@learncard/render-method-plugin 6.0.0 → 8.0.0

package/dist/render-method-plugin.esm.js

@@ -15949,6 +15949,7 @@ var require_types_cjs_development = __commonJS({
     var __toCommonJS = /* @__PURE__ */ __name2((mod) => __copyProps2(__defProp22({}, "__esModule", { value: true }), mod), "__toCommonJS");
     var index_exports = {};
     __export22(index_exports, {
+      ACT_AS_HEADER: /* @__PURE__ */ __name2(() => ACT_AS_HEADER, "ACT_AS_HEADER"),
       AUTH_GRANT_AUDIENCE_DOMAIN_PREFIX: /* @__PURE__ */ __name2(() => AUTH_GRANT_AUDIENCE_DOMAIN_PREFIX2, "AUTH_GRANT_AUDIENCE_DOMAIN_PREFIX"),
       AchievementCredentialValidator: /* @__PURE__ */ __name2(() => AchievementCredentialValidator2, "AchievementCredentialValidator"),
       AchievementCriteriaValidator: /* @__PURE__ */ __name2(() => AchievementCriteriaValidator2, "AchievementCriteriaValidator"),
@@ -16011,6 +16012,7 @@ var require_types_cjs_development = __commonJS({
       ConsentFlowContractValidator: /* @__PURE__ */ __name2(() => ConsentFlowContractValidator2, "ConsentFlowContractValidator"),
       ConsentFlowDataForDidQueryValidator: /* @__PURE__ */ __name2(() => ConsentFlowDataForDidQueryValidator2, "ConsentFlowDataForDidQueryValidator"),
       ConsentFlowDataQueryValidator: /* @__PURE__ */ __name2(() => ConsentFlowDataQueryValidator2, "ConsentFlowDataQueryValidator"),
+      ConsentFlowGuardianApprovalValidator: /* @__PURE__ */ __name2(() => ConsentFlowGuardianApprovalValidator2, "ConsentFlowGuardianApprovalValidator"),
       ConsentFlowTermValidator: /* @__PURE__ */ __name2(() => ConsentFlowTermValidator2, "ConsentFlowTermValidator"),
       ConsentFlowTermsQueryValidator: /* @__PURE__ */ __name2(() => ConsentFlowTermsQueryValidator2, "ConsentFlowTermsQueryValidator"),
       ConsentFlowTermsStatusValidator: /* @__PURE__ */ __name2(() => ConsentFlowTermsStatusValidator2, "ConsentFlowTermsStatusValidator"),
@@ -16087,10 +16089,18 @@ var require_types_cjs_development = __commonJS({
       IdentifierTypeValidator: /* @__PURE__ */ __name2(() => IdentifierTypeValidator2, "IdentifierTypeValidator"),
       IdentityObjectValidator: /* @__PURE__ */ __name2(() => IdentityObjectValidator2, "IdentityObjectValidator"),
       ImageValidator: /* @__PURE__ */ __name2(() => ImageValidator2, "ImageValidator"),
+      InboxBatchErrorReasonValidator: /* @__PURE__ */ __name2(() => InboxBatchErrorReasonValidator2, "InboxBatchErrorReasonValidator"),
+      InboxBatchReceiptValidator: /* @__PURE__ */ __name2(() => InboxBatchReceiptValidator2, "InboxBatchReceiptValidator"),
+      InboxBatchStatusValidator: /* @__PURE__ */ __name2(() => InboxBatchStatusValidator2, "InboxBatchStatusValidator"),
       InboxCredentialQueryValidator: /* @__PURE__ */ __name2(() => InboxCredentialQueryValidator2, "InboxCredentialQueryValidator"),
+      InboxCredentialRefreshReceiptValidator: /* @__PURE__ */ __name2(() => InboxCredentialRefreshReceiptValidator2, "InboxCredentialRefreshReceiptValidator"),
       InboxCredentialValidator: /* @__PURE__ */ __name2(() => InboxCredentialValidator2, "InboxCredentialValidator"),
       IncrementCounterEventValidator: /* @__PURE__ */ __name2(() => IncrementCounterEventValidator2, "IncrementCounterEventValidator"),
       InstalledAppValidator: /* @__PURE__ */ __name2(() => InstalledAppValidator2, "InstalledAppValidator"),
+      IssueInboxCredentialBatchItemResultValidator: /* @__PURE__ */ __name2(() => IssueInboxCredentialBatchItemResultValidator2, "IssueInboxCredentialBatchItemResultValidator"),
+      IssueInboxCredentialBatchItemValidator: /* @__PURE__ */ __name2(() => IssueInboxCredentialBatchItemValidator2, "IssueInboxCredentialBatchItemValidator"),
+      IssueInboxCredentialBatchResponseValidator: /* @__PURE__ */ __name2(() => IssueInboxCredentialBatchResponseValidator2, "IssueInboxCredentialBatchResponseValidator"),
+      IssueInboxCredentialBatchValidator: /* @__PURE__ */ __name2(() => IssueInboxCredentialBatchValidator2, "IssueInboxCredentialBatchValidator"),
       IssueInboxCredentialResponseValidator: /* @__PURE__ */ __name2(() => IssueInboxCredentialResponseValidator2, "IssueInboxCredentialResponseValidator"),
       IssueInboxCredentialValidator: /* @__PURE__ */ __name2(() => IssueInboxCredentialValidator2, "IssueInboxCredentialValidator"),
       IssueInboxSigningAuthorityValidator: /* @__PURE__ */ __name2(() => IssueInboxSigningAuthorityValidator2, "IssueInboxSigningAuthorityValidator"),
@@ -16139,6 +16149,7 @@ var require_types_cjs_development = __commonJS({
       LaunchTypeValidator: /* @__PURE__ */ __name2(() => LaunchTypeValidator2, "LaunchTypeValidator"),
       LearnCardRefreshAuthorizationValidator: /* @__PURE__ */ __name2(() => LearnCardRefreshAuthorizationValidator2, "LearnCardRefreshAuthorizationValidator"),
       LinkProviderFrameworkInputValidator: /* @__PURE__ */ __name2(() => LinkProviderFrameworkInputValidator2, "LinkProviderFrameworkInputValidator"),
+      ManagedCredentialRefreshReceiptValidator: /* @__PURE__ */ __name2(() => ManagedCredentialRefreshReceiptValidator2, "ManagedCredentialRefreshReceiptValidator"),
       ManagedCredentialRefreshServiceValidator: /* @__PURE__ */ __name2(() => ManagedCredentialRefreshServiceValidator2, "ManagedCredentialRefreshServiceValidator"),
       PaginatedAppStoreListingsValidator: /* @__PURE__ */ __name2(() => PaginatedAppStoreListingsValidator2, "PaginatedAppStoreListingsValidator"),
       PaginatedBoostRecipientsValidator: /* @__PURE__ */ __name2(() => PaginatedBoostRecipientsValidator2, "PaginatedBoostRecipientsValidator"),
@@ -16165,6 +16176,8 @@ var require_types_cjs_development = __commonJS({
       PaginatedVisibleLCNProfilesValidator: /* @__PURE__ */ __name2(() => PaginatedVisibleLCNProfilesValidator2, "PaginatedVisibleLCNProfilesValidator"),
       PaginationOptionsValidator: /* @__PURE__ */ __name2(() => PaginationOptionsValidator2, "PaginationOptionsValidator"),
       PaginationResponseValidator: /* @__PURE__ */ __name2(() => PaginationResponseValidator2, "PaginationResponseValidator"),
+      PrepareRefreshableSendInputValidator: /* @__PURE__ */ __name2(() => PrepareRefreshableSendInputValidator2, "PrepareRefreshableSendInputValidator"),
+      PrepareRefreshableSendResultValidator: /* @__PURE__ */ __name2(() => PrepareRefreshableSendResultValidator2, "PrepareRefreshableSendResultValidator"),
       ProfileValidator: /* @__PURE__ */ __name2(() => ProfileValidator2, "ProfileValidator"),
       ProfileVisibilityEnum: /* @__PURE__ */ __name2(() => ProfileVisibilityEnum2, "ProfileVisibilityEnum"),
       PromotionLevelValidator: /* @__PURE__ */ __name2(() => PromotionLevelValidator2, "PromotionLevelValidator"),
@@ -16190,6 +16203,7 @@ var require_types_cjs_development = __commonJS({
       SendAiSessionCredentialEventValidator: /* @__PURE__ */ __name2(() => SendAiSessionCredentialEventValidator2, "SendAiSessionCredentialEventValidator"),
       SendBoostInputValidator: /* @__PURE__ */ __name2(() => SendBoostInputValidator2, "SendBoostInputValidator"),
       SendBoostResponseValidator: /* @__PURE__ */ __name2(() => SendBoostResponseValidator2, "SendBoostResponseValidator"),
+      SendBoostTemplateValidator: /* @__PURE__ */ __name2(() => SendBoostTemplateValidator2, "SendBoostTemplateValidator"),
       SendBrandingOptionsValidator: /* @__PURE__ */ __name2(() => SendBrandingOptionsValidator2, "SendBrandingOptionsValidator"),
       SendCredentialEventValidator: /* @__PURE__ */ __name2(() => SendCredentialEventValidator2, "SendCredentialEventValidator"),
       SendInboxResponseValidator: /* @__PURE__ */ __name2(() => SendInboxResponseValidator2, "SendInboxResponseValidator"),
@@ -16909,7 +16923,7 @@ var require_types_cjs_development = __commonJS({
       getSizableOrigin: /* @__PURE__ */ __name2(() => getSizableOrigin2, "getSizableOrigin"),
       hexToUint8Array: /* @__PURE__ */ __name2(() => hexToUint8Array2, "hexToUint8Array"),
       isObject: /* @__PURE__ */ __name2(() => isObject2, "isObject"),
-      isPlainObject: /* @__PURE__ */ __name2(() => isPlainObject3, "isPlainObject"),
+      isPlainObject: /* @__PURE__ */ __name2(() => isPlainObject22, "isPlainObject"),
       issue: /* @__PURE__ */ __name2(() => issue2, "issue"),
       joinValues: /* @__PURE__ */ __name2(() => joinValues2, "joinValues"),
       jsonStringifyReplacer: /* @__PURE__ */ __name2(() => jsonStringifyReplacer2, "jsonStringifyReplacer"),
@@ -17158,7 +17172,7 @@ var require_types_cjs_development = __commonJS({
         return false;
       }
     });
-    function isPlainObject3(o) {
+    function isPlainObject22(o) {
       if (isObject2(o) === false)
         return false;
       const ctor = o.constructor;
@@ -17174,11 +17188,11 @@ var require_types_cjs_development = __commonJS({
       }
       return true;
     }
-    __name(isPlainObject3, "isPlainObject");
-    __name2(isPlainObject3, "isPlainObject");
-    __name22(isPlainObject3, "isPlainObject");
+    __name(isPlainObject22, "isPlainObject2");
+    __name2(isPlainObject22, "isPlainObject");
+    __name22(isPlainObject22, "isPlainObject");
     function shallowClone2(o) {
-      if (isPlainObject3(o))
+      if (isPlainObject22(o))
         return { ...o };
       if (Array.isArray(o))
         return [...o];
@@ -17412,7 +17426,7 @@ var require_types_cjs_development = __commonJS({
     __name2(omit2, "omit");
     __name22(omit2, "omit");
     function extend2(schema, shape) {
-      if (!isPlainObject3(shape)) {
+      if (!isPlainObject22(shape)) {
         throw new Error("Invalid input to extend: expected a plain object");
       }
       const checks = schema._zod.def.checks;
@@ -17438,7 +17452,7 @@ var require_types_cjs_development = __commonJS({
     __name2(extend2, "extend");
     __name22(extend2, "extend");
     function safeExtend2(schema, shape) {
-      if (!isPlainObject3(shape)) {
+      if (!isPlainObject22(shape)) {
         throw new Error("Invalid input to safeExtend: expected a plain object");
       }
       const def = mergeDefs2(schema._zod.def, {
@@ -19894,7 +19908,7 @@ var require_types_cjs_development = __commonJS({
       if (a instanceof Date && b instanceof Date && +a === +b) {
         return { valid: true, data: a };
       }
-      if (isPlainObject3(a) && isPlainObject3(b)) {
+      if (isPlainObject22(a) && isPlainObject22(b)) {
         const bKeys = Object.keys(b);
         const sharedKeys = Object.keys(a).filter((key) => bKeys.indexOf(key) !== -1);
         const newObj = { ...a, ...b };
@@ -20095,7 +20109,7 @@ var require_types_cjs_development = __commonJS({
       $ZodType2.init(inst, def);
       inst._zod.parse = (payload, ctx) => {
         const input = payload.value;
-        if (!isPlainObject3(input)) {
+        if (!isPlainObject22(input)) {
           payload.issues.push({
             expected: "record",
             code: "invalid_type",
@@ -32050,14 +32064,22 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
     }).catchall(external_exports2.any());
     var ProofValidator2 = external_exports2.object({
       type: external_exports2.string(),
-      created: external_exports2.string(),
+      created: external_exports2.string().optional(),
       challenge: external_exports2.string().optional(),
       domain: external_exports2.string().optional(),
       nonce: external_exports2.string().optional(),
       proofPurpose: external_exports2.string(),
       verificationMethod: external_exports2.string(),
       jws: external_exports2.string().optional()
-    }).catchall(external_exports2.any());
+    }).catchall(external_exports2.any()).superRefine((proof, ctx) => {
+      if (proof.created === void 0 && (proof.type !== "DataIntegrityProof" || proof.cryptosuite !== "ecdsa-rdfc-2019")) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["created"],
+          message: "created is required for this proof suite"
+        });
+      }
+    });
     var VCValidator2 = UnsignedVCValidator2.extend({
       proof: ProofValidator2.or(ProofValidator2.array())
     });
@@ -32499,6 +32521,204 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
         $or: BaseStringQuery2.array()
       })
     ]);
+    var LearnCardRefreshAuthorizationValidator2 = external_exports2.object({ type: external_exports2.literal("LearnCardDIDAuth") }).catchall(external_exports2.any());
+    var ManagedCredentialRefreshServiceValidator2 = external_exports2.object({
+      id: external_exports2.string().min(1),
+      type: external_exports2.literal("LearnCardCredentialRefresh2026"),
+      authorization: LearnCardRefreshAuthorizationValidator2.optional()
+    }).catchall(external_exports2.any());
+    var StandardCredentialRefreshServiceValidator2 = external_exports2.object({
+      id: external_exports2.string().min(1),
+      type: external_exports2.literal("1EdTechCredentialRefresh")
+    }).catchall(external_exports2.any());
+    var SupportedCredentialRefreshServiceValidator2 = external_exports2.union([
+      ManagedCredentialRefreshServiceValidator2,
+      StandardCredentialRefreshServiceValidator2
+    ]);
+    var AllocateCredentialRefreshInputValidator2 = external_exports2.object({
+      holder: external_exports2.object({
+        profileId: external_exports2.string().optional(),
+        did: external_exports2.string().min(1)
+      }),
+      credentialId: external_exports2.string().min(1)
+    });
+    var AllocateCredentialRefreshResultValidator2 = external_exports2.object({
+      refreshId: external_exports2.string().min(1),
+      refreshService: ManagedCredentialRefreshServiceValidator2.extend({
+        authorization: LearnCardRefreshAuthorizationValidator2
+      })
+    });
+    var ManagedCredentialRefreshReceiptValidator2 = external_exports2.object({
+      refreshId: external_exports2.string().min(1),
+      refreshService: ManagedCredentialRefreshServiceValidator2,
+      credentialId: external_exports2.string().min(1),
+      issuerDid: external_exports2.string().min(1),
+      holderDid: external_exports2.string().min(1),
+      credentialStatus: CredentialStatusValidator2.or(
+        CredentialStatusValidator2.array()
+      ).optional()
+    }).strip();
+    var InboxCredentialRefreshReceiptValidator2 = ManagedCredentialRefreshReceiptValidator2.omit(
+      { holderDid: true }
+    ).extend({ holderDid: external_exports2.string().min(1).optional() });
+    var CredentialRefreshSigningModeValidator2 = external_exports2.enum(["issuer-signed", "signing-authority"]);
+    var PublishCredentialRefreshBaseFields2 = {
+      refreshId: external_exports2.string().min(1),
+      notifyHolder: external_exports2.boolean().optional(),
+      updateSummary: external_exports2.string().optional(),
+      idempotencyKey: external_exports2.string().optional()
+    };
+    var PublishIssuerSignedRefreshValidator2 = external_exports2.object({
+      ...PublishCredentialRefreshBaseFields2,
+      mode: external_exports2.literal("issuer-signed"),
+      signedCredential: VCValidator2
+    });
+    var PublishSigningAuthorityRefreshValidator2 = external_exports2.object({
+      ...PublishCredentialRefreshBaseFields2,
+      mode: external_exports2.literal("signing-authority"),
+      credential: UnsignedVCValidator2,
+      signingAuthority: external_exports2.object({
+        type: external_exports2.string().min(1)
+      }).catchall(external_exports2.any())
+    });
+    var PublishCredentialRefreshInputValidator2 = external_exports2.object({
+      ...PublishCredentialRefreshBaseFields2,
+      mode: CredentialRefreshSigningModeValidator2,
+      signedCredential: VCValidator2.optional(),
+      credential: UnsignedVCValidator2.optional(),
+      signingAuthority: external_exports2.object({
+        type: external_exports2.string().min(1)
+      }).catchall(external_exports2.any()).optional()
+    }).superRefine((input, ctx) => {
+      if (input.mode === "issuer-signed" && !input.signedCredential) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["signedCredential"],
+          message: "signedCredential is required for issuer-signed publication"
+        });
+      }
+      if (input.mode === "issuer-signed" && (input.credential !== void 0 || input.signingAuthority !== void 0)) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["mode"],
+          message: "issuer-signed publication cannot include signing-authority fields"
+        });
+      }
+      if (input.mode === "signing-authority") {
+        if (input.signedCredential !== void 0) {
+          ctx.addIssue({
+            code: "custom",
+            path: ["signedCredential"],
+            message: "signing-authority publication cannot include signedCredential"
+          });
+        }
+        if (!input.credential) {
+          ctx.addIssue({
+            code: "custom",
+            path: ["credential"],
+            message: "credential is required for signing-authority publication"
+          });
+        }
+        if (!input.signingAuthority) {
+          ctx.addIssue({
+            code: "custom",
+            path: ["signingAuthority"],
+            message: "signingAuthority is required for signing-authority publication"
+          });
+        }
+      }
+    });
+    var PublishCredentialRefreshNotificationValidator2 = external_exports2.enum([
+      "queued",
+      "suppressed",
+      "not-applicable",
+      /** Publication succeeded, but the post-commit notification enqueue must be retried. */
+      "delivery-failed"
+    ]);
+    var PublishCredentialRefreshResultValidator2 = external_exports2.object({
+      refreshId: external_exports2.string().min(1),
+      version: external_exports2.number().int().positive(),
+      publishedAt: external_exports2.string().min(1),
+      notification: PublishCredentialRefreshNotificationValidator2
+    });
+    var CredentialRefreshVersionMetadataValidator2 = external_exports2.object({
+      version: external_exports2.number().int().positive(),
+      publishedAt: external_exports2.string().min(1),
+      effectiveAt: external_exports2.string().optional(),
+      etag: external_exports2.string().optional(),
+      signingMode: CredentialRefreshSigningModeValidator2.optional(),
+      updateSummary: external_exports2.string().optional()
+    });
+    var GetCredentialRefreshHistoryInputValidator2 = external_exports2.object({
+      refreshId: external_exports2.string().min(1),
+      cursor: external_exports2.string().optional(),
+      limit: external_exports2.number().int().positive().optional()
+    });
+    var GetCredentialRefreshHistoryResultValidator2 = external_exports2.object({
+      records: CredentialRefreshVersionMetadataValidator2.array(),
+      hasMore: external_exports2.boolean(),
+      cursor: external_exports2.string().optional()
+    });
+    var CredentialRefreshChallengeValidator2 = external_exports2.object({
+      challenge: external_exports2.string().min(1),
+      expiresAt: external_exports2.string().min(1),
+      domain: external_exports2.string().optional(),
+      scheme: external_exports2.literal("LearnCardDIDAuth").optional()
+    });
+    var PublicCredentialRefreshEnvelopeValidator2 = external_exports2.object({
+      format: external_exports2.literal("vc"),
+      credential: VCValidator2,
+      etag: external_exports2.string().optional()
+    });
+    var JweCredentialRefreshEnvelopeValidator2 = external_exports2.object({
+      format: external_exports2.literal("jwe"),
+      jwe: JWEValidator2,
+      etag: external_exports2.string().optional(),
+      /** Present on LearnCard-managed endpoints; optional for interoperable JWE services. */
+      version: external_exports2.number().int().positive().optional()
+    });
+    var CredentialRefreshResponseEnvelopeValidator2 = external_exports2.discriminatedUnion("format", [
+      PublicCredentialRefreshEnvelopeValidator2,
+      JweCredentialRefreshEnvelopeValidator2
+    ]);
+    var CredentialRefreshFailureCodeValidator2 = external_exports2.enum([
+      "UNAVAILABLE",
+      "TIMEOUT",
+      "UNSUPPORTED_SERVICE",
+      "UNAUTHORIZED",
+      "MALFORMED_RESPONSE",
+      "INVALID_PROOF",
+      "ISSUER_MISMATCH",
+      "ID_MISMATCH",
+      "ROLLBACK",
+      "REVOKED",
+      "UNSAFE_ENDPOINT"
+    ]);
+    var CredentialRefreshUpdatedResultValidator2 = external_exports2.object({
+      status: external_exports2.literal("updated"),
+      credential: VCValidator2,
+      etag: external_exports2.string().optional(),
+      managedVersion: external_exports2.number().int().positive().optional()
+    });
+    var CredentialRefreshUnchangedResultValidator2 = external_exports2.object({
+      status: external_exports2.literal("unchanged"),
+      checkedAt: external_exports2.string().min(1),
+      etag: external_exports2.string().optional()
+    });
+    var CredentialRefreshUnsupportedResultValidator2 = external_exports2.object({
+      status: external_exports2.literal("unsupported")
+    });
+    var CredentialRefreshFailedResultValidator2 = external_exports2.object({
+      status: external_exports2.literal("failed"),
+      code: CredentialRefreshFailureCodeValidator2,
+      retryable: external_exports2.boolean()
+    });
+    var CredentialRefreshResultValidator2 = external_exports2.discriminatedUnion("status", [
+      CredentialRefreshUpdatedResultValidator2,
+      CredentialRefreshUnchangedResultValidator2,
+      CredentialRefreshUnsupportedResultValidator2,
+      CredentialRefreshFailedResultValidator2
+    ]);
     var LCNProfileDisplayValidator2 = external_exports2.object({
       backgroundColor: external_exports2.string().optional(),
       backgroundImage: external_exports2.string().optional(),
@@ -32834,7 +33054,13 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
         "Options for email/phone recipients (Universal Inbox)"
       ),
       templateData: external_exports2.record(external_exports2.string(), external_exports2.unknown()).optional(),
-      integrationId: external_exports2.string().optional().describe("Integration ID for activity tracking")
+      integrationId: external_exports2.string().optional().describe("Integration ID for activity tracking"),
+      refresh: external_exports2.boolean().optional().describe(
+        "Request managed credential refresh for this send. Profile/DID recipients use immediate issuance; email/phone recipients use deferred Universal Inbox signing and bind the holder at claim."
+      ),
+      idempotencyKey: external_exports2.string().min(1).max(200).optional().describe(
+        "Caller-chosen key that makes a managed refresh send (refresh: true) safe to retry as a whole: retries with the same key reuse the same boost, refresh allocation and result. Reusing a key for a different request is rejected. With signedCredential, requires prior tRPC prepareRefreshableSend; direct REST callers omit the key and retry the exact signed credential and templateUri."
+      )
     }).refine((data) => data.templateUri || data.template || data.signedCredential, {
       message: "Either templateUri, template, or signedCredential must be provided.",
       path: ["templateUri"]
@@ -32849,8 +33075,12 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
         message: "guardianEmail must differ from recipient (self-approval not allowed)",
         path: ["options", "guardianEmail"]
       }
-    );
+    ).refine((data) => !data.idempotencyKey || data.refresh === true, {
+      message: "idempotencyKey is only supported with refresh: true.",
+      path: ["idempotencyKey"]
+    });
     var SendInboxResponseValidator2 = external_exports2.object({
+      refresh: InboxCredentialRefreshReceiptValidator2.optional(),
       issuanceId: external_exports2.string(),
       status: external_exports2.enum(["PENDING", "ISSUED", "EXPIRED", "DELIVERED", "CLAIMED"]),
       claimUrl: external_exports2.string().url().optional().describe("Present when suppressDelivery=true"),
@@ -32865,8 +33095,34 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       activityId: external_exports2.string().describe("Links to the activity lifecycle for this issuance"),
       inbox: SendInboxResponseValidator2.optional().describe(
         "Present when sent via email/phone (Universal Inbox)"
+      ),
+      refresh: ManagedCredentialRefreshReceiptValidator2.optional().describe(
+        "Present when managed refresh was requested: issuance metadata the issuer keeps to publish future updates"
       )
     });
+    var PrepareRefreshableSendInputValidator2 = external_exports2.object({
+      recipient: external_exports2.string(),
+      templateUri: external_exports2.string().optional(),
+      template: SendBoostTemplateValidator2.optional(),
+      contractUri: external_exports2.string().optional(),
+      templateData: external_exports2.record(external_exports2.string(), external_exports2.unknown()).optional(),
+      integrationId: external_exports2.string().optional(),
+      /** Credential ID to allocate for; generated server-side when omitted. */
+      credentialId: external_exports2.string().min(1).optional(),
+      idempotencyKey: external_exports2.string().min(1).max(200).optional()
+    }).refine((data) => Boolean(data.templateUri) !== Boolean(data.template), {
+      message: "Provide exactly one of templateUri or template."
+    });
+    var PrepareRefreshableSendResultValidator2 = external_exports2.object({
+      boostUri: external_exports2.string(),
+      credentialId: external_exports2.string(),
+      refreshId: external_exports2.string(),
+      refreshService: ManagedCredentialRefreshServiceValidator2,
+      /** The DID to use as credentialSubject.id (recipient DID, or the profile's did:web). */
+      holderDid: external_exports2.string(),
+      /** Present when this idempotencyKey already completed: return it without signing. */
+      completed: SendBoostResponseValidator2.optional()
+    });
     var SendInputValidator2 = external_exports2.discriminatedUnion("type", [SendBoostInputValidator2]);
     var SendResponseValidator2 = external_exports2.discriminatedUnion("type", [SendBoostResponseValidator2]);
     var ConsentFlowTermsStatusValidator2 = external_exports2.enum(["live", "stale", "withdrawn"]);
@@ -32942,15 +33198,6 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
     var PaginatedConsentFlowDataValidator2 = PaginationResponseValidator2.extend({
       records: ConsentFlowContractDataValidator2.array()
     });
-    var ConsentFlowContractDataForDidValidator2 = external_exports2.object({
-      credentials: external_exports2.object({ category: external_exports2.string(), uri: external_exports2.string() }).array(),
-      personal: external_exports2.record(external_exports2.string(), external_exports2.string()).default({}),
-      date: external_exports2.string(),
-      contractUri: external_exports2.string()
-    });
-    var PaginatedConsentFlowDataForDidValidator2 = PaginationResponseValidator2.extend({
-      records: ConsentFlowContractDataForDidValidator2.array()
-    });
     var ConsentFlowTermValidator2 = external_exports2.object({
       sharing: external_exports2.boolean().optional(),
       shared: external_exports2.string().array().optional(),
@@ -32984,6 +33231,34 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
         status: ConsentFlowTermsStatusValidator2
       }).array()
     });
+    var ConsentFlowGuardianApprovalValidator2 = external_exports2.object({
+      guardianProfileId: external_exports2.string(),
+      guardianDid: external_exports2.string(),
+      approvedAt: external_exports2.string().datetime(),
+      contractUpdatedAt: external_exports2.string()
+    });
+    var ConsentFlowContractDataForDidValidator2 = external_exports2.object({
+      credentials: external_exports2.object({ category: external_exports2.string(), uri: external_exports2.string() }).array(),
+      personal: external_exports2.record(external_exports2.string(), external_exports2.string()).default({}),
+      date: external_exports2.string(),
+      createdAt: external_exports2.string().optional(),
+      contractUpdatedAt: external_exports2.string(),
+      contractExpiresAt: external_exports2.string().optional(),
+      reasonForAccessing: external_exports2.string().optional(),
+      guardian: external_exports2.object({
+        required: external_exports2.boolean(),
+        approved: external_exports2.boolean(),
+        approval: ConsentFlowGuardianApprovalValidator2.optional()
+      }),
+      contractUri: external_exports2.string(),
+      termsUri: external_exports2.string(),
+      status: ConsentFlowTermsStatusValidator2,
+      expiresAt: external_exports2.string().optional(),
+      terms: ConsentFlowTermsValidator2
+    });
+    var PaginatedConsentFlowDataForDidValidator2 = PaginationResponseValidator2.extend({
+      records: ConsentFlowContractDataForDidValidator2.array()
+    });
     var ConsentFlowContractQueryValidator2 = external_exports2.object({
       read: external_exports2.object({
         anonymize: external_exports2.boolean().optional(),
@@ -33044,6 +33319,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       expiresAt: external_exports2.string().optional(),
       oneTime: external_exports2.boolean().optional(),
       terms: ConsentFlowTermsValidator2.optional(),
+      guardianApproval: ConsentFlowGuardianApprovalValidator2.optional(),
       id: external_exports2.string(),
       action: ConsentFlowTransactionActionValidator2,
       date: external_exports2.string(),
@@ -33165,6 +33441,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       webhookUrl: external_exports2.string().optional()
     });
     var AUTH_GRANT_AUDIENCE_DOMAIN_PREFIX2 = "auth-grant:";
+    var ACT_AS_HEADER = "X-LearnCard-Act-As";
     var AuthGrantValidator2 = external_exports2.object({
       id: external_exports2.string(),
       name: external_exports2.string(),
@@ -33177,6 +33454,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
         }, "error")
       }),
       scope: external_exports2.string(),
+      actAs: external_exports2.string().optional(),
       createdAt: external_exports2.iso.datetime({ error: "createdAt must be a valid ISO 8601 datetime string" }),
       expiresAt: external_exports2.iso.datetime({ error: "expiresAt must be a valid ISO 8601 datetime string" }).nullish().optional()
     });
@@ -33248,6 +33526,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       sessionJwt: external_exports2.string()
     });
     var InboxCredentialValidator2 = external_exports2.object({
+      refresh: InboxCredentialRefreshReceiptValidator2.optional(),
+      refreshId: external_exports2.string().optional(),
       id: external_exports2.string(),
       credential: external_exports2.string().optional(),
       isSigned: external_exports2.boolean(),
@@ -33302,12 +33582,19 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       templateUri: external_exports2.string().optional().describe(
         "URI of a boost template to use for issuance. The boost credential will be resolved and used. Mutually exclusive with credential field."
       ),
+      refresh: external_exports2.boolean().optional().describe(
+        "Allocate managed refresh before signing. Requires unsigned content and a registered signing authority; binds the holder on claim."
+      ),
+      idempotencyKey: external_exports2.string().min(1).max(200).optional(),
       // === OPTIONAL FEATURES ===
       // Add major, distinct features at the top level.
       //consentRequest: ConsentRequestValidator.optional(),
       // === PROCESS CONFIGURATION (Optional) ===
       // HOW should this issuance be handled?
       configuration: external_exports2.object({
+        guardianEmail: external_exports2.string().email().optional().describe(
+          "Require approval from this guardian before the recipient can claim. Must differ from the recipient email."
+        ),
         signingAuthority: IssueInboxSigningAuthorityValidator2.optional().describe(
           "The signing authority to use for the credential. If not provided, the users default signing authority will be used if the credential is not signed."
         ),
@@ -33361,32 +33648,145 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       }).optional().describe(
         "Configuration for the credential issuance. If not provided, the default configuration will be used."
       )
+    }).refine((data) => !data.idempotencyKey || data.refresh === true, {
+      message: "idempotencyKey requires refresh: true."
     }).refine((data) => data.credential || data.templateUri, {
       message: "Either credential or templateUri must be provided.",
       path: ["credential"]
-    });
+    }).refine(
+      (data) => !data.configuration?.guardianEmail || data.recipient.type !== "email" || data.configuration.guardianEmail.toLowerCase() !== data.recipient.value.toLowerCase(),
+      {
+        message: "guardianEmail must differ from recipient (self-approval not allowed)",
+        path: ["configuration", "guardianEmail"]
+      }
+    );
     var IssueInboxCredentialResponseValidator2 = external_exports2.object({
+      refresh: InboxCredentialRefreshReceiptValidator2.optional(),
       issuanceId: external_exports2.string(),
       status: LCNInboxStatusEnumValidator2,
       recipient: ContactMethodQueryValidator2,
       claimUrl: external_exports2.string().url().optional(),
       recipientDid: external_exports2.string().optional()
     });
-    var CredentialNameRefValidator2 = external_exports2.object({ name: external_exports2.string() }).passthrough();
-    var ClaimInboxCredentialValidator2 = external_exports2.object({
-      credential: VCValidator2.or(VPValidator2).or(UnsignedVCValidator2).or(CredentialNameRefValidator2).describe("The credential to issue, or a { name } reference to resolve a boost template."),
-      configuration: external_exports2.object({
-        publishableKey: external_exports2.string(),
-        expiresInDays: external_exports2.number().int().min(1).max(720).optional().describe(
-          "Inbox claim window in days. Defaults to 720; use a shorter window for sensitive records."
-        ),
-        signingAuthorityName: external_exports2.string().optional(),
-        listingId: external_exports2.string().optional(),
-        listingSlug: external_exports2.string().optional()
-      }).optional()
+    var InboxBatchConfigurationValidator2 = IssueInboxCredentialValidator2.shape.configuration.unwrap().extend({
+      refresh: IssueInboxCredentialValidator2.shape.refresh.describe(
+        "Enable managed refresh by default. An item configuration.refresh overrides this value, including false."
+      ),
+      delivery: IssueInboxCredentialValidator2.shape.configuration.unwrap().shape.delivery.unwrap().extend({ suppress: external_exports2.boolean().optional() }).optional()
     });
-    var LCNDomainOrOriginValidator2 = external_exports2.union([
-      external_exports2.string().regex(
+    var InboxBatchItemConfigurationValidator2 = InboxBatchConfigurationValidator2.extend({
+      guardianEmail: InboxBatchConfigurationValidator2.shape.guardianEmail.nullable().describe(
+        "Require guardian approval, or set null to clear a batch-level guardianEmail for this item."
+      )
+    });
+    var IssueInboxCredentialBatchItemValidator2 = external_exports2.object({
+      ...IssueInboxCredentialValidator2.shape,
+      configuration: InboxBatchItemConfigurationValidator2.optional(),
+      idempotencyKey: external_exports2.string().max(256).optional()
+    }).refine((data) => data.credential || data.templateUri, {
+      message: "Either credential or templateUri must be provided.",
+      path: ["credential"]
+    }).describe(
+      "One issuance: provide credential or templateUri. Invalid input is rejected at submission with its item index."
+    );
+    var IssueInboxCredentialBatchValidator2 = external_exports2.object({
+      requestId: external_exports2.string().min(1).max(256).optional(),
+      items: external_exports2.array(IssueInboxCredentialBatchItemValidator2).min(1).max(100),
+      configuration: InboxBatchConfigurationValidator2.optional()
+    }).superRefine((batch, ctx) => {
+      batch.items.forEach((item, index) => {
+        const itemGuardian = item.configuration?.guardianEmail;
+        const guardian = itemGuardian === null ? void 0 : itemGuardian ?? batch.configuration?.guardianEmail;
+        if (guardian && item.recipient.type === "email" && guardian.toLowerCase() === item.recipient.value.toLowerCase()) {
+          ctx.addIssue({
+            code: "custom",
+            path: ["items", index, "configuration", "guardianEmail"],
+            message: "guardianEmail must differ from recipient (self-approval not allowed)"
+          });
+        }
+      });
+    });
+    var InboxBatchErrorReasonValidator2 = external_exports2.enum([
+      "DUPLICATE_KEY",
+      "IDEMPOTENCY_MISMATCH",
+      "IN_PROGRESS",
+      "UNCONFIRMED"
+    ]);
+    var IssueInboxCredentialBatchItemResultValidator2 = external_exports2.discriminatedUnion("success", [
+      IssueInboxCredentialResponseValidator2.extend({
+        success: external_exports2.literal(true),
+        index: external_exports2.number().int().nonnegative(),
+        deduplicated: external_exports2.boolean().optional(),
+        guardianStatus: GuardianStatusValidator2.optional(),
+        idempotencyKey: external_exports2.string().optional()
+      }),
+      external_exports2.object({
+        success: external_exports2.literal(false),
+        index: external_exports2.number().int().nonnegative(),
+        idempotencyKey: external_exports2.string().optional(),
+        recipient: ContactMethodQueryValidator2.optional(),
+        error: external_exports2.object({
+          code: external_exports2.string(),
+          message: external_exports2.string(),
+          reason: InboxBatchErrorReasonValidator2.optional()
+        }),
+        issuanceId: external_exports2.string().optional().describe(
+          "Present when issuance completed but replay storage could not be confirmed. Reconcile this issuance; do not issue again with a new key."
+        ),
+        claimUrl: external_exports2.string().url().optional().describe(
+          "Claim URL of the completed issuance, if available, when replay storage could not be confirmed."
+        )
+      })
+    ]);
+    var IssueInboxCredentialBatchResponseValidator2 = external_exports2.object({
+      results: external_exports2.array(IssueInboxCredentialBatchItemResultValidator2),
+      summary: external_exports2.object({
+        total: external_exports2.number(),
+        succeeded: external_exports2.number(),
+        failed: external_exports2.number(),
+        deduplicated: external_exports2.number()
+      })
+    });
+    var InboxBatchReceiptValidator2 = external_exports2.object({
+      batchId: external_exports2.string(),
+      status: external_exports2.enum(["QUEUED", "PROCESSING", "COMPLETED", "NEEDS_RECONCILIATION"]),
+      createdAt: external_exports2.string()
+    });
+    var InboxBatchStatusValidator2 = external_exports2.object({
+      batchId: external_exports2.string(),
+      createdAt: external_exports2.string(),
+      done: external_exports2.boolean().describe(
+        "True when no queued or processing items remain, including unconfirmed outcomes."
+      ),
+      status: external_exports2.enum(["QUEUED", "PROCESSING", "COMPLETED", "NEEDS_RECONCILIATION"]),
+      items: external_exports2.array(
+        external_exports2.object({
+          index: external_exports2.number().int().nonnegative(),
+          state: external_exports2.enum(["QUEUED", "PROCESSING", "COMPLETED", "NEEDS_RECONCILIATION"]),
+          result: IssueInboxCredentialBatchItemResultValidator2.optional()
+        })
+      ),
+      summary: IssueInboxCredentialBatchResponseValidator2.shape.summary.extend({
+        completed: external_exports2.number(),
+        pending: external_exports2.number(),
+        unconfirmed: external_exports2.number()
+      })
+    });
+    var CredentialNameRefValidator2 = external_exports2.object({ name: external_exports2.string() }).passthrough();
+    var ClaimInboxCredentialValidator2 = external_exports2.object({
+      credential: VCValidator2.or(VPValidator2).or(UnsignedVCValidator2).or(CredentialNameRefValidator2).describe("The credential to issue, or a { name } reference to resolve a boost template."),
+      configuration: external_exports2.object({
+        publishableKey: external_exports2.string(),
+        expiresInDays: external_exports2.number().int().min(1).max(720).optional().describe(
+          "Inbox claim window in days. Defaults to 720; use a shorter window for sensitive records."
+        ),
+        signingAuthorityName: external_exports2.string().optional(),
+        listingId: external_exports2.string().optional(),
+        listingSlug: external_exports2.string().optional()
+      }).optional()
+    });
+    var LCNDomainOrOriginValidator2 = external_exports2.union([
+      external_exports2.string().regex(
         /^(?:(?:[a-zA-Z0-9-]{1,63}\.)+[a-zA-Z]{2,63}|localhost|\d{1,3}(?:\.\d{1,3}){3})(?::\d{1,5})?$/,
         {
           message: "Must be a valid domain (incl. subdomains), localhost, or IPv4, optionally with port"
@@ -33857,6 +34257,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       eventType: CredentialActivityEventTypeValidator2,
       timestamp: external_exports2.string(),
       actorProfileId: external_exports2.string().optional(),
+      onBehalfOf: external_exports2.string().optional(),
       recipientType: CredentialActivityRecipientTypeValidator2,
       recipientIdentifier: external_exports2.string(),
       boostUri: external_exports2.string().optional(),
@@ -34011,191 +34412,6 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       const result = inAppMessagesFlagValidator2.safeParse(raw);
       return result.success ? result.data : EMPTY_IN_APP_MESSAGES_FLAG;
     }, "parseInAppMessagesFlag");
-    var LearnCardRefreshAuthorizationValidator2 = external_exports2.object({ type: external_exports2.literal("LearnCardDIDAuth") }).catchall(external_exports2.any());
-    var ManagedCredentialRefreshServiceValidator2 = external_exports2.object({
-      id: external_exports2.string().min(1),
-      type: external_exports2.literal("LearnCardCredentialRefresh2026"),
-      authorization: LearnCardRefreshAuthorizationValidator2.optional()
-    }).catchall(external_exports2.any());
-    var StandardCredentialRefreshServiceValidator2 = external_exports2.object({
-      id: external_exports2.string().min(1),
-      type: external_exports2.literal("1EdTechCredentialRefresh")
-    }).catchall(external_exports2.any());
-    var SupportedCredentialRefreshServiceValidator2 = external_exports2.union([
-      ManagedCredentialRefreshServiceValidator2,
-      StandardCredentialRefreshServiceValidator2
-    ]);
-    var AllocateCredentialRefreshInputValidator2 = external_exports2.object({
-      holder: external_exports2.object({
-        profileId: external_exports2.string().optional(),
-        did: external_exports2.string().min(1)
-      }),
-      credentialId: external_exports2.string().min(1)
-    });
-    var AllocateCredentialRefreshResultValidator2 = external_exports2.object({
-      refreshId: external_exports2.string().min(1),
-      refreshService: ManagedCredentialRefreshServiceValidator2.extend({
-        authorization: LearnCardRefreshAuthorizationValidator2
-      })
-    });
-    var CredentialRefreshSigningModeValidator2 = external_exports2.enum(["issuer-signed", "signing-authority"]);
-    var PublishCredentialRefreshBaseFields2 = {
-      refreshId: external_exports2.string().min(1),
-      notifyHolder: external_exports2.boolean().optional(),
-      updateSummary: external_exports2.string().optional(),
-      idempotencyKey: external_exports2.string().optional()
-    };
-    var PublishIssuerSignedRefreshValidator2 = external_exports2.object({
-      ...PublishCredentialRefreshBaseFields2,
-      mode: external_exports2.literal("issuer-signed"),
-      signedCredential: VCValidator2
-    });
-    var PublishSigningAuthorityRefreshValidator2 = external_exports2.object({
-      ...PublishCredentialRefreshBaseFields2,
-      mode: external_exports2.literal("signing-authority"),
-      credential: UnsignedVCValidator2,
-      signingAuthority: external_exports2.object({
-        type: external_exports2.string().min(1)
-      }).catchall(external_exports2.any())
-    });
-    var PublishCredentialRefreshInputValidator2 = external_exports2.object({
-      ...PublishCredentialRefreshBaseFields2,
-      mode: CredentialRefreshSigningModeValidator2,
-      signedCredential: VCValidator2.optional(),
-      credential: UnsignedVCValidator2.optional(),
-      signingAuthority: external_exports2.object({
-        type: external_exports2.string().min(1)
-      }).catchall(external_exports2.any()).optional()
-    }).superRefine((input, ctx) => {
-      if (input.mode === "issuer-signed" && !input.signedCredential) {
-        ctx.addIssue({
-          code: "custom",
-          path: ["signedCredential"],
-          message: "signedCredential is required for issuer-signed publication"
-        });
-      }
-      if (input.mode === "issuer-signed" && (input.credential !== void 0 || input.signingAuthority !== void 0)) {
-        ctx.addIssue({
-          code: "custom",
-          path: ["mode"],
-          message: "issuer-signed publication cannot include signing-authority fields"
-        });
-      }
-      if (input.mode === "signing-authority") {
-        if (input.signedCredential !== void 0) {
-          ctx.addIssue({
-            code: "custom",
-            path: ["signedCredential"],
-            message: "signing-authority publication cannot include signedCredential"
-          });
-        }
-        if (!input.credential) {
-          ctx.addIssue({
-            code: "custom",
-            path: ["credential"],
-            message: "credential is required for signing-authority publication"
-          });
-        }
-        if (!input.signingAuthority) {
-          ctx.addIssue({
-            code: "custom",
-            path: ["signingAuthority"],
-            message: "signingAuthority is required for signing-authority publication"
-          });
-        }
-      }
-    });
-    var PublishCredentialRefreshNotificationValidator2 = external_exports2.enum([
-      "queued",
-      "suppressed",
-      "not-applicable",
-      /** Publication succeeded, but the post-commit notification enqueue must be retried. */
-      "delivery-failed"
-    ]);
-    var PublishCredentialRefreshResultValidator2 = external_exports2.object({
-      refreshId: external_exports2.string().min(1),
-      version: external_exports2.number().int().positive(),
-      publishedAt: external_exports2.string().min(1),
-      notification: PublishCredentialRefreshNotificationValidator2
-    });
-    var CredentialRefreshVersionMetadataValidator2 = external_exports2.object({
-      version: external_exports2.number().int().positive(),
-      publishedAt: external_exports2.string().min(1),
-      effectiveAt: external_exports2.string().optional(),
-      etag: external_exports2.string().optional(),
-      signingMode: CredentialRefreshSigningModeValidator2.optional(),
-      updateSummary: external_exports2.string().optional()
-    });
-    var GetCredentialRefreshHistoryInputValidator2 = external_exports2.object({
-      refreshId: external_exports2.string().min(1),
-      cursor: external_exports2.string().optional(),
-      limit: external_exports2.number().int().positive().optional()
-    });
-    var GetCredentialRefreshHistoryResultValidator2 = external_exports2.object({
-      records: CredentialRefreshVersionMetadataValidator2.array(),
-      hasMore: external_exports2.boolean(),
-      cursor: external_exports2.string().optional()
-    });
-    var CredentialRefreshChallengeValidator2 = external_exports2.object({
-      challenge: external_exports2.string().min(1),
-      expiresAt: external_exports2.string().min(1),
-      domain: external_exports2.string().optional(),
-      scheme: external_exports2.literal("LearnCardDIDAuth").optional()
-    });
-    var PublicCredentialRefreshEnvelopeValidator2 = external_exports2.object({
-      format: external_exports2.literal("vc"),
-      credential: VCValidator2,
-      etag: external_exports2.string().optional()
-    });
-    var JweCredentialRefreshEnvelopeValidator2 = external_exports2.object({
-      format: external_exports2.literal("jwe"),
-      jwe: JWEValidator2,
-      etag: external_exports2.string().optional(),
-      /** Present on LearnCard-managed endpoints; optional for interoperable JWE services. */
-      version: external_exports2.number().int().positive().optional()
-    });
-    var CredentialRefreshResponseEnvelopeValidator2 = external_exports2.discriminatedUnion("format", [
-      PublicCredentialRefreshEnvelopeValidator2,
-      JweCredentialRefreshEnvelopeValidator2
-    ]);
-    var CredentialRefreshFailureCodeValidator2 = external_exports2.enum([
-      "UNAVAILABLE",
-      "TIMEOUT",
-      "UNSUPPORTED_SERVICE",
-      "UNAUTHORIZED",
-      "MALFORMED_RESPONSE",
-      "INVALID_PROOF",
-      "ISSUER_MISMATCH",
-      "ID_MISMATCH",
-      "ROLLBACK",
-      "REVOKED",
-      "UNSAFE_ENDPOINT"
-    ]);
-    var CredentialRefreshUpdatedResultValidator2 = external_exports2.object({
-      status: external_exports2.literal("updated"),
-      credential: VCValidator2,
-      etag: external_exports2.string().optional(),
-      managedVersion: external_exports2.number().int().positive().optional()
-    });
-    var CredentialRefreshUnchangedResultValidator2 = external_exports2.object({
-      status: external_exports2.literal("unchanged"),
-      checkedAt: external_exports2.string().min(1),
-      etag: external_exports2.string().optional()
-    });
-    var CredentialRefreshUnsupportedResultValidator2 = external_exports2.object({
-      status: external_exports2.literal("unsupported")
-    });
-    var CredentialRefreshFailedResultValidator2 = external_exports2.object({
-      status: external_exports2.literal("failed"),
-      code: CredentialRefreshFailureCodeValidator2,
-      retryable: external_exports2.boolean()
-    });
-    var CredentialRefreshResultValidator2 = external_exports2.discriminatedUnion("status", [
-      CredentialRefreshUpdatedResultValidator2,
-      CredentialRefreshUnchangedResultValidator2,
-      CredentialRefreshUnsupportedResultValidator2,
-      CredentialRefreshFailedResultValidator2
-    ]);
   }
 });
 var require_dist = __commonJS({
@@ -34491,6 +34707,18 @@ var ImageWithLoadingStateValdator = external_exports.object({
 });
 var import_types2 = __toESM(require_dist());
 var import_types22 = __toESM(require_dist());
+var MANAGED_REFRESH_TYPE_TERM = "LearnCardCredentialRefresh2026";
+var MANAGED_REFRESH_DID_AUTH_TERM = "LearnCardDIDAuth";
+var MANAGED_REFRESH_TYPE_IRI = "https://learncard.com/refresh#LearnCardCredentialRefresh2026";
+var MANAGED_REFRESH_AUTHORIZATION_IRI = "https://purl.imsglobal.org/spec/ob/v3p0#authorization";
+var MANAGED_REFRESH_DID_AUTH_IRI = "https://docs.learncard.com/definitions#LearnCardDIDAuth";
+var MANAGED_REFRESH_SERVICE_CONTEXT = {
+  [MANAGED_REFRESH_TYPE_TERM]: MANAGED_REFRESH_TYPE_IRI,
+  authorization: {
+    "@id": MANAGED_REFRESH_AUTHORIZATION_IRI,
+    "@context": { [MANAGED_REFRESH_DID_AUTH_TERM]: MANAGED_REFRESH_DID_AUTH_IRI }
+  }
+};
 var _a4;
 var EnvironmentConfigurationError = (_a4 = class extends Error {
   constructor(message) {
@@ -34663,14 +34891,22 @@ var UnsignedVCValidator = external_exports.object({
 }).catchall(external_exports.any());
 var ProofValidator = external_exports.object({
   type: external_exports.string(),
-  created: external_exports.string(),
+  created: external_exports.string().optional(),
   challenge: external_exports.string().optional(),
   domain: external_exports.string().optional(),
   nonce: external_exports.string().optional(),
   proofPurpose: external_exports.string(),
   verificationMethod: external_exports.string(),
   jws: external_exports.string().optional()
-}).catchall(external_exports.any());
+}).catchall(external_exports.any()).superRefine((proof, ctx) => {
+  if (proof.created === void 0 && (proof.type !== "DataIntegrityProof" || proof.cryptosuite !== "ecdsa-rdfc-2019")) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["created"],
+      message: "created is required for this proof suite"
+    });
+  }
+});
 var VCValidator = UnsignedVCValidator.extend({
   proof: ProofValidator.or(ProofValidator.array())
 });
@@ -35105,21 +35341,219 @@ var StringQuery = external_exports.union([
     $or: BaseStringQuery.array()
   })
 ]);
-var LCNProfileDisplayValidator = external_exports.object({
-  backgroundColor: external_exports.string().optional(),
-  backgroundImage: external_exports.string().optional(),
-  fadeBackgroundImage: external_exports.boolean().optional(),
-  repeatBackgroundImage: external_exports.boolean().optional(),
-  fontColor: external_exports.string().optional(),
-  accentColor: external_exports.string().optional(),
-  accentFontColor: external_exports.string().optional(),
-  idBackgroundImage: external_exports.string().optional(),
-  fadeIdBackgroundImage: external_exports.boolean().optional(),
-  idBackgroundColor: external_exports.string().optional(),
-  repeatIdBackgroundImage: external_exports.boolean().optional()
-});
-var ProfileVisibilityEnum = external_exports.enum(["public", "connections_only", "private"]);
-var AllowConnectionRequestsEnum = external_exports.enum(["anyone", "invite_only"]);
+var LearnCardRefreshAuthorizationValidator = external_exports.object({ type: external_exports.literal("LearnCardDIDAuth") }).catchall(external_exports.any());
+var ManagedCredentialRefreshServiceValidator = external_exports.object({
+  id: external_exports.string().min(1),
+  type: external_exports.literal("LearnCardCredentialRefresh2026"),
+  authorization: LearnCardRefreshAuthorizationValidator.optional()
+}).catchall(external_exports.any());
+var StandardCredentialRefreshServiceValidator = external_exports.object({
+  id: external_exports.string().min(1),
+  type: external_exports.literal("1EdTechCredentialRefresh")
+}).catchall(external_exports.any());
+var SupportedCredentialRefreshServiceValidator = external_exports.union([
+  ManagedCredentialRefreshServiceValidator,
+  StandardCredentialRefreshServiceValidator
+]);
+var AllocateCredentialRefreshInputValidator = external_exports.object({
+  holder: external_exports.object({
+    profileId: external_exports.string().optional(),
+    did: external_exports.string().min(1)
+  }),
+  credentialId: external_exports.string().min(1)
+});
+var AllocateCredentialRefreshResultValidator = external_exports.object({
+  refreshId: external_exports.string().min(1),
+  refreshService: ManagedCredentialRefreshServiceValidator.extend({
+    authorization: LearnCardRefreshAuthorizationValidator
+  })
+});
+var ManagedCredentialRefreshReceiptValidator = external_exports.object({
+  refreshId: external_exports.string().min(1),
+  refreshService: ManagedCredentialRefreshServiceValidator,
+  credentialId: external_exports.string().min(1),
+  issuerDid: external_exports.string().min(1),
+  holderDid: external_exports.string().min(1),
+  credentialStatus: CredentialStatusValidator.or(
+    CredentialStatusValidator.array()
+  ).optional()
+}).strip();
+var InboxCredentialRefreshReceiptValidator = ManagedCredentialRefreshReceiptValidator.omit(
+  { holderDid: true }
+).extend({ holderDid: external_exports.string().min(1).optional() });
+var CredentialRefreshSigningModeValidator = external_exports.enum(["issuer-signed", "signing-authority"]);
+var PublishCredentialRefreshBaseFields = {
+  refreshId: external_exports.string().min(1),
+  notifyHolder: external_exports.boolean().optional(),
+  updateSummary: external_exports.string().optional(),
+  idempotencyKey: external_exports.string().optional()
+};
+var PublishIssuerSignedRefreshValidator = external_exports.object({
+  ...PublishCredentialRefreshBaseFields,
+  mode: external_exports.literal("issuer-signed"),
+  signedCredential: VCValidator
+});
+var PublishSigningAuthorityRefreshValidator = external_exports.object({
+  ...PublishCredentialRefreshBaseFields,
+  mode: external_exports.literal("signing-authority"),
+  credential: UnsignedVCValidator,
+  signingAuthority: external_exports.object({
+    type: external_exports.string().min(1)
+  }).catchall(external_exports.any())
+});
+var PublishCredentialRefreshInputValidator = external_exports.object({
+  ...PublishCredentialRefreshBaseFields,
+  mode: CredentialRefreshSigningModeValidator,
+  signedCredential: VCValidator.optional(),
+  credential: UnsignedVCValidator.optional(),
+  signingAuthority: external_exports.object({
+    type: external_exports.string().min(1)
+  }).catchall(external_exports.any()).optional()
+}).superRefine((input, ctx) => {
+  if (input.mode === "issuer-signed" && !input.signedCredential) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["signedCredential"],
+      message: "signedCredential is required for issuer-signed publication"
+    });
+  }
+  if (input.mode === "issuer-signed" && (input.credential !== void 0 || input.signingAuthority !== void 0)) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["mode"],
+      message: "issuer-signed publication cannot include signing-authority fields"
+    });
+  }
+  if (input.mode === "signing-authority") {
+    if (input.signedCredential !== void 0) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["signedCredential"],
+        message: "signing-authority publication cannot include signedCredential"
+      });
+    }
+    if (!input.credential) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["credential"],
+        message: "credential is required for signing-authority publication"
+      });
+    }
+    if (!input.signingAuthority) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["signingAuthority"],
+        message: "signingAuthority is required for signing-authority publication"
+      });
+    }
+  }
+});
+var PublishCredentialRefreshNotificationValidator = external_exports.enum([
+  "queued",
+  "suppressed",
+  "not-applicable",
+  /** Publication succeeded, but the post-commit notification enqueue must be retried. */
+  "delivery-failed"
+]);
+var PublishCredentialRefreshResultValidator = external_exports.object({
+  refreshId: external_exports.string().min(1),
+  version: external_exports.number().int().positive(),
+  publishedAt: external_exports.string().min(1),
+  notification: PublishCredentialRefreshNotificationValidator
+});
+var CredentialRefreshVersionMetadataValidator = external_exports.object({
+  version: external_exports.number().int().positive(),
+  publishedAt: external_exports.string().min(1),
+  effectiveAt: external_exports.string().optional(),
+  etag: external_exports.string().optional(),
+  signingMode: CredentialRefreshSigningModeValidator.optional(),
+  updateSummary: external_exports.string().optional()
+});
+var GetCredentialRefreshHistoryInputValidator = external_exports.object({
+  refreshId: external_exports.string().min(1),
+  cursor: external_exports.string().optional(),
+  limit: external_exports.number().int().positive().optional()
+});
+var GetCredentialRefreshHistoryResultValidator = external_exports.object({
+  records: CredentialRefreshVersionMetadataValidator.array(),
+  hasMore: external_exports.boolean(),
+  cursor: external_exports.string().optional()
+});
+var CredentialRefreshChallengeValidator = external_exports.object({
+  challenge: external_exports.string().min(1),
+  expiresAt: external_exports.string().min(1),
+  domain: external_exports.string().optional(),
+  scheme: external_exports.literal("LearnCardDIDAuth").optional()
+});
+var PublicCredentialRefreshEnvelopeValidator = external_exports.object({
+  format: external_exports.literal("vc"),
+  credential: VCValidator,
+  etag: external_exports.string().optional()
+});
+var JweCredentialRefreshEnvelopeValidator = external_exports.object({
+  format: external_exports.literal("jwe"),
+  jwe: JWEValidator,
+  etag: external_exports.string().optional(),
+  /** Present on LearnCard-managed endpoints; optional for interoperable JWE services. */
+  version: external_exports.number().int().positive().optional()
+});
+var CredentialRefreshResponseEnvelopeValidator = external_exports.discriminatedUnion("format", [
+  PublicCredentialRefreshEnvelopeValidator,
+  JweCredentialRefreshEnvelopeValidator
+]);
+var CredentialRefreshFailureCodeValidator = external_exports.enum([
+  "UNAVAILABLE",
+  "TIMEOUT",
+  "UNSUPPORTED_SERVICE",
+  "UNAUTHORIZED",
+  "MALFORMED_RESPONSE",
+  "INVALID_PROOF",
+  "ISSUER_MISMATCH",
+  "ID_MISMATCH",
+  "ROLLBACK",
+  "REVOKED",
+  "UNSAFE_ENDPOINT"
+]);
+var CredentialRefreshUpdatedResultValidator = external_exports.object({
+  status: external_exports.literal("updated"),
+  credential: VCValidator,
+  etag: external_exports.string().optional(),
+  managedVersion: external_exports.number().int().positive().optional()
+});
+var CredentialRefreshUnchangedResultValidator = external_exports.object({
+  status: external_exports.literal("unchanged"),
+  checkedAt: external_exports.string().min(1),
+  etag: external_exports.string().optional()
+});
+var CredentialRefreshUnsupportedResultValidator = external_exports.object({
+  status: external_exports.literal("unsupported")
+});
+var CredentialRefreshFailedResultValidator = external_exports.object({
+  status: external_exports.literal("failed"),
+  code: CredentialRefreshFailureCodeValidator,
+  retryable: external_exports.boolean()
+});
+var CredentialRefreshResultValidator = external_exports.discriminatedUnion("status", [
+  CredentialRefreshUpdatedResultValidator,
+  CredentialRefreshUnchangedResultValidator,
+  CredentialRefreshUnsupportedResultValidator,
+  CredentialRefreshFailedResultValidator
+]);
+var LCNProfileDisplayValidator = external_exports.object({
+  backgroundColor: external_exports.string().optional(),
+  backgroundImage: external_exports.string().optional(),
+  fadeBackgroundImage: external_exports.boolean().optional(),
+  repeatBackgroundImage: external_exports.boolean().optional(),
+  fontColor: external_exports.string().optional(),
+  accentColor: external_exports.string().optional(),
+  accentFontColor: external_exports.string().optional(),
+  idBackgroundImage: external_exports.string().optional(),
+  fadeIdBackgroundImage: external_exports.boolean().optional(),
+  idBackgroundColor: external_exports.string().optional(),
+  repeatIdBackgroundImage: external_exports.boolean().optional()
+});
+var ProfileVisibilityEnum = external_exports.enum(["public", "connections_only", "private"]);
+var AllowConnectionRequestsEnum = external_exports.enum(["anyone", "invite_only"]);
 var LCNProfileValidator = external_exports.object({
   profileId: external_exports.string().min(3).max(40).describe("Unique, URL-safe identifier for the profile."),
   displayName: external_exports.string().default("").describe("Human-readable display name for the profile."),
@@ -35440,7 +35874,13 @@ var SendBoostInputValidator = external_exports.object({
     "Options for email/phone recipients (Universal Inbox)"
   ),
   templateData: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
-  integrationId: external_exports.string().optional().describe("Integration ID for activity tracking")
+  integrationId: external_exports.string().optional().describe("Integration ID for activity tracking"),
+  refresh: external_exports.boolean().optional().describe(
+    "Request managed credential refresh for this send. Profile/DID recipients use immediate issuance; email/phone recipients use deferred Universal Inbox signing and bind the holder at claim."
+  ),
+  idempotencyKey: external_exports.string().min(1).max(200).optional().describe(
+    "Caller-chosen key that makes a managed refresh send (refresh: true) safe to retry as a whole: retries with the same key reuse the same boost, refresh allocation and result. Reusing a key for a different request is rejected. With signedCredential, requires prior tRPC prepareRefreshableSend; direct REST callers omit the key and retry the exact signed credential and templateUri."
+  )
 }).refine((data) => data.templateUri || data.template || data.signedCredential, {
   message: "Either templateUri, template, or signedCredential must be provided.",
   path: ["templateUri"]
@@ -35455,8 +35895,12 @@ var SendBoostInputValidator = external_exports.object({
     message: "guardianEmail must differ from recipient (self-approval not allowed)",
     path: ["options", "guardianEmail"]
   }
-);
+).refine((data) => !data.idempotencyKey || data.refresh === true, {
+  message: "idempotencyKey is only supported with refresh: true.",
+  path: ["idempotencyKey"]
+});
 var SendInboxResponseValidator = external_exports.object({
+  refresh: InboxCredentialRefreshReceiptValidator.optional(),
   issuanceId: external_exports.string(),
   status: external_exports.enum(["PENDING", "ISSUED", "EXPIRED", "DELIVERED", "CLAIMED"]),
   claimUrl: external_exports.string().url().optional().describe("Present when suppressDelivery=true"),
@@ -35471,8 +35915,34 @@ var SendBoostResponseValidator = external_exports.object({
   activityId: external_exports.string().describe("Links to the activity lifecycle for this issuance"),
   inbox: SendInboxResponseValidator.optional().describe(
     "Present when sent via email/phone (Universal Inbox)"
+  ),
+  refresh: ManagedCredentialRefreshReceiptValidator.optional().describe(
+    "Present when managed refresh was requested: issuance metadata the issuer keeps to publish future updates"
   )
 });
+var PrepareRefreshableSendInputValidator = external_exports.object({
+  recipient: external_exports.string(),
+  templateUri: external_exports.string().optional(),
+  template: SendBoostTemplateValidator.optional(),
+  contractUri: external_exports.string().optional(),
+  templateData: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
+  integrationId: external_exports.string().optional(),
+  /** Credential ID to allocate for; generated server-side when omitted. */
+  credentialId: external_exports.string().min(1).optional(),
+  idempotencyKey: external_exports.string().min(1).max(200).optional()
+}).refine((data) => Boolean(data.templateUri) !== Boolean(data.template), {
+  message: "Provide exactly one of templateUri or template."
+});
+var PrepareRefreshableSendResultValidator = external_exports.object({
+  boostUri: external_exports.string(),
+  credentialId: external_exports.string(),
+  refreshId: external_exports.string(),
+  refreshService: ManagedCredentialRefreshServiceValidator,
+  /** The DID to use as credentialSubject.id (recipient DID, or the profile's did:web). */
+  holderDid: external_exports.string(),
+  /** Present when this idempotencyKey already completed: return it without signing. */
+  completed: SendBoostResponseValidator.optional()
+});
 var SendInputValidator = external_exports.discriminatedUnion("type", [SendBoostInputValidator]);
 var SendResponseValidator = external_exports.discriminatedUnion("type", [SendBoostResponseValidator]);
 var ConsentFlowTermsStatusValidator = external_exports.enum(["live", "stale", "withdrawn"]);
@@ -35548,15 +36018,6 @@ var ConsentFlowContractDataValidator = external_exports.object({
 var PaginatedConsentFlowDataValidator = PaginationResponseValidator.extend({
   records: ConsentFlowContractDataValidator.array()
 });
-var ConsentFlowContractDataForDidValidator = external_exports.object({
-  credentials: external_exports.object({ category: external_exports.string(), uri: external_exports.string() }).array(),
-  personal: external_exports.record(external_exports.string(), external_exports.string()).default({}),
-  date: external_exports.string(),
-  contractUri: external_exports.string()
-});
-var PaginatedConsentFlowDataForDidValidator = PaginationResponseValidator.extend({
-  records: ConsentFlowContractDataForDidValidator.array()
-});
 var ConsentFlowTermValidator = external_exports.object({
   sharing: external_exports.boolean().optional(),
   shared: external_exports.string().array().optional(),
@@ -35590,6 +36051,34 @@ var PaginatedConsentFlowTermsValidator = PaginationResponseValidator.extend({
     status: ConsentFlowTermsStatusValidator
   }).array()
 });
+var ConsentFlowGuardianApprovalValidator = external_exports.object({
+  guardianProfileId: external_exports.string(),
+  guardianDid: external_exports.string(),
+  approvedAt: external_exports.string().datetime(),
+  contractUpdatedAt: external_exports.string()
+});
+var ConsentFlowContractDataForDidValidator = external_exports.object({
+  credentials: external_exports.object({ category: external_exports.string(), uri: external_exports.string() }).array(),
+  personal: external_exports.record(external_exports.string(), external_exports.string()).default({}),
+  date: external_exports.string(),
+  createdAt: external_exports.string().optional(),
+  contractUpdatedAt: external_exports.string(),
+  contractExpiresAt: external_exports.string().optional(),
+  reasonForAccessing: external_exports.string().optional(),
+  guardian: external_exports.object({
+    required: external_exports.boolean(),
+    approved: external_exports.boolean(),
+    approval: ConsentFlowGuardianApprovalValidator.optional()
+  }),
+  contractUri: external_exports.string(),
+  termsUri: external_exports.string(),
+  status: ConsentFlowTermsStatusValidator,
+  expiresAt: external_exports.string().optional(),
+  terms: ConsentFlowTermsValidator
+});
+var PaginatedConsentFlowDataForDidValidator = PaginationResponseValidator.extend({
+  records: ConsentFlowContractDataForDidValidator.array()
+});
 var ConsentFlowContractQueryValidator = external_exports.object({
   read: external_exports.object({
     anonymize: external_exports.boolean().optional(),
@@ -35650,6 +36139,7 @@ var ConsentFlowTransactionValidator = external_exports.object({
   expiresAt: external_exports.string().optional(),
   oneTime: external_exports.boolean().optional(),
   terms: ConsentFlowTermsValidator.optional(),
+  guardianApproval: ConsentFlowGuardianApprovalValidator.optional(),
   id: external_exports.string(),
   action: ConsentFlowTransactionActionValidator,
   date: external_exports.string(),
@@ -35783,6 +36273,7 @@ var AuthGrantValidator = external_exports.object({
     }, "error")
   }),
   scope: external_exports.string(),
+  actAs: external_exports.string().optional(),
   createdAt: external_exports.iso.datetime({ error: "createdAt must be a valid ISO 8601 datetime string" }),
   expiresAt: external_exports.iso.datetime({ error: "expiresAt must be a valid ISO 8601 datetime string" }).nullish().optional()
 });
@@ -35854,6 +36345,8 @@ var CreateContactMethodSessionResponseValidator = external_exports.object({
   sessionJwt: external_exports.string()
 });
 var InboxCredentialValidator = external_exports.object({
+  refresh: InboxCredentialRefreshReceiptValidator.optional(),
+  refreshId: external_exports.string().optional(),
   id: external_exports.string(),
   credential: external_exports.string().optional(),
   isSigned: external_exports.boolean(),
@@ -35908,12 +36401,19 @@ var IssueInboxCredentialValidator = external_exports.object({
   templateUri: external_exports.string().optional().describe(
     "URI of a boost template to use for issuance. The boost credential will be resolved and used. Mutually exclusive with credential field."
   ),
+  refresh: external_exports.boolean().optional().describe(
+    "Allocate managed refresh before signing. Requires unsigned content and a registered signing authority; binds the holder on claim."
+  ),
+  idempotencyKey: external_exports.string().min(1).max(200).optional(),
   // === OPTIONAL FEATURES ===
   // Add major, distinct features at the top level.
   //consentRequest: ConsentRequestValidator.optional(),
   // === PROCESS CONFIGURATION (Optional) ===
   // HOW should this issuance be handled?
   configuration: external_exports.object({
+    guardianEmail: external_exports.string().email().optional().describe(
+      "Require approval from this guardian before the recipient can claim. Must differ from the recipient email."
+    ),
     signingAuthority: IssueInboxSigningAuthorityValidator.optional().describe(
       "The signing authority to use for the credential. If not provided, the users default signing authority will be used if the credential is not signed."
     ),
@@ -35967,17 +36467,130 @@ var IssueInboxCredentialValidator = external_exports.object({
   }).optional().describe(
     "Configuration for the credential issuance. If not provided, the default configuration will be used."
   )
+}).refine((data) => !data.idempotencyKey || data.refresh === true, {
+  message: "idempotencyKey requires refresh: true."
 }).refine((data) => data.credential || data.templateUri, {
   message: "Either credential or templateUri must be provided.",
   path: ["credential"]
-});
+}).refine(
+  (data) => !data.configuration?.guardianEmail || data.recipient.type !== "email" || data.configuration.guardianEmail.toLowerCase() !== data.recipient.value.toLowerCase(),
+  {
+    message: "guardianEmail must differ from recipient (self-approval not allowed)",
+    path: ["configuration", "guardianEmail"]
+  }
+);
 var IssueInboxCredentialResponseValidator = external_exports.object({
+  refresh: InboxCredentialRefreshReceiptValidator.optional(),
   issuanceId: external_exports.string(),
   status: LCNInboxStatusEnumValidator,
   recipient: ContactMethodQueryValidator,
   claimUrl: external_exports.string().url().optional(),
   recipientDid: external_exports.string().optional()
 });
+var InboxBatchConfigurationValidator = IssueInboxCredentialValidator.shape.configuration.unwrap().extend({
+  refresh: IssueInboxCredentialValidator.shape.refresh.describe(
+    "Enable managed refresh by default. An item configuration.refresh overrides this value, including false."
+  ),
+  delivery: IssueInboxCredentialValidator.shape.configuration.unwrap().shape.delivery.unwrap().extend({ suppress: external_exports.boolean().optional() }).optional()
+});
+var InboxBatchItemConfigurationValidator = InboxBatchConfigurationValidator.extend({
+  guardianEmail: InboxBatchConfigurationValidator.shape.guardianEmail.nullable().describe(
+    "Require guardian approval, or set null to clear a batch-level guardianEmail for this item."
+  )
+});
+var IssueInboxCredentialBatchItemValidator = external_exports.object({
+  ...IssueInboxCredentialValidator.shape,
+  configuration: InboxBatchItemConfigurationValidator.optional(),
+  idempotencyKey: external_exports.string().max(256).optional()
+}).refine((data) => data.credential || data.templateUri, {
+  message: "Either credential or templateUri must be provided.",
+  path: ["credential"]
+}).describe(
+  "One issuance: provide credential or templateUri. Invalid input is rejected at submission with its item index."
+);
+var IssueInboxCredentialBatchValidator = external_exports.object({
+  requestId: external_exports.string().min(1).max(256).optional(),
+  items: external_exports.array(IssueInboxCredentialBatchItemValidator).min(1).max(100),
+  configuration: InboxBatchConfigurationValidator.optional()
+}).superRefine((batch, ctx) => {
+  batch.items.forEach((item, index) => {
+    const itemGuardian = item.configuration?.guardianEmail;
+    const guardian = itemGuardian === null ? void 0 : itemGuardian ?? batch.configuration?.guardianEmail;
+    if (guardian && item.recipient.type === "email" && guardian.toLowerCase() === item.recipient.value.toLowerCase()) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["items", index, "configuration", "guardianEmail"],
+        message: "guardianEmail must differ from recipient (self-approval not allowed)"
+      });
+    }
+  });
+});
+var InboxBatchErrorReasonValidator = external_exports.enum([
+  "DUPLICATE_KEY",
+  "IDEMPOTENCY_MISMATCH",
+  "IN_PROGRESS",
+  "UNCONFIRMED"
+]);
+var IssueInboxCredentialBatchItemResultValidator = external_exports.discriminatedUnion("success", [
+  IssueInboxCredentialResponseValidator.extend({
+    success: external_exports.literal(true),
+    index: external_exports.number().int().nonnegative(),
+    deduplicated: external_exports.boolean().optional(),
+    guardianStatus: GuardianStatusValidator.optional(),
+    idempotencyKey: external_exports.string().optional()
+  }),
+  external_exports.object({
+    success: external_exports.literal(false),
+    index: external_exports.number().int().nonnegative(),
+    idempotencyKey: external_exports.string().optional(),
+    recipient: ContactMethodQueryValidator.optional(),
+    error: external_exports.object({
+      code: external_exports.string(),
+      message: external_exports.string(),
+      reason: InboxBatchErrorReasonValidator.optional()
+    }),
+    issuanceId: external_exports.string().optional().describe(
+      "Present when issuance completed but replay storage could not be confirmed. Reconcile this issuance; do not issue again with a new key."
+    ),
+    claimUrl: external_exports.string().url().optional().describe(
+      "Claim URL of the completed issuance, if available, when replay storage could not be confirmed."
+    )
+  })
+]);
+var IssueInboxCredentialBatchResponseValidator = external_exports.object({
+  results: external_exports.array(IssueInboxCredentialBatchItemResultValidator),
+  summary: external_exports.object({
+    total: external_exports.number(),
+    succeeded: external_exports.number(),
+    failed: external_exports.number(),
+    deduplicated: external_exports.number()
+  })
+});
+var InboxBatchReceiptValidator = external_exports.object({
+  batchId: external_exports.string(),
+  status: external_exports.enum(["QUEUED", "PROCESSING", "COMPLETED", "NEEDS_RECONCILIATION"]),
+  createdAt: external_exports.string()
+});
+var InboxBatchStatusValidator = external_exports.object({
+  batchId: external_exports.string(),
+  createdAt: external_exports.string(),
+  done: external_exports.boolean().describe(
+    "True when no queued or processing items remain, including unconfirmed outcomes."
+  ),
+  status: external_exports.enum(["QUEUED", "PROCESSING", "COMPLETED", "NEEDS_RECONCILIATION"]),
+  items: external_exports.array(
+    external_exports.object({
+      index: external_exports.number().int().nonnegative(),
+      state: external_exports.enum(["QUEUED", "PROCESSING", "COMPLETED", "NEEDS_RECONCILIATION"]),
+      result: IssueInboxCredentialBatchItemResultValidator.optional()
+    })
+  ),
+  summary: IssueInboxCredentialBatchResponseValidator.shape.summary.extend({
+    completed: external_exports.number(),
+    pending: external_exports.number(),
+    unconfirmed: external_exports.number()
+  })
+});
 var CredentialNameRefValidator = external_exports.object({ name: external_exports.string() }).passthrough();
 var ClaimInboxCredentialValidator = external_exports.object({
   credential: VCValidator.or(VPValidator).or(UnsignedVCValidator).or(CredentialNameRefValidator).describe("The credential to issue, or a { name } reference to resolve a boost template."),
@@ -36463,6 +37076,7 @@ var CredentialActivityValidator = external_exports.object({
   eventType: CredentialActivityEventTypeValidator,
   timestamp: external_exports.string(),
   actorProfileId: external_exports.string().optional(),
+  onBehalfOf: external_exports.string().optional(),
   recipientType: CredentialActivityRecipientTypeValidator,
   recipientIdentifier: external_exports.string(),
   boostUri: external_exports.string().optional(),
@@ -36612,191 +37226,6 @@ var inAppMessagesFlagValidator = external_exports.object({
   version: external_exports.number().default(1),
   messages: external_exports.array(inAppMessageValidator).default([])
 }).passthrough();
-var LearnCardRefreshAuthorizationValidator = external_exports.object({ type: external_exports.literal("LearnCardDIDAuth") }).catchall(external_exports.any());
-var ManagedCredentialRefreshServiceValidator = external_exports.object({
-  id: external_exports.string().min(1),
-  type: external_exports.literal("LearnCardCredentialRefresh2026"),
-  authorization: LearnCardRefreshAuthorizationValidator.optional()
-}).catchall(external_exports.any());
-var StandardCredentialRefreshServiceValidator = external_exports.object({
-  id: external_exports.string().min(1),
-  type: external_exports.literal("1EdTechCredentialRefresh")
-}).catchall(external_exports.any());
-var SupportedCredentialRefreshServiceValidator = external_exports.union([
-  ManagedCredentialRefreshServiceValidator,
-  StandardCredentialRefreshServiceValidator
-]);
-var AllocateCredentialRefreshInputValidator = external_exports.object({
-  holder: external_exports.object({
-    profileId: external_exports.string().optional(),
-    did: external_exports.string().min(1)
-  }),
-  credentialId: external_exports.string().min(1)
-});
-var AllocateCredentialRefreshResultValidator = external_exports.object({
-  refreshId: external_exports.string().min(1),
-  refreshService: ManagedCredentialRefreshServiceValidator.extend({
-    authorization: LearnCardRefreshAuthorizationValidator
-  })
-});
-var CredentialRefreshSigningModeValidator = external_exports.enum(["issuer-signed", "signing-authority"]);
-var PublishCredentialRefreshBaseFields = {
-  refreshId: external_exports.string().min(1),
-  notifyHolder: external_exports.boolean().optional(),
-  updateSummary: external_exports.string().optional(),
-  idempotencyKey: external_exports.string().optional()
-};
-var PublishIssuerSignedRefreshValidator = external_exports.object({
-  ...PublishCredentialRefreshBaseFields,
-  mode: external_exports.literal("issuer-signed"),
-  signedCredential: VCValidator
-});
-var PublishSigningAuthorityRefreshValidator = external_exports.object({
-  ...PublishCredentialRefreshBaseFields,
-  mode: external_exports.literal("signing-authority"),
-  credential: UnsignedVCValidator,
-  signingAuthority: external_exports.object({
-    type: external_exports.string().min(1)
-  }).catchall(external_exports.any())
-});
-var PublishCredentialRefreshInputValidator = external_exports.object({
-  ...PublishCredentialRefreshBaseFields,
-  mode: CredentialRefreshSigningModeValidator,
-  signedCredential: VCValidator.optional(),
-  credential: UnsignedVCValidator.optional(),
-  signingAuthority: external_exports.object({
-    type: external_exports.string().min(1)
-  }).catchall(external_exports.any()).optional()
-}).superRefine((input, ctx) => {
-  if (input.mode === "issuer-signed" && !input.signedCredential) {
-    ctx.addIssue({
-      code: "custom",
-      path: ["signedCredential"],
-      message: "signedCredential is required for issuer-signed publication"
-    });
-  }
-  if (input.mode === "issuer-signed" && (input.credential !== void 0 || input.signingAuthority !== void 0)) {
-    ctx.addIssue({
-      code: "custom",
-      path: ["mode"],
-      message: "issuer-signed publication cannot include signing-authority fields"
-    });
-  }
-  if (input.mode === "signing-authority") {
-    if (input.signedCredential !== void 0) {
-      ctx.addIssue({
-        code: "custom",
-        path: ["signedCredential"],
-        message: "signing-authority publication cannot include signedCredential"
-      });
-    }
-    if (!input.credential) {
-      ctx.addIssue({
-        code: "custom",
-        path: ["credential"],
-        message: "credential is required for signing-authority publication"
-      });
-    }
-    if (!input.signingAuthority) {
-      ctx.addIssue({
-        code: "custom",
-        path: ["signingAuthority"],
-        message: "signingAuthority is required for signing-authority publication"
-      });
-    }
-  }
-});
-var PublishCredentialRefreshNotificationValidator = external_exports.enum([
-  "queued",
-  "suppressed",
-  "not-applicable",
-  /** Publication succeeded, but the post-commit notification enqueue must be retried. */
-  "delivery-failed"
-]);
-var PublishCredentialRefreshResultValidator = external_exports.object({
-  refreshId: external_exports.string().min(1),
-  version: external_exports.number().int().positive(),
-  publishedAt: external_exports.string().min(1),
-  notification: PublishCredentialRefreshNotificationValidator
-});
-var CredentialRefreshVersionMetadataValidator = external_exports.object({
-  version: external_exports.number().int().positive(),
-  publishedAt: external_exports.string().min(1),
-  effectiveAt: external_exports.string().optional(),
-  etag: external_exports.string().optional(),
-  signingMode: CredentialRefreshSigningModeValidator.optional(),
-  updateSummary: external_exports.string().optional()
-});
-var GetCredentialRefreshHistoryInputValidator = external_exports.object({
-  refreshId: external_exports.string().min(1),
-  cursor: external_exports.string().optional(),
-  limit: external_exports.number().int().positive().optional()
-});
-var GetCredentialRefreshHistoryResultValidator = external_exports.object({
-  records: CredentialRefreshVersionMetadataValidator.array(),
-  hasMore: external_exports.boolean(),
-  cursor: external_exports.string().optional()
-});
-var CredentialRefreshChallengeValidator = external_exports.object({
-  challenge: external_exports.string().min(1),
-  expiresAt: external_exports.string().min(1),
-  domain: external_exports.string().optional(),
-  scheme: external_exports.literal("LearnCardDIDAuth").optional()
-});
-var PublicCredentialRefreshEnvelopeValidator = external_exports.object({
-  format: external_exports.literal("vc"),
-  credential: VCValidator,
-  etag: external_exports.string().optional()
-});
-var JweCredentialRefreshEnvelopeValidator = external_exports.object({
-  format: external_exports.literal("jwe"),
-  jwe: JWEValidator,
-  etag: external_exports.string().optional(),
-  /** Present on LearnCard-managed endpoints; optional for interoperable JWE services. */
-  version: external_exports.number().int().positive().optional()
-});
-var CredentialRefreshResponseEnvelopeValidator = external_exports.discriminatedUnion("format", [
-  PublicCredentialRefreshEnvelopeValidator,
-  JweCredentialRefreshEnvelopeValidator
-]);
-var CredentialRefreshFailureCodeValidator = external_exports.enum([
-  "UNAVAILABLE",
-  "TIMEOUT",
-  "UNSUPPORTED_SERVICE",
-  "UNAUTHORIZED",
-  "MALFORMED_RESPONSE",
-  "INVALID_PROOF",
-  "ISSUER_MISMATCH",
-  "ID_MISMATCH",
-  "ROLLBACK",
-  "REVOKED",
-  "UNSAFE_ENDPOINT"
-]);
-var CredentialRefreshUpdatedResultValidator = external_exports.object({
-  status: external_exports.literal("updated"),
-  credential: VCValidator,
-  etag: external_exports.string().optional(),
-  managedVersion: external_exports.number().int().positive().optional()
-});
-var CredentialRefreshUnchangedResultValidator = external_exports.object({
-  status: external_exports.literal("unchanged"),
-  checkedAt: external_exports.string().min(1),
-  etag: external_exports.string().optional()
-});
-var CredentialRefreshUnsupportedResultValidator = external_exports.object({
-  status: external_exports.literal("unsupported")
-});
-var CredentialRefreshFailedResultValidator = external_exports.object({
-  status: external_exports.literal("failed"),
-  code: CredentialRefreshFailureCodeValidator,
-  retryable: external_exports.boolean()
-});
-var CredentialRefreshResultValidator = external_exports.discriminatedUnion("status", [
-  CredentialRefreshUpdatedResultValidator,
-  CredentialRefreshUnchangedResultValidator,
-  CredentialRefreshUnsupportedResultValidator,
-  CredentialRefreshFailedResultValidator
-]);
 
 // src/read.ts
 var isTemplateRenderMethod = /* @__PURE__ */ __name((rm) => TemplateRenderMethodValidator.safeParse(rm).success, "isTemplateRenderMethod");