@learncard/network-plugin 3.2.3 → 4.0.0

package/dist/lcn-plugin.esm.js

@@ -53,7 +53,7 @@ var waitForInboxCredentialBatch = /* @__PURE__ */ __name(async (read, options =
 }, "waitForInboxCredentialBatch");
 
 // src/plugin.ts
-import { getClient, getApiTokenClient } from "@learncard/network-brain-client";
+import { getClient, getApiTokenClient, getAnonymousClient } from "@learncard/network-brain-client";
 
 // ../../../node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -21030,12 +21030,46 @@ var StringQuery = external_exports.union([
     $or: BaseStringQuery.array()
   })
 ]);
+var BITSTRING_STATUS_PURPOSES = ["revocation", "suspension"];
+var BitstringStatusPurposeValidator = external_exports.enum(BITSTRING_STATUS_PURPOSES);
+var BitstringStatusListEntryValidator = external_exports.object({
+  id: external_exports.string().optional(),
+  type: external_exports.literal("BitstringStatusListEntry"),
+  statusPurpose: BitstringStatusPurposeValidator,
+  statusListIndex: external_exports.string().or(external_exports.number().int().nonnegative()),
+  statusListCredential: external_exports.string()
+});
+var AllocatedBitstringStatusListEntryValidator = BitstringStatusListEntryValidator.extend({
+  id: external_exports.string()
+});
+var BitstringStatusListCredentialSubjectValidator = external_exports.object({
+  id: external_exports.string().optional(),
+  type: external_exports.literal("BitstringStatusList"),
+  statusPurpose: BitstringStatusPurposeValidator,
+  encodedList: external_exports.string()
+});
+var AllocateCredentialStatusInputValidator = external_exports.object({
+  statusPurposes: external_exports.array(BitstringStatusPurposeValidator).optional(),
+  listSize: external_exports.number().int().positive().optional()
+}).default({});
+var AttachCredentialRefreshStatusEntriesInputValidator = external_exports.object({
+  refreshId: external_exports.string().min(1),
+  credentialStatus: CredentialStatusValidator.or(CredentialStatusValidator.array()).nullable()
+});
 var LearnCardRefreshAuthorizationValidator = external_exports.object({ type: external_exports.literal("LearnCardDIDAuth") }).catchall(external_exports.any());
 var ManagedCredentialRefreshServiceValidator = external_exports.object({
   id: external_exports.string().min(1),
   type: external_exports.literal("LearnCardCredentialRefresh2026"),
   authorization: LearnCardRefreshAuthorizationValidator.optional()
 }).catchall(external_exports.any());
+var ManagedCredentialRefreshBindingValidator = ManagedCredentialRefreshServiceValidator.or(
+  RefreshServiceValidator.array().refine(
+    (services) => services.some(
+      (service) => ManagedCredentialRefreshServiceValidator.safeParse(service).success
+    ),
+    "A managed refresh service is required"
+  )
+);
 var StandardCredentialRefreshServiceValidator = external_exports.object({
   id: external_exports.string().min(1),
   type: external_exports.literal("1EdTechCredentialRefresh")
@@ -21059,7 +21093,9 @@ var AllocateCredentialRefreshResultValidator = external_exports.object({
 });
 var ManagedCredentialRefreshReceiptValidator = external_exports.object({
   refreshId: external_exports.string().min(1),
-  refreshService: ManagedCredentialRefreshServiceValidator,
+  refreshService: ManagedCredentialRefreshBindingValidator,
+  /** Legacy receipts authenticate only the allocated managed entry, not other services. */
+  refreshServiceBinding: external_exports.literal("managed-entry").optional(),
   credentialId: external_exports.string().min(1),
   issuerDid: external_exports.string().min(1),
   holderDid: external_exports.string().min(1),
@@ -21067,14 +21103,43 @@ var ManagedCredentialRefreshReceiptValidator = external_exports.object({
     CredentialStatusValidator.array()
   ).optional()
 }).strip();
+var GetCredentialRefreshReceiptInputValidator = external_exports.object({ uri: external_exports.string().min(1) });
+var CredentialRefreshReceiptValidator = ManagedCredentialRefreshReceiptValidator.extend({
+  encryptionMode: external_exports.enum(["network", "holder"])
+});
+var HolderEncryptedHandoffValidator = external_exports.object({
+  refreshId: external_exports.string().min(1),
+  credentialId: external_exports.string().min(1),
+  holderDid: external_exports.string().min(1),
+  issuerDid: external_exports.string().min(1),
+  credentialStatus: CredentialStatusValidator.or(CredentialStatusValidator.array()),
+  refreshService: ManagedCredentialRefreshBindingValidator.optional(),
+  jwe: JWEValidator
+}).strict();
+var SendHolderEncryptedRefreshableInputValidator = external_exports.object({
+  handoff: HolderEncryptedHandoffValidator,
+  idempotencyKey: external_exports.string().min(1).optional(),
+  boostUri: external_exports.string().optional(),
+  skipNotification: external_exports.boolean().optional()
+});
+var GetEncryptionRecipientsInputValidator = external_exports.object({ refreshId: external_exports.string().min(1) });
+var EncryptionRecipientsResultValidator = external_exports.object({
+  recipientKeyIds: external_exports.array(external_exports.string())
+});
 var InboxCredentialRefreshReceiptValidator = ManagedCredentialRefreshReceiptValidator.omit(
   { holderDid: true }
 ).extend({ holderDid: external_exports.string().min(1).optional() });
 var CredentialRefreshSigningModeValidator = external_exports.enum(["issuer-signed", "signing-authority"]);
+var CredentialRefreshUpdateReasonValidator = external_exports.enum(["corrected", "updated", "reissued"]);
 var PublishCredentialRefreshBaseFields = {
   refreshId: external_exports.string().min(1),
   notifyHolder: external_exports.boolean().optional(),
-  updateSummary: external_exports.string().optional(),
+  updateSummary: external_exports.string().max(280).optional().describe(
+    "Public legacy update summary. Do not include private claims; prefer updateReason."
+  ),
+  updateReason: CredentialRefreshUpdateReasonValidator.optional().describe(
+    "Public reason for this update"
+  ),
   idempotencyKey: external_exports.string().optional()
 };
 var PublishIssuerSignedRefreshValidator = external_exports.object({
@@ -21150,13 +21215,25 @@ var PublishCredentialRefreshResultValidator = external_exports.object({
   publishedAt: external_exports.string().min(1),
   notification: PublishCredentialRefreshNotificationValidator
 });
+var PublishHolderEncryptedRefreshInputValidator = external_exports.object({
+  handoff: HolderEncryptedHandoffValidator,
+  notify: external_exports.boolean(),
+  updateSummary: external_exports.string().max(280).optional().describe(
+    "Public legacy update summary. Do not include private claims; prefer updateReason."
+  ),
+  updateReason: CredentialRefreshUpdateReasonValidator.optional().describe(
+    "Public reason for this update"
+  ),
+  idempotencyKey: external_exports.string().optional()
+});
 var CredentialRefreshVersionMetadataValidator = external_exports.object({
   version: external_exports.number().int().positive(),
   publishedAt: external_exports.string().min(1),
   effectiveAt: external_exports.string().optional(),
   etag: external_exports.string().optional(),
   signingMode: CredentialRefreshSigningModeValidator.optional(),
-  updateSummary: external_exports.string().optional()
+  updateSummary: external_exports.string().optional(),
+  updateReason: CredentialRefreshUpdateReasonValidator.optional()
 });
 var GetCredentialRefreshHistoryInputValidator = external_exports.object({
   refreshId: external_exports.string().min(1),
@@ -21199,6 +21276,7 @@ var CredentialRefreshFailureCodeValidator = external_exports.enum([
   "INVALID_PROOF",
   "ISSUER_MISMATCH",
   "ID_MISMATCH",
+  "BINDING_MISMATCH",
   "ROLLBACK",
   "REVOKED",
   "UNSAFE_ENDPOINT"
@@ -21523,6 +21601,11 @@ var AutoBoostConfigValidator = external_exports.object({
     name: external_exports.string()
   })
 });
+var CredentialDisplayValidator = external_exports.object({
+  name: external_exports.string().trim().min(1).max(280).optional(),
+  category: external_exports.string().max(280).optional(),
+  image: external_exports.string().max(2048).url().refine((url2) => url2.startsWith("https://"), { message: "Image URL must use https" }).optional()
+});
 var SendBoostTemplateValidator = BoostValidator.partial().omit({ uri: true, claimPermissions: true }).extend({
   credential: VCValidator.or(UnsignedVCValidator),
   claimPermissions: BoostPermissionsValidator.partial().optional(),
@@ -21561,6 +21644,10 @@ var SendBoostInputValidator = external_exports.object({
   templateUri: external_exports.string().optional(),
   template: SendBoostTemplateValidator.optional(),
   signedCredential: VCValidator.optional(),
+  display: CredentialDisplayValidator.optional().describe(
+    "Public display metadata for managed and signed-only sends. Nothing is inferred from credential content; omitted names use generic copy. The exception is category: when display.category is omitted for an inline template, the template's category is copied, since consent-flow write authorization is keyed on it."
+  ),
+  statusPurposes: external_exports.array(BitstringStatusPurposeValidator).optional(),
   options: SendOptionsValidator.optional().describe(
     "Options for email/phone recipients (Universal Inbox)"
   ),
@@ -21599,7 +21686,10 @@ var SendInboxResponseValidator = external_exports.object({
     "Present when guardianEmail was specified"
   )
 });
+var StatusManagementValidator = external_exports.enum(["network", "external", "mixed", "none"]);
 var SendBoostResponseValidator = external_exports.object({
+  /** Public status providers for a managed send; external entries require provider-side updates. */
+  statusManagement: StatusManagementValidator.optional(),
   type: external_exports.literal("boost"),
   credentialUri: external_exports.string(),
   uri: external_exports.string(),
@@ -21612,19 +21702,33 @@ var SendBoostResponseValidator = external_exports.object({
   )
 });
 var PrepareRefreshableSendInputValidator = external_exports.object({
+  /** Opt in to signing the server-bound statusEntries; omission preserves client allocation. */
+  statusBinding: external_exports.literal("server").optional(),
+  statusPurposes: external_exports.array(BitstringStatusPurposeValidator).optional(),
   recipient: external_exports.string(),
   templateUri: external_exports.string().optional(),
   template: SendBoostTemplateValidator.optional(),
+  display: CredentialDisplayValidator.optional().describe("Public display metadata only"),
   contractUri: external_exports.string().optional(),
   templateData: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
   integrationId: external_exports.string().optional(),
   /** Credential ID to allocate for; generated server-side when omitted. */
   credentialId: external_exports.string().min(1).optional(),
-  idempotencyKey: external_exports.string().min(1).max(200).optional()
-}).refine((data) => Boolean(data.templateUri) !== Boolean(data.template), {
-  message: "Provide exactly one of templateUri or template."
+  idempotencyKey: external_exports.string().min(1).max(200).optional(),
+  /**
+   * `'holder'` requests student-only encryption (LC-2345): the SDK signs and
+   * encrypts locally and the server never receives plaintext. Requires a
+   * profile or DID recipient; rejected for signedCredential-only sends and for
+   * inbox (email/phone) recipients. Defaults to `'network'`.
+   */
+  encryption: external_exports.enum(["network", "holder"]).optional()
+}).refine((data) => !(data.templateUri && data.template), {
+  message: "Provide at most one of templateUri or template."
 });
 var PrepareRefreshableSendResultValidator = external_exports.object({
+  /** Public status providers known at preparation; final send reports the signed entries. */
+  statusManagement: StatusManagementValidator.optional(),
+  statusEntries: external_exports.array(BitstringStatusListEntryValidator).optional(),
   boostUri: external_exports.string(),
   credentialId: external_exports.string(),
   refreshId: external_exports.string(),
@@ -21632,11 +21736,110 @@ var PrepareRefreshableSendResultValidator = external_exports.object({
   /** The DID to use as credentialSubject.id (recipient DID, or the profile's did:web). */
   holderDid: external_exports.string(),
   /** Present when this idempotencyKey already completed: return it without signing. */
-  completed: SendBoostResponseValidator.optional()
+  completed: SendBoostResponseValidator.optional(),
+  /**
+   * Present only when `encryption: 'holder'` was requested: the exact
+   * key-agreement verification-method ids (holder + current managers) the SDK
+   * must encrypt to. Recomputed on every call, so a later manager change can
+   * make a previously-prepared set stale (see `credentialRefresh.sendHolderEncryptedRefreshable`
+   * and `credentialRefresh.getEncryptionRecipients`).
+   */
+  recipientKeyIds: external_exports.array(external_exports.string()).optional()
 });
 var SendInputValidator = external_exports.discriminatedUnion("type", [SendBoostInputValidator]);
 var SendResponseValidator = external_exports.discriminatedUnion("type", [SendBoostResponseValidator]);
-var ConsentFlowTermsStatusValidator = external_exports.enum(["live", "stale", "withdrawn"]);
+var ConsentFlowTermsStatusValidator = external_exports.enum([
+  "live",
+  "consumed",
+  "withdrawn",
+  "needs_reconsent",
+  "suspended"
+]);
+var ConsentFlowContractChangeKindValidator = external_exports.enum([
+  "relaxed",
+  "expanded_optional",
+  "requires_consent"
+]);
+var ConsentFlowContractScopeValidator = external_exports.object({
+  area: external_exports.enum(["read", "write"]),
+  type: external_exports.enum(["credential", "personal"]),
+  key: external_exports.string(),
+  required: external_exports.boolean(),
+  reason: external_exports.string().optional()
+});
+var ConsentFlowContractDetailValueValidator = external_exports.union([
+  external_exports.string(),
+  external_exports.boolean(),
+  external_exports.string().array()
+]);
+var ConsentFlowContractDetailChangeValidator = external_exports.object({
+  field: external_exports.enum([
+    "name",
+    "subtitle",
+    "description",
+    "reasonForAccessing",
+    "image",
+    "needsGuardianConsent",
+    "redirectUrl",
+    "frontDoorBoostUri",
+    "expiresAt",
+    "writers",
+    "autoboosts"
+  ]),
+  before: ConsentFlowContractDetailValueValidator.optional(),
+  after: ConsentFlowContractDetailValueValidator.optional()
+});
+var ConsentFlowContractDiffValidator = external_exports.object({
+  added: ConsentFlowContractScopeValidator.array(),
+  removed: ConsentFlowContractScopeValidator.array(),
+  changed: ConsentFlowContractScopeValidator.array(),
+  details: ConsentFlowContractDetailChangeValidator.array().optional()
+});
+var ConsentFlowContractUpdatePreviewValidator = external_exports.object({
+  headline: external_exports.string(),
+  subhead: external_exports.string(),
+  rows: external_exports.array(
+    external_exports.object({
+      scope: ConsentFlowContractScopeValidator,
+      change: external_exports.enum(["added", "removed", "changed"]),
+      label: external_exports.string(),
+      subtitle: external_exports.string()
+    })
+  ),
+  primaryLabel: external_exports.string()
+});
+var ConsentFlowContractStatusValidator = external_exports.enum(["active", "retired"]);
+var ConsentFlowContractVersionValidator = external_exports.object({
+  version: external_exports.number().int().positive(),
+  createdAt: external_exports.string(),
+  reason: external_exports.string().optional(),
+  kind: ConsentFlowContractChangeKindValidator.optional()
+});
+var ConsentFlowContractUpdateResultValidator = external_exports.object({
+  version: external_exports.number().int().positive(),
+  kind: ConsentFlowContractChangeKindValidator,
+  affectedUsers: external_exports.number().int().nonnegative(),
+  preview: ConsentFlowContractUpdatePreviewValidator
+});
+var ConsentFlowConsentStatusValidator = external_exports.object({
+  status: ConsentFlowTermsStatusValidator.or(external_exports.literal("not_consented")),
+  consentedVersion: external_exports.number().int().positive().optional(),
+  currentVersion: external_exports.number().int().positive(),
+  needsReconsent: external_exports.boolean(),
+  reviewUrl: external_exports.string().optional()
+});
+var ConsentFlowContractNotificationDataValidator = external_exports.object({
+  contractUri: external_exports.string(),
+  contractName: external_exports.string().optional(),
+  fromVersion: external_exports.number().int().positive(),
+  toVersion: external_exports.number().int().positive(),
+  kind: ConsentFlowContractChangeKindValidator,
+  reason: external_exports.string().optional(),
+  diff: ConsentFlowContractDiffValidator,
+  reconsentDeadline: external_exports.string().optional(),
+  reviewUrl: external_exports.string(),
+  preview: ConsentFlowContractUpdatePreviewValidator.optional()
+});
 var ConsentFlowContractValidator = external_exports.object({
   read: external_exports.object({
     anonymize: external_exports.boolean().optional(),
@@ -21645,13 +21848,18 @@ var ConsentFlowContractValidator = external_exports.object({
         external_exports.string(),
         external_exports.object({
           required: external_exports.boolean(),
-          defaultEnabled: external_exports.boolean().optional()
+          defaultEnabled: external_exports.boolean().optional(),
+          reason: external_exports.string().optional()
         })
       ).default({})
     }).prefault({ categories: {} }),
     personal: external_exports.record(
       external_exports.string(),
-      external_exports.object({ required: external_exports.boolean(), defaultEnabled: external_exports.boolean().optional() })
+      external_exports.object({
+        required: external_exports.boolean(),
+        defaultEnabled: external_exports.boolean().optional(),
+        reason: external_exports.string().optional()
+      })
     ).default({})
   }).prefault({ credentials: { categories: {} }, personal: {} }),
   write: external_exports.object({
@@ -21660,16 +21868,55 @@ var ConsentFlowContractValidator = external_exports.object({
         external_exports.string(),
         external_exports.object({
           required: external_exports.boolean(),
-          defaultEnabled: external_exports.boolean().optional()
+          defaultEnabled: external_exports.boolean().optional(),
+          reason: external_exports.string().optional()
         })
       ).default({})
     }).prefault({ categories: {} }),
     personal: external_exports.record(
       external_exports.string(),
-      external_exports.object({ required: external_exports.boolean(), defaultEnabled: external_exports.boolean().optional() })
+      external_exports.object({
+        required: external_exports.boolean(),
+        defaultEnabled: external_exports.boolean().optional(),
+        reason: external_exports.string().optional()
+      })
     ).default({})
   }).prefault({ credentials: { categories: {} }, personal: {} })
 });
+var ConsentFlowContractScopePatchValidator = external_exports.object({
+  required: external_exports.boolean(),
+  defaultEnabled: external_exports.boolean().optional(),
+  reason: external_exports.string().optional()
+}).nullable();
+var ConsentFlowContractChangesValidator = external_exports.object({
+  contract: external_exports.object({
+    read: external_exports.object({
+      anonymize: external_exports.boolean().optional(),
+      credentials: external_exports.object({
+        categories: external_exports.record(external_exports.string(), ConsentFlowContractScopePatchValidator).optional()
+      }).optional(),
+      personal: external_exports.record(external_exports.string(), ConsentFlowContractScopePatchValidator).optional()
+    }).optional(),
+    write: external_exports.object({
+      credentials: external_exports.object({
+        categories: external_exports.record(external_exports.string(), ConsentFlowContractScopePatchValidator).optional()
+      }).optional(),
+      personal: external_exports.record(external_exports.string(), ConsentFlowContractScopePatchValidator).optional()
+    }).optional()
+  }).optional(),
+  name: external_exports.string().optional(),
+  subtitle: external_exports.string().optional(),
+  description: external_exports.string().optional(),
+  reasonForAccessing: external_exports.string().optional(),
+  image: external_exports.string().optional(),
+  needsGuardianConsent: external_exports.boolean().optional(),
+  redirectUrl: external_exports.string().optional(),
+  frontDoorBoostUri: external_exports.string().optional(),
+  expiresAt: external_exports.string().nullable().optional(),
+  autoboosts: AutoBoostConfigValidator.array().optional(),
+  writers: external_exports.string().array().optional(),
+  recipients: external_exports.string().array().optional()
+});
 var ConsentFlowContractDetailsValidator = external_exports.object({
   contract: ConsentFlowContractValidator,
   owner: LCNProfileValidator,
@@ -21688,7 +21935,19 @@ var ConsentFlowContractDetailsValidator = external_exports.object({
   autoBoosts: external_exports.string().array().optional(),
   writers: external_exports.array(LCNProfileValidator).optional(),
   recipients: external_exports.array(LCNPublicProfileValidator.extend({ did: external_exports.string() })).optional(),
-  audienceVersion: external_exports.number().int().nonnegative().optional()
+  audienceVersion: external_exports.number().int().nonnegative().optional(),
+  version: external_exports.number().int().positive(),
+  status: ConsentFlowContractStatusValidator.optional(),
+  latestUpdate: external_exports.object({
+    fromVersion: external_exports.number().int().positive(),
+    toVersion: external_exports.number().int().positive(),
+    kind: ConsentFlowContractChangeKindValidator,
+    reason: external_exports.string().optional(),
+    diff: ConsentFlowContractDiffValidator,
+    reconsentDeadline: external_exports.string().optional(),
+    createdAt: external_exports.string(),
+    preview: ConsentFlowContractUpdatePreviewValidator
+  }).optional()
 });
 var ConsentFlowContractRequestStatusValidator = external_exports.enum(["pending", "accepted", "denied", "cancelled"]).nullable();
 var ConsentFlowContractRequestReadStatusValidator = external_exports.enum(["unseen", "seen"]).nullable();
@@ -21777,7 +22036,12 @@ var PaginatedConsentFlowTermsValidator = PaginationResponseValidator.extend({
     contract: ConsentFlowContractDetailsValidator,
     uri: external_exports.string(),
     consenter: LCNProfileValidator,
-    status: ConsentFlowTermsStatusValidator
+    status: ConsentFlowTermsStatusValidator,
+    consentedVersion: external_exports.number().int().positive(),
+    lastReviewedVersion: external_exports.number().int().positive().optional(),
+    reconsentDeadline: external_exports.string().optional(),
+    newOptionsUntil: external_exports.string().optional(),
+    cumulativeUpdate: ConsentFlowContractDetailsValidator.shape.latestUpdate
   }).array()
 });
 var ConsentFlowGuardianApprovalValidator = external_exports.object({
@@ -21853,7 +22117,8 @@ var ConsentFlowTransactionActionValidator = external_exports.enum([
   "update",
   "sync",
   "withdraw",
-  "write"
+  "write",
+  "reconsent"
 ]);
 var ConsentFlowTransactionsQueryValidator = external_exports.object({
   terms: ConsentFlowTermsQueryValidator.optional(),
@@ -21872,8 +22137,12 @@ var ConsentFlowTransactionValidator = external_exports.object({
   referral: ConsentFlowReferralValidator.optional(),
   id: external_exports.string(),
   action: ConsentFlowTransactionActionValidator,
+  kind: ConsentFlowContractChangeKindValidator.optional(),
   date: external_exports.string(),
-  uris: external_exports.string().array().optional()
+  uris: external_exports.string().array().optional(),
+  consentedVersion: external_exports.number().int().positive().optional(),
+  reconsentDeadline: external_exports.string().optional(),
+  newOptionsUntil: external_exports.string().optional()
 });
 var HolderExportConsentRecordValidator = external_exports.object({
   termsUri: external_exports.string(),
@@ -21881,6 +22150,10 @@ var HolderExportConsentRecordValidator = external_exports.object({
   contract: ConsentFlowContractDetailsValidator,
   terms: ConsentFlowTermsValidator,
   referral: ConsentFlowReferralValidator.optional(),
+  consentedVersion: external_exports.number().int().positive(),
+  reconsentDeadline: external_exports.string().optional(),
+  newOptionsUntil: external_exports.string().optional(),
+  cumulativeUpdate: ConsentFlowContractDetailsValidator.shape.latestUpdate,
   transactions: ConsentFlowTransactionValidator.array()
 });
 var HolderExportMetadataValidator = external_exports.object({
@@ -21941,10 +22214,12 @@ var LCNNotificationTypeEnumValidator = external_exports.enum([
   "GUARDIAN_APPROVED",
   "GUARDIAN_REJECTED",
   "APP_NOTIFICATION",
+  "ANNOUNCEMENT",
   "CREDENTIAL_REVOKED",
   "CREDENTIAL_SUSPENDED",
   "CREDENTIAL_UNSUSPENDED",
-  "CREDENTIAL_REFRESHED"
+  "CREDENTIAL_REFRESHED",
+  "CONSENT_FLOW_CONTRACT_UPDATED"
 ]);
 var LCNNotificationMessageValidator = external_exports.object({
   title: external_exports.string().optional(),
@@ -21973,12 +22248,26 @@ var LCNNotificationInboxValidator = external_exports.object({
   timestamp: external_exports.iso.datetime().optional()
 });
 var LCNNotificationMetadataValidator = external_exports.object({
-  connectionPrompt: LCNConnectionPromptMetadataValidator.optional()
+  connectionPrompt: LCNConnectionPromptMetadataValidator.optional(),
+  campaignId: external_exports.string().regex(/^[a-z0-9-]{3,64}$/).optional(),
+  campaignCreatedAt: external_exports.iso.datetime().optional(),
+  campaignHasInApp: external_exports.boolean().optional(),
+  campaignTestId: external_exports.uuid().optional()
 }).catchall(external_exports.unknown());
 var LCNNotificationDataValidator = external_exports.object({
   vcUris: external_exports.array(external_exports.string()).optional(),
   vpUris: external_exports.array(external_exports.string()).optional(),
   transaction: ConsentFlowTransactionValidator.optional(),
+  contractUri: external_exports.string().optional(),
+  contractName: external_exports.string().optional(),
+  fromVersion: external_exports.number().int().positive().optional(),
+  toVersion: external_exports.number().int().positive().optional(),
+  kind: ConsentFlowContractChangeKindValidator.optional(),
+  reason: external_exports.string().optional(),
+  diff: ConsentFlowContractDiffValidator.optional(),
+  reconsentDeadline: external_exports.string().optional(),
+  reviewUrl: external_exports.string().optional(),
+  preview: ConsentFlowContractUpdatePreviewValidator.optional(),
   inbox: LCNNotificationInboxValidator.optional(),
   metadata: LCNNotificationMetadataValidator.optional()
 }).loose();
@@ -23077,28 +23366,6 @@ var EscrowPinStatusValidator = external_exports.object({
    */
   wrongAttempts: external_exports.number().int().nonnegative().optional()
 });
-var BITSTRING_STATUS_PURPOSES = ["revocation", "suspension"];
-var BitstringStatusPurposeValidator = external_exports.enum(BITSTRING_STATUS_PURPOSES);
-var BitstringStatusListEntryValidator = external_exports.object({
-  id: external_exports.string().optional(),
-  type: external_exports.literal("BitstringStatusListEntry"),
-  statusPurpose: BitstringStatusPurposeValidator,
-  statusListIndex: external_exports.string().or(external_exports.number().int().nonnegative()),
-  statusListCredential: external_exports.string()
-});
-var AllocatedBitstringStatusListEntryValidator = BitstringStatusListEntryValidator.extend({
-  id: external_exports.string()
-});
-var BitstringStatusListCredentialSubjectValidator = external_exports.object({
-  id: external_exports.string().optional(),
-  type: external_exports.literal("BitstringStatusList"),
-  statusPurpose: BitstringStatusPurposeValidator,
-  encodedList: external_exports.string()
-});
-var AllocateCredentialStatusInputValidator = external_exports.object({
-  statusPurposes: external_exports.array(BitstringStatusPurposeValidator).optional(),
-  listSize: external_exports.number().int().positive().optional()
-}).default({});
 var isSafeInAppMessagePath = /* @__PURE__ */ __name2((path) => {
   let decoded = path;
   for (let depth = 0; depth < 5; depth += 1) {
@@ -23379,24 +23646,46 @@ var inAppMessagesFlagEnvelopeValidator = external_exports.object({
 }).passthrough();
 var CampaignIdValidator = external_exports.string().regex(/^[a-z0-9-]{3,64}$/);
 var CampaignStatusValidator = external_exports.enum(["draft", "live", "paused", "archived"]);
-var CampaignChannelValidator = external_exports.enum(["inApp", "notify"]);
+var CampaignChannelValidator = external_exports.enum(["inApp", "notify", "email"]);
 var CampaignEventValidator = external_exports.enum(["shown", "clicked", "dismissed", "converted"]);
-var timestamp = external_exports.iso.datetime({ offset: true }).overwrite((value) => new Date(value).toISOString());
+var timestamp = external_exports.iso.datetime({ offset: true }).overwrite((value) => {
+  const date5 = new Date(value);
+  return Number.isFinite(date5.getTime()) ? date5.toISOString() : value;
+});
 var notification = external_exports.object({ title: external_exports.string().min(1), body: external_exports.string().min(1) }).strict();
-var channels = external_exports.array(CampaignChannelValidator).min(1).max(2).refine((values) => new Set(values).size === values.length, "Channels must be unique");
+var CampaignEmailValidator = external_exports.object({
+  subject: external_exports.string().trim().min(1).max(200).regex(/^[^\r\n]+$/),
+  title: external_exports.string().trim().min(1).max(200),
+  body: external_exports.string().trim().min(1).max(2e4),
+  heroImageUrl: external_exports.url().startsWith("https://").max(2048).optional(),
+  ctaLabel: external_exports.string().trim().min(1).max(100)
+}).strict();
+var AnnouncementPreferencesValidator = external_exports.object({
+  announcementEmailOptOut: external_exports.boolean(),
+  announcementPushOptOut: external_exports.boolean()
+}).strict();
+var channels = external_exports.array(CampaignChannelValidator).min(1).max(3).refine((values) => new Set(values).size === values.length, "Channels must be unique");
 var campaignDefinition = external_exports.object({
   id: CampaignIdValidator,
   name: external_exports.string().trim().min(1).max(200),
   status: CampaignStatusValidator.default("draft"),
   channels,
-  message: inAppMessageValidator,
+  message: inAppMessageValidator.optional(),
   notification: notification.optional(),
+  email: CampaignEmailValidator.optional(),
   startsAt: timestamp.optional(),
   endsAt: timestamp.optional(),
   excludeMinors: external_exports.boolean().default(true),
   selfEnroll: external_exports.boolean().default(false)
 }).strict();
 var validDefinition = /* @__PURE__ */ __name2((value, ctx) => {
+  if (value.channels.includes("inApp") && !value.message) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["message"],
+      message: "In-app requires a message"
+    });
+  }
   if (value.channels.includes("notify") && !value.notification) {
     ctx.addIssue({
       code: "custom",
@@ -23404,15 +23693,23 @@ var validDefinition = /* @__PURE__ */ __name2((value, ctx) => {
       message: "Notify requires a title and body"
     });
   }
+  if (value.channels.includes("email") && !value.email) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["email"],
+      message: "Email requires announcement content"
+    });
+  }
   if (value.startsAt && value.endsAt && value.startsAt >= value.endsAt) {
     ctx.addIssue({ code: "custom", path: ["endsAt"], message: "End must be after start" });
   }
 }, "validDefinition");
 var CampaignValidator = campaignDefinition.extend({
+  tenantId: external_exports.string().optional(),
   createdAt: timestamp,
   updatedAt: timestamp
 }).superRefine(validDefinition).superRefine((value, ctx) => {
-  if (value.message.id !== value.id) {
+  if (value.message && value.message.id !== value.id) {
     ctx.addIssue({
       code: "custom",
       path: ["message", "id"],
@@ -23421,21 +23718,23 @@ var CampaignValidator = campaignDefinition.extend({
   }
 });
 var CreateCampaignInputValidator = campaignDefinition.extend({
-  message: inAppMessageAuthoringValidator
+  message: inAppMessageAuthoringValidator.optional()
 }).superRefine(validDefinition);
 var CampaignUpdatesValidator = campaignDefinition.omit({ id: true }).partial().extend({
   // A PATCH must not apply creation defaults to fields the caller omitted.
   status: CampaignStatusValidator.optional(),
   excludeMinors: external_exports.boolean().optional(),
   selfEnroll: external_exports.boolean().optional(),
-  message: inAppMessageAuthoringValidator.optional(),
+  message: inAppMessageAuthoringValidator.nullable().optional(),
   notification: notification.nullable().optional(),
+  email: CampaignEmailValidator.nullable().optional(),
   startsAt: timestamp.nullable().optional(),
   endsAt: timestamp.nullable().optional()
 }).strict();
 var UpdateCampaignInputValidator = external_exports.object({
   campaignId: CampaignIdValidator,
-  updates: CampaignUpdatesValidator
+  updates: CampaignUpdatesValidator,
+  expectedUpdatedAt: timestamp.optional()
 }).strict();
 var identifier = external_exports.string().trim().min(1).max(2048);
 var metadataKey = external_exports.string().regex(/^[a-zA-Z_][a-zA-Z0-9_.-]{0,63}$/).refine(
@@ -23487,7 +23786,8 @@ var CampaignUserStateValidator = external_exports.object({
   clickedAt: timestamp.optional(),
   dismissedAt: timestamp.optional(),
   convertedAt: timestamp.optional(),
-  notifiedAt: timestamp.optional()
+  notifiedAt: timestamp.optional(),
+  emailedAt: timestamp.optional()
 });
 var MyCampaignValidator = external_exports.object({
   campaign: campaignDefinition.pick({
@@ -23496,12 +23796,19 @@ var MyCampaignValidator = external_exports.object({
     startsAt: true,
     endsAt: true,
     selfEnroll: true
-  }),
-  state: CampaignUserStateValidator
+  }).extend({ message: inAppMessageValidator }),
+  state: CampaignUserStateValidator,
+  testId: external_exports.uuid().optional()
+});
+var CampaignTestValidator = external_exports.object({
+  id: external_exports.uuid(),
+  campaignId: CampaignIdValidator,
+  message: inAppMessageValidator
 });
 var CampaignStatsValidator = external_exports.object({
   audience: external_exports.number().int().nonnegative(),
   notified: external_exports.number().int().nonnegative(),
+  emailed: external_exports.number().int().nonnegative(),
   shown: external_exports.number().int().nonnegative(),
   clicked: external_exports.number().int().nonnegative(),
   dismissed: external_exports.number().int().nonnegative(),
@@ -23528,6 +23835,31 @@ var PaginatedCampaignAudienceValidator = external_exports.object({
   hasMore: external_exports.boolean(),
   cursor: external_exports.string().optional()
 });
+var CampaignDispatchPreviewValidator = external_exports.object({
+  campaignId: CampaignIdValidator,
+  audienceCount: external_exports.number().int().nonnegative(),
+  alreadyNotifiedCount: external_exports.number().int().nonnegative(),
+  recipientCount: external_exports.number().int().nonnegative(),
+  notificationRecipientCount: external_exports.number().int().nonnegative().optional(),
+  emailRecipientCount: external_exports.number().int().nonnegative().optional(),
+  previewToken: external_exports.string().regex(/^[a-f0-9]{64}$/),
+  blockedReason: external_exports.enum([
+    "not_live",
+    "notify_disabled",
+    "email_confirmation_required",
+    "not_started",
+    "ended",
+    "no_recipients"
+  ]).optional()
+});
+var CampaignDispatchOptionsValidator = external_exports.object({
+  expectedPreviewToken: CampaignDispatchPreviewValidator.shape.previewToken.optional()
+}).strict();
+var CampaignAudienceResultValidator = external_exports.object({
+  count: external_exports.number().int().nonnegative(),
+  added: external_exports.number().int().nonnegative(),
+  notFound: external_exports.array(external_exports.string())
+});
 var SHARE_LINK_ID_BYTES = 16;
 var SHARE_CONTENT_KEY_BYTES = 32;
 var SHARE_IV_BYTES = 12;
@@ -24051,16 +24383,231 @@ var SkillIconNamesValidator = external_exports.array(external_exports.string().n
   }
 );
 var GenerateSkillIconsInputValidator = external_exports.object({ names: SkillIconNamesValidator });
+var RoleValidator = external_exports.enum(["user", "assistant", "tool", "system"]);
+var AiSessionMode = {
+  tutor: "ai-tutor",
+  insights: "ai-insights"
+};
+var AiSessionModeValidator = external_exports.enum([AiSessionMode.tutor, AiSessionMode.insights]);
+var StructuredResponseValidator = external_exports.object({
+  notes: external_exports.string().optional(),
+  questions: external_exports.array(external_exports.string())
+});
+var IntroStreamModeValidator = external_exports.enum(["formatted", "structured"]);
+var ChatMessageValidator = external_exports.object({
+  role: RoleValidator,
+  content: external_exports.string().nullable(),
+  tool_call_id: external_exports.string().optional(),
+  tool_calls: external_exports.array(
+    external_exports.object({
+      id: external_exports.string(),
+      type: external_exports.literal("function"),
+      function: external_exports.object({
+        name: external_exports.string(),
+        arguments: external_exports.string()
+      })
+    })
+  ).optional()
+});
+var InsightArtifactValidator = external_exports.object({
+  title: external_exports.string(),
+  summary: external_exports.string(),
+  category: external_exports.string(),
+  question: external_exports.string(),
+  narrative: external_exports.string()
+});
+var ArtifactSuggestionValidator = external_exports.object({
+  artifact: InsightArtifactValidator,
+  source_text: external_exports.string().optional(),
+  created_at: external_exports.string()
+});
+var ThreadCredentialContextValidator = external_exports.object({
+  uri: external_exports.string(),
+  type: external_exports.string(),
+  context: external_exports.string(),
+  score: external_exports.number(),
+  strongestScore: external_exports.number().optional(),
+  averageScore: external_exports.number().optional(),
+  matchCount: external_exports.number().optional(),
+  title: external_exports.string().optional()
+});
+var ThreadValidator = external_exports.object({
+  id: external_exports.string(),
+  did: external_exports.string(),
+  topicCredentialUri: external_exports.string().nullable().optional(),
+  title: external_exports.string(),
+  created_at: external_exports.string(),
+  last_message_at: external_exports.string(),
+  active: external_exports.boolean().optional(),
+  ended_at: external_exports.string().optional(),
+  plan_started_at: external_exports.string().optional(),
+  summaries: external_exports.array(
+    external_exports.object({
+      summary_data: external_exports.string(),
+      credential_uri: external_exports.string(),
+      created_at: external_exports.string()
+    })
+  ).optional(),
+  plans: external_exports.array(
+    external_exports.object({
+      plan_data: external_exports.string(),
+      created_at: external_exports.string(),
+      consentRevision: external_exports.string().optional()
+    })
+  ).optional(),
+  credentials: external_exports.array(ThreadCredentialContextValidator).optional(),
+  credentialSearchTopic: external_exports.string().optional(),
+  credentialContextStatus: external_exports.enum(["pending", "ready", "empty", "error"]).optional(),
+  mode: AiSessionModeValidator.optional(),
+  artifactSuggestions: external_exports.array(ArtifactSuggestionValidator).optional()
+});
+var CredentialVerificationMetadataValidator = external_exports.object({
+  credentialUri: external_exports.string(),
+  contentHash: external_exports.string().regex(/^[a-f0-9]{64}$/),
+  status: external_exports.enum(["valid", "invalid"]),
+  checkedAt: external_exports.string().datetime(),
+  verifier: external_exports.object({
+    name: external_exports.string(),
+    version: external_exports.string()
+  }),
+  verifiedPayload: external_exports.enum(["credential", "boostCredential"]),
+  checks: external_exports.array(external_exports.string()),
+  errors: external_exports.array(external_exports.string()),
+  warnings: external_exports.array(external_exports.string()),
+  provenance: external_exports.object({
+    source: external_exports.enum(["wallet", "generated"]),
+    retrievedAt: external_exports.string().datetime()
+  }),
+  consent: external_exports.object({
+    contractUri: external_exports.string(),
+    receiptId: external_exports.string().min(1),
+    grantedAt: external_exports.string().datetime().optional(),
+    updatedAt: external_exports.string().datetime(),
+    contractUpdatedAt: external_exports.string().min(1),
+    status: external_exports.literal("live"),
+    expiresAt: external_exports.string().datetime().optional(),
+    contractExpiresAt: external_exports.string().datetime().optional(),
+    categories: external_exports.array(external_exports.string()),
+    credentialUris: external_exports.array(external_exports.string()),
+    personalFields: external_exports.array(external_exports.string()),
+    purpose: external_exports.enum(["credential-ingestion", "model-inference", "embedding"]),
+    revision: external_exports.string().min(1),
+    guardian: external_exports.object({ required: external_exports.boolean(), approved: external_exports.boolean() })
+  })
+});
+var ModelSafeCredentialFactValidator = external_exports.object({
+  kind: external_exports.enum([
+    "skill",
+    "goal",
+    "achievement",
+    "course",
+    "experience",
+    "competency",
+    "title",
+    "summary",
+    "assessment",
+    "grade",
+    "date",
+    "alignment",
+    "criteria",
+    "pathway",
+    "topic"
+  ]),
+  value: external_exports.string().min(1).max(240),
+  label: external_exports.string().min(1).max(120).optional()
+});
+var ModelSafeCredentialProjectionValidator = external_exports.object({
+  schemaVersion: external_exports.literal("1"),
+  category: external_exports.string().min(1).max(120),
+  credentialTypes: external_exports.array(external_exports.string().min(1).max(120)).max(20),
+  facts: external_exports.array(ModelSafeCredentialFactValidator).max(100),
+  // Present only on credentials that are past their expiry, so the model can
+  // tell a lapsed credential from a current one.
+  expired: external_exports.literal(true).optional(),
+  expirationDate: external_exports.string().datetime().optional()
+});
+var AIPassportCredentialRecordValidator = external_exports.object({
+  id: external_exports.string(),
+  uri: external_exports.string(),
+  category: external_exports.string(),
+  credential: VCValidator,
+  aiContext: external_exports.string(),
+  generalSummary: external_exports.string().optional(),
+  createdAt: external_exports.string(),
+  verification: CredentialVerificationMetadataValidator.optional(),
+  projection: ModelSafeCredentialProjectionValidator.optional()
+});
+var AuthenticatedMessageValidator = external_exports.object({
+  message: ChatMessageValidator.optional(),
+  threadId: external_exports.string().optional(),
+  selectedQuestion: external_exports.string().optional(),
+  action: external_exports.enum([
+    "start_topic",
+    "continue_plan",
+    "start_topic_uri",
+    "start_learning_pathway",
+    "start_insights_session",
+    "close_insights_session",
+    "artifact_suggestion"
+  ]).optional(),
+  topic: external_exports.string().optional(),
+  topicUri: external_exports.string().optional(),
+  pathwayUri: external_exports.string().optional(),
+  mode: AiSessionModeValidator.optional(),
+  introStreamMode: IntroStreamModeValidator.optional(),
+  // BCP-47 language for AI responses (LC-1901). This has to live on the
+  // validator, not just the inferred type — z.object strips unknown keys, so an
+  // undeclared `locale` would be dropped before the WS handler ever saw it.
+  locale: external_exports.string().nullish()
+});
+var DebugInfoValidator = external_exports.object({
+  operation: external_exports.string(),
+  collection: external_exports.string(),
+  input: external_exports.unknown().optional(),
+  output: external_exports.unknown().optional(),
+  timestamp: external_exports.string(),
+  duration: external_exports.number().optional()
+});
+var TimingEventValidator = external_exports.object({
+  event: external_exports.literal("timing"),
+  operation: external_exports.string(),
+  phase: external_exports.enum(["start", "end", "complete"]),
+  duration: external_exports.number().optional(),
+  metadata: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
+  timestamp: external_exports.string()
+});
+var LearningPathwayValidator = external_exports.object({
+  id: external_exports.string(),
+  learningPathway: external_exports.object({
+    stepIndex: external_exports.number(),
+    step: external_exports.object({
+      title: external_exports.string(),
+      description: external_exports.string(),
+      summary: external_exports.string(),
+      learned: external_exports.array(external_exports.string()),
+      skills: external_exports.array(
+        external_exports.object({
+          title: external_exports.string(),
+          description: external_exports.string()
+        })
+      )
+    })
+  })
+});
 
 // src/plugin.ts
 import {
   getCredentialIssuerId,
   getCredentialStatusArray,
   injectManagedRefreshService as injectSharedManagedRefreshService,
+  prepareManagedRefreshContext,
+  isDisplayOnlyAnchorTemplate,
   isVC2Format,
   materializeCredentialFields,
   isEncrypted,
-  resolveStorageReadResult
+  resolveStorageReadResult,
+  assertExactJweRecipients,
+  assertManagedCredentialBinding
 } from "@learncard/helpers";
 
 // ../../../node_modules/mustache/mustache.mjs
@@ -24671,7 +25218,14 @@ var appendNetworkCredentialStatus = /* @__PURE__ */ __name(async (client, creden
   credential.credentialStatus = credentialStatuses.length === 1 ? credentialStatuses[0] : credentialStatuses;
   return credential;
 }, "appendNetworkCredentialStatus");
-var issueCredentialWithNetworkStatus = /* @__PURE__ */ __name(async (learnCard, client, credential, statusPurposes) => {
+var issueCredentialWithNetworkStatus = /* @__PURE__ */ __name(async (learnCard, client, credential, statusPurposes, statusEntries) => {
+  if (statusEntries) {
+    const prepared = UnsignedVCValidator.parse({
+      ...materializeCredentialFields(credential),
+      credentialStatus: statusEntries.length === 1 && !Array.isArray(credential.credentialStatus) ? statusEntries[0] : statusEntries
+    });
+    return learnCard.invoke.issueCredential(prepareManagedRefreshContext(prepared));
+  }
   return learnCard.invoke.issueCredential(
     await appendNetworkCredentialStatus(
       client,
@@ -24696,7 +25250,7 @@ var buildManagedRefreshReceipt = /* @__PURE__ */ __name((vc, allocation, credent
   const hasStatus = rawStatus !== void 0 && rawStatus !== null && !(Array.isArray(rawStatus) && rawStatus.length === 0);
   return {
     refreshId: allocation.refreshId,
-    refreshService: allocation.refreshService,
+    refreshService: ManagedCredentialRefreshBindingValidator.parse(vc.refreshService),
     credentialId: typeof vc.id === "string" && vc.id.length > 0 ? vc.id : credentialId,
     issuerDid,
     holderDid,
@@ -24705,6 +25259,40 @@ var buildManagedRefreshReceipt = /* @__PURE__ */ __name((vc, allocation, credent
     } : {}
   };
 }, "buildManagedRefreshReceipt");
+var HOLDER_MODE_PREPARE_UNSUPPORTED = "Server does not support holder-mode encryption (missing recipientKeyIds from prepareRefreshableSend); refusing to fall back to network-mode plaintext delivery.";
+var getPreparedRecipientKeyIds = /* @__PURE__ */ __name((prepared) => prepared.recipientKeyIds, "getPreparedRecipientKeyIds");
+var isRecipientsChangedError = /* @__PURE__ */ __name((error62) => {
+  const code = error62?.data?.code;
+  const message = error62?.message;
+  return code === "CONFLICT" && message === "RECIPIENTS_CHANGED";
+}, "isRecipientsChangedError");
+var didFromRecipientKeyId = /* @__PURE__ */ __name((keyId) => {
+  const [did] = keyId.split("#");
+  if (!did) throw new Error(`Invalid recipient key id: ${keyId}`);
+  return did;
+}, "didFromRecipientKeyId");
+var buildHolderEncryptedHandoff = /* @__PURE__ */ __name(async (learnCard, signedCredential, bindings, recipientKeyIds) => {
+  const recipientDids = recipientKeyIds.map(didFromRecipientKeyId);
+  const jwe = await learnCard.invoke.createDagJweExact?.(signedCredential, recipientDids);
+  if (!jwe) {
+    throw new Error(
+      'encryption: "holder" requires the Encryption plugin (createDagJweExact), which this wallet does not have.'
+    );
+  }
+  assertExactJweRecipients(jwe, recipientKeyIds);
+  return HolderEncryptedHandoffValidator.parse({ ...bindings, jwe });
+}, "buildHolderEncryptedHandoff");
+var deliverHolderEncryptedHandoff = /* @__PURE__ */ __name(async (holderClient, refreshId, recipientKeyIds, buildHandoff, deliver) => {
+  const handoff2 = await buildHandoff(recipientKeyIds);
+  try {
+    return await deliver(handoff2);
+  } catch (error62) {
+    if (!isRecipientsChangedError(error62)) throw error62;
+    const fresh = await holderClient.getEncryptionRecipients.query({ refreshId });
+    const retryHandoff = await buildHandoff(fresh.recipientKeyIds);
+    return deliver(retryHandoff);
+  }
+}, "deliverHolderEncryptedHandoff");
 var ACT_AS_TARGET_NOT_FOUND_MESSAGE = "Act-as target profile not found";
 var isActAsDenial = /* @__PURE__ */ __name((error62) => {
   const code = error62?.data?.code;
@@ -24715,6 +25303,11 @@ var isActAsDenial = /* @__PURE__ */ __name((error62) => {
   return false;
 }, "isActAsDenial");
 var getInboxFailureReason = /* @__PURE__ */ __name((reason) => reason instanceof Error ? `${reason.name}: ${reason.message}` : String(reason), "getInboxFailureReason");
+var normalizePublicDisplay = /* @__PURE__ */ __name((input2) => {
+  const category = input2.display?.category ?? input2.template?.category?.slice(0, 280);
+  if (!input2.display && !category) return void 0;
+  return { ...input2.display, ...category ? { category } : {} };
+}, "normalizePublicDisplay");
 async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, options) {
   const apiToken = typeof apiTokenOrOptions === "string" ? apiTokenOrOptions : void 0;
   const resolvedOptions = (typeof apiTokenOrOptions === "object" ? apiTokenOrOptions : options) ?? {};
@@ -24801,6 +25394,13 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
       return _learnCard.invoke.resolveFromLCN(boostUri);
     }
   }, "getBoostTemplateForIssuance");
+  const assertIssuableBoostTemplate = /* @__PURE__ */ __name((boost) => {
+    if (isDisplayOnlyAnchorTemplate(boost)) {
+      throw new Error(
+        "This Boost is a display-only anchor and has no issuance credential. Pass `template` or `signedCredential` instead of reusing its uri as a templateUri."
+      );
+    }
+  }, "assertIssuableBoostTemplate");
   const getInboxEndpointForDid = /* @__PURE__ */ __name(async (_learnCard, recipientDid) => {
     const serviceUrl2 = new URL(url2);
     const serviceDomain = `${serviceUrl2.hostname}${serviceUrl2.port ? `%3A${serviceUrl2.port}` : ""}`;
@@ -25593,6 +26193,124 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
         await ensureUser();
         return client.credentialRefresh.getCredentialRefreshHistory.query(input2);
       }, "getCredentialRefreshHistory"),
+      getCredentialRefreshReceipt: /* @__PURE__ */ __name(async (_learnCard, input2) => {
+        await ensureUser();
+        return client.credentialRefresh.getReceipt.query(input2);
+      }, "getCredentialRefreshReceipt"),
+      publishHolderEncryptedRefreshable: /* @__PURE__ */ __name(async (_learnCard, receipt, credential, options2) => {
+        await ensureUser();
+        if (!("issueCredential" in _learnCard.invoke)) {
+          throw new Error(
+            "Holder-mode publishing requires local signing capability, which this wallet does not have."
+          );
+        }
+        if (!("createDagJweExact" in _learnCard.invoke)) {
+          throw new Error(
+            "Holder-mode publishing requires the Encryption plugin (createDagJweExact), which this wallet does not have."
+          );
+        }
+        if (receipt.credentialStatus === void 0) {
+          throw new Error(
+            "Holder-mode publishing requires the original send receipt's credentialStatus binding."
+          );
+        }
+        const boundCredentialStatus = BitstringStatusListEntryValidator.array().parse(
+          Array.isArray(receipt.credentialStatus) ? receipt.credentialStatus : [receipt.credentialStatus]
+        );
+        let boost = JSON.parse(JSON.stringify(credential));
+        const boostString = JSON.stringify(boost);
+        const allowAutoAppendEvidence = !hasDynamicEvidenceTemplate(boostString);
+        if (options2.templateData && Object.keys(options2.templateData).length > 0) {
+          try {
+            const rendered = renderTemplateJson(boostString, options2.templateData);
+            boost = JSON.parse(rendered);
+            boost = appendTemplateEvidence(
+              boost,
+              options2.templateData,
+              allowAutoAppendEvidence
+            );
+          } catch (error62) {
+            throw new Error(
+              `Failed to apply template data: ${error62 instanceof Error ? error62.message : "Unknown error"}`,
+              { cause: error62 }
+            );
+          }
+        }
+        if (isVC2Format(boost)) {
+          boost.validFrom = (/* @__PURE__ */ new Date()).toISOString();
+        } else {
+          boost.issuanceDate = (/* @__PURE__ */ new Date()).toISOString();
+        }
+        boost.issuer = receipt.issuerDid;
+        boost.id = receipt.credentialId;
+        if (Array.isArray(boost.credentialSubject)) {
+          boost.credentialSubject = boost.credentialSubject.map((subject) => ({
+            ...subject,
+            id: receipt.holderDid
+          }));
+        } else {
+          boost.credentialSubject = { ...boost.credentialSubject, id: receipt.holderDid };
+        }
+        if (receipt.refreshServiceBinding === "managed-entry" && !credential.refreshService) {
+          throw new Error(
+            "This legacy receipt does not include the original refresh service descriptor. Repair the receipt or reissue the credential before publishing."
+          );
+        }
+        boost = prepareManagedRefreshContext({
+          ...boost,
+          refreshService: receipt.refreshServiceBinding === "managed-entry" ? credential.refreshService : receipt.refreshService
+        });
+        boost.credentialStatus = receipt.credentialStatus;
+        assertManagedCredentialBinding(boost, { ...receipt, encryptionMode: "holder" });
+        const signedCredential = await issueCredentialWithNetworkStatus(
+          _learnCard,
+          client,
+          boost,
+          void 0,
+          boundCredentialStatus
+        );
+        const holderBindings = {
+          refreshId: receipt.refreshId,
+          credentialId: receipt.credentialId,
+          holderDid: receipt.holderDid,
+          issuerDid: receipt.issuerDid,
+          refreshService: ManagedCredentialRefreshBindingValidator.parse(
+            boost.refreshService
+          ),
+          credentialStatus: BitstringStatusListEntryValidator.or(
+            BitstringStatusListEntryValidator.array()
+          ).parse(receipt.credentialStatus)
+        };
+        assertManagedCredentialBinding(signedCredential, {
+          ...holderBindings,
+          refreshService: ManagedCredentialRefreshBindingValidator.parse(
+            boost.refreshService
+          ),
+          encryptionMode: "holder"
+        });
+        const holderClient = client.credentialRefresh;
+        const { recipientKeyIds } = await holderClient.getEncryptionRecipients.query({
+          refreshId: receipt.refreshId
+        });
+        return deliverHolderEncryptedHandoff(
+          holderClient,
+          receipt.refreshId,
+          recipientKeyIds,
+          (keyIds) => buildHolderEncryptedHandoff(
+            _learnCard,
+            signedCredential,
+            holderBindings,
+            keyIds
+          ),
+          (handoff2) => holderClient.publishHolderEncryptedRefreshable.mutate({
+            handoff: handoff2,
+            notify: options2.notify,
+            ...options2.updateSummary !== void 0 ? { updateSummary: options2.updateSummary } : {},
+            ...options2.updateReason !== void 0 ? { updateReason: options2.updateReason } : {},
+            ...options2.idempotencyKey !== void 0 ? { idempotencyKey: options2.idempotencyKey } : {}
+          })
+        );
+      }, "publishHolderEncryptedRefreshable"),
       revokeBoostRecipient: /* @__PURE__ */ __name(async (_learnCard, boostUri, recipientProfileId, credentialUri) => {
         await ensureUser();
         const input2 = { boostUri, recipientProfileId };
@@ -25618,6 +26336,7 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
       sendBoost: /* @__PURE__ */ __name(async (_learnCard, profileId, boostUri, options2 = { encrypt: true, skipNotification: false, templateData: {} }) => {
         await ensureUser();
         const result = await getBoostTemplateForIssuance(_learnCard, boostUri);
+        assertIssuableBoostTemplate(result);
         const data = await UnsignedVCValidator.spa(result);
         if (!data.success) throw new Error("Did not get a valid boost from URI");
         const targetProfile = await _learnCard.invoke.getProfile(profileId);
@@ -25758,18 +26477,65 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
       }, "claimBoostWithLink"),
       send: /* @__PURE__ */ __name(async (_learnCard, input2) => {
         await ensureUser();
+        if (input2.type === "boost" && input2.encryption === "holder" && input2.refresh !== true) {
+          throw new Error(
+            'encryption: "holder" requires refresh: true; holder-mode encryption is only defined for managed refresh sends.'
+          );
+        }
         if (input2.type === "boost" && input2.refresh === true) {
           const isEmail = /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(input2.recipient);
           const isPhone = /^\+?[\d\s-]{10,}$/.test(input2.recipient.replace(/[\s-]/g, ""));
-          if (isEmail || isPhone) return client.boost.send.mutate(input2);
+          const isHolderEncryption = input2.encryption === "holder";
+          if (isHolderEncryption && (isEmail || isPhone)) {
+            throw new Error(
+              'encryption: "holder" does not support inbox (email or phone) recipients; use a profile ID or DID recipient instead.'
+            );
+          }
+          if (isHolderEncryption && input2.signedCredential) {
+            throw new Error(
+              'encryption: "holder" does not support signedCredential; the SDK must sign locally so the server never receives plaintext.'
+            );
+          }
+          const request = {
+            type: "boost",
+            recipient: input2.recipient,
+            templateUri: input2.templateUri,
+            template: input2.template,
+            signedCredential: input2.signedCredential,
+            display: normalizePublicDisplay(input2),
+            statusPurposes: input2.statusPurposes,
+            contractUri: input2.contractUri,
+            templateData: input2.templateData,
+            integrationId: input2.integrationId,
+            options: input2.options,
+            idempotencyKey: input2.idempotencyKey,
+            refresh: true
+          };
+          if (isEmail || isPhone) return client.boost.send.mutate(request);
           const canIssueLocally = "issueCredential" in _learnCard.invoke;
+          if (isHolderEncryption && !canIssueLocally) {
+            throw new Error(
+              'encryption: "holder" requires local signing capability, which this wallet does not have.'
+            );
+          }
+          if (isHolderEncryption && !("createDagJweExact" in _learnCard.invoke)) {
+            throw new Error(
+              'encryption: "holder" requires the Encryption plugin (createDagJweExact), which this wallet does not have.'
+            );
+          }
           if (canIssueLocally && !input2.signedCredential && (input2.templateUri || input2.template)) {
             let boost;
+            if (input2.template?.status === "DRAFT") {
+              throw new Error(
+                "Draft Boosts cannot be sent. Publish the template first."
+              );
+            }
             if (input2.templateUri) {
               const result = await getBoostTemplateForIssuance(
                 _learnCard,
                 input2.templateUri
               );
+              assertIssuableBoostTemplate(result);
               const data = await UnsignedVCValidator.spa(result);
               if (!data.success)
                 throw new Error("Did not get a valid boost from URI");
@@ -25780,15 +26546,21 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
               );
             }
             const prepared = await client.boost.prepareRefreshableSend.mutate({
+              ...boost.credentialStatus ? {} : { statusBinding: "server" },
+              ...input2.statusPurposes ? { statusPurposes: input2.statusPurposes } : {},
               recipient: input2.recipient,
-              ...input2.templateUri ? { templateUri: input2.templateUri } : { template: input2.template },
+              templateUri: input2.templateUri,
+              display: normalizePublicDisplay(input2),
               ...input2.contractUri ? { contractUri: input2.contractUri } : {},
-              ...input2.templateData ? { templateData: input2.templateData } : {},
               ...input2.integrationId ? { integrationId: input2.integrationId } : {},
               ...boost.id ? { credentialId: boost.id } : {},
-              ...input2.idempotencyKey ? { idempotencyKey: input2.idempotencyKey } : {}
+              ...input2.idempotencyKey ? { idempotencyKey: input2.idempotencyKey } : {},
+              ...isHolderEncryption ? { encryption: "holder" } : {}
             });
             if (prepared.completed) return prepared.completed;
+            if (isHolderEncryption && !getPreparedRecipientKeyIds(prepared)) {
+              throw new Error(HOLDER_MODE_PREPARE_UNSUPPORTED);
+            }
             const boostString = JSON.stringify(boost);
             const allowAutoAppendEvidence = !hasDynamicEvidenceTemplate(boostString);
             if (input2.templateData && Object.keys(input2.templateData).length > 0) {
@@ -25831,20 +26603,89 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
             if (boost.type?.includes("BoostCredential"))
               boost.boostId = prepared.boostUri;
             boost = injectManagedRefreshService(boost, prepared.refreshService);
-            const signedCredential = await issueCredentialWithNetworkStatus(
+            if (isHolderEncryption && !prepared.statusEntries?.length && !boost.credentialStatus) {
+              throw new Error(
+                "Server did not bind status entries for this holder-mode send; refusing to send a managed credential without a public status binding."
+              );
+            }
+            const signedCredential = boost.credentialStatus ? await _learnCard.invoke.issueCredential(
+              prepareManagedRefreshContext(
+                UnsignedVCValidator.parse(materializeCredentialFields(boost))
+              )
+            ) : await issueCredentialWithNetworkStatus(
               _learnCard,
               client,
-              boost
+              boost,
+              input2.statusPurposes ? [
+                .../* @__PURE__ */ new Set([
+                  "revocation",
+                  ...input2.statusPurposes
+                ])
+              ] : void 0,
+              prepared.statusEntries
             );
-            return client.boost.send.mutate({
-              ...input2,
-              template: void 0,
-              templateUri: prepared.boostUri,
-              signedCredential,
-              refresh: true
+            if (!isHolderEncryption) {
+              return client.boost.send.mutate({
+                type: "boost",
+                recipient: input2.recipient,
+                display: normalizePublicDisplay(input2),
+                statusPurposes: input2.statusPurposes,
+                contractUri: input2.contractUri,
+                integrationId: input2.integrationId,
+                idempotencyKey: input2.idempotencyKey,
+                templateUri: prepared.boostUri,
+                signedCredential,
+                refresh: true
+              });
+            }
+            const initialRecipientKeyIds = getPreparedRecipientKeyIds(prepared);
+            if (!initialRecipientKeyIds) {
+              throw new Error(HOLDER_MODE_PREPARE_UNSUPPORTED);
+            }
+            const boundCredentialStatus = BitstringStatusListEntryValidator.or(
+              BitstringStatusListEntryValidator.array()
+            ).parse(signedCredential.credentialStatus);
+            const holderBindings = {
+              refreshId: prepared.refreshId,
+              credentialId: prepared.credentialId,
+              holderDid: prepared.holderDid,
+              issuerDid: _learnCard.id.did(),
+              credentialStatus: boundCredentialStatus,
+              refreshService: ManagedCredentialRefreshBindingValidator.parse(
+                signedCredential.refreshService
+              )
+            };
+            assertManagedCredentialBinding(signedCredential, {
+              ...holderBindings,
+              encryptionMode: "holder"
             });
+            const holderClient = client.credentialRefresh;
+            const delivered = await deliverHolderEncryptedHandoff(
+              holderClient,
+              prepared.refreshId,
+              initialRecipientKeyIds,
+              (recipientKeyIds) => buildHolderEncryptedHandoff(
+                _learnCard,
+                signedCredential,
+                holderBindings,
+                recipientKeyIds
+              ),
+              (handoff2) => holderClient.sendHolderEncryptedRefreshable.mutate({
+                handoff: handoff2,
+                boostUri: prepared.boostUri,
+                idempotencyKey: input2.idempotencyKey
+              })
+            );
+            return {
+              type: "boost",
+              uri: prepared.boostUri,
+              credentialUri: delivered.uri,
+              activityId: delivered.activityId,
+              statusManagement: delivered.statusManagement,
+              refresh: holderBindings
+            };
           }
-          return client.boost.send.mutate(input2);
+          return client.boost.send.mutate(request);
         }
         if (input2.type === "boost") {
           const recipient = input2.recipient;
@@ -25857,6 +26698,7 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
           const isRemoteDidWebRecipient = recipient.startsWith("did:web:") && recipientDomain !== serviceDomain;
           if (isRemoteDidWebRecipient && input2.templateUri) {
             const boostRecord = await _learnCard.invoke.getBoost(input2.templateUri);
+            assertIssuableBoostTemplate(boostRecord.boost);
             let boost = boostRecord.boost;
             const boostString = JSON.stringify(boost);
             const allowAutoAppendEvidence = !hasDynamicEvidenceTemplate(boostString);
@@ -25917,6 +26759,7 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
               _learnCard,
               input2.templateUri
             );
+            assertIssuableBoostTemplate(result);
             const data = await UnsignedVCValidator.spa(result);
             if (data.success) {
               let targetDid;
@@ -26002,17 +26845,29 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
         await ensureUser();
         return client.contracts.createConsentFlowContract.mutate(contract);
       }, "createContract"),
-      addAutoBoostsToContract: /* @__PURE__ */ __name(async (_learnCard, contractUri, autoboosts) => {
-        await ensureUser();
-        return client.contracts.addAutoBoostsToContract.mutate({ contractUri, autoboosts });
-      }, "addAutoBoostsToContract"),
-      removeAutoBoostsFromContract: /* @__PURE__ */ __name(async (_learnCard, contractUri, boostUris) => {
+      updateContract: /* @__PURE__ */ __name(async (_learnCard, uri, changes, options2 = {}) => {
+        const { read, write, contract, ...details } = changes;
+        if (read && contract?.read || write && contract?.write) {
+          throw new Error(
+            "Contract read/write updates must use either the top-level or nested contract shape, not both."
+          );
+        }
         await ensureUser();
-        return client.contracts.removeAutoBoostsFromContract.mutate({
-          contractUri,
-          boostUris
+        return client.contracts.updateConsentFlowContract.mutate({
+          uri,
+          changes: {
+            ...details,
+            ...(contract || read || write) && {
+              contract: {
+                ...contract,
+                ...read && { read },
+                ...write && { write }
+              }
+            }
+          },
+          ...options2
         });
-      }, "removeAutoBoostsFromContract"),
+      }, "updateContract"),
       addContractRecipient: /* @__PURE__ */ __name(async (_learnCard, contractUri, recipient) => {
         await ensureUser();
         return client.contracts.addContractRecipient.mutate({ contractUri, recipient });
@@ -26024,6 +26879,14 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
       getContract: /* @__PURE__ */ __name(async (_learnCard, uri) => {
         return client.contracts.getConsentFlowContract.query({ uri });
       }, "getContract"),
+      getContractVersions: /* @__PURE__ */ __name(async (_learnCard, uri) => {
+        await ensureUser();
+        return client.contracts.getContractVersions.query({ uri });
+      }, "getContractVersions"),
+      getConsentStatus: /* @__PURE__ */ __name(async (_learnCard, uri, profileId) => {
+        await ensureUser();
+        return client.contracts.getConsentStatus.query({ uri, profileId });
+      }, "getConsentStatus"),
       getContracts: /* @__PURE__ */ __name(async (_learnCard, options2) => {
         await ensureUser();
         return client.contracts.getConsentFlowContracts.query(options2);
@@ -26080,6 +26943,15 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
           audienceVersion
         });
       }, "updateContractTerms"),
+      acceptContractUpdate: /* @__PURE__ */ __name(async (_learnCard, uri, { version: version2, terms, audienceVersion }) => {
+        await ensureUser();
+        return client.contracts.updateConsentedContractTerms.mutate({
+          uri,
+          terms,
+          acceptVersion: version2,
+          audienceVersion
+        });
+      }, "acceptContractUpdate"),
       withdrawConsent: /* @__PURE__ */ __name(async (_learnCard, uri) => {
         await ensureUser();
         return client.contracts.withdrawConsent.mutate({ uri });
@@ -26357,7 +27229,13 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
           );
           return [];
         });
-        return { ...result, records, failed: results.length - records.length };
+        const { cursor, ...page } = result;
+        return {
+          ...page,
+          ...cursor === void 0 ? {} : { cursor },
+          records,
+          failed: results.length - records.length
+        };
       }, "recoverInboxCredentials"),
       sendGuardianApprovalEmail: /* @__PURE__ */ __name(async (_learnCard, options2) => {
         await ensureUser();
@@ -26714,10 +27592,33 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
         await ensureUser();
         return client.appStore.isAdmin.query();
       }, "isAppStoreAdmin"),
+      getAnnouncementPreferences: /* @__PURE__ */ __name(async (_learnCard) => {
+        await ensureUser();
+        return client.campaigns.getAnnouncementPreferences.query();
+      }, "getAnnouncementPreferences"),
+      updateAnnouncementPreferences: /* @__PURE__ */ __name(async (_learnCard, updates) => {
+        await ensureUser();
+        return client.campaigns.updateAnnouncementPreferences.mutate(updates);
+      }, "updateAnnouncementPreferences"),
+      unsubscribeFromAnnouncements: /* @__PURE__ */ __name(async (_learnCard, token) => {
+        return getAnonymousClient(url2).campaigns.unsubscribe.mutate({ token });
+      }, "unsubscribeFromAnnouncements"),
       campaignsIsAdmin: /* @__PURE__ */ __name(async (_learnCard) => {
         await ensureUser();
         return client.campaigns.isAdmin.query();
       }, "campaignsIsAdmin"),
+      campaignsSendTestToMe: /* @__PURE__ */ __name(async (_learnCard, campaignId) => {
+        await ensureUser();
+        return client.campaigns.sendTestToMe.mutate({ campaignId });
+      }, "campaignsSendTestToMe"),
+      campaignsPreviewDispatch: /* @__PURE__ */ __name(async (_learnCard, campaignId) => {
+        await ensureUser();
+        return client.campaigns.previewDispatch.query({ campaignId });
+      }, "campaignsPreviewDispatch"),
+      campaignsDispatch: /* @__PURE__ */ __name(async (_learnCard, campaignId, options2 = {}) => {
+        await ensureUser();
+        return client.campaigns.dispatch.mutate({ campaignId, ...options2 });
+      }, "campaignsDispatch"),
       campaignsCreate: /* @__PURE__ */ __name(async (_learnCard, input2) => {
         await ensureUser();
         return client.campaigns.create.mutate(input2);
@@ -26760,11 +27661,21 @@ async function getLearnCardNetworkPlugin(learnCard, url2, apiTokenOrOptions, opt
       }, "campaignsGetStats"),
       getMyCampaigns: /* @__PURE__ */ __name(async (_learnCard) => {
         await ensureUser();
-        return client.campaigns.getMyCampaigns.query();
+        const response = await client.campaigns.getMyCampaigns.query();
+        if (!Array.isArray(response))
+          throw new Error("Invalid campaigns response: expected an array");
+        return response.flatMap((item) => {
+          const result = MyCampaignValidator.safeParse(item);
+          return result.success ? [result.data] : [];
+        });
       }, "getMyCampaigns"),
-      recordCampaignEvent: /* @__PURE__ */ __name(async (_learnCard, campaignId, event) => {
+      recordCampaignEvent: /* @__PURE__ */ __name(async (_learnCard, campaignId, event, testId) => {
         await ensureUser();
-        return client.campaigns.recordEvent.mutate({ campaignId, event });
+        return client.campaigns.recordEvent.mutate({
+          campaignId,
+          event,
+          ...testId ? { testId } : {}
+        });
       }, "recordCampaignEvent"),
       enrollInCampaign: /* @__PURE__ */ __name(async (_learnCard, campaignId) => {
         await ensureUser();