardCredentialRefresh2026" in entry
+  );
+  return {
+    ...credential,
+    "@context": hasMapping ? contextList : [...contextList, MANAGED_REFRESH_SERVICE_CONTEXT],
+    refreshService
+  };
+}, "injectManagedRefreshService");
 async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, options) {
   const apiToken = typeof apiTokenOrOptions === "string" ? apiTokenOrOptions : void 0;
   const resolvedOptions = (typeof apiTokenOrOptions === "object" ? apiTokenOrOptions : options) ?? {};
@@ -18430,6 +18649,27 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
         await ensureUser();
         return client.boost.allocateCredentialStatus.mutate(options2);
       }, "allocateCredentialStatus"),
+      allocateCredentialRefresh: /* @__PURE__ */ __name(async (_learnCard, input) => {
+        await ensureUser();
+        return client.credentialRefresh.allocateCredentialRefresh.mutate(input);
+      }, "allocateCredentialRefresh"),
+      sendRefreshableCredential: /* @__PURE__ */ __name(async (_learnCard, refreshId, credential, boostUri, skipNotification) => {
+        await ensureUser();
+        return client.credentialRefresh.sendRefreshableCredential.mutate({
+          refreshId,
+          credential,
+          boostUri,
+          ...skipNotification ? { skipNotification: true } : {}
+        });
+      }, "sendRefreshableCredential"),
+      publishCredentialRefresh: /* @__PURE__ */ __name(async (_learnCard, input) => {
+        await ensureUser();
+        return client.credentialRefresh.publishCredentialRefresh.mutate(input);
+      }, "publishCredentialRefresh"),
+      getCredentialRefreshHistory: /* @__PURE__ */ __name(async (_learnCard, input) => {
+        await ensureUser();
+        return client.credentialRefresh.getCredentialRefreshHistory.query(input);
+      }, "getCredentialRefreshHistory"),
       revokeBoostRecipient: /* @__PURE__ */ __name(async (_learnCard, boostUri, recipientProfileId, credentialUri) => {
         await ensureUser();
         const input = { boostUri, recipientProfileId };
@@ -18496,6 +18736,17 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
         if (typeof options2 === "object" && options2.overideFn) {
           boost = options2.overideFn(boost);
         }
+        const enableRefresh = typeof options2 === "object" && options2.enableRefresh === true;
+        let managedRefreshId;
+        if (enableRefresh) {
+          if (!boost.id) boost.id = `urn:uuid:${crypto.randomUUID()}`;
+          const allocation = await client.credentialRefresh.allocateCredentialRefresh.mutate({
+            holder: { profileId, did: targetProfile.did },
+            credentialId: boost.id
+          });
+          managedRefreshId = allocation.refreshId;
+          boost = injectManagedRefreshService(boost, allocation.refreshService);
+        }
         const statusPurposes = typeof options2 === "object" ? options2.statusPurposes : void 0;
         const vc = await issueCredentialWithNetworkStatus(
           _learnCard,
@@ -18503,6 +18754,14 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
           boost,
           statusPurposes
         );
+        if (managedRefreshId) {
+          return client.credentialRefresh.sendRefreshableCredential.mutate({
+            refreshId: managedRefreshId,
+            credential: vc,
+            boostUri,
+            ...typeof options2 === "object" && options2.skipNotification ? { skipNotification: true } : {}
+          });
+        }
         if (typeof options2 === "object" && !options2.encrypt || !options2) {
           return client.boost.sendBoost.mutate({
             profileId,
@@ -18985,6 +19244,23 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
         await ensureUser();
         return client.inbox.finalize.mutate();
       }, "finalizeInboxCredentials"),
+      recoverInboxCredentials: /* @__PURE__ */ __name(async (learnCard2, options2 = {}) => {
+        const result = await client.inbox.getMyInboxDeliveries.query(options2);
+        const results = await Promise.allSettled(
+          result.records.map(async (record2) => ({
+            ...record2,
+            credential: VCValidator.parse(
+              await learnCard2.invoke.decryptDagJwe(record2.credential, [
+                learnCard2.id.keypair()
+              ])
+            )
+          }))
+        );
+        const records = results.flatMap(
+          (record2) => record2.status === "fulfilled" ? [record2.value] : []
+        );
+        return { ...result, records, failed: results.length - records.length };
+      }, "recoverInboxCredentials"),
       sendGuardianApprovalEmail: /* @__PURE__ */ __name(async (_learnCard, options2) => {
         await ensureUser();
         return client.inbox.sendGuardianApprovalEmail.mutate(options2);