@learncard/react 2.12.7 → 2.12.8

package/dist/cjs/{types.esm-94c6d461.js → types.esm-9062360c.js}

@@ -7408,6 +7408,7 @@ var __getOwnPropDescs = Object.getOwnPropertyDescriptors;
 var __getOwnPropSymbols = Object.getOwnPropertySymbols;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __propIsEnum = Object.prototype.propertyIsEnumerable;
+var __pow = Math.pow;
 var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
 var __spreadValues = (a, b) => {
   for (var prop in b || (b = {}))
@@ -9786,6 +9787,12 @@ object({
     this.name = "AuthSessionError";
   }
 }, __name(_a, "AuthSessionError"), _a);
+object({
+  state: _enum(["none", "enabled", "locked", "stale"]),
+  enabled: boolean(),
+  attemptsRemaining: number().int().nonnegative(),
+  salt: string().optional()
+});
 var BITSTRING_STATUS_PURPOSES = ["revocation", "suspension"];
 var BitstringStatusPurposeValidator = _enum(BITSTRING_STATUS_PURPOSES);
 var BitstringStatusListEntryValidator = object({
@@ -9894,6 +9901,456 @@ object({
   version: number().default(1),
   messages: array(inAppMessageValidator).default([])
 }).passthrough();
+var SHARE_LINK_ID_BYTES = 16;
+var SHARE_CONTENT_KEY_BYTES = 32;
+var SHARE_IV_BYTES = 12;
+var SHARE_TAG_BYTES = 16;
+var MAX_SHARE_CIPHERTEXT_BYTES = 512 * 1024;
+var MAX_SHARE_RECOVERY_JWE_BYTES = 64 * 1024;
+var MAX_SELECTED_CREDENTIALS = 50;
+var MAX_ENDORSEMENTS = 200;
+var MAX_VP_MEMBERS = MAX_SELECTED_CREDENTIALS + MAX_ENDORSEMENTS;
+var MAX_SHARE_SOURCE_URI_CHARS = 2048;
+var SHARE_LINK_PROTOCOL = "lc-share/v1";
+var SHARE_RECOVERY_PROTOCOL = "lc-share-recovery/v1";
+var BASE64URL_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+var BASE64URL_LOOKUP = (() => {
+  const table = new Int16Array(128).fill(-1);
+  for (let index = 0; index < BASE64URL_ALPHABET.length; index += 1) {
+    table[BASE64URL_ALPHABET.charCodeAt(index)] = index;
+  }
+  return table;
+})();
+var encodeBase64Url = /* @__PURE__ */ __name((bytes) => {
+  let output = "";
+  for (let index = 0; index < bytes.length; index += 3) {
+    const first = bytes[index];
+    const second = bytes[index + 1];
+    const third = bytes[index + 2];
+    output += BASE64URL_ALPHABET[first >> 2];
+    output += BASE64URL_ALPHABET[(first & 3) << 4 | (second != null ? second : 0) >> 4];
+    if (second === void 0) break;
+    output += BASE64URL_ALPHABET[(second & 15) << 2 | (third != null ? third : 0) >> 6];
+    if (third === void 0) break;
+    output += BASE64URL_ALPHABET[third & 63];
+  }
+  return output;
+}, "encodeBase64Url");
+var decodeBase64Url = /* @__PURE__ */ __name((value) => {
+  if (typeof value !== "string") return null;
+  const output = new Uint8Array(Math.floor(value.length * 6 / 8));
+  let bits = 0;
+  let bitCount = 0;
+  let outputIndex = 0;
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    const digit = code < 128 ? BASE64URL_LOOKUP[code] : -1;
+    if (digit < 0) return null;
+    bits = bits << 6 | digit;
+    bitCount += 6;
+    if (bitCount >= 8) {
+      bitCount -= 8;
+      output[outputIndex] = bits >> bitCount & 255;
+      outputIndex += 1;
+    }
+  }
+  return output;
+}, "decodeBase64Url");
+var isCanonicalBase64Url = /* @__PURE__ */ __name((value, expectedBytes) => {
+  if (typeof value !== "string") return false;
+  if (expectedBytes !== void 0 && value.length !== Math.ceil(expectedBytes * 4 / 3))
+    return false;
+  const decoded = decodeBase64Url(value);
+  if (decoded === null) return false;
+  if (expectedBytes !== void 0 && decoded.length !== expectedBytes) return false;
+  return encodeBase64Url(decoded) === value;
+}, "isCanonicalBase64Url");
+var utf8ByteLength = /* @__PURE__ */ __name((value) => new TextEncoder().encode(value).length, "utf8ByteLength");
+var canonicalBase64Url = /* @__PURE__ */ __name((bytes) => string().refine((value) => isCanonicalBase64Url(value, bytes), {
+  message: `must be canonical base64url for exactly ${bytes} bytes`
+}), "canonicalBase64Url");
+var ShareLinkIdValidator = canonicalBase64Url(SHARE_LINK_ID_BYTES);
+var ShareContentKeyValidator = canonicalBase64Url(SHARE_CONTENT_KEY_BYTES);
+var ShareIvValidator = canonicalBase64Url(SHARE_IV_BYTES);
+var ShareCiphertextValidator = string().refine(
+  (value) => {
+    if (value.length > Math.ceil(MAX_SHARE_CIPHERTEXT_BYTES * 4 / 3)) return false;
+    const decoded = decodeBase64Url(value);
+    if (decoded === null) return false;
+    if (encodeBase64Url(decoded) !== value) return false;
+    return decoded.length >= SHARE_TAG_BYTES && decoded.length <= MAX_SHARE_CIPHERTEXT_BYTES;
+  },
+  {
+    message: `must be canonical base64url decoding to ${SHARE_TAG_BYTES}..${MAX_SHARE_CIPHERTEXT_BYTES} bytes`
+  }
+);
+var ShareEnvelopeValidator = object({
+  v: literal(1),
+  alg: literal("A256GCM"),
+  iv: ShareIvValidator,
+  ct: ShareCiphertextValidator
+}).strict();
+var safeVersion = number().int().min(1).max(__pow(2, 31) - 1);
+var safeCredentialIndex = number().int().min(0).max(MAX_VP_MEMBERS - 1);
+var ShareSelectionEntryValidator = object({ credentialIndex: safeCredentialIndex }).strict();
+var ShareEndorsementEntryValidator = object({ credentialIndex: safeCredentialIndex, targetCredentialIndex: safeCredentialIndex }).strict();
+var ShareSharerValidator = object({
+  profileId: string().min(1).max(128),
+  displayName: string().min(1).max(120),
+  avatar: string().max(2048).optional()
+}).strict();
+var presentationShape = VPValidator.extend({
+  verifiableCredential: VCValidator.array().min(1).max(MAX_VP_MEMBERS)
+});
+var hasBoundedPresentation = /* @__PURE__ */ __name((value) => {
+  let credentialCount = 0;
+  const ancestors = /* @__PURE__ */ new Set();
+  const visit = /* @__PURE__ */ __name((node, depth) => {
+    if (node === null || typeof node !== "object") return true;
+    if (depth > 32 || ancestors.has(node)) return false;
+    ancestors.add(node);
+    try {
+      for (const [key, child] of Object.entries(node)) {
+        if (key === "verifiableCredential") {
+          credentialCount += Array.isArray(child) ? child.length : 1;
+          if (credentialCount > MAX_VP_MEMBERS) return false;
+        }
+        if (!visit(child, depth + 1)) return false;
+      }
+      return true;
+    } finally {
+      ancestors.delete(node);
+    }
+  }, "visit");
+  return visit(value, 0);
+}, "hasBoundedPresentation");
+var ShareManifestPresentationValidator = custom(
+  (value) => hasBoundedPresentation(value) && presentationShape.safeParse(value).success,
+  { message: "invalid share presentation" }
+);
+var SharePayloadValidatorShape = object({
+  protocol: literal(SHARE_LINK_PROTOCOL),
+  shareId: ShareLinkIdValidator,
+  contentVersion: safeVersion,
+  createdAt: datetime(),
+  sharer: ShareSharerValidator,
+  presentation: ShareManifestPresentationValidator,
+  selection: ShareSelectionEntryValidator.array().min(1).max(MAX_SELECTED_CREDENTIALS),
+  endorsements: ShareEndorsementEntryValidator.array().max(MAX_ENDORSEMENTS).default([])
+}).strict();
+var classificationFailure = /* @__PURE__ */ __name((code, message, path = []) => ({ ok: false, code, message, path }), "classificationFailure");
+var readSignedClaimId = /* @__PURE__ */ __name((member) => {
+  var _a2, _b;
+  if (member === null || typeof member !== "object") return void 0;
+  const record = member;
+  const claim = (_a2 = record.credentialSubject) != null ? _a2 : record.endorsement;
+  if (claim === null || typeof claim !== "object") return void 0;
+  const claimRecord = claim;
+  const nested = claimRecord.endorsement;
+  const nestedId = nested !== null && typeof nested === "object" ? nested.id : void 0;
+  return (_b = claimRecord.id) != null ? _b : nestedId;
+}, "readSignedClaimId");
+var classifyShareManifest = /* @__PURE__ */ __name((payload) => {
+  var _a2, _b;
+  const members = (_a2 = payload.presentation) == null ? void 0 : _a2.verifiableCredential;
+  if (!Array.isArray(members) || members.length === 0) {
+    return classificationFailure("NO_PRESENTATION_MEMBERS", "presentation has no credentials");
+  }
+  if (members.length > MAX_VP_MEMBERS) {
+    return classificationFailure(
+      "TOO_MANY_VP_MEMBERS",
+      `presentation has ${members.length} members, over the ${MAX_VP_MEMBERS} bound`
+    );
+  }
+  const selection = payload.selection;
+  const endorsements = (_b = payload.endorsements) != null ? _b : [];
+  if (!Array.isArray(selection) || selection.length < 1 || selection.length > MAX_SELECTED_CREDENTIALS) {
+    return classificationFailure("BAD_SELECTION", "selection must contain 1..50 entries");
+  }
+  if (!Array.isArray(endorsements) || endorsements.length > MAX_ENDORSEMENTS) {
+    return classificationFailure(
+      "BAD_ENDORSEMENTS",
+      "endorsements must contain at most 200 entries"
+    );
+  }
+  const selectedIndices = [];
+  const selected = /* @__PURE__ */ new Set();
+  for (let index = 0; index < selection.length; index += 1) {
+    const entry = selection[index];
+    const credentialIndex = entry == null ? void 0 : entry.credentialIndex;
+    if (!Number.isSafeInteger(credentialIndex) || credentialIndex < 0 || credentialIndex >= members.length) {
+      return classificationFailure(
+        "SELECTION_INDEX_OUT_OF_BOUNDS",
+        `selection[${index}].credentialIndex is out of bounds`,
+        ["selection", index, "credentialIndex"]
+      );
+    }
+    if (selected.has(credentialIndex)) {
+      return classificationFailure(
+        "SELECTION_INDEX_DUPLICATE",
+        `selection[${index}].credentialIndex is duplicated`,
+        ["selection", index, "credentialIndex"]
+      );
+    }
+    selected.add(credentialIndex);
+    selectedIndices.push(credentialIndex);
+  }
+  const classified = new Set(selected);
+  const endorsementIndices = [];
+  for (let index = 0; index < endorsements.length; index += 1) {
+    const entry = endorsements[index];
+    const credentialIndex = entry == null ? void 0 : entry.credentialIndex;
+    const targetIndex = entry == null ? void 0 : entry.targetCredentialIndex;
+    if (!Number.isSafeInteger(credentialIndex) || credentialIndex < 0 || credentialIndex >= members.length) {
+      return classificationFailure(
+        "ENDORSEMENT_INDEX_OUT_OF_BOUNDS",
+        `endorsements[${index}].credentialIndex is out of bounds`,
+        ["endorsements", index, "credentialIndex"]
+      );
+    }
+    if (classified.has(credentialIndex)) {
+      return classificationFailure(
+        "VP_MEMBER_CLASSIFIED_TWICE",
+        `endorsements[${index}].credentialIndex was already classified`,
+        ["endorsements", index, "credentialIndex"]
+      );
+    }
+    if (!selected.has(targetIndex)) {
+      return classificationFailure(
+        "ENDORSEMENT_TARGET_NOT_SELECTED",
+        `endorsements[${index}].targetCredentialIndex must reference a selected credential`,
+        ["endorsements", index, "targetCredentialIndex"]
+      );
+    }
+    const referenced = readSignedClaimId(members[credentialIndex]);
+    const target = members[targetIndex];
+    const targetId = target !== null && typeof target === "object" ? target.id : void 0;
+    if (typeof referenced !== "string" || typeof targetId !== "string" || referenced !== targetId) {
+      return classificationFailure(
+        "ENDORSEMENT_TARGET_UNBOUND",
+        `endorsements[${index}] claim does not reference the target credential id`,
+        ["endorsements", index]
+      );
+    }
+    classified.add(credentialIndex);
+    endorsementIndices.push(credentialIndex);
+  }
+  if (classified.size !== members.length) {
+    return classificationFailure(
+      "UNCLASSIFIED_VP_MEMBER",
+      "every presentation member must be classified exactly once",
+      ["presentation", "verifiableCredential"]
+    );
+  }
+  return {
+    ok: true,
+    classification: { selectedIndices, endorsementIndices, memberCount: members.length }
+  };
+}, "classifyShareManifest");
+SharePayloadValidatorShape.superRefine((payload, ctx) => {
+  const result = classifyShareManifest(payload);
+  if (!result.ok) {
+    ctx.addIssue({
+      code: "custom",
+      message: result.message,
+      path: result.path,
+      params: { shareLinkCode: result.code }
+    });
+  }
+});
+var ShareRecoverySelectionValidator = object({
+  ref: string().min(1).max(MAX_SHARE_SOURCE_URI_CHARS),
+  order: number().int().min(0).max(MAX_SELECTED_CREDENTIALS - 1)
+}).strict();
+var ShareRecoveryEndorsementValidator = object({ targetRef: string().min(1).max(MAX_SHARE_SOURCE_URI_CHARS) }).strict();
+object({
+  protocol: literal(SHARE_RECOVERY_PROTOCOL),
+  shareId: ShareLinkIdValidator,
+  ownerProfileId: string().min(1).max(128),
+  createdAt: datetime(),
+  latest: object({ contentVersion: safeVersion, key: ShareContentKeyValidator }).strict(),
+  selection: ShareRecoverySelectionValidator.array().min(1).max(MAX_SELECTED_CREDENTIALS),
+  endorsements: ShareRecoveryEndorsementValidator.array().max(MAX_ENDORSEMENTS).default([])
+}).strict().superRefine((recovery, ctx) => {
+  const orders = /* @__PURE__ */ new Set();
+  recovery.selection.forEach((entry, index) => {
+    if (entry.order >= recovery.selection.length) {
+      ctx.addIssue({
+        code: "custom",
+        message: "order must be within the selection bounds",
+        path: ["selection", index, "order"]
+      });
+    }
+    if (orders.has(entry.order)) {
+      ctx.addIssue({
+        code: "custom",
+        message: "order must be unique within the selection",
+        path: ["selection", index, "order"]
+      });
+    }
+    orders.add(entry.order);
+  });
+});
+var ShareOwnerRecoveryValidator = JWEValidator.refine(
+  (value) => utf8ByteLength(JSON.stringify(value)) <= MAX_SHARE_RECOVERY_JWE_BYTES,
+  { message: `serialized recovery JWE must be at most ${MAX_SHARE_RECOVERY_JWE_BYTES} bytes` }
+);
+var ShareLinkStatusValidator = _enum(["pending", "active", "stopped"]);
+var ShareContentStateValidator = _enum(["staging", "finalized", "content_missing"]);
+var ShareLinkValidator = object({
+  id: ShareLinkIdValidator,
+  title: string().min(1).max(120),
+  note: string().max(500).optional(),
+  selectedCount: number().int().min(1).max(MAX_SELECTED_CREDENTIALS),
+  version: safeVersion,
+  contentVersion: safeVersion,
+  status: ShareLinkStatusValidator,
+  contentState: ShareContentStateValidator,
+  createdAt: datetime(),
+  updatedAt: datetime(),
+  expiresAt: datetime().nullable(),
+  stoppedAt: datetime().nullable(),
+  lastViewedAt: datetime().nullable(),
+  viewCount: number().int().min(0).optional(),
+  passcodeProtected: boolean(),
+  notifyOnView: boolean(),
+  minorPolicy: object({
+    isMinor: boolean().nullable(),
+    policyResolved: boolean(),
+    defaultExpiryDays: union([literal(30), literal(365)]),
+    viewCountingEnabled: boolean()
+  }),
+  /**
+   * Guarded application/API URL for the content. Optional because owner APIs in
+   * D1 have no public resolve/content endpoint yet; it must never be a
+   * LearnCloud object URL or carry a fabricated decryption key.
+   */
+  contentUrl: string().optional()
+});
+var clientRequestId = string().uuid();
+object({
+  id: ShareLinkIdValidator,
+  clientRequestId,
+  title: string().min(1).max(120),
+  note: string().max(500).optional(),
+  expiresAt: datetime().nullable().optional(),
+  passcode: string().min(8).max(64).optional(),
+  notifyOnView: boolean().default(false),
+  selectedCount: number().int().min(1).max(MAX_SELECTED_CREDENTIALS),
+  contentVersion: literal(1),
+  envelope: ShareEnvelopeValidator,
+  ownerEncryptedRecovery: ShareOwnerRecoveryValidator
+}).strict();
+object({
+  id: ShareLinkIdValidator,
+  expectedVersion: safeVersion,
+  clientRequestId,
+  title: string().min(1).max(120).optional(),
+  note: string().max(500).nullable().optional(),
+  expiresAt: datetime().nullable().optional(),
+  /** Omitted preserves the current passcode, null removes it, and a string replaces it. */
+  passcode: string().min(8).max(64).nullable().optional(),
+  notifyOnView: boolean().optional(),
+  contentVersion: safeVersion.optional(),
+  selectedCount: number().int().min(1).max(MAX_SELECTED_CREDENTIALS).optional(),
+  envelope: ShareEnvelopeValidator.optional(),
+  ownerEncryptedRecovery: ShareOwnerRecoveryValidator.optional()
+}).strict().superRefine((value, ctx) => {
+  const provided = [
+    value.contentVersion,
+    value.selectedCount,
+    value.envelope,
+    value.ownerEncryptedRecovery
+  ].filter((field) => field !== void 0).length;
+  if (provided !== 0 && provided !== 4) {
+    ctx.addIssue({
+      code: "custom",
+      message: "content replacement requires contentVersion, selectedCount, envelope and ownerEncryptedRecovery together"
+    });
+  }
+});
+object({ id: ShareLinkIdValidator }).strict();
+object({ id: ShareLinkIdValidator, operationId: string().uuid() }).strict();
+discriminatedUnion("status", [
+  object({ status: literal("completed"), share: ShareLinkValidator }).strict(),
+  object({
+    status: literal("pending"),
+    id: ShareLinkIdValidator,
+    operationId: string().uuid()
+  }).strict()
+]);
+discriminatedUnion("status", [
+  object({ status: literal("found"), share: ShareLinkValidator }).strict(),
+  object({
+    status: literal("pending"),
+    id: ShareLinkIdValidator,
+    operationId: string().uuid()
+  }).strict(),
+  object({ status: literal("not_found"), id: ShareLinkIdValidator }).strict()
+]);
+object({ recovery: ShareOwnerRecoveryValidator }).strict();
+object({
+  id: ShareLinkIdValidator,
+  contentVersion: safeVersion,
+  envelope: ShareEnvelopeValidator
+}).strict();
+object({
+  id: ShareLinkIdValidator,
+  /** Sent only in a POST body; it must never be placed in a share URL. */
+  passcode: string().min(4).max(64).optional()
+}).strict();
+discriminatedUnion("state", [
+  object({
+    state: literal("passcode_required"),
+    id: ShareLinkIdValidator
+  }).strict(),
+  object({ state: literal("try_later"), id: ShareLinkIdValidator }).strict(),
+  object({
+    state: literal("active"),
+    id: ShareLinkIdValidator,
+    title: string().max(120),
+    note: string().max(500).optional(),
+    selectedCount: number().int().min(1).max(MAX_SELECTED_CREDENTIALS),
+    contentVersion: safeVersion,
+    contentUrl: string(),
+    sharer: object({
+      displayName: string().max(120),
+      avatar: string().max(2048).optional()
+    }),
+    createdAt: datetime(),
+    updatedAt: datetime(),
+    expiresAt: datetime().nullable()
+  }).strict(),
+  object({
+    state: literal("expired"),
+    id: ShareLinkIdValidator,
+    expiresAt: datetime()
+  }).strict(),
+  object({
+    state: literal("stopped"),
+    id: ShareLinkIdValidator,
+    stoppedAt: datetime()
+  }).strict(),
+  object({ state: literal("not_found"), id: ShareLinkIdValidator }).strict()
+]);
+object({
+  limit: number().int().min(1).max(50).default(25),
+  cursor: string().max(512).optional()
+}).strict();
+PaginationResponseValidator.extend({
+  records: ShareLinkValidator.array()
+});
+object({
+  receipt: string().min(22).max(128).regex(/^[A-Za-z0-9_-]+$/)
+}).strict();
+object({ ok: literal(true) }).strict();
+object({
+  id: ShareLinkIdValidator,
+  contentVersion: safeVersion,
+  envelope: ShareEnvelopeValidator,
+  contentUrl: string(),
+  receipt: string().min(22).max(128).regex(/^[A-Za-z0-9_-]+$/)
+}).strict();
 
 exports.VerificationStatusEnum = VerificationStatusEnum;
-//# sourceMappingURL=types.esm-94c6d461.js.map
+//# sourceMappingURL=types.esm-9062360c.js.map