@learncard/react 3.0.3 → 3.0.5

package/dist/cjs/{types.esm-95ade0c0.js → types.esm-56901371.js}

@@ -9721,12 +9721,46 @@ var StringQuery = union([
     $or: BaseStringQuery.array()
   })
 ]);
+var BITSTRING_STATUS_PURPOSES = ["revocation", "suspension"];
+var BitstringStatusPurposeValidator = _enum(BITSTRING_STATUS_PURPOSES);
+var BitstringStatusListEntryValidator = object({
+  id: string().optional(),
+  type: literal("BitstringStatusListEntry"),
+  statusPurpose: BitstringStatusPurposeValidator,
+  statusListIndex: string().or(number().int().nonnegative()),
+  statusListCredential: string()
+});
+BitstringStatusListEntryValidator.extend({
+  id: string()
+});
+object({
+  id: string().optional(),
+  type: literal("BitstringStatusList"),
+  statusPurpose: BitstringStatusPurposeValidator,
+  encodedList: string()
+});
+object({
+  statusPurposes: array(BitstringStatusPurposeValidator).optional(),
+  listSize: number().int().positive().optional()
+}).default({});
+object({
+  refreshId: string().min(1),
+  credentialStatus: CredentialStatusValidator.or(CredentialStatusValidator.array()).nullable()
+});
 var LearnCardRefreshAuthorizationValidator = object({ type: literal("LearnCardDIDAuth") }).catchall(any());
 var ManagedCredentialRefreshServiceValidator = object({
   id: string().min(1),
   type: literal("LearnCardCredentialRefresh2026"),
   authorization: LearnCardRefreshAuthorizationValidator.optional()
 }).catchall(any());
+var ManagedCredentialRefreshBindingValidator = ManagedCredentialRefreshServiceValidator.or(
+  RefreshServiceValidator.array().refine(
+    (services) => services.some(
+      (service) => ManagedCredentialRefreshServiceValidator.safeParse(service).success
+    ),
+    "A managed refresh service is required"
+  )
+);
 var StandardCredentialRefreshServiceValidator = object({
   id: string().min(1),
   type: literal("1EdTechCredentialRefresh")
@@ -9750,7 +9784,9 @@ object({
 });
 var ManagedCredentialRefreshReceiptValidator = object({
   refreshId: string().min(1),
-  refreshService: ManagedCredentialRefreshServiceValidator,
+  refreshService: ManagedCredentialRefreshBindingValidator,
+  /** Legacy receipts authenticate only the allocated managed entry, not other services. */
+  refreshServiceBinding: literal("managed-entry").optional(),
   credentialId: string().min(1),
   issuerDid: string().min(1),
   holderDid: string().min(1),
@@ -9758,14 +9794,43 @@ var ManagedCredentialRefreshReceiptValidator = object({
     CredentialStatusValidator.array()
   ).optional()
 }).strip();
+object({ uri: string().min(1) });
+ManagedCredentialRefreshReceiptValidator.extend({
+  encryptionMode: _enum(["network", "holder"])
+});
+var HolderEncryptedHandoffValidator = object({
+  refreshId: string().min(1),
+  credentialId: string().min(1),
+  holderDid: string().min(1),
+  issuerDid: string().min(1),
+  credentialStatus: CredentialStatusValidator.or(CredentialStatusValidator.array()),
+  refreshService: ManagedCredentialRefreshBindingValidator.optional(),
+  jwe: JWEValidator
+}).strict();
+object({
+  handoff: HolderEncryptedHandoffValidator,
+  idempotencyKey: string().min(1).optional(),
+  boostUri: string().optional(),
+  skipNotification: boolean().optional()
+});
+object({ refreshId: string().min(1) });
+object({
+  recipientKeyIds: array(string())
+});
 var InboxCredentialRefreshReceiptValidator = ManagedCredentialRefreshReceiptValidator.omit(
   { holderDid: true }
 ).extend({ holderDid: string().min(1).optional() });
 var CredentialRefreshSigningModeValidator = _enum(["issuer-signed", "signing-authority"]);
+var CredentialRefreshUpdateReasonValidator = _enum(["corrected", "updated", "reissued"]);
 var PublishCredentialRefreshBaseFields = {
   refreshId: string().min(1),
   notifyHolder: boolean().optional(),
-  updateSummary: string().optional(),
+  updateSummary: string().max(280).optional().describe(
+    "Public legacy update summary. Do not include private claims; prefer updateReason."
+  ),
+  updateReason: CredentialRefreshUpdateReasonValidator.optional().describe(
+    "Public reason for this update"
+  ),
   idempotencyKey: string().optional()
 };
 object(__spreadProps(__spreadValues({}, PublishCredentialRefreshBaseFields), {
@@ -9838,13 +9903,25 @@ object({
   publishedAt: string().min(1),
   notification: PublishCredentialRefreshNotificationValidator
 });
+object({
+  handoff: HolderEncryptedHandoffValidator,
+  notify: boolean(),
+  updateSummary: string().max(280).optional().describe(
+    "Public legacy update summary. Do not include private claims; prefer updateReason."
+  ),
+  updateReason: CredentialRefreshUpdateReasonValidator.optional().describe(
+    "Public reason for this update"
+  ),
+  idempotencyKey: string().optional()
+});
 var CredentialRefreshVersionMetadataValidator = object({
   version: number().int().positive(),
   publishedAt: string().min(1),
   effectiveAt: string().optional(),
   etag: string().optional(),
   signingMode: CredentialRefreshSigningModeValidator.optional(),
-  updateSummary: string().optional()
+  updateSummary: string().optional(),
+  updateReason: CredentialRefreshUpdateReasonValidator.optional()
 });
 object({
   refreshId: string().min(1),
@@ -9887,6 +9964,7 @@ var CredentialRefreshFailureCodeValidator = _enum([
   "INVALID_PROOF",
   "ISSUER_MISMATCH",
   "ID_MISMATCH",
+  "BINDING_MISMATCH",
   "ROLLBACK",
   "REVOKED",
   "UNSAFE_ENDPOINT"
@@ -10204,13 +10282,18 @@ object({
     isPrimary: boolean().optional()
   })
 });
-object({
+var AutoBoostConfigValidator = object({
   boostUri: string(),
   signingAuthority: object({
     endpoint: string(),
     name: string()
   })
 });
+var CredentialDisplayValidator = object({
+  name: string().trim().min(1).max(280).optional(),
+  category: string().max(280).optional(),
+  image: string().max(2048).url().refine((url) => url.startsWith("https://"), { message: "Image URL must use https" }).optional()
+});
 var SendBoostTemplateValidator = BoostValidator.partial().omit({ uri: true, claimPermissions: true }).extend({
   credential: VCValidator.or(UnsignedVCValidator),
   claimPermissions: BoostPermissionsValidator.partial().optional(),
@@ -10249,6 +10332,10 @@ var SendBoostInputValidator = object({
   templateUri: string().optional(),
   template: SendBoostTemplateValidator.optional(),
   signedCredential: VCValidator.optional(),
+  display: CredentialDisplayValidator.optional().describe(
+    "Public display metadata for managed and signed-only sends. Nothing is inferred from credential content; omitted names use generic copy. The exception is category: when display.category is omitted for an inline template, the template's category is copied, since consent-flow write authorization is keyed on it."
+  ),
+  statusPurposes: array(BitstringStatusPurposeValidator).optional(),
   options: SendOptionsValidator.optional().describe(
     "Options for email/phone recipients (Universal Inbox)"
   ),
@@ -10288,7 +10375,10 @@ var SendInboxResponseValidator = object({
     "Present when guardianEmail was specified"
   )
 });
+var StatusManagementValidator = _enum(["network", "external", "mixed", "none"]);
 var SendBoostResponseValidator = object({
+  /** Public status providers for a managed send; external entries require provider-side updates. */
+  statusManagement: StatusManagementValidator.optional(),
   type: literal("boost"),
   credentialUri: string(),
   uri: string(),
@@ -10301,19 +10391,33 @@ var SendBoostResponseValidator = object({
   )
 });
 object({
+  /** Opt in to signing the server-bound statusEntries; omission preserves client allocation. */
+  statusBinding: literal("server").optional(),
+  statusPurposes: array(BitstringStatusPurposeValidator).optional(),
   recipient: string(),
   templateUri: string().optional(),
   template: SendBoostTemplateValidator.optional(),
+  display: CredentialDisplayValidator.optional().describe("Public display metadata only"),
   contractUri: string().optional(),
   templateData: record(string(), unknown()).optional(),
   integrationId: string().optional(),
   /** Credential ID to allocate for; generated server-side when omitted. */
   credentialId: string().min(1).optional(),
-  idempotencyKey: string().min(1).max(200).optional()
-}).refine((data) => Boolean(data.templateUri) !== Boolean(data.template), {
-  message: "Provide exactly one of templateUri or template."
+  idempotencyKey: string().min(1).max(200).optional(),
+  /**
+   * `'holder'` requests student-only encryption (LC-2345): the SDK signs and
+   * encrypts locally and the server never receives plaintext. Requires a
+   * profile or DID recipient; rejected for signedCredential-only sends and for
+   * inbox (email/phone) recipients. Defaults to `'network'`.
+   */
+  encryption: _enum(["network", "holder"]).optional()
+}).refine((data) => !(data.templateUri && data.template), {
+  message: "Provide at most one of templateUri or template."
 });
 object({
+  /** Public status providers known at preparation; final send reports the signed entries. */
+  statusManagement: StatusManagementValidator.optional(),
+  statusEntries: array(BitstringStatusListEntryValidator).optional(),
   boostUri: string(),
   credentialId: string(),
   refreshId: string(),
@@ -10321,11 +10425,110 @@ object({
   /** The DID to use as credentialSubject.id (recipient DID, or the profile's did:web). */
   holderDid: string(),
   /** Present when this idempotencyKey already completed: return it without signing. */
-  completed: SendBoostResponseValidator.optional()
+  completed: SendBoostResponseValidator.optional(),
+  /**
+   * Present only when `encryption: 'holder'` was requested: the exact
+   * key-agreement verification-method ids (holder + current managers) the SDK
+   * must encrypt to. Recomputed on every call, so a later manager change can
+   * make a previously-prepared set stale (see `credentialRefresh.sendHolderEncryptedRefreshable`
+   * and `credentialRefresh.getEncryptionRecipients`).
+   */
+  recipientKeyIds: array(string()).optional()
 });
 discriminatedUnion("type", [SendBoostInputValidator]);
 discriminatedUnion("type", [SendBoostResponseValidator]);
-var ConsentFlowTermsStatusValidator = _enum(["live", "stale", "withdrawn"]);
+var ConsentFlowTermsStatusValidator = _enum([
+  "live",
+  "consumed",
+  "withdrawn",
+  "needs_reconsent",
+  "suspended"
+]);
+var ConsentFlowContractChangeKindValidator = _enum([
+  "relaxed",
+  "expanded_optional",
+  "requires_consent"
+]);
+var ConsentFlowContractScopeValidator = object({
+  area: _enum(["read", "write"]),
+  type: _enum(["credential", "personal"]),
+  key: string(),
+  required: boolean(),
+  reason: string().optional()
+});
+var ConsentFlowContractDetailValueValidator = union([
+  string(),
+  boolean(),
+  string().array()
+]);
+var ConsentFlowContractDetailChangeValidator = object({
+  field: _enum([
+    "name",
+    "subtitle",
+    "description",
+    "reasonForAccessing",
+    "image",
+    "needsGuardianConsent",
+    "redirectUrl",
+    "frontDoorBoostUri",
+    "expiresAt",
+    "writers",
+    "autoboosts"
+  ]),
+  before: ConsentFlowContractDetailValueValidator.optional(),
+  after: ConsentFlowContractDetailValueValidator.optional()
+});
+var ConsentFlowContractDiffValidator = object({
+  added: ConsentFlowContractScopeValidator.array(),
+  removed: ConsentFlowContractScopeValidator.array(),
+  changed: ConsentFlowContractScopeValidator.array(),
+  details: ConsentFlowContractDetailChangeValidator.array().optional()
+});
+var ConsentFlowContractUpdatePreviewValidator = object({
+  headline: string(),
+  subhead: string(),
+  rows: array(
+    object({
+      scope: ConsentFlowContractScopeValidator,
+      change: _enum(["added", "removed", "changed"]),
+      label: string(),
+      subtitle: string()
+    })
+  ),
+  primaryLabel: string()
+});
+var ConsentFlowContractStatusValidator = _enum(["active", "retired"]);
+object({
+  version: number().int().positive(),
+  createdAt: string(),
+  reason: string().optional(),
+  kind: ConsentFlowContractChangeKindValidator.optional()
+});
+object({
+  version: number().int().positive(),
+  kind: ConsentFlowContractChangeKindValidator,
+  affectedUsers: number().int().nonnegative(),
+  preview: ConsentFlowContractUpdatePreviewValidator
+});
+object({
+  status: ConsentFlowTermsStatusValidator.or(literal("not_consented")),
+  consentedVersion: number().int().positive().optional(),
+  currentVersion: number().int().positive(),
+  needsReconsent: boolean(),
+  reviewUrl: string().optional()
+});
+object({
+  contractUri: string(),
+  contractName: string().optional(),
+  fromVersion: number().int().positive(),
+  toVersion: number().int().positive(),
+  kind: ConsentFlowContractChangeKindValidator,
+  reason: string().optional(),
+  diff: ConsentFlowContractDiffValidator,
+  reconsentDeadline: string().optional(),
+  reviewUrl: string(),
+  preview: ConsentFlowContractUpdatePreviewValidator.optional()
+});
 var ConsentFlowContractValidator = object({
   read: object({
     anonymize: boolean().optional(),
@@ -10334,13 +10537,18 @@ var ConsentFlowContractValidator = object({
         string(),
         object({
           required: boolean(),
-          defaultEnabled: boolean().optional()
+          defaultEnabled: boolean().optional(),
+          reason: string().optional()
         })
       ).default({})
     }).prefault({ categories: {} }),
     personal: record(
       string(),
-      object({ required: boolean(), defaultEnabled: boolean().optional() })
+      object({
+        required: boolean(),
+        defaultEnabled: boolean().optional(),
+        reason: string().optional()
+      })
     ).default({})
   }).prefault({ credentials: { categories: {} }, personal: {} }),
   write: object({
@@ -10349,16 +10557,55 @@ var ConsentFlowContractValidator = object({
         string(),
         object({
           required: boolean(),
-          defaultEnabled: boolean().optional()
+          defaultEnabled: boolean().optional(),
+          reason: string().optional()
         })
       ).default({})
     }).prefault({ categories: {} }),
     personal: record(
       string(),
-      object({ required: boolean(), defaultEnabled: boolean().optional() })
+      object({
+        required: boolean(),
+        defaultEnabled: boolean().optional(),
+        reason: string().optional()
+      })
     ).default({})
   }).prefault({ credentials: { categories: {} }, personal: {} })
 });
+var ConsentFlowContractScopePatchValidator = object({
+  required: boolean(),
+  defaultEnabled: boolean().optional(),
+  reason: string().optional()
+}).nullable();
+object({
+  contract: object({
+    read: object({
+      anonymize: boolean().optional(),
+      credentials: object({
+        categories: record(string(), ConsentFlowContractScopePatchValidator).optional()
+      }).optional(),
+      personal: record(string(), ConsentFlowContractScopePatchValidator).optional()
+    }).optional(),
+    write: object({
+      credentials: object({
+        categories: record(string(), ConsentFlowContractScopePatchValidator).optional()
+      }).optional(),
+      personal: record(string(), ConsentFlowContractScopePatchValidator).optional()
+    }).optional()
+  }).optional(),
+  name: string().optional(),
+  subtitle: string().optional(),
+  description: string().optional(),
+  reasonForAccessing: string().optional(),
+  image: string().optional(),
+  needsGuardianConsent: boolean().optional(),
+  redirectUrl: string().optional(),
+  frontDoorBoostUri: string().optional(),
+  expiresAt: string().nullable().optional(),
+  autoboosts: AutoBoostConfigValidator.array().optional(),
+  writers: string().array().optional(),
+  recipients: string().array().optional()
+});
 var ConsentFlowContractDetailsValidator = object({
   contract: ConsentFlowContractValidator,
   owner: LCNProfileValidator,
@@ -10377,7 +10624,19 @@ var ConsentFlowContractDetailsValidator = object({
   autoBoosts: string().array().optional(),
   writers: array(LCNProfileValidator).optional(),
   recipients: array(LCNPublicProfileValidator.extend({ did: string() })).optional(),
-  audienceVersion: number().int().nonnegative().optional()
+  audienceVersion: number().int().nonnegative().optional(),
+  version: number().int().positive(),
+  status: ConsentFlowContractStatusValidator.optional(),
+  latestUpdate: object({
+    fromVersion: number().int().positive(),
+    toVersion: number().int().positive(),
+    kind: ConsentFlowContractChangeKindValidator,
+    reason: string().optional(),
+    diff: ConsentFlowContractDiffValidator,
+    reconsentDeadline: string().optional(),
+    createdAt: string(),
+    preview: ConsentFlowContractUpdatePreviewValidator
+  }).optional()
 });
 var ConsentFlowContractRequestStatusValidator = _enum(["pending", "accepted", "denied", "cancelled"]).nullable();
 var ConsentFlowContractRequestReadStatusValidator = _enum(["unseen", "seen"]).nullable();
@@ -10466,7 +10725,12 @@ PaginationResponseValidator.extend({
     contract: ConsentFlowContractDetailsValidator,
     uri: string(),
     consenter: LCNProfileValidator,
-    status: ConsentFlowTermsStatusValidator
+    status: ConsentFlowTermsStatusValidator,
+    consentedVersion: number().int().positive(),
+    lastReviewedVersion: number().int().positive().optional(),
+    reconsentDeadline: string().optional(),
+    newOptionsUntil: string().optional(),
+    cumulativeUpdate: ConsentFlowContractDetailsValidator.shape.latestUpdate
   }).array()
 });
 var ConsentFlowGuardianApprovalValidator = object({
@@ -10542,7 +10806,8 @@ var ConsentFlowTransactionActionValidator = _enum([
   "update",
   "sync",
   "withdraw",
-  "write"
+  "write",
+  "reconsent"
 ]);
 object({
   terms: ConsentFlowTermsQueryValidator.optional(),
@@ -10561,8 +10826,12 @@ var ConsentFlowTransactionValidator = object({
   referral: ConsentFlowReferralValidator.optional(),
   id: string(),
   action: ConsentFlowTransactionActionValidator,
+  kind: ConsentFlowContractChangeKindValidator.optional(),
   date: string(),
-  uris: string().array().optional()
+  uris: string().array().optional(),
+  consentedVersion: number().int().positive().optional(),
+  reconsentDeadline: string().optional(),
+  newOptionsUntil: string().optional()
 });
 var HolderExportConsentRecordValidator = object({
   termsUri: string(),
@@ -10570,6 +10839,10 @@ var HolderExportConsentRecordValidator = object({
   contract: ConsentFlowContractDetailsValidator,
   terms: ConsentFlowTermsValidator,
   referral: ConsentFlowReferralValidator.optional(),
+  consentedVersion: number().int().positive(),
+  reconsentDeadline: string().optional(),
+  newOptionsUntil: string().optional(),
+  cumulativeUpdate: ConsentFlowContractDetailsValidator.shape.latestUpdate,
   transactions: ConsentFlowTransactionValidator.array()
 });
 object({
@@ -10630,10 +10903,12 @@ var LCNNotificationTypeEnumValidator = _enum([
   "GUARDIAN_APPROVED",
   "GUARDIAN_REJECTED",
   "APP_NOTIFICATION",
+  "ANNOUNCEMENT",
   "CREDENTIAL_REVOKED",
   "CREDENTIAL_SUSPENDED",
   "CREDENTIAL_UNSUSPENDED",
-  "CREDENTIAL_REFRESHED"
+  "CREDENTIAL_REFRESHED",
+  "CONSENT_FLOW_CONTRACT_UPDATED"
 ]);
 var LCNNotificationMessageValidator = object({
   title: string().optional(),
@@ -10662,12 +10937,26 @@ var LCNNotificationInboxValidator = object({
   timestamp: datetime().optional()
 });
 var LCNNotificationMetadataValidator = object({
-  connectionPrompt: LCNConnectionPromptMetadataValidator.optional()
+  connectionPrompt: LCNConnectionPromptMetadataValidator.optional(),
+  campaignId: string().regex(/^[a-z0-9-]{3,64}$/).optional(),
+  campaignCreatedAt: datetime().optional(),
+  campaignHasInApp: boolean().optional(),
+  campaignTestId: uuid().optional()
 }).catchall(unknown());
 var LCNNotificationDataValidator = object({
   vcUris: array(string()).optional(),
   vpUris: array(string()).optional(),
   transaction: ConsentFlowTransactionValidator.optional(),
+  contractUri: string().optional(),
+  contractName: string().optional(),
+  fromVersion: number().int().positive().optional(),
+  toVersion: number().int().positive().optional(),
+  kind: ConsentFlowContractChangeKindValidator.optional(),
+  reason: string().optional(),
+  diff: ConsentFlowContractDiffValidator.optional(),
+  reconsentDeadline: string().optional(),
+  reviewUrl: string().optional(),
+  preview: ConsentFlowContractUpdatePreviewValidator.optional(),
   inbox: LCNNotificationInboxValidator.optional(),
   metadata: LCNNotificationMetadataValidator.optional()
 }).loose();
@@ -11766,28 +12055,6 @@ object({
    */
   wrongAttempts: number().int().nonnegative().optional()
 });
-var BITSTRING_STATUS_PURPOSES = ["revocation", "suspension"];
-var BitstringStatusPurposeValidator = _enum(BITSTRING_STATUS_PURPOSES);
-var BitstringStatusListEntryValidator = object({
-  id: string().optional(),
-  type: literal("BitstringStatusListEntry"),
-  statusPurpose: BitstringStatusPurposeValidator,
-  statusListIndex: string().or(number().int().nonnegative()),
-  statusListCredential: string()
-});
-BitstringStatusListEntryValidator.extend({
-  id: string()
-});
-object({
-  id: string().optional(),
-  type: literal("BitstringStatusList"),
-  statusPurpose: BitstringStatusPurposeValidator,
-  encodedList: string()
-});
-object({
-  statusPurposes: array(BitstringStatusPurposeValidator).optional(),
-  listSize: number().int().positive().optional()
-}).default({});
 var isSafeInAppMessagePath = /* @__PURE__ */ __name((path) => {
   let decoded = path;
   for (let depth = 0; depth < 5; depth += 1) {
@@ -12068,24 +12335,46 @@ object({
 }).passthrough();
 var CampaignIdValidator = string().regex(/^[a-z0-9-]{3,64}$/);
 var CampaignStatusValidator = _enum(["draft", "live", "paused", "archived"]);
-var CampaignChannelValidator = _enum(["inApp", "notify"]);
+var CampaignChannelValidator = _enum(["inApp", "notify", "email"]);
 _enum(["shown", "clicked", "dismissed", "converted"]);
-var timestamp = datetime({ offset: true }).overwrite((value) => new Date(value).toISOString());
+var timestamp = datetime({ offset: true }).overwrite((value) => {
+  const date = new Date(value);
+  return Number.isFinite(date.getTime()) ? date.toISOString() : value;
+});
 var notification = object({ title: string().min(1), body: string().min(1) }).strict();
-var channels = array(CampaignChannelValidator).min(1).max(2).refine((values) => new Set(values).size === values.length, "Channels must be unique");
+var CampaignEmailValidator = object({
+  subject: string().trim().min(1).max(200).regex(/^[^\r\n]+$/),
+  title: string().trim().min(1).max(200),
+  body: string().trim().min(1).max(2e4),
+  heroImageUrl: url().startsWith("https://").max(2048).optional(),
+  ctaLabel: string().trim().min(1).max(100)
+}).strict();
+object({
+  announcementEmailOptOut: boolean(),
+  announcementPushOptOut: boolean()
+}).strict();
+var channels = array(CampaignChannelValidator).min(1).max(3).refine((values) => new Set(values).size === values.length, "Channels must be unique");
 var campaignDefinition = object({
   id: CampaignIdValidator,
   name: string().trim().min(1).max(200),
   status: CampaignStatusValidator.default("draft"),
   channels,
-  message: inAppMessageValidator,
+  message: inAppMessageValidator.optional(),
   notification: notification.optional(),
+  email: CampaignEmailValidator.optional(),
   startsAt: timestamp.optional(),
   endsAt: timestamp.optional(),
   excludeMinors: boolean().default(true),
   selfEnroll: boolean().default(false)
 }).strict();
 var validDefinition = /* @__PURE__ */ __name((value, ctx) => {
+  if (value.channels.includes("inApp") && !value.message) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["message"],
+      message: "In-app requires a message"
+    });
+  }
   if (value.channels.includes("notify") && !value.notification) {
     ctx.addIssue({
       code: "custom",
@@ -12093,15 +12382,23 @@ var validDefinition = /* @__PURE__ */ __name((value, ctx) => {
       message: "Notify requires a title and body"
     });
   }
+  if (value.channels.includes("email") && !value.email) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["email"],
+      message: "Email requires announcement content"
+    });
+  }
   if (value.startsAt && value.endsAt && value.startsAt >= value.endsAt) {
     ctx.addIssue({ code: "custom", path: ["endsAt"], message: "End must be after start" });
   }
 }, "validDefinition");
 var CampaignValidator = campaignDefinition.extend({
+  tenantId: string().optional(),
   createdAt: timestamp,
   updatedAt: timestamp
 }).superRefine(validDefinition).superRefine((value, ctx) => {
-  if (value.message.id !== value.id) {
+  if (value.message && value.message.id !== value.id) {
     ctx.addIssue({
       code: "custom",
       path: ["message", "id"],
@@ -12110,21 +12407,23 @@ var CampaignValidator = campaignDefinition.extend({
   }
 });
 campaignDefinition.extend({
-  message: inAppMessageAuthoringValidator
+  message: inAppMessageAuthoringValidator.optional()
 }).superRefine(validDefinition);
 var CampaignUpdatesValidator = campaignDefinition.omit({ id: true }).partial().extend({
   // A PATCH must not apply creation defaults to fields the caller omitted.
   status: CampaignStatusValidator.optional(),
   excludeMinors: boolean().optional(),
   selfEnroll: boolean().optional(),
-  message: inAppMessageAuthoringValidator.optional(),
+  message: inAppMessageAuthoringValidator.nullable().optional(),
   notification: notification.nullable().optional(),
+  email: CampaignEmailValidator.nullable().optional(),
   startsAt: timestamp.nullable().optional(),
   endsAt: timestamp.nullable().optional()
 }).strict();
 object({
   campaignId: CampaignIdValidator,
-  updates: CampaignUpdatesValidator
+  updates: CampaignUpdatesValidator,
+  expectedUpdatedAt: timestamp.optional()
 }).strict();
 var identifier = string().trim().min(1).max(2048);
 var metadataKey = string().regex(/^[a-zA-Z_][a-zA-Z0-9_.-]{0,63}$/).refine(
@@ -12176,7 +12475,8 @@ var CampaignUserStateValidator = object({
   clickedAt: timestamp.optional(),
   dismissedAt: timestamp.optional(),
   convertedAt: timestamp.optional(),
-  notifiedAt: timestamp.optional()
+  notifiedAt: timestamp.optional(),
+  emailedAt: timestamp.optional()
 });
 object({
   campaign: campaignDefinition.pick({
@@ -12185,12 +12485,19 @@ object({
     startsAt: true,
     endsAt: true,
     selfEnroll: true
-  }),
-  state: CampaignUserStateValidator
+  }).extend({ message: inAppMessageValidator }),
+  state: CampaignUserStateValidator,
+  testId: uuid().optional()
+});
+object({
+  id: uuid(),
+  campaignId: CampaignIdValidator,
+  message: inAppMessageValidator
 });
 object({
   audience: number().int().nonnegative(),
   notified: number().int().nonnegative(),
+  emailed: number().int().nonnegative(),
   shown: number().int().nonnegative(),
   clicked: number().int().nonnegative(),
   dismissed: number().int().nonnegative(),
@@ -12217,6 +12524,31 @@ object({
   hasMore: boolean(),
   cursor: string().optional()
 });
+var CampaignDispatchPreviewValidator = object({
+  campaignId: CampaignIdValidator,
+  audienceCount: number().int().nonnegative(),
+  alreadyNotifiedCount: number().int().nonnegative(),
+  recipientCount: number().int().nonnegative(),
+  notificationRecipientCount: number().int().nonnegative().optional(),
+  emailRecipientCount: number().int().nonnegative().optional(),
+  previewToken: string().regex(/^[a-f0-9]{64}$/),
+  blockedReason: _enum([
+    "not_live",
+    "notify_disabled",
+    "email_confirmation_required",
+    "not_started",
+    "ended",
+    "no_recipients"
+  ]).optional()
+});
+object({
+  expectedPreviewToken: CampaignDispatchPreviewValidator.shape.previewToken.optional()
+}).strict();
+object({
+  count: number().int().nonnegative(),
+  added: number().int().nonnegative(),
+  notFound: array(string())
+});
 var SHARE_LINK_ID_BYTES = 16;
 var SHARE_CONTENT_KEY_BYTES = 32;
 var SHARE_IV_BYTES = 12;
@@ -12743,6 +13075,217 @@ var SkillIconNamesValidator = array(string().nonempty()).min(1).max(SKILL_ICON_M
   }
 );
 object({ names: SkillIconNamesValidator });
+var RoleValidator = _enum(["user", "assistant", "tool", "system"]);
+var AiSessionMode = {
+  tutor: "ai-tutor",
+  insights: "ai-insights"
+};
+var AiSessionModeValidator = _enum([AiSessionMode.tutor, AiSessionMode.insights]);
+object({
+  notes: string().optional(),
+  questions: array(string())
+});
+var IntroStreamModeValidator = _enum(["formatted", "structured"]);
+var ChatMessageValidator = object({
+  role: RoleValidator,
+  content: string().nullable(),
+  tool_call_id: string().optional(),
+  tool_calls: array(
+    object({
+      id: string(),
+      type: literal("function"),
+      function: object({
+        name: string(),
+        arguments: string()
+      })
+    })
+  ).optional()
+});
+var InsightArtifactValidator = object({
+  title: string(),
+  summary: string(),
+  category: string(),
+  question: string(),
+  narrative: string()
+});
+var ArtifactSuggestionValidator = object({
+  artifact: InsightArtifactValidator,
+  source_text: string().optional(),
+  created_at: string()
+});
+var ThreadCredentialContextValidator = object({
+  uri: string(),
+  type: string(),
+  context: string(),
+  score: number(),
+  strongestScore: number().optional(),
+  averageScore: number().optional(),
+  matchCount: number().optional(),
+  title: string().optional()
+});
+object({
+  id: string(),
+  did: string(),
+  topicCredentialUri: string().nullable().optional(),
+  title: string(),
+  created_at: string(),
+  last_message_at: string(),
+  active: boolean().optional(),
+  ended_at: string().optional(),
+  plan_started_at: string().optional(),
+  summaries: array(
+    object({
+      summary_data: string(),
+      credential_uri: string(),
+      created_at: string()
+    })
+  ).optional(),
+  plans: array(
+    object({
+      plan_data: string(),
+      created_at: string(),
+      consentRevision: string().optional()
+    })
+  ).optional(),
+  credentials: array(ThreadCredentialContextValidator).optional(),
+  credentialSearchTopic: string().optional(),
+  credentialContextStatus: _enum(["pending", "ready", "empty", "error"]).optional(),
+  mode: AiSessionModeValidator.optional(),
+  artifactSuggestions: array(ArtifactSuggestionValidator).optional()
+});
+var CredentialVerificationMetadataValidator = object({
+  credentialUri: string(),
+  contentHash: string().regex(/^[a-f0-9]{64}$/),
+  status: _enum(["valid", "invalid"]),
+  checkedAt: string().datetime(),
+  verifier: object({
+    name: string(),
+    version: string()
+  }),
+  verifiedPayload: _enum(["credential", "boostCredential"]),
+  checks: array(string()),
+  errors: array(string()),
+  warnings: array(string()),
+  provenance: object({
+    source: _enum(["wallet", "generated"]),
+    retrievedAt: string().datetime()
+  }),
+  consent: object({
+    contractUri: string(),
+    receiptId: string().min(1),
+    grantedAt: string().datetime().optional(),
+    updatedAt: string().datetime(),
+    contractUpdatedAt: string().min(1),
+    status: literal("live"),
+    expiresAt: string().datetime().optional(),
+    contractExpiresAt: string().datetime().optional(),
+    categories: array(string()),
+    credentialUris: array(string()),
+    personalFields: array(string()),
+    purpose: _enum(["credential-ingestion", "model-inference", "embedding"]),
+    revision: string().min(1),
+    guardian: object({ required: boolean(), approved: boolean() })
+  })
+});
+var ModelSafeCredentialFactValidator = object({
+  kind: _enum([
+    "skill",
+    "goal",
+    "achievement",
+    "course",
+    "experience",
+    "competency",
+    "title",
+    "summary",
+    "assessment",
+    "grade",
+    "date",
+    "alignment",
+    "criteria",
+    "pathway",
+    "topic"
+  ]),
+  value: string().min(1).max(240),
+  label: string().min(1).max(120).optional()
+});
+var ModelSafeCredentialProjectionValidator = object({
+  schemaVersion: literal("1"),
+  category: string().min(1).max(120),
+  credentialTypes: array(string().min(1).max(120)).max(20),
+  facts: array(ModelSafeCredentialFactValidator).max(100),
+  // Present only on credentials that are past their expiry, so the model can
+  // tell a lapsed credential from a current one.
+  expired: literal(true).optional(),
+  expirationDate: string().datetime().optional()
+});
+object({
+  id: string(),
+  uri: string(),
+  category: string(),
+  credential: VCValidator,
+  aiContext: string(),
+  generalSummary: string().optional(),
+  createdAt: string(),
+  verification: CredentialVerificationMetadataValidator.optional(),
+  projection: ModelSafeCredentialProjectionValidator.optional()
+});
+object({
+  message: ChatMessageValidator.optional(),
+  threadId: string().optional(),
+  selectedQuestion: string().optional(),
+  action: _enum([
+    "start_topic",
+    "continue_plan",
+    "start_topic_uri",
+    "start_learning_pathway",
+    "start_insights_session",
+    "close_insights_session",
+    "artifact_suggestion"
+  ]).optional(),
+  topic: string().optional(),
+  topicUri: string().optional(),
+  pathwayUri: string().optional(),
+  mode: AiSessionModeValidator.optional(),
+  introStreamMode: IntroStreamModeValidator.optional(),
+  // BCP-47 language for AI responses (LC-1901). This has to live on the
+  // validator, not just the inferred type — z.object strips unknown keys, so an
+  // undeclared `locale` would be dropped before the WS handler ever saw it.
+  locale: string().nullish()
+});
+object({
+  operation: string(),
+  collection: string(),
+  input: unknown().optional(),
+  output: unknown().optional(),
+  timestamp: string(),
+  duration: number().optional()
+});
+object({
+  event: literal("timing"),
+  operation: string(),
+  phase: _enum(["start", "end", "complete"]),
+  duration: number().optional(),
+  metadata: record(string(), unknown()).optional(),
+  timestamp: string()
+});
+object({
+  id: string(),
+  learningPathway: object({
+    stepIndex: number(),
+    step: object({
+      title: string(),
+      description: string(),
+      summary: string(),
+      learned: array(string()),
+      skills: array(
+        object({
+          title: string(),
+          description: string()
+        })
+      )
+    })
+  })
+});
 
 exports.VerificationStatusEnum = VerificationStatusEnum;
-//# sourceMappingURL=types.esm-95ade0c0.js.map
+//# sourceMappingURL=types.esm-56901371.js.map