@learncard/network-plugin 2.14.1 → 3.0.1

package/dist/lcn-plugin.cjs.development.cjs

@@ -21,11 +21,59 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  ACT_AS_HEADER: () => ACT_AS_HEADER,
   getLearnCardNetworkPlugin: () => getLearnCardNetworkPlugin,
   getVerifyBoostPlugin: () => getVerifyBoostPlugin
 });
 module.exports = __toCommonJS(index_exports);
 
+// src/inbox-batch.ts
+var waitForInboxCredentialBatch = /* @__PURE__ */ __name(async (read, options = {}) => {
+  const { timeoutMs = 6e5, intervalMs = 2e3, signal, onProgress } = options;
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0 || timeoutMs > 2147483647 || !Number.isFinite(intervalMs) || intervalMs <= 0 || intervalMs > 2147483647) {
+    throw new RangeError("timeoutMs and intervalMs must be positive finite timer durations.");
+  }
+  const controller = new AbortController();
+  const abort = /* @__PURE__ */ __name(() => controller.abort(signal?.reason), "abort");
+  signal?.addEventListener("abort", abort, { once: true });
+  if (signal?.aborted) abort();
+  const timeout = setTimeout(() => {
+    const error51 = new Error(
+      "Timed out waiting for inbox batch. Keep the batch ID to check again."
+    );
+    error51.name = "TimeoutError";
+    controller.abort(error51);
+  }, timeoutMs);
+  const cancellable = /* @__PURE__ */ __name((operation) => new Promise((resolve, reject) => {
+    const interrupted = /* @__PURE__ */ __name(() => reject(controller.signal.reason), "interrupted");
+    if (controller.signal.aborted) return interrupted();
+    controller.signal.addEventListener("abort", interrupted, { once: true });
+    Promise.resolve().then(() => {
+      if (controller.signal.aborted) throw controller.signal.reason;
+      return operation();
+    }).then(resolve, reject).finally(() => controller.signal.removeEventListener("abort", interrupted));
+  }), "cancellable");
+  let delay = intervalMs;
+  let sleepTimer;
+  try {
+    while (true) {
+      const batch = await cancellable(() => read(controller.signal));
+      onProgress?.(batch);
+      if (batch.done) return batch;
+      await cancellable(
+        () => new Promise((resolve) => {
+          sleepTimer = setTimeout(resolve, delay);
+        })
+      );
+      delay = Math.min(delay * 1.5, Math.max(intervalMs, 1e4));
+    }
+  } finally {
+    clearTimeout(timeout);
+    clearTimeout(sleepTimer);
+    signal?.removeEventListener("abort", abort);
+  }
+}, "waitForInboxCredentialBatch");
+
 // src/plugin.ts
 var import_network_brain_client = require("@learncard/network-brain-client");
 
@@ -15583,6 +15631,204 @@ var StringQuery = external_exports.union([
     $or: BaseStringQuery.array()
   })
 ]);
+var LearnCardRefreshAuthorizationValidator = external_exports.object({ type: external_exports.literal("LearnCardDIDAuth") }).catchall(external_exports.any());
+var ManagedCredentialRefreshServiceValidator = external_exports.object({
+  id: external_exports.string().min(1),
+  type: external_exports.literal("LearnCardCredentialRefresh2026"),
+  authorization: LearnCardRefreshAuthorizationValidator.optional()
+}).catchall(external_exports.any());
+var StandardCredentialRefreshServiceValidator = external_exports.object({
+  id: external_exports.string().min(1),
+  type: external_exports.literal("1EdTechCredentialRefresh")
+}).catchall(external_exports.any());
+var SupportedCredentialRefreshServiceValidator = external_exports.union([
+  ManagedCredentialRefreshServiceValidator,
+  StandardCredentialRefreshServiceValidator
+]);
+var AllocateCredentialRefreshInputValidator = external_exports.object({
+  holder: external_exports.object({
+    profileId: external_exports.string().optional(),
+    did: external_exports.string().min(1)
+  }),
+  credentialId: external_exports.string().min(1)
+});
+var AllocateCredentialRefreshResultValidator = external_exports.object({
+  refreshId: external_exports.string().min(1),
+  refreshService: ManagedCredentialRefreshServiceValidator.extend({
+    authorization: LearnCardRefreshAuthorizationValidator
+  })
+});
+var ManagedCredentialRefreshReceiptValidator = external_exports.object({
+  refreshId: external_exports.string().min(1),
+  refreshService: ManagedCredentialRefreshServiceValidator,
+  credentialId: external_exports.string().min(1),
+  issuerDid: external_exports.string().min(1),
+  holderDid: external_exports.string().min(1),
+  credentialStatus: CredentialStatusValidator.or(
+    CredentialStatusValidator.array()
+  ).optional()
+}).strip();
+var InboxCredentialRefreshReceiptValidator = ManagedCredentialRefreshReceiptValidator.omit(
+  { holderDid: true }
+).extend({ holderDid: external_exports.string().min(1).optional() });
+var CredentialRefreshSigningModeValidator = external_exports.enum(["issuer-signed", "signing-authority"]);
+var PublishCredentialRefreshBaseFields = {
+  refreshId: external_exports.string().min(1),
+  notifyHolder: external_exports.boolean().optional(),
+  updateSummary: external_exports.string().optional(),
+  idempotencyKey: external_exports.string().optional()
+};
+var PublishIssuerSignedRefreshValidator = external_exports.object({
+  ...PublishCredentialRefreshBaseFields,
+  mode: external_exports.literal("issuer-signed"),
+  signedCredential: VCValidator
+});
+var PublishSigningAuthorityRefreshValidator = external_exports.object({
+  ...PublishCredentialRefreshBaseFields,
+  mode: external_exports.literal("signing-authority"),
+  credential: UnsignedVCValidator,
+  signingAuthority: external_exports.object({
+    type: external_exports.string().min(1)
+  }).catchall(external_exports.any())
+});
+var PublishCredentialRefreshInputValidator = external_exports.object({
+  ...PublishCredentialRefreshBaseFields,
+  mode: CredentialRefreshSigningModeValidator,
+  signedCredential: VCValidator.optional(),
+  credential: UnsignedVCValidator.optional(),
+  signingAuthority: external_exports.object({
+    type: external_exports.string().min(1)
+  }).catchall(external_exports.any()).optional()
+}).superRefine((input, ctx) => {
+  if (input.mode === "issuer-signed" && !input.signedCredential) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["signedCredential"],
+      message: "signedCredential is required for issuer-signed publication"
+    });
+  }
+  if (input.mode === "issuer-signed" && (input.credential !== void 0 || input.signingAuthority !== void 0)) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["mode"],
+      message: "issuer-signed publication cannot include signing-authority fields"
+    });
+  }
+  if (input.mode === "signing-authority") {
+    if (input.signedCredential !== void 0) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["signedCredential"],
+        message: "signing-authority publication cannot include signedCredential"
+      });
+    }
+    if (!input.credential) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["credential"],
+        message: "credential is required for signing-authority publication"
+      });
+    }
+    if (!input.signingAuthority) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["signingAuthority"],
+        message: "signingAuthority is required for signing-authority publication"
+      });
+    }
+  }
+});
+var PublishCredentialRefreshNotificationValidator = external_exports.enum([
+  "queued",
+  "suppressed",
+  "not-applicable",
+  /** Publication succeeded, but the post-commit notification enqueue must be retried. */
+  "delivery-failed"
+]);
+var PublishCredentialRefreshResultValidator = external_exports.object({
+  refreshId: external_exports.string().min(1),
+  version: external_exports.number().int().positive(),
+  publishedAt: external_exports.string().min(1),
+  notification: PublishCredentialRefreshNotificationValidator
+});
+var CredentialRefreshVersionMetadataValidator = external_exports.object({
+  version: external_exports.number().int().positive(),
+  publishedAt: external_exports.string().min(1),
+  effectiveAt: external_exports.string().optional(),
+  etag: external_exports.string().optional(),
+  signingMode: CredentialRefreshSigningModeValidator.optional(),
+  updateSummary: external_exports.string().optional()
+});
+var GetCredentialRefreshHistoryInputValidator = external_exports.object({
+  refreshId: external_exports.string().min(1),
+  cursor: external_exports.string().optional(),
+  limit: external_exports.number().int().positive().optional()
+});
+var GetCredentialRefreshHistoryResultValidator = external_exports.object({
+  records: CredentialRefreshVersionMetadataValidator.array(),
+  hasMore: external_exports.boolean(),
+  cursor: external_exports.string().optional()
+});
+var CredentialRefreshChallengeValidator = external_exports.object({
+  challenge: external_exports.string().min(1),
+  expiresAt: external_exports.string().min(1),
+  domain: external_exports.string().optional(),
+  scheme: external_exports.literal("LearnCardDIDAuth").optional()
+});
+var PublicCredentialRefreshEnvelopeValidator = external_exports.object({
+  format: external_exports.literal("vc"),
+  credential: VCValidator,
+  etag: external_exports.string().optional()
+});
+var JweCredentialRefreshEnvelopeValidator = external_exports.object({
+  format: external_exports.literal("jwe"),
+  jwe: JWEValidator,
+  etag: external_exports.string().optional(),
+  /** Present on LearnCard-managed endpoints; optional for interoperable JWE services. */
+  version: external_exports.number().int().positive().optional()
+});
+var CredentialRefreshResponseEnvelopeValidator = external_exports.discriminatedUnion("format", [
+  PublicCredentialRefreshEnvelopeValidator,
+  JweCredentialRefreshEnvelopeValidator
+]);
+var CredentialRefreshFailureCodeValidator = external_exports.enum([
+  "UNAVAILABLE",
+  "TIMEOUT",
+  "UNSUPPORTED_SERVICE",
+  "UNAUTHORIZED",
+  "MALFORMED_RESPONSE",
+  "INVALID_PROOF",
+  "ISSUER_MISMATCH",
+  "ID_MISMATCH",
+  "ROLLBACK",
+  "REVOKED",
+  "UNSAFE_ENDPOINT"
+]);
+var CredentialRefreshUpdatedResultValidator = external_exports.object({
+  status: external_exports.literal("updated"),
+  credential: VCValidator,
+  etag: external_exports.string().optional(),
+  managedVersion: external_exports.number().int().positive().optional()
+});
+var CredentialRefreshUnchangedResultValidator = external_exports.object({
+  status: external_exports.literal("unchanged"),
+  checkedAt: external_exports.string().min(1),
+  etag: external_exports.string().optional()
+});
+var CredentialRefreshUnsupportedResultValidator = external_exports.object({
+  status: external_exports.literal("unsupported")
+});
+var CredentialRefreshFailedResultValidator = external_exports.object({
+  status: external_exports.literal("failed"),
+  code: CredentialRefreshFailureCodeValidator,
+  retryable: external_exports.boolean()
+});
+var CredentialRefreshResultValidator = external_exports.discriminatedUnion("status", [
+  CredentialRefreshUpdatedResultValidator,
+  CredentialRefreshUnchangedResultValidator,
+  CredentialRefreshUnsupportedResultValidator,
+  CredentialRefreshFailedResultValidator
+]);
 var LCNProfileDisplayValidator = external_exports.object({
   backgroundColor: external_exports.string().optional(),
   backgroundImage: external_exports.string().optional(),
@@ -15918,7 +16164,13 @@ var SendBoostInputValidator = external_exports.object({
     "Options for email/phone recipients (Universal Inbox)"
   ),
   templateData: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
-  integrationId: external_exports.string().optional().describe("Integration ID for activity tracking")
+  integrationId: external_exports.string().optional().describe("Integration ID for activity tracking"),
+  refresh: external_exports.boolean().optional().describe(
+    "Request managed credential refresh for this send. Profile/DID recipients use immediate issuance; email/phone recipients use deferred Universal Inbox signing and bind the holder at claim."
+  ),
+  idempotencyKey: external_exports.string().min(1).max(200).optional().describe(
+    "Caller-chosen key that makes a managed refresh send (refresh: true) safe to retry as a whole: retries with the same key reuse the same boost, refresh allocation and result. Reusing a key for a different request is rejected. With signedCredential, requires prior tRPC prepareRefreshableSend; direct REST callers omit the key and retry the exact signed credential and templateUri."
+  )
 }).refine((data) => data.templateUri || data.template || data.signedCredential, {
   message: "Either templateUri, template, or signedCredential must be provided.",
   path: ["templateUri"]
@@ -15933,8 +16185,12 @@ var SendBoostInputValidator = external_exports.object({
     message: "guardianEmail must differ from recipient (self-approval not allowed)",
     path: ["options", "guardianEmail"]
   }
-);
+).refine((data) => !data.idempotencyKey || data.refresh === true, {
+  message: "idempotencyKey is only supported with refresh: true.",
+  path: ["idempotencyKey"]
+});
 var SendInboxResponseValidator = external_exports.object({
+  refresh: InboxCredentialRefreshReceiptValidator.optional(),
   issuanceId: external_exports.string(),
   status: external_exports.enum(["PENDING", "ISSUED", "EXPIRED", "DELIVERED", "CLAIMED"]),
   claimUrl: external_exports.string().url().optional().describe("Present when suppressDelivery=true"),
@@ -15949,8 +16205,34 @@ var SendBoostResponseValidator = external_exports.object({
   activityId: external_exports.string().describe("Links to the activity lifecycle for this issuance"),
   inbox: SendInboxResponseValidator.optional().describe(
     "Present when sent via email/phone (Universal Inbox)"
+  ),
+  refresh: ManagedCredentialRefreshReceiptValidator.optional().describe(
+    "Present when managed refresh was requested: issuance metadata the issuer keeps to publish future updates"
   )
 });
+var PrepareRefreshableSendInputValidator = external_exports.object({
+  recipient: external_exports.string(),
+  templateUri: external_exports.string().optional(),
+  template: SendBoostTemplateValidator.optional(),
+  contractUri: external_exports.string().optional(),
+  templateData: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
+  integrationId: external_exports.string().optional(),
+  /** Credential ID to allocate for; generated server-side when omitted. */
+  credentialId: external_exports.string().min(1).optional(),
+  idempotencyKey: external_exports.string().min(1).max(200).optional()
+}).refine((data) => Boolean(data.templateUri) !== Boolean(data.template), {
+  message: "Provide exactly one of templateUri or template."
+});
+var PrepareRefreshableSendResultValidator = external_exports.object({
+  boostUri: external_exports.string(),
+  credentialId: external_exports.string(),
+  refreshId: external_exports.string(),
+  refreshService: ManagedCredentialRefreshServiceValidator,
+  /** The DID to use as credentialSubject.id (recipient DID, or the profile's did:web). */
+  holderDid: external_exports.string(),
+  /** Present when this idempotencyKey already completed: return it without signing. */
+  completed: SendBoostResponseValidator.optional()
+});
 var SendInputValidator = external_exports.discriminatedUnion("type", [SendBoostInputValidator]);
 var SendResponseValidator = external_exports.discriminatedUnion("type", [SendBoostResponseValidator]);
 var ConsentFlowTermsStatusValidator = external_exports.enum(["live", "stale", "withdrawn"]);
@@ -16269,6 +16551,7 @@ var LCNNotificationValidator = external_exports.object({
   webhookUrl: external_exports.string().optional()
 });
 var AUTH_GRANT_AUDIENCE_DOMAIN_PREFIX = "auth-grant:";
+var ACT_AS_HEADER = "X-LearnCard-Act-As";
 var AuthGrantValidator = external_exports.object({
   id: external_exports.string(),
   name: external_exports.string(),
@@ -16281,6 +16564,7 @@ var AuthGrantValidator = external_exports.object({
     }, "error")
   }),
   scope: external_exports.string(),
+  actAs: external_exports.string().optional(),
   createdAt: external_exports.iso.datetime({ error: "createdAt must be a valid ISO 8601 datetime string" }),
   expiresAt: external_exports.iso.datetime({ error: "expiresAt must be a valid ISO 8601 datetime string" }).nullish().optional()
 });
@@ -16352,6 +16636,8 @@ var CreateContactMethodSessionResponseValidator = external_exports.object({
   sessionJwt: external_exports.string()
 });
 var InboxCredentialValidator = external_exports.object({
+  refresh: InboxCredentialRefreshReceiptValidator.optional(),
+  refreshId: external_exports.string().optional(),
   id: external_exports.string(),
   credential: external_exports.string().optional(),
   isSigned: external_exports.boolean(),
@@ -16406,12 +16692,19 @@ var IssueInboxCredentialValidator = external_exports.object({
   templateUri: external_exports.string().optional().describe(
     "URI of a boost template to use for issuance. The boost credential will be resolved and used. Mutually exclusive with credential field."
   ),
+  refresh: external_exports.boolean().optional().describe(
+    "Allocate managed refresh before signing. Requires unsigned content and a registered signing authority; binds the holder on claim."
+  ),
+  idempotencyKey: external_exports.string().min(1).max(200).optional(),
   // === OPTIONAL FEATURES ===
   // Add major, distinct features at the top level.
   //consentRequest: ConsentRequestValidator.optional(),
   // === PROCESS CONFIGURATION (Optional) ===
   // HOW should this issuance be handled?
   configuration: external_exports.object({
+    guardianEmail: external_exports.string().email().optional().describe(
+      "Require approval from this guardian before the recipient can claim. Must differ from the recipient email."
+    ),
     signingAuthority: IssueInboxSigningAuthorityValidator.optional().describe(
       "The signing authority to use for the credential. If not provided, the users default signing authority will be used if the credential is not signed."
     ),
@@ -16465,17 +16758,130 @@ var IssueInboxCredentialValidator = external_exports.object({
   }).optional().describe(
     "Configuration for the credential issuance. If not provided, the default configuration will be used."
   )
+}).refine((data) => !data.idempotencyKey || data.refresh === true, {
+  message: "idempotencyKey requires refresh: true."
 }).refine((data) => data.credential || data.templateUri, {
   message: "Either credential or templateUri must be provided.",
   path: ["credential"]
-});
+}).refine(
+  (data) => !data.configuration?.guardianEmail || data.recipient.type !== "email" || data.configuration.guardianEmail.toLowerCase() !== data.recipient.value.toLowerCase(),
+  {
+    message: "guardianEmail must differ from recipient (self-approval not allowed)",
+    path: ["configuration", "guardianEmail"]
+  }
+);
 var IssueInboxCredentialResponseValidator = external_exports.object({
+  refresh: InboxCredentialRefreshReceiptValidator.optional(),
   issuanceId: external_exports.string(),
   status: LCNInboxStatusEnumValidator,
   recipient: ContactMethodQueryValidator,
   claimUrl: external_exports.string().url().optional(),
   recipientDid: external_exports.string().optional()
 });
+var InboxBatchConfigurationValidator = IssueInboxCredentialValidator.shape.configuration.unwrap().extend({
+  refresh: IssueInboxCredentialValidator.shape.refresh.describe(
+    "Enable managed refresh by default. An item configuration.refresh overrides this value, including false."
+  ),
+  delivery: IssueInboxCredentialValidator.shape.configuration.unwrap().shape.delivery.unwrap().extend({ suppress: external_exports.boolean().optional() }).optional()
+});
+var InboxBatchItemConfigurationValidator = InboxBatchConfigurationValidator.extend({
+  guardianEmail: InboxBatchConfigurationValidator.shape.guardianEmail.nullable().describe(
+    "Require guardian approval, or set null to clear a batch-level guardianEmail for this item."
+  )
+});
+var IssueInboxCredentialBatchItemValidator = external_exports.object({
+  ...IssueInboxCredentialValidator.shape,
+  configuration: InboxBatchItemConfigurationValidator.optional(),
+  idempotencyKey: external_exports.string().max(256).optional()
+}).refine((data) => data.credential || data.templateUri, {
+  message: "Either credential or templateUri must be provided.",
+  path: ["credential"]
+}).describe(
+  "One issuance: provide credential or templateUri. Invalid input is rejected at submission with its item index."
+);
+var IssueInboxCredentialBatchValidator = external_exports.object({
+  requestId: external_exports.string().min(1).max(256).optional(),
+  items: external_exports.array(IssueInboxCredentialBatchItemValidator).min(1).max(100),
+  configuration: InboxBatchConfigurationValidator.optional()
+}).superRefine((batch, ctx) => {
+  batch.items.forEach((item, index) => {
+    const itemGuardian = item.configuration?.guardianEmail;
+    const guardian = itemGuardian === null ? void 0 : itemGuardian ?? batch.configuration?.guardianEmail;
+    if (guardian && item.recipient.type === "email" && guardian.toLowerCase() === item.recipient.value.toLowerCase()) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["items", index, "configuration", "guardianEmail"],
+        message: "guardianEmail must differ from recipient (self-approval not allowed)"
+      });
+    }
+  });
+});
+var InboxBatchErrorReasonValidator = external_exports.enum([
+  "DUPLICATE_KEY",
+  "IDEMPOTENCY_MISMATCH",
+  "IN_PROGRESS",
+  "UNCONFIRMED"
+]);
+var IssueInboxCredentialBatchItemResultValidator = external_exports.discriminatedUnion("success", [
+  IssueInboxCredentialResponseValidator.extend({
+    success: external_exports.literal(true),
+    index: external_exports.number().int().nonnegative(),
+    deduplicated: external_exports.boolean().optional(),
+    guardianStatus: GuardianStatusValidator.optional(),
+    idempotencyKey: external_exports.string().optional()
+  }),
+  external_exports.object({
+    success: external_exports.literal(false),
+    index: external_exports.number().int().nonnegative(),
+    idempotencyKey: external_exports.string().optional(),
+    recipient: ContactMethodQueryValidator.optional(),
+    error: external_exports.object({
+      code: external_exports.string(),
+      message: external_exports.string(),
+      reason: InboxBatchErrorReasonValidator.optional()
+    }),
+    issuanceId: external_exports.string().optional().describe(
+      "Present when issuance completed but replay storage could not be confirmed. Reconcile this issuance; do not issue again with a new key."
+    ),
+    claimUrl: external_exports.string().url().optional().describe(
+      "Claim URL of the completed issuance, if available, when replay storage could not be confirmed."
+    )
+  })
+]);
+var IssueInboxCredentialBatchResponseValidator = external_exports.object({
+  results: external_exports.array(IssueInboxCredentialBatchItemResultValidator),
+  summary: external_exports.object({
+    total: external_exports.number(),
+    succeeded: external_exports.number(),
+    failed: external_exports.number(),
+    deduplicated: external_exports.number()
+  })
+});
+var InboxBatchReceiptValidator = external_exports.object({
+  batchId: external_exports.string(),
+  status: external_exports.enum(["QUEUED", "PROCESSING", "COMPLETED", "NEEDS_RECONCILIATION"]),
+  createdAt: external_exports.string()
+});
+var InboxBatchStatusValidator = external_exports.object({
+  batchId: external_exports.string(),
+  createdAt: external_exports.string(),
+  done: external_exports.boolean().describe(
+    "True when no queued or processing items remain, including unconfirmed outcomes."
+  ),
+  status: external_exports.enum(["QUEUED", "PROCESSING", "COMPLETED", "NEEDS_RECONCILIATION"]),
+  items: external_exports.array(
+    external_exports.object({
+      index: external_exports.number().int().nonnegative(),
+      state: external_exports.enum(["QUEUED", "PROCESSING", "COMPLETED", "NEEDS_RECONCILIATION"]),
+      result: IssueInboxCredentialBatchItemResultValidator.optional()
+    })
+  ),
+  summary: IssueInboxCredentialBatchResponseValidator.shape.summary.extend({
+    completed: external_exports.number(),
+    pending: external_exports.number(),
+    unconfirmed: external_exports.number()
+  })
+});
 var CredentialNameRefValidator = external_exports.object({ name: external_exports.string() }).passthrough();
 var ClaimInboxCredentialValidator = external_exports.object({
   credential: VCValidator.or(VPValidator).or(UnsignedVCValidator).or(CredentialNameRefValidator).describe("The credential to issue, or a { name } reference to resolve a boost template."),
@@ -16961,6 +17367,7 @@ var CredentialActivityValidator = external_exports.object({
   eventType: CredentialActivityEventTypeValidator,
   timestamp: external_exports.string(),
   actorProfileId: external_exports.string().optional(),
+  onBehalfOf: external_exports.string().optional(),
   recipientType: CredentialActivityRecipientTypeValidator,
   recipientIdentifier: external_exports.string(),
   boostUri: external_exports.string().optional(),
@@ -17002,6 +17409,12 @@ var AuthSessionError = (_a3 = class extends Error {
     this.name = "AuthSessionError";
   }
 }, __name(_a3, "AuthSessionError"), __name2(_a3, "AuthSessionError"), _a3);
+var EscrowPinStatusValidator = external_exports.object({
+  state: external_exports.enum(["none", "enabled", "locked", "stale"]),
+  enabled: external_exports.boolean(),
+  attemptsRemaining: external_exports.number().int().nonnegative(),
+  salt: external_exports.string().optional()
+});
 var BITSTRING_STATUS_PURPOSES = ["revocation", "suspension"];
 var BitstringStatusPurposeValidator = external_exports.enum(BITSTRING_STATUS_PURPOSES);
 var BitstringStatusListEntryValidator = external_exports.object({
@@ -17110,191 +17523,456 @@ var inAppMessagesFlagValidator = external_exports.object({
   version: external_exports.number().default(1),
   messages: external_exports.array(inAppMessageValidator).default([])
 }).passthrough();
-var LearnCardRefreshAuthorizationValidator = external_exports.object({ type: external_exports.literal("LearnCardDIDAuth") }).catchall(external_exports.any());
-var ManagedCredentialRefreshServiceValidator = external_exports.object({
-  id: external_exports.string().min(1),
-  type: external_exports.literal("LearnCardCredentialRefresh2026"),
-  authorization: LearnCardRefreshAuthorizationValidator.optional()
-}).catchall(external_exports.any());
-var StandardCredentialRefreshServiceValidator = external_exports.object({
-  id: external_exports.string().min(1),
-  type: external_exports.literal("1EdTechCredentialRefresh")
-}).catchall(external_exports.any());
-var SupportedCredentialRefreshServiceValidator = external_exports.union([
-  ManagedCredentialRefreshServiceValidator,
-  StandardCredentialRefreshServiceValidator
-]);
-var AllocateCredentialRefreshInputValidator = external_exports.object({
-  holder: external_exports.object({
-    profileId: external_exports.string().optional(),
-    did: external_exports.string().min(1)
-  }),
-  credentialId: external_exports.string().min(1)
-});
-var AllocateCredentialRefreshResultValidator = external_exports.object({
-  refreshId: external_exports.string().min(1),
-  refreshService: ManagedCredentialRefreshServiceValidator.extend({
-    authorization: LearnCardRefreshAuthorizationValidator
-  })
-});
-var CredentialRefreshSigningModeValidator = external_exports.enum(["issuer-signed", "signing-authority"]);
-var PublishCredentialRefreshBaseFields = {
-  refreshId: external_exports.string().min(1),
-  notifyHolder: external_exports.boolean().optional(),
-  updateSummary: external_exports.string().optional(),
-  idempotencyKey: external_exports.string().optional()
-};
-var PublishIssuerSignedRefreshValidator = external_exports.object({
-  ...PublishCredentialRefreshBaseFields,
-  mode: external_exports.literal("issuer-signed"),
-  signedCredential: VCValidator
-});
-var PublishSigningAuthorityRefreshValidator = external_exports.object({
-  ...PublishCredentialRefreshBaseFields,
-  mode: external_exports.literal("signing-authority"),
-  credential: UnsignedVCValidator,
-  signingAuthority: external_exports.object({
-    type: external_exports.string().min(1)
-  }).catchall(external_exports.any())
-});
-var PublishCredentialRefreshInputValidator = external_exports.object({
-  ...PublishCredentialRefreshBaseFields,
-  mode: CredentialRefreshSigningModeValidator,
-  signedCredential: VCValidator.optional(),
-  credential: UnsignedVCValidator.optional(),
-  signingAuthority: external_exports.object({
-    type: external_exports.string().min(1)
-  }).catchall(external_exports.any()).optional()
-}).superRefine((input, ctx) => {
-  if (input.mode === "issuer-signed" && !input.signedCredential) {
-    ctx.addIssue({
-      code: "custom",
-      path: ["signedCredential"],
-      message: "signedCredential is required for issuer-signed publication"
-    });
+var SHARE_LINK_ID_BYTES = 16;
+var SHARE_CONTENT_KEY_BYTES = 32;
+var SHARE_IV_BYTES = 12;
+var SHARE_TAG_BYTES = 16;
+var MAX_SHARE_CIPHERTEXT_BYTES = 512 * 1024;
+var MAX_SHARE_RECOVERY_JWE_BYTES = 64 * 1024;
+var MAX_SELECTED_CREDENTIALS = 50;
+var MAX_ENDORSEMENTS = 200;
+var MAX_VP_MEMBERS = MAX_SELECTED_CREDENTIALS + MAX_ENDORSEMENTS;
+var MAX_SHARE_SOURCE_URI_CHARS = 2048;
+var MAX_SHARE_LINK_REQUEST_BYTES = 1024 * 1024;
+var SHARE_LINK_PROTOCOL = "lc-share/v1";
+var SHARE_RECOVERY_PROTOCOL = "lc-share-recovery/v1";
+var BASE64URL_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+var BASE64URL_LOOKUP = (() => {
+  const table = new Int16Array(128).fill(-1);
+  for (let index = 0; index < BASE64URL_ALPHABET.length; index += 1) {
+    table[BASE64URL_ALPHABET.charCodeAt(index)] = index;
+  }
+  return table;
+})();
+var encodeBase64Url = /* @__PURE__ */ __name2((bytes) => {
+  let output = "";
+  for (let index = 0; index < bytes.length; index += 3) {
+    const first = bytes[index];
+    const second = bytes[index + 1];
+    const third = bytes[index + 2];
+    output += BASE64URL_ALPHABET[first >> 2];
+    output += BASE64URL_ALPHABET[(first & 3) << 4 | (second ?? 0) >> 4];
+    if (second === void 0) break;
+    output += BASE64URL_ALPHABET[(second & 15) << 2 | (third ?? 0) >> 6];
+    if (third === void 0) break;
+    output += BASE64URL_ALPHABET[third & 63];
+  }
+  return output;
+}, "encodeBase64Url");
+var decodeBase64Url = /* @__PURE__ */ __name2((value) => {
+  if (typeof value !== "string") return null;
+  const output = new Uint8Array(Math.floor(value.length * 6 / 8));
+  let bits = 0;
+  let bitCount = 0;
+  let outputIndex = 0;
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    const digit = code < 128 ? BASE64URL_LOOKUP[code] : -1;
+    if (digit < 0) return null;
+    bits = bits << 6 | digit;
+    bitCount += 6;
+    if (bitCount >= 8) {
+      bitCount -= 8;
+      output[outputIndex] = bits >> bitCount & 255;
+      outputIndex += 1;
+    }
+  }
+  return output;
+}, "decodeBase64Url");
+var isCanonicalBase64Url = /* @__PURE__ */ __name2((value, expectedBytes) => {
+  if (typeof value !== "string") return false;
+  if (expectedBytes !== void 0 && value.length !== Math.ceil(expectedBytes * 4 / 3))
+    return false;
+  const decoded = decodeBase64Url(value);
+  if (decoded === null) return false;
+  if (expectedBytes !== void 0 && decoded.length !== expectedBytes) return false;
+  return encodeBase64Url(decoded) === value;
+}, "isCanonicalBase64Url");
+var utf8ByteLength = /* @__PURE__ */ __name2((value) => new TextEncoder().encode(value).length, "utf8ByteLength");
+var canonicalBase64Url = /* @__PURE__ */ __name2((bytes) => external_exports.string().refine((value) => isCanonicalBase64Url(value, bytes), {
+  message: `must be canonical base64url for exactly ${bytes} bytes`
+}), "canonicalBase64Url");
+var ShareLinkIdValidator = canonicalBase64Url(SHARE_LINK_ID_BYTES);
+var ShareContentKeyValidator = canonicalBase64Url(SHARE_CONTENT_KEY_BYTES);
+var ShareIvValidator = canonicalBase64Url(SHARE_IV_BYTES);
+var ShareCiphertextValidator = external_exports.string().refine(
+  (value) => {
+    if (value.length > Math.ceil(MAX_SHARE_CIPHERTEXT_BYTES * 4 / 3)) return false;
+    const decoded = decodeBase64Url(value);
+    if (decoded === null) return false;
+    if (encodeBase64Url(decoded) !== value) return false;
+    return decoded.length >= SHARE_TAG_BYTES && decoded.length <= MAX_SHARE_CIPHERTEXT_BYTES;
+  },
+  {
+    message: `must be canonical base64url decoding to ${SHARE_TAG_BYTES}..${MAX_SHARE_CIPHERTEXT_BYTES} bytes`
   }
-  if (input.mode === "issuer-signed" && (input.credential !== void 0 || input.signingAuthority !== void 0)) {
+);
+var ShareEnvelopeValidator = external_exports.object({
+  v: external_exports.literal(1),
+  alg: external_exports.literal("A256GCM"),
+  iv: ShareIvValidator,
+  ct: ShareCiphertextValidator
+}).strict();
+var safeVersion = external_exports.number().int().min(1).max(2 ** 31 - 1);
+var safeCredentialIndex = external_exports.number().int().min(0).max(MAX_VP_MEMBERS - 1);
+var ShareSelectionEntryValidator = external_exports.object({ credentialIndex: safeCredentialIndex }).strict();
+var ShareEndorsementEntryValidator = external_exports.object({ credentialIndex: safeCredentialIndex, targetCredentialIndex: safeCredentialIndex }).strict();
+var ShareSharerValidator = external_exports.object({
+  profileId: external_exports.string().min(1).max(128),
+  displayName: external_exports.string().min(1).max(120),
+  avatar: external_exports.string().max(2048).optional()
+}).strict();
+var presentationShape = VPValidator.extend({
+  verifiableCredential: VCValidator.array().min(1).max(MAX_VP_MEMBERS)
+});
+var hasBoundedPresentation = /* @__PURE__ */ __name2((value) => {
+  let credentialCount = 0;
+  const ancestors = /* @__PURE__ */ new Set();
+  const visit = /* @__PURE__ */ __name2((node, depth) => {
+    if (node === null || typeof node !== "object") return true;
+    if (depth > 32 || ancestors.has(node)) return false;
+    ancestors.add(node);
+    try {
+      for (const [key, child] of Object.entries(node)) {
+        if (key === "verifiableCredential") {
+          credentialCount += Array.isArray(child) ? child.length : 1;
+          if (credentialCount > MAX_VP_MEMBERS) return false;
+        }
+        if (!visit(child, depth + 1)) return false;
+      }
+      return true;
+    } finally {
+      ancestors.delete(node);
+    }
+  }, "visit");
+  return visit(value, 0);
+}, "hasBoundedPresentation");
+var ShareManifestPresentationValidator = external_exports.custom(
+  (value) => hasBoundedPresentation(value) && presentationShape.safeParse(value).success,
+  { message: "invalid share presentation" }
+);
+var SharePayloadValidatorShape = external_exports.object({
+  protocol: external_exports.literal(SHARE_LINK_PROTOCOL),
+  shareId: ShareLinkIdValidator,
+  contentVersion: safeVersion,
+  createdAt: external_exports.iso.datetime(),
+  sharer: ShareSharerValidator,
+  presentation: ShareManifestPresentationValidator,
+  selection: ShareSelectionEntryValidator.array().min(1).max(MAX_SELECTED_CREDENTIALS),
+  endorsements: ShareEndorsementEntryValidator.array().max(MAX_ENDORSEMENTS).default([])
+}).strict();
+var classificationFailure = /* @__PURE__ */ __name2((code, message, path = []) => ({ ok: false, code, message, path }), "classificationFailure");
+var readSignedClaimId = /* @__PURE__ */ __name2((member) => {
+  if (member === null || typeof member !== "object") return void 0;
+  const record2 = member;
+  const claim = record2.credentialSubject ?? record2.endorsement;
+  if (claim === null || typeof claim !== "object") return void 0;
+  const claimRecord = claim;
+  const nested = claimRecord.endorsement;
+  const nestedId = nested !== null && typeof nested === "object" ? nested.id : void 0;
+  return claimRecord.id ?? nestedId;
+}, "readSignedClaimId");
+var classifyShareManifest = /* @__PURE__ */ __name2((payload) => {
+  const members = payload.presentation?.verifiableCredential;
+  if (!Array.isArray(members) || members.length === 0) {
+    return classificationFailure("NO_PRESENTATION_MEMBERS", "presentation has no credentials");
+  }
+  if (members.length > MAX_VP_MEMBERS) {
+    return classificationFailure(
+      "TOO_MANY_VP_MEMBERS",
+      `presentation has ${members.length} members, over the ${MAX_VP_MEMBERS} bound`
+    );
+  }
+  const selection = payload.selection;
+  const endorsements = payload.endorsements ?? [];
+  if (!Array.isArray(selection) || selection.length < 1 || selection.length > MAX_SELECTED_CREDENTIALS) {
+    return classificationFailure("BAD_SELECTION", "selection must contain 1..50 entries");
+  }
+  if (!Array.isArray(endorsements) || endorsements.length > MAX_ENDORSEMENTS) {
+    return classificationFailure(
+      "BAD_ENDORSEMENTS",
+      "endorsements must contain at most 200 entries"
+    );
+  }
+  const selectedIndices = [];
+  const selected = /* @__PURE__ */ new Set();
+  for (let index = 0; index < selection.length; index += 1) {
+    const entry = selection[index];
+    const credentialIndex = entry?.credentialIndex;
+    if (!Number.isSafeInteger(credentialIndex) || credentialIndex < 0 || credentialIndex >= members.length) {
+      return classificationFailure(
+        "SELECTION_INDEX_OUT_OF_BOUNDS",
+        `selection[${index}].credentialIndex is out of bounds`,
+        ["selection", index, "credentialIndex"]
+      );
+    }
+    if (selected.has(credentialIndex)) {
+      return classificationFailure(
+        "SELECTION_INDEX_DUPLICATE",
+        `selection[${index}].credentialIndex is duplicated`,
+        ["selection", index, "credentialIndex"]
+      );
+    }
+    selected.add(credentialIndex);
+    selectedIndices.push(credentialIndex);
+  }
+  const classified = new Set(selected);
+  const endorsementIndices = [];
+  for (let index = 0; index < endorsements.length; index += 1) {
+    const entry = endorsements[index];
+    const credentialIndex = entry?.credentialIndex;
+    const targetIndex = entry?.targetCredentialIndex;
+    if (!Number.isSafeInteger(credentialIndex) || credentialIndex < 0 || credentialIndex >= members.length) {
+      return classificationFailure(
+        "ENDORSEMENT_INDEX_OUT_OF_BOUNDS",
+        `endorsements[${index}].credentialIndex is out of bounds`,
+        ["endorsements", index, "credentialIndex"]
+      );
+    }
+    if (classified.has(credentialIndex)) {
+      return classificationFailure(
+        "VP_MEMBER_CLASSIFIED_TWICE",
+        `endorsements[${index}].credentialIndex was already classified`,
+        ["endorsements", index, "credentialIndex"]
+      );
+    }
+    if (!selected.has(targetIndex)) {
+      return classificationFailure(
+        "ENDORSEMENT_TARGET_NOT_SELECTED",
+        `endorsements[${index}].targetCredentialIndex must reference a selected credential`,
+        ["endorsements", index, "targetCredentialIndex"]
+      );
+    }
+    const referenced = readSignedClaimId(members[credentialIndex]);
+    const target = members[targetIndex];
+    const targetId = target !== null && typeof target === "object" ? target.id : void 0;
+    if (typeof referenced !== "string" || typeof targetId !== "string" || referenced !== targetId) {
+      return classificationFailure(
+        "ENDORSEMENT_TARGET_UNBOUND",
+        `endorsements[${index}] claim does not reference the target credential id`,
+        ["endorsements", index]
+      );
+    }
+    classified.add(credentialIndex);
+    endorsementIndices.push(credentialIndex);
+  }
+  if (classified.size !== members.length) {
+    return classificationFailure(
+      "UNCLASSIFIED_VP_MEMBER",
+      "every presentation member must be classified exactly once",
+      ["presentation", "verifiableCredential"]
+    );
+  }
+  return {
+    ok: true,
+    classification: { selectedIndices, endorsementIndices, memberCount: members.length }
+  };
+}, "classifyShareManifest");
+var SharePayloadValidator = SharePayloadValidatorShape.superRefine((payload, ctx) => {
+  const result = classifyShareManifest(payload);
+  if (!result.ok) {
     ctx.addIssue({
       code: "custom",
-      path: ["mode"],
-      message: "issuer-signed publication cannot include signing-authority fields"
+      message: result.message,
+      path: result.path,
+      params: { shareLinkCode: result.code }
     });
   }
-  if (input.mode === "signing-authority") {
-    if (input.signedCredential !== void 0) {
-      ctx.addIssue({
-        code: "custom",
-        path: ["signedCredential"],
-        message: "signing-authority publication cannot include signedCredential"
-      });
-    }
-    if (!input.credential) {
+});
+var ShareRecoverySelectionValidator = external_exports.object({
+  ref: external_exports.string().min(1).max(MAX_SHARE_SOURCE_URI_CHARS),
+  order: external_exports.number().int().min(0).max(MAX_SELECTED_CREDENTIALS - 1)
+}).strict();
+var ShareRecoveryEndorsementValidator = external_exports.object({ targetRef: external_exports.string().min(1).max(MAX_SHARE_SOURCE_URI_CHARS) }).strict();
+var ShareRecoveryPlaintextValidator = external_exports.object({
+  protocol: external_exports.literal(SHARE_RECOVERY_PROTOCOL),
+  shareId: ShareLinkIdValidator,
+  ownerProfileId: external_exports.string().min(1).max(128),
+  createdAt: external_exports.iso.datetime(),
+  latest: external_exports.object({ contentVersion: safeVersion, key: ShareContentKeyValidator }).strict(),
+  selection: ShareRecoverySelectionValidator.array().min(1).max(MAX_SELECTED_CREDENTIALS),
+  endorsements: ShareRecoveryEndorsementValidator.array().max(MAX_ENDORSEMENTS).default([])
+}).strict().superRefine((recovery, ctx) => {
+  const orders = /* @__PURE__ */ new Set();
+  recovery.selection.forEach((entry, index) => {
+    if (entry.order >= recovery.selection.length) {
       ctx.addIssue({
         code: "custom",
-        path: ["credential"],
-        message: "credential is required for signing-authority publication"
+        message: "order must be within the selection bounds",
+        path: ["selection", index, "order"]
       });
     }
-    if (!input.signingAuthority) {
+    if (orders.has(entry.order)) {
       ctx.addIssue({
         code: "custom",
-        path: ["signingAuthority"],
-        message: "signingAuthority is required for signing-authority publication"
+        message: "order must be unique within the selection",
+        path: ["selection", index, "order"]
       });
     }
+    orders.add(entry.order);
+  });
+});
+var ShareOwnerRecoveryValidator = JWEValidator.refine(
+  (value) => utf8ByteLength(JSON.stringify(value)) <= MAX_SHARE_RECOVERY_JWE_BYTES,
+  { message: `serialized recovery JWE must be at most ${MAX_SHARE_RECOVERY_JWE_BYTES} bytes` }
+);
+var ShareLinkStatusValidator = external_exports.enum(["pending", "active", "stopped"]);
+var ShareContentStateValidator = external_exports.enum(["staging", "finalized", "content_missing"]);
+var ShareLinkValidator = external_exports.object({
+  id: ShareLinkIdValidator,
+  title: external_exports.string().min(1).max(120),
+  note: external_exports.string().max(500).optional(),
+  selectedCount: external_exports.number().int().min(1).max(MAX_SELECTED_CREDENTIALS),
+  version: safeVersion,
+  contentVersion: safeVersion,
+  status: ShareLinkStatusValidator,
+  contentState: ShareContentStateValidator,
+  createdAt: external_exports.iso.datetime(),
+  updatedAt: external_exports.iso.datetime(),
+  expiresAt: external_exports.iso.datetime().nullable(),
+  stoppedAt: external_exports.iso.datetime().nullable(),
+  lastViewedAt: external_exports.iso.datetime().nullable(),
+  viewCount: external_exports.number().int().min(0).optional(),
+  passcodeProtected: external_exports.boolean(),
+  notifyOnView: external_exports.boolean(),
+  minorPolicy: external_exports.object({
+    isMinor: external_exports.boolean().nullable(),
+    policyResolved: external_exports.boolean(),
+    defaultExpiryDays: external_exports.union([external_exports.literal(30), external_exports.literal(365)]),
+    viewCountingEnabled: external_exports.boolean()
+  }),
+  /**
+   * Guarded application/API URL for the content. Optional because owner APIs in
+   * D1 have no public resolve/content endpoint yet; it must never be a
+   * LearnCloud object URL or carry a fabricated decryption key.
+   */
+  contentUrl: external_exports.string().optional()
+});
+var clientRequestId = external_exports.string().uuid();
+var CreateShareLinkInputValidator = external_exports.object({
+  id: ShareLinkIdValidator,
+  clientRequestId,
+  title: external_exports.string().min(1).max(120),
+  note: external_exports.string().max(500).optional(),
+  expiresAt: external_exports.iso.datetime().nullable().optional(),
+  passcode: external_exports.string().min(8).max(64).optional(),
+  notifyOnView: external_exports.boolean().default(false),
+  selectedCount: external_exports.number().int().min(1).max(MAX_SELECTED_CREDENTIALS),
+  contentVersion: external_exports.literal(1),
+  envelope: ShareEnvelopeValidator,
+  ownerEncryptedRecovery: ShareOwnerRecoveryValidator
+}).strict();
+var UpdateShareLinkInputValidator = external_exports.object({
+  id: ShareLinkIdValidator,
+  expectedVersion: safeVersion,
+  clientRequestId,
+  title: external_exports.string().min(1).max(120).optional(),
+  note: external_exports.string().max(500).nullable().optional(),
+  expiresAt: external_exports.iso.datetime().nullable().optional(),
+  /** Omitted preserves the current passcode, null removes it, and a string replaces it. */
+  passcode: external_exports.string().min(8).max(64).nullable().optional(),
+  notifyOnView: external_exports.boolean().optional(),
+  contentVersion: safeVersion.optional(),
+  selectedCount: external_exports.number().int().min(1).max(MAX_SELECTED_CREDENTIALS).optional(),
+  envelope: ShareEnvelopeValidator.optional(),
+  ownerEncryptedRecovery: ShareOwnerRecoveryValidator.optional()
+}).strict().superRefine((value, ctx) => {
+  const provided = [
+    value.contentVersion,
+    value.selectedCount,
+    value.envelope,
+    value.ownerEncryptedRecovery
+  ].filter((field) => field !== void 0).length;
+  if (provided !== 0 && provided !== 4) {
+    ctx.addIssue({
+      code: "custom",
+      message: "content replacement requires contentVersion, selectedCount, envelope and ownerEncryptedRecovery together"
+    });
   }
 });
-var PublishCredentialRefreshNotificationValidator = external_exports.enum([
-  "queued",
-  "suppressed",
-  "not-applicable",
-  /** Publication succeeded, but the post-commit notification enqueue must be retried. */
-  "delivery-failed"
+var ShareLinkIdInputValidator = external_exports.object({ id: ShareLinkIdValidator }).strict();
+var ShareLinkOperationKeyInputValidator = external_exports.object({ id: ShareLinkIdValidator, operationId: external_exports.string().uuid() }).strict();
+var ShareLinkOwnerCommitOutputValidator = external_exports.discriminatedUnion("status", [
+  external_exports.object({ status: external_exports.literal("completed"), share: ShareLinkValidator }).strict(),
+  external_exports.object({
+    status: external_exports.literal("pending"),
+    id: ShareLinkIdValidator,
+    operationId: external_exports.string().uuid()
+  }).strict()
 ]);
-var PublishCredentialRefreshResultValidator = external_exports.object({
-  refreshId: external_exports.string().min(1),
-  version: external_exports.number().int().positive(),
-  publishedAt: external_exports.string().min(1),
-  notification: PublishCredentialRefreshNotificationValidator
-});
-var CredentialRefreshVersionMetadataValidator = external_exports.object({
-  version: external_exports.number().int().positive(),
-  publishedAt: external_exports.string().min(1),
-  effectiveAt: external_exports.string().optional(),
-  etag: external_exports.string().optional(),
-  signingMode: CredentialRefreshSigningModeValidator.optional(),
-  updateSummary: external_exports.string().optional()
-});
-var GetCredentialRefreshHistoryInputValidator = external_exports.object({
-  refreshId: external_exports.string().min(1),
-  cursor: external_exports.string().optional(),
-  limit: external_exports.number().int().positive().optional()
-});
-var GetCredentialRefreshHistoryResultValidator = external_exports.object({
-  records: CredentialRefreshVersionMetadataValidator.array(),
-  hasMore: external_exports.boolean(),
-  cursor: external_exports.string().optional()
-});
-var CredentialRefreshChallengeValidator = external_exports.object({
-  challenge: external_exports.string().min(1),
-  expiresAt: external_exports.string().min(1),
-  domain: external_exports.string().optional(),
-  scheme: external_exports.literal("LearnCardDIDAuth").optional()
-});
-var PublicCredentialRefreshEnvelopeValidator = external_exports.object({
-  format: external_exports.literal("vc"),
-  credential: VCValidator,
-  etag: external_exports.string().optional()
-});
-var JweCredentialRefreshEnvelopeValidator = external_exports.object({
-  format: external_exports.literal("jwe"),
-  jwe: JWEValidator,
-  etag: external_exports.string().optional(),
-  /** Present on LearnCard-managed endpoints; optional for interoperable JWE services. */
-  version: external_exports.number().int().positive().optional()
-});
-var CredentialRefreshResponseEnvelopeValidator = external_exports.discriminatedUnion("format", [
-  PublicCredentialRefreshEnvelopeValidator,
-  JweCredentialRefreshEnvelopeValidator
+var ShareLinkOwnerStatusOutputValidator = external_exports.discriminatedUnion("status", [
+  external_exports.object({ status: external_exports.literal("found"), share: ShareLinkValidator }).strict(),
+  external_exports.object({
+    status: external_exports.literal("pending"),
+    id: ShareLinkIdValidator,
+    operationId: external_exports.string().uuid()
+  }).strict(),
+  external_exports.object({ status: external_exports.literal("not_found"), id: ShareLinkIdValidator }).strict()
 ]);
-var CredentialRefreshFailureCodeValidator = external_exports.enum([
-  "UNAVAILABLE",
-  "TIMEOUT",
-  "UNSUPPORTED_SERVICE",
-  "UNAUTHORIZED",
-  "MALFORMED_RESPONSE",
-  "INVALID_PROOF",
-  "ISSUER_MISMATCH",
-  "ID_MISMATCH",
-  "ROLLBACK",
-  "REVOKED",
-  "UNSAFE_ENDPOINT"
+var ShareLinkOwnerRecoveryOutputValidator = external_exports.object({ recovery: ShareOwnerRecoveryValidator }).strict();
+var ShareLinkOwnerContentOutputValidator = external_exports.object({
+  id: ShareLinkIdValidator,
+  contentVersion: safeVersion,
+  envelope: ShareEnvelopeValidator
+}).strict();
+var ResolveShareLinkInputValidator = external_exports.object({
+  id: ShareLinkIdValidator,
+  /** Sent only in a POST body; it must never be placed in a share URL. */
+  passcode: external_exports.string().min(4).max(64).optional()
+}).strict();
+var ShareLinkPublicStateValidator = external_exports.discriminatedUnion("state", [
+  external_exports.object({
+    state: external_exports.literal("passcode_required"),
+    id: ShareLinkIdValidator
+  }).strict(),
+  external_exports.object({ state: external_exports.literal("try_later"), id: ShareLinkIdValidator }).strict(),
+  external_exports.object({
+    state: external_exports.literal("active"),
+    id: ShareLinkIdValidator,
+    title: external_exports.string().max(120),
+    note: external_exports.string().max(500).optional(),
+    selectedCount: external_exports.number().int().min(1).max(MAX_SELECTED_CREDENTIALS),
+    contentVersion: safeVersion,
+    contentUrl: external_exports.string(),
+    sharer: external_exports.object({
+      displayName: external_exports.string().max(120),
+      avatar: external_exports.string().max(2048).optional()
+    }),
+    createdAt: external_exports.iso.datetime(),
+    updatedAt: external_exports.iso.datetime(),
+    expiresAt: external_exports.iso.datetime().nullable()
+  }).strict(),
+  external_exports.object({
+    state: external_exports.literal("expired"),
+    id: ShareLinkIdValidator,
+    expiresAt: external_exports.iso.datetime()
+  }).strict(),
+  external_exports.object({
+    state: external_exports.literal("stopped"),
+    id: ShareLinkIdValidator,
+    stoppedAt: external_exports.iso.datetime()
+  }).strict(),
+  external_exports.object({ state: external_exports.literal("not_found"), id: ShareLinkIdValidator }).strict()
 ]);
-var CredentialRefreshUpdatedResultValidator = external_exports.object({
-  status: external_exports.literal("updated"),
-  credential: VCValidator,
-  etag: external_exports.string().optional(),
-  managedVersion: external_exports.number().int().positive().optional()
-});
-var CredentialRefreshUnchangedResultValidator = external_exports.object({
-  status: external_exports.literal("unchanged"),
-  checkedAt: external_exports.string().min(1),
-  etag: external_exports.string().optional()
-});
-var CredentialRefreshUnsupportedResultValidator = external_exports.object({
-  status: external_exports.literal("unsupported")
-});
-var CredentialRefreshFailedResultValidator = external_exports.object({
-  status: external_exports.literal("failed"),
-  code: CredentialRefreshFailureCodeValidator,
-  retryable: external_exports.boolean()
+var ListShareLinksInputValidator = external_exports.object({
+  limit: external_exports.number().int().min(1).max(50).default(25),
+  cursor: external_exports.string().max(512).optional()
+}).strict();
+var PaginatedShareLinksValidator = PaginationResponseValidator.extend({
+  records: ShareLinkValidator.array()
 });
-var CredentialRefreshResultValidator = external_exports.discriminatedUnion("status", [
-  CredentialRefreshUpdatedResultValidator,
-  CredentialRefreshUnchangedResultValidator,
-  CredentialRefreshUnsupportedResultValidator,
-  CredentialRefreshFailedResultValidator
-]);
+var AcknowledgeViewInputValidator = external_exports.object({
+  receipt: external_exports.string().min(22).max(128).regex(/^[A-Za-z0-9_-]+$/)
+}).strict();
+var AcknowledgeViewOutputValidator = external_exports.object({ ok: external_exports.literal(true) }).strict();
+var SHARE_VIEW_RECEIPT_TTL_SECONDS = 10 * 60;
+var ShareLinkPublicContentViewValidator = external_exports.object({
+  id: ShareLinkIdValidator,
+  contentVersion: safeVersion,
+  envelope: ShareEnvelopeValidator,
+  contentUrl: external_exports.string(),
+  receipt: external_exports.string().min(22).max(128).regex(/^[A-Za-z0-9_-]+$/)
+}).strict();
 
 // src/plugin.ts
 var import_helpers = require("@learncard/helpers");
@@ -17912,27 +18590,40 @@ var issueCredentialWithNetworkStatus = /* @__PURE__ */ __name(async (learnCard,
     await appendNetworkCredentialStatus(client, credential, statusPurposes)
   );
 }, "issueCredentialWithNetworkStatus");
-var MANAGED_REFRESH_SERVICE_CONTEXT = {
-  "LearnCardCredentialRefresh2026": "https://learncard.com/refresh#LearnCardCredentialRefresh2026",
-  authorization: {
-    "@id": "https://purl.imsglobal.org/spec/ob/v3p0#authorization",
-    "@context": {
-      LearnCardDIDAuth: "https://docs.learncard.com/definitions#LearnCardDIDAuth"
-    }
-  }
-};
-var injectManagedRefreshService = /* @__PURE__ */ __name((credential, refreshService) => {
-  const existingContext = credential["@context"];
-  const contextList = Array.isArray(existingContext) ? existingContext : [existingContext];
-  const hasMapping = contextList.some(
-    (entry) => !!entry && typeof entry === "object" && "LearnCardCredentialRefresh2026" in entry
-  );
+var injectManagedRefreshService = /* @__PURE__ */ __name((credential, refreshService) => (0, import_helpers.injectManagedRefreshService)(credential, refreshService), "injectManagedRefreshService");
+var getCredentialSubjectIds = /* @__PURE__ */ __name((vc) => {
+  const subject = vc.credentialSubject;
+  const subjects = Array.isArray(subject) ? subject : subject ? [subject] : [];
+  return subjects.flatMap((entry) => {
+    const id = entry?.id;
+    return typeof id === "string" && id.length > 0 ? [id] : [];
+  });
+}, "getCredentialSubjectIds");
+var buildManagedRefreshReceipt = /* @__PURE__ */ __name((vc, allocation, credentialId, fallbackHolderDid, fallbackIssuerDid) => {
+  const issuerDid = (0, import_helpers.getCredentialIssuerId)(vc) ?? fallbackIssuerDid;
+  const holderDid = getCredentialSubjectIds(vc)[0] ?? fallbackHolderDid;
+  const rawStatus = vc.credentialStatus;
+  const hasStatus = rawStatus !== void 0 && rawStatus !== null && !(Array.isArray(rawStatus) && rawStatus.length === 0);
   return {
-    ...credential,
-    "@context": hasMapping ? contextList : [...contextList, MANAGED_REFRESH_SERVICE_CONTEXT],
-    refreshService
-  };
-}, "injectManagedRefreshService");
+    refreshId: allocation.refreshId,
+    refreshService: allocation.refreshService,
+    credentialId: typeof vc.id === "string" && vc.id.length > 0 ? vc.id : credentialId,
+    issuerDid,
+    holderDid,
+    ...hasStatus ? {
+      credentialStatus: rawStatus
+    } : {}
+  };
+}, "buildManagedRefreshReceipt");
+var ACT_AS_TARGET_NOT_FOUND_MESSAGE = "Act-as target profile not found";
+var isActAsDenial = /* @__PURE__ */ __name((error51) => {
+  const code = error51?.data?.code;
+  if (code === "FORBIDDEN" || code === "BAD_REQUEST") return true;
+  if (code === "NOT_FOUND") {
+    return error51?.message === ACT_AS_TARGET_NOT_FOUND_MESSAGE;
+  }
+  return false;
+}, "isActAsDenial");
 async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, options) {
   const apiToken = typeof apiTokenOrOptions === "string" ? apiTokenOrOptions : void 0;
   const resolvedOptions = (typeof apiTokenOrOptions === "object" ? apiTokenOrOptions : options) ?? {};
@@ -17940,8 +18631,10 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
     guardianApprovalGetter,
     extraHeaders,
     trustedFederationHosts,
-    allowLocalhostFederation
+    allowLocalhostFederation,
+    actAs
   } = resolvedOptions;
+  const mergedExtraHeaders = actAs ? { ...extraHeaders, [ACT_AS_HEADER]: actAs } : extraHeaders;
   const serviceUrl = new URL(url2);
   const serviceIsLocalhost = isLocalhostHost(serviceUrl.hostname);
   const federationConfig = {
@@ -17959,7 +18652,7 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
     learnCard?.debug?.("LCN: no local DID available at init; will fetch from profile");
   }
   learnCard?.debug?.("Adding LearnCardNetwork Plugin");
-  const client = apiToken ? await (0, import_network_brain_client.getApiTokenClient)(url2, apiToken, guardianApprovalGetter, extraHeaders) : await (0, import_network_brain_client.getClient)(
+  const client = apiToken ? await (0, import_network_brain_client.getApiTokenClient)(url2, apiToken, guardianApprovalGetter, mergedExtraHeaders) : await (0, import_network_brain_client.getClient)(
     url2,
     async (challenge) => {
       const jwt2 = await learnCard.invoke.getDidAuthVp({
@@ -17970,7 +18663,7 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
       return jwt2;
     },
     guardianApprovalGetter,
-    extraHeaders
+    mergedExtraHeaders
   );
   let userData;
   learnCard?.debug?.("LCN: initial getProfile query starting", { apiToken: !!apiToken });
@@ -18173,6 +18866,23 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
       getManagedProfiles: /* @__PURE__ */ __name(async (_learnCard, options2 = {}) => {
         return client.profileManager.getManagedProfiles.query(options2);
       }, "getManagedProfiles"),
+      actAs: /* @__PURE__ */ __name(async (_learnCard, profileId) => {
+        const actingOptions = {
+          ...resolvedOptions,
+          actAs: profileId
+        };
+        const actingPlugin = apiToken ? await getLearnCardNetworkPlugin(_learnCard, url2, apiToken, actingOptions) : await getLearnCardNetworkPlugin(_learnCard, url2, actingOptions);
+        try {
+          await actingPlugin.methods.getLCNClient(_learnCard).profile.getProfile.query();
+        } catch (error51) {
+          if (isActAsDenial(error51)) {
+            const message = error51 instanceof Error ? error51.message : "Act-as request was denied.";
+            throw new Error(message, { cause: error51 });
+          }
+          _learnCard.debug?.("LCN actAs: getProfile failed (non-fatal)", error51);
+        }
+        return _learnCard.addPlugin(actingPlugin);
+      }, "actAs"),
       claimPendingGuardianLinks: /* @__PURE__ */ __name(async () => {
         await ensureUser();
         return client.inbox.claimPendingGuardianLinks.mutate({});
@@ -18326,6 +19036,49 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
         await ensureUser();
         return client.profile.invalidateInvite.mutate({ challenge });
       }, "invalidateInvite"),
+      createShareLink: /* @__PURE__ */ __name(async (_learnCard, input) => {
+        await ensureUser();
+        return client.shareLinks.create.mutate(input);
+      }, "createShareLink"),
+      updateShareLink: /* @__PURE__ */ __name(async (_learnCard, input) => {
+        await ensureUser();
+        return client.shareLinks.update.mutate(input);
+      }, "updateShareLink"),
+      revokeShareLink: /* @__PURE__ */ __name(async (_learnCard, input) => {
+        await ensureUser();
+        return client.shareLinks.revoke.mutate(input);
+      }, "revokeShareLink"),
+      getShareLink: /* @__PURE__ */ __name(async (_learnCard, id) => {
+        await ensureUser();
+        return client.shareLinks.get.query({ id });
+      }, "getShareLink"),
+      getShareLinkOperationStatus: /* @__PURE__ */ __name(async (_learnCard, input) => {
+        await ensureUser();
+        return client.shareLinks.getOperationStatus.query(input);
+      }, "getShareLinkOperationStatus"),
+      retryShareLinkOperation: /* @__PURE__ */ __name(async (_learnCard, input) => {
+        await ensureUser();
+        return client.shareLinks.retry.mutate(input);
+      }, "retryShareLinkOperation"),
+      getShareLinkRecovery: /* @__PURE__ */ __name(async (_learnCard, id) => {
+        await ensureUser();
+        return client.shareLinks.getRecovery.query({ id });
+      }, "getShareLinkRecovery"),
+      getShareLinkOwnerContent: /* @__PURE__ */ __name(async (_learnCard, id) => {
+        await ensureUser();
+        return client.shareLinks.getContent.query({ id });
+      }, "getShareLinkOwnerContent"),
+      listShareLinks: /* @__PURE__ */ __name(async (_learnCard, input) => {
+        await ensureUser();
+        return client.shareLinks.list.query(input);
+      }, "listShareLinks"),
+      // Anonymous public methods: deliberately NO `ensureUser()`. A viewer
+      // has no account and must not need one.
+      // POST keeps an optional passcode in the request body and out of URLs,
+      // access logs, browser history and referrers.
+      resolveShareLink: /* @__PURE__ */ __name(async (_learnCard, id, passcode) => client.publicShareLinks.resolve.mutate({ id, passcode }), "resolveShareLink"),
+      getShareLinkContent: /* @__PURE__ */ __name(async (_learnCard, id, passcode) => client.publicShareLinks.content.mutate({ id, passcode }), "getShareLinkContent"),
+      acknowledgeShareLinkView: /* @__PURE__ */ __name(async (_learnCard, receipt) => client.publicShareLinks.acknowledgeView.mutate({ receipt }), "acknowledgeShareLinkView"),
       blockProfile: /* @__PURE__ */ __name(async (_learnCard, profileId) => {
         await ensureUser();
         return client.profile.blockProfile.mutate({ profileId });
@@ -18440,12 +19193,15 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
         await ensureUser();
         return client.credential.deleteCredential.mutate({ uri });
       }, "deleteCredential"),
-      sendPresentation: /* @__PURE__ */ __name(async (_learnCard, profileId, vp, encrypt = true) => {
+      sendPresentation: /* @__PURE__ */ __name(async (_learnCard, profileId, vp, metadataOrEncrypt, encrypt) => {
         await ensureUser();
-        if (!encrypt) {
+        const metadata = typeof metadataOrEncrypt === "object" ? metadataOrEncrypt : void 0;
+        const shouldEncrypt = typeof metadataOrEncrypt === "boolean" ? metadataOrEncrypt : encrypt ?? true;
+        if (!shouldEncrypt) {
           return client.presentation.sendPresentation.mutate({
             profileId,
-            presentation: vp
+            presentation: vp,
+            metadata
           });
         }
         const target = await _learnCard.invoke.getProfile(profileId);
@@ -18455,7 +19211,11 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
           _learnCard.id.did(),
           target.did
         ]);
-        return client.presentation.sendPresentation.mutate({ profileId, presentation });
+        return client.presentation.sendPresentation.mutate({
+          profileId,
+          presentation,
+          metadata
+        });
       }, "sendPresentation"),
       acceptPresentation: /* @__PURE__ */ __name(async (_learnCard, uri) => {
         await ensureUser();
@@ -18782,15 +19542,14 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
           boost = options2.overideFn(boost);
         }
         const enableRefresh = typeof options2 === "object" && options2.enableRefresh === true;
-        let managedRefreshId;
+        let refreshAllocation;
         if (enableRefresh) {
           if (!boost.id) boost.id = `urn:uuid:${crypto.randomUUID()}`;
-          const allocation = await client.credentialRefresh.allocateCredentialRefresh.mutate({
+          refreshAllocation = await client.credentialRefresh.allocateCredentialRefresh.mutate({
             holder: { profileId, did: targetProfile.did },
             credentialId: boost.id
           });
-          managedRefreshId = allocation.refreshId;
-          boost = injectManagedRefreshService(boost, allocation.refreshService);
+          boost = injectManagedRefreshService(boost, refreshAllocation.refreshService);
         }
         const statusPurposes = typeof options2 === "object" ? options2.statusPurposes : void 0;
         const vc = await issueCredentialWithNetworkStatus(
@@ -18799,13 +19558,23 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
           boost,
           statusPurposes
         );
-        if (managedRefreshId) {
-          return client.credentialRefresh.sendRefreshableCredential.mutate({
-            refreshId: managedRefreshId,
+        if (refreshAllocation) {
+          const credentialUri = await client.credentialRefresh.sendRefreshableCredential.mutate({
+            refreshId: refreshAllocation.refreshId,
             credential: vc,
             boostUri,
             ...typeof options2 === "object" && options2.skipNotification ? { skipNotification: true } : {}
           });
+          return {
+            credentialUri,
+            refresh: buildManagedRefreshReceipt(
+              vc,
+              refreshAllocation,
+              boost.id ?? "",
+              targetProfile.did,
+              _learnCard.id.did()
+            )
+          };
         }
         if (typeof options2 === "object" && !options2.encrypt || !options2) {
           return client.boost.sendBoost.mutate({
@@ -18871,6 +19640,94 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
       }, "claimBoostWithLink"),
       send: /* @__PURE__ */ __name(async (_learnCard, input) => {
         await ensureUser();
+        if (input.type === "boost" && input.refresh === true) {
+          const isEmail = /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(input.recipient);
+          const isPhone = /^\+?[\d\s-]{10,}$/.test(input.recipient.replace(/[\s-]/g, ""));
+          if (isEmail || isPhone) return client.boost.send.mutate(input);
+          const canIssueLocally = "issueCredential" in _learnCard.invoke;
+          if (canIssueLocally && !input.signedCredential && (input.templateUri || input.template)) {
+            let boost;
+            if (input.templateUri) {
+              const result = await getBoostTemplateForIssuance(
+                _learnCard,
+                input.templateUri
+              );
+              const data = await UnsignedVCValidator.spa(result);
+              if (!data.success)
+                throw new Error("Did not get a valid boost from URI");
+              boost = data.data;
+            } else {
+              boost = JSON.parse(
+                JSON.stringify(input.template.credential)
+              );
+            }
+            const prepared = await client.boost.prepareRefreshableSend.mutate({
+              recipient: input.recipient,
+              ...input.templateUri ? { templateUri: input.templateUri } : { template: input.template },
+              ...input.contractUri ? { contractUri: input.contractUri } : {},
+              ...input.templateData ? { templateData: input.templateData } : {},
+              ...input.integrationId ? { integrationId: input.integrationId } : {},
+              ...boost.id ? { credentialId: boost.id } : {},
+              ...input.idempotencyKey ? { idempotencyKey: input.idempotencyKey } : {}
+            });
+            if (prepared.completed) return prepared.completed;
+            const boostString = JSON.stringify(boost);
+            const allowAutoAppendEvidence = !hasDynamicEvidenceTemplate(boostString);
+            if (input.templateData && Object.keys(input.templateData).length > 0) {
+              try {
+                const rendered = renderTemplateJson(
+                  boostString,
+                  input.templateData
+                );
+                boost = JSON.parse(rendered);
+                boost = appendTemplateEvidence(
+                  boost,
+                  input.templateData,
+                  allowAutoAppendEvidence
+                );
+              } catch (error51) {
+                throw new Error(
+                  `Failed to apply template data: ${error51 instanceof Error ? error51.message : "Unknown error"}`,
+                  { cause: error51 }
+                );
+              }
+            }
+            if ((0, import_helpers.isVC2Format)(boost)) {
+              boost.validFrom = (/* @__PURE__ */ new Date()).toISOString();
+            } else {
+              boost.issuanceDate = (/* @__PURE__ */ new Date()).toISOString();
+            }
+            boost.issuer = _learnCard.id.did();
+            if (Array.isArray(boost.credentialSubject)) {
+              boost.credentialSubject = boost.credentialSubject.map((subject) => ({
+                ...subject,
+                id: prepared.holderDid
+              }));
+            } else {
+              boost.credentialSubject = {
+                ...boost.credentialSubject,
+                id: prepared.holderDid
+              };
+            }
+            boost.id = prepared.credentialId;
+            if (boost.type?.includes("BoostCredential"))
+              boost.boostId = prepared.boostUri;
+            boost = injectManagedRefreshService(boost, prepared.refreshService);
+            const signedCredential = await issueCredentialWithNetworkStatus(
+              _learnCard,
+              client,
+              boost
+            );
+            return client.boost.send.mutate({
+              ...input,
+              template: void 0,
+              templateUri: prepared.boostUri,
+              signedCredential,
+              refresh: true
+            });
+          }
+          return client.boost.send.mutate(input);
+        }
         if (input.type === "boost") {
           const recipient = input.recipient;
           const isDid = recipient.startsWith("did:");
@@ -19277,6 +20134,37 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
         await ensureUser();
         return client.inbox.issue.mutate(issueInboxCredential);
       }, "sendCredentialViaInbox"),
+      sendCredentialsViaInbox: /* @__PURE__ */ __name(async (_learnCard, batch) => {
+        await ensureUser();
+        return client.inbox.issueBatch.mutate(batch);
+      }, "sendCredentialsViaInbox"),
+      sendCredentialBatchViaInbox: /* @__PURE__ */ __name(async (_learnCard, batch) => {
+        await ensureUser();
+        return client.inbox.issueBatch.mutate(batch);
+      }, "sendCredentialBatchViaInbox"),
+      waitForInboxCredentialBatch: /* @__PURE__ */ __name(async (_learnCard, batchId, options2) => {
+        await ensureUser();
+        return waitForInboxCredentialBatch(
+          (signal) => client.inbox.getBatch.query({ batchId }, { signal }),
+          options2
+        );
+      }, "waitForInboxCredentialBatch"),
+      sendCredentialsViaInboxAndWait: /* @__PURE__ */ __name(async (_learnCard, batch, options2) => {
+        await ensureUser();
+        if (options2?.signal?.aborted) throw options2.signal.reason;
+        const receipt = await client.inbox.issueBatch.mutate(batch, {
+          signal: options2?.signal
+        });
+        await options2?.onSubmitted?.(receipt);
+        return waitForInboxCredentialBatch(
+          (signal) => client.inbox.getBatch.query({ batchId: receipt.batchId }, { signal }),
+          options2
+        );
+      }, "sendCredentialsViaInboxAndWait"),
+      getInboxCredentialBatch: /* @__PURE__ */ __name(async (_learnCard, batchId) => {
+        await ensureUser();
+        return client.inbox.getBatch.query({ batchId });
+      }, "getInboxCredentialBatch"),
       getMySentInboxCredentials: /* @__PURE__ */ __name(async (_learnCard, options2) => {
         await ensureUser();
         return client.inbox.getMyIssuedCredentials.query(options2);