@learncard/render-method-plugin 7.0.0 → 9.0.0

package/dist/render-method-plugin.esm.js

@@ -1332,10 +1332,10 @@ function $constructor(name, initializer3, params) {
   let Definition = _Definition;
   Object.defineProperty(Definition, "name", { value: name });
   function _(def) {
-    var _a6;
+    var _a7;
     const inst = params?.Parent ? new Definition() : this;
     init(inst, def);
-    (_a6 = inst._zod).deferred ?? (_a6.deferred = []);
+    (_a7 = inst._zod).deferred ?? (_a7.deferred = []);
     for (const fn of inst._zod.deferred) {
       fn();
     }
@@ -2001,8 +2001,8 @@ function explicitlyAborted(x, startIndex = 0) {
 __name(explicitlyAborted, "explicitlyAborted");
 function prefixIssues(path, issues) {
   return issues.map((iss) => {
-    var _a6;
-    (_a6 = iss).path ?? (_a6.path = []);
+    var _a7;
+    (_a7 = iss).path ?? (_a7.path = []);
     iss.path.unshift(path);
     return iss;
   });
@@ -2205,7 +2205,7 @@ __name(formatError, "formatError");
 function treeifyError(error51, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
   const processError = /* @__PURE__ */ __name((error52, path = []) => {
-    var _a6, _b;
+    var _a7, _b;
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
         issue2.errors.map((issues) => processError({ issues }, [...path, ...issue2.path]));
@@ -2226,7 +2226,7 @@ function treeifyError(error51, mapper = (issue2) => issue2.message) {
           const terminal = i === fullpath.length - 1;
           if (typeof el === "string") {
             curr.properties ?? (curr.properties = {});
-            (_a6 = curr.properties)[el] ?? (_a6[el] = { errors: [] });
+            (_a7 = curr.properties)[el] ?? (_a7[el] = { errors: [] });
             curr = curr.properties[el];
           } else {
             curr.items ?? (curr.items = []);
@@ -2531,10 +2531,10 @@ var sha512_base64url = /* @__PURE__ */ fixedBase64url(86);
 
 // ../../../node_modules/zod/v4/core/checks.js
 var $ZodCheck = /* @__PURE__ */ $constructor("$ZodCheck", (inst, def) => {
-  var _a6;
+  var _a7;
   inst._zod ?? (inst._zod = {});
   inst._zod.def = def;
-  (_a6 = inst._zod).onattach ?? (_a6.onattach = []);
+  (_a7 = inst._zod).onattach ?? (_a7.onattach = []);
 });
 var numericOriginMap = {
   number: "number",
@@ -2600,8 +2600,8 @@ var $ZodCheckGreaterThan = /* @__PURE__ */ $constructor("$ZodCheckGreaterThan",
 var $ZodCheckMultipleOf = /* @__PURE__ */ $constructor("$ZodCheckMultipleOf", (inst, def) => {
   $ZodCheck.init(inst, def);
   inst._zod.onattach.push((inst2) => {
-    var _a6;
-    (_a6 = inst2._zod.bag).multipleOf ?? (_a6.multipleOf = def.value);
+    var _a7;
+    (_a7 = inst2._zod.bag).multipleOf ?? (_a7.multipleOf = def.value);
   });
   inst._zod.check = (payload) => {
     if (typeof payload.value !== typeof def.value)
@@ -2734,9 +2734,9 @@ var $ZodCheckBigIntFormat = /* @__PURE__ */ $constructor("$ZodCheckBigIntFormat"
   };
 });
 var $ZodCheckMaxSize = /* @__PURE__ */ $constructor("$ZodCheckMaxSize", (inst, def) => {
-  var _a6;
+  var _a7;
   $ZodCheck.init(inst, def);
-  (_a6 = inst._zod.def).when ?? (_a6.when = (payload) => {
+  (_a7 = inst._zod.def).when ?? (_a7.when = (payload) => {
     const val = payload.value;
     return !nullish(val) && val.size !== void 0;
   });
@@ -2762,9 +2762,9 @@ var $ZodCheckMaxSize = /* @__PURE__ */ $constructor("$ZodCheckMaxSize", (inst, d
   };
 });
 var $ZodCheckMinSize = /* @__PURE__ */ $constructor("$ZodCheckMinSize", (inst, def) => {
-  var _a6;
+  var _a7;
   $ZodCheck.init(inst, def);
-  (_a6 = inst._zod.def).when ?? (_a6.when = (payload) => {
+  (_a7 = inst._zod.def).when ?? (_a7.when = (payload) => {
     const val = payload.value;
     return !nullish(val) && val.size !== void 0;
   });
@@ -2790,9 +2790,9 @@ var $ZodCheckMinSize = /* @__PURE__ */ $constructor("$ZodCheckMinSize", (inst, d
   };
 });
 var $ZodCheckSizeEquals = /* @__PURE__ */ $constructor("$ZodCheckSizeEquals", (inst, def) => {
-  var _a6;
+  var _a7;
   $ZodCheck.init(inst, def);
-  (_a6 = inst._zod.def).when ?? (_a6.when = (payload) => {
+  (_a7 = inst._zod.def).when ?? (_a7.when = (payload) => {
     const val = payload.value;
     return !nullish(val) && val.size !== void 0;
   });
@@ -2820,9 +2820,9 @@ var $ZodCheckSizeEquals = /* @__PURE__ */ $constructor("$ZodCheckSizeEquals", (i
   };
 });
 var $ZodCheckMaxLength = /* @__PURE__ */ $constructor("$ZodCheckMaxLength", (inst, def) => {
-  var _a6;
+  var _a7;
   $ZodCheck.init(inst, def);
-  (_a6 = inst._zod.def).when ?? (_a6.when = (payload) => {
+  (_a7 = inst._zod.def).when ?? (_a7.when = (payload) => {
     const val = payload.value;
     return !nullish(val) && val.length !== void 0;
   });
@@ -2849,9 +2849,9 @@ var $ZodCheckMaxLength = /* @__PURE__ */ $constructor("$ZodCheckMaxLength", (ins
   };
 });
 var $ZodCheckMinLength = /* @__PURE__ */ $constructor("$ZodCheckMinLength", (inst, def) => {
-  var _a6;
+  var _a7;
   $ZodCheck.init(inst, def);
-  (_a6 = inst._zod.def).when ?? (_a6.when = (payload) => {
+  (_a7 = inst._zod.def).when ?? (_a7.when = (payload) => {
     const val = payload.value;
     return !nullish(val) && val.length !== void 0;
   });
@@ -2878,9 +2878,9 @@ var $ZodCheckMinLength = /* @__PURE__ */ $constructor("$ZodCheckMinLength", (ins
   };
 });
 var $ZodCheckLengthEquals = /* @__PURE__ */ $constructor("$ZodCheckLengthEquals", (inst, def) => {
-  var _a6;
+  var _a7;
   $ZodCheck.init(inst, def);
-  (_a6 = inst._zod.def).when ?? (_a6.when = (payload) => {
+  (_a7 = inst._zod.def).when ?? (_a7.when = (payload) => {
     const val = payload.value;
     return !nullish(val) && val.length !== void 0;
   });
@@ -2909,7 +2909,7 @@ var $ZodCheckLengthEquals = /* @__PURE__ */ $constructor("$ZodCheckLengthEquals"
   };
 });
 var $ZodCheckStringFormat = /* @__PURE__ */ $constructor("$ZodCheckStringFormat", (inst, def) => {
-  var _a6, _b;
+  var _a7, _b;
   $ZodCheck.init(inst, def);
   inst._zod.onattach.push((inst2) => {
     const bag = inst2._zod.bag;
@@ -2920,7 +2920,7 @@ var $ZodCheckStringFormat = /* @__PURE__ */ $constructor("$ZodCheckStringFormat"
     }
   });
   if (def.pattern)
-    (_a6 = inst._zod).check ?? (_a6.check = (payload) => {
+    (_a7 = inst._zod).check ?? (_a7.check = (payload) => {
       def.pattern.lastIndex = 0;
       if (def.pattern.test(payload.value))
         return;
@@ -3125,7 +3125,7 @@ var version = {
 
 // ../../../node_modules/zod/v4/core/schemas.js
 var $ZodType = /* @__PURE__ */ $constructor("$ZodType", (inst, def) => {
-  var _a6;
+  var _a7;
   inst ?? (inst = {});
   inst._zod.def = def;
   inst._zod.bag = inst._zod.bag || {};
@@ -3140,7 +3140,7 @@ var $ZodType = /* @__PURE__ */ $constructor("$ZodType", (inst, def) => {
     }
   }
   if (checks.length === 0) {
-    (_a6 = inst._zod).deferred ?? (_a6.deferred = []);
+    (_a7 = inst._zod).deferred ?? (_a7.deferred = []);
     inst._zod.deferred?.push(() => {
       inst._zod.run = inst._zod.parse;
     });
@@ -12531,7 +12531,7 @@ function initializeContext(params) {
 }
 __name(initializeContext, "initializeContext");
 function process2(schema, ctx, _params = { path: [], schemaPath: [] }) {
-  var _a6;
+  var _a7;
   const def = schema._zod.def;
   const seen = ctx.seen.get(schema);
   if (seen) {
@@ -12579,7 +12579,7 @@ function process2(schema, ctx, _params = { path: [], schemaPath: [] }) {
     delete result.schema.default;
   }
   if (ctx.io === "input" && "_prefault" in result.schema)
-    (_a6 = result.schema).default ?? (_a6.default = result.schema._prefault);
+    (_a7 = result.schema).default ?? (_a7.default = result.schema._prefault);
   delete result.schema._prefault;
   const _result = ctx.seen.get(schema);
   return _result.schema;
@@ -15928,7 +15928,7 @@ var __toESM = /* @__PURE__ */ __name((mod, isNodeMode, target) => (target = mod
 var require_types_cjs_development = __commonJS({
   "../learn-card-types/dist/types.cjs.development.cjs"(exports, module) {
     "use strict";
-    var _a7, _b, _c, _d, _e, _f, _g;
+    var _a8, _b, _c, _d, _e, _f, _g;
     var __defProp22 = Object.defineProperty;
     var __getOwnPropDesc2 = Object.getOwnPropertyDescriptor;
     var __getOwnPropNames2 = Object.getOwnPropertyNames;
@@ -15949,12 +15949,15 @@ var require_types_cjs_development = __commonJS({
     var __toCommonJS = /* @__PURE__ */ __name2((mod) => __copyProps2(__defProp22({}, "__esModule", { value: true }), mod), "__toCommonJS");
     var index_exports = {};
     __export22(index_exports, {
+      ACT_AS_HEADER: /* @__PURE__ */ __name2(() => ACT_AS_HEADER, "ACT_AS_HEADER"),
       AUTH_GRANT_AUDIENCE_DOMAIN_PREFIX: /* @__PURE__ */ __name2(() => AUTH_GRANT_AUDIENCE_DOMAIN_PREFIX2, "AUTH_GRANT_AUDIENCE_DOMAIN_PREFIX"),
       AchievementCredentialValidator: /* @__PURE__ */ __name2(() => AchievementCredentialValidator2, "AchievementCredentialValidator"),
       AchievementCriteriaValidator: /* @__PURE__ */ __name2(() => AchievementCriteriaValidator2, "AchievementCriteriaValidator"),
       AchievementSubjectValidator: /* @__PURE__ */ __name2(() => AchievementSubjectValidator2, "AchievementSubjectValidator"),
       AchievementTypeValidator: /* @__PURE__ */ __name2(() => AchievementTypeValidator2, "AchievementTypeValidator"),
       AchievementValidator: /* @__PURE__ */ __name2(() => AchievementValidator2, "AchievementValidator"),
+      AcknowledgeViewInputValidator: /* @__PURE__ */ __name2(() => AcknowledgeViewInputValidator2, "AcknowledgeViewInputValidator"),
+      AcknowledgeViewOutputValidator: /* @__PURE__ */ __name2(() => AcknowledgeViewOutputValidator2, "AcknowledgeViewOutputValidator"),
       AddTagInputValidator: /* @__PURE__ */ __name2(() => AddTagInputValidator2, "AddTagInputValidator"),
       AddressValidator: /* @__PURE__ */ __name2(() => AddressValidator2, "AddressValidator"),
       AgeRatingValidator: /* @__PURE__ */ __name2(() => AgeRatingValidator2, "AgeRatingValidator"),
@@ -16032,6 +16035,7 @@ var require_types_cjs_development = __commonJS({
       CreateContactMethodSessionValidator: /* @__PURE__ */ __name2(() => CreateContactMethodSessionValidator2, "CreateContactMethodSessionValidator"),
       CreateManagedFrameworkBatchInputValidator: /* @__PURE__ */ __name2(() => CreateManagedFrameworkBatchInputValidator2, "CreateManagedFrameworkBatchInputValidator"),
       CreateManagedFrameworkInputValidator: /* @__PURE__ */ __name2(() => CreateManagedFrameworkInputValidator2, "CreateManagedFrameworkInputValidator"),
+      CreateShareLinkInputValidator: /* @__PURE__ */ __name2(() => CreateShareLinkInputValidator2, "CreateShareLinkInputValidator"),
       CreateSkillInputValidator: /* @__PURE__ */ __name2(() => CreateSkillInputValidator2, "CreateSkillInputValidator"),
       CreateSkillsBatchInputValidator: /* @__PURE__ */ __name2(() => CreateSkillsBatchInputValidator2, "CreateSkillsBatchInputValidator"),
       CredentialActivityEventTypeValidator: /* @__PURE__ */ __name2(() => CredentialActivityEventTypeValidator2, "CredentialActivityEventTypeValidator"),
@@ -16063,10 +16067,14 @@ var require_types_cjs_development = __commonJS({
       DeleteSkillInputValidator: /* @__PURE__ */ __name2(() => DeleteSkillInputValidator2, "DeleteSkillInputValidator"),
       DidDocumentValidator: /* @__PURE__ */ __name2(() => DidDocumentValidator2, "DidDocumentValidator"),
       EMPTY_IN_APP_MESSAGES_FLAG: /* @__PURE__ */ __name2(() => EMPTY_IN_APP_MESSAGES_FLAG, "EMPTY_IN_APP_MESSAGES_FLAG"),
+      ESCROW_PIN_LOCKED_MESSAGE: /* @__PURE__ */ __name2(() => ESCROW_PIN_LOCKED_MESSAGE, "ESCROW_PIN_LOCKED_MESSAGE"),
+      ESCROW_PIN_MISMATCH_PATTERN: /* @__PURE__ */ __name2(() => ESCROW_PIN_MISMATCH_PATTERN, "ESCROW_PIN_MISMATCH_PATTERN"),
+      ESCROW_PIN_UNAVAILABLE_MESSAGE: /* @__PURE__ */ __name2(() => ESCROW_PIN_UNAVAILABLE_MESSAGE, "ESCROW_PIN_UNAVAILABLE_MESSAGE"),
       EncryptedCredentialRecordValidator: /* @__PURE__ */ __name2(() => EncryptedCredentialRecordValidator2, "EncryptedCredentialRecordValidator"),
       EncryptedRecordValidator: /* @__PURE__ */ __name2(() => EncryptedRecordValidator2, "EncryptedRecordValidator"),
       EndorsementCredentialValidator: /* @__PURE__ */ __name2(() => EndorsementCredentialValidator2, "EndorsementCredentialValidator"),
       EndorsementSubjectValidator: /* @__PURE__ */ __name2(() => EndorsementSubjectValidator2, "EndorsementSubjectValidator"),
+      EscrowPinStatusValidator: /* @__PURE__ */ __name2(() => EscrowPinStatusValidator2, "EscrowPinStatusValidator"),
       EvidenceValidator: /* @__PURE__ */ __name2(() => EvidenceValidator2, "EvidenceValidator"),
       FlatAuthGrantValidator: /* @__PURE__ */ __name2(() => FlatAuthGrantValidator2, "FlatAuthGrantValidator"),
       FrameworkWithSkillsValidator: /* @__PURE__ */ __name2(() => FrameworkWithSkillsValidator2, "FrameworkWithSkillsValidator"),
@@ -16088,10 +16096,18 @@ var require_types_cjs_development = __commonJS({
       IdentifierTypeValidator: /* @__PURE__ */ __name2(() => IdentifierTypeValidator2, "IdentifierTypeValidator"),
       IdentityObjectValidator: /* @__PURE__ */ __name2(() => IdentityObjectValidator2, "IdentityObjectValidator"),
       ImageValidator: /* @__PURE__ */ __name2(() => ImageValidator2, "ImageValidator"),
+      InboxBatchErrorReasonValidator: /* @__PURE__ */ __name2(() => InboxBatchErrorReasonValidator2, "InboxBatchErrorReasonValidator"),
+      InboxBatchReceiptValidator: /* @__PURE__ */ __name2(() => InboxBatchReceiptValidator2, "InboxBatchReceiptValidator"),
+      InboxBatchStatusValidator: /* @__PURE__ */ __name2(() => InboxBatchStatusValidator2, "InboxBatchStatusValidator"),
       InboxCredentialQueryValidator: /* @__PURE__ */ __name2(() => InboxCredentialQueryValidator2, "InboxCredentialQueryValidator"),
+      InboxCredentialRefreshReceiptValidator: /* @__PURE__ */ __name2(() => InboxCredentialRefreshReceiptValidator2, "InboxCredentialRefreshReceiptValidator"),
       InboxCredentialValidator: /* @__PURE__ */ __name2(() => InboxCredentialValidator2, "InboxCredentialValidator"),
       IncrementCounterEventValidator: /* @__PURE__ */ __name2(() => IncrementCounterEventValidator2, "IncrementCounterEventValidator"),
       InstalledAppValidator: /* @__PURE__ */ __name2(() => InstalledAppValidator2, "InstalledAppValidator"),
+      IssueInboxCredentialBatchItemResultValidator: /* @__PURE__ */ __name2(() => IssueInboxCredentialBatchItemResultValidator2, "IssueInboxCredentialBatchItemResultValidator"),
+      IssueInboxCredentialBatchItemValidator: /* @__PURE__ */ __name2(() => IssueInboxCredentialBatchItemValidator2, "IssueInboxCredentialBatchItemValidator"),
+      IssueInboxCredentialBatchResponseValidator: /* @__PURE__ */ __name2(() => IssueInboxCredentialBatchResponseValidator2, "IssueInboxCredentialBatchResponseValidator"),
+      IssueInboxCredentialBatchValidator: /* @__PURE__ */ __name2(() => IssueInboxCredentialBatchValidator2, "IssueInboxCredentialBatchValidator"),
       IssueInboxCredentialResponseValidator: /* @__PURE__ */ __name2(() => IssueInboxCredentialResponseValidator2, "IssueInboxCredentialResponseValidator"),
       IssueInboxCredentialValidator: /* @__PURE__ */ __name2(() => IssueInboxCredentialValidator2, "IssueInboxCredentialValidator"),
       IssueInboxSigningAuthorityValidator: /* @__PURE__ */ __name2(() => IssueInboxSigningAuthorityValidator2, "IssueInboxSigningAuthorityValidator"),
@@ -16140,6 +16156,15 @@ var require_types_cjs_development = __commonJS({
       LaunchTypeValidator: /* @__PURE__ */ __name2(() => LaunchTypeValidator2, "LaunchTypeValidator"),
       LearnCardRefreshAuthorizationValidator: /* @__PURE__ */ __name2(() => LearnCardRefreshAuthorizationValidator2, "LearnCardRefreshAuthorizationValidator"),
       LinkProviderFrameworkInputValidator: /* @__PURE__ */ __name2(() => LinkProviderFrameworkInputValidator2, "LinkProviderFrameworkInputValidator"),
+      ListShareLinksInputValidator: /* @__PURE__ */ __name2(() => ListShareLinksInputValidator2, "ListShareLinksInputValidator"),
+      MAX_ENDORSEMENTS: /* @__PURE__ */ __name2(() => MAX_ENDORSEMENTS2, "MAX_ENDORSEMENTS"),
+      MAX_SELECTED_CREDENTIALS: /* @__PURE__ */ __name2(() => MAX_SELECTED_CREDENTIALS2, "MAX_SELECTED_CREDENTIALS"),
+      MAX_SHARE_CIPHERTEXT_BYTES: /* @__PURE__ */ __name2(() => MAX_SHARE_CIPHERTEXT_BYTES2, "MAX_SHARE_CIPHERTEXT_BYTES"),
+      MAX_SHARE_LINK_REQUEST_BYTES: /* @__PURE__ */ __name2(() => MAX_SHARE_LINK_REQUEST_BYTES2, "MAX_SHARE_LINK_REQUEST_BYTES"),
+      MAX_SHARE_RECOVERY_JWE_BYTES: /* @__PURE__ */ __name2(() => MAX_SHARE_RECOVERY_JWE_BYTES2, "MAX_SHARE_RECOVERY_JWE_BYTES"),
+      MAX_SHARE_SOURCE_URI_CHARS: /* @__PURE__ */ __name2(() => MAX_SHARE_SOURCE_URI_CHARS2, "MAX_SHARE_SOURCE_URI_CHARS"),
+      MAX_VP_MEMBERS: /* @__PURE__ */ __name2(() => MAX_VP_MEMBERS2, "MAX_VP_MEMBERS"),
+      ManagedCredentialRefreshReceiptValidator: /* @__PURE__ */ __name2(() => ManagedCredentialRefreshReceiptValidator2, "ManagedCredentialRefreshReceiptValidator"),
       ManagedCredentialRefreshServiceValidator: /* @__PURE__ */ __name2(() => ManagedCredentialRefreshServiceValidator2, "ManagedCredentialRefreshServiceValidator"),
       PaginatedAppStoreListingsValidator: /* @__PURE__ */ __name2(() => PaginatedAppStoreListingsValidator2, "PaginatedAppStoreListingsValidator"),
       PaginatedBoostRecipientsValidator: /* @__PURE__ */ __name2(() => PaginatedBoostRecipientsValidator2, "PaginatedBoostRecipientsValidator"),
@@ -16161,11 +16186,14 @@ var require_types_cjs_development = __commonJS({
       PaginatedLCNProfileManagersValidator: /* @__PURE__ */ __name2(() => PaginatedLCNProfileManagersValidator2, "PaginatedLCNProfileManagersValidator"),
       PaginatedLCNProfilesAndManagersValidator: /* @__PURE__ */ __name2(() => PaginatedLCNProfilesAndManagersValidator2, "PaginatedLCNProfilesAndManagersValidator"),
       PaginatedLCNProfilesValidator: /* @__PURE__ */ __name2(() => PaginatedLCNProfilesValidator2, "PaginatedLCNProfilesValidator"),
+      PaginatedShareLinksValidator: /* @__PURE__ */ __name2(() => PaginatedShareLinksValidator2, "PaginatedShareLinksValidator"),
       PaginatedSkillFrameworksValidator: /* @__PURE__ */ __name2(() => PaginatedSkillFrameworksValidator2, "PaginatedSkillFrameworksValidator"),
       PaginatedSkillTreeValidator: /* @__PURE__ */ __name2(() => PaginatedSkillTreeValidator2, "PaginatedSkillTreeValidator"),
       PaginatedVisibleLCNProfilesValidator: /* @__PURE__ */ __name2(() => PaginatedVisibleLCNProfilesValidator2, "PaginatedVisibleLCNProfilesValidator"),
       PaginationOptionsValidator: /* @__PURE__ */ __name2(() => PaginationOptionsValidator2, "PaginationOptionsValidator"),
       PaginationResponseValidator: /* @__PURE__ */ __name2(() => PaginationResponseValidator2, "PaginationResponseValidator"),
+      PrepareRefreshableSendInputValidator: /* @__PURE__ */ __name2(() => PrepareRefreshableSendInputValidator2, "PrepareRefreshableSendInputValidator"),
+      PrepareRefreshableSendResultValidator: /* @__PURE__ */ __name2(() => PrepareRefreshableSendResultValidator2, "PrepareRefreshableSendResultValidator"),
       ProfileValidator: /* @__PURE__ */ __name2(() => ProfileValidator2, "ProfileValidator"),
       ProfileVisibilityEnum: /* @__PURE__ */ __name2(() => ProfileVisibilityEnum2, "ProfileVisibilityEnum"),
       PromotionLevelValidator: /* @__PURE__ */ __name2(() => PromotionLevelValidator2, "PromotionLevelValidator"),
@@ -16183,14 +16211,24 @@ var require_types_cjs_development = __commonJS({
       ReplaceSkillFrameworkSkillsInputValidator: /* @__PURE__ */ __name2(() => ReplaceSkillFrameworkSkillsInputValidator2, "ReplaceSkillFrameworkSkillsInputValidator"),
       ReplaceSkillFrameworkSkillsResultValidator: /* @__PURE__ */ __name2(() => ReplaceSkillFrameworkSkillsResultValidator2, "ReplaceSkillFrameworkSkillsResultValidator"),
       RequestLearnerContextEventValidator: /* @__PURE__ */ __name2(() => RequestLearnerContextEventValidator2, "RequestLearnerContextEventValidator"),
+      ResolveShareLinkInputValidator: /* @__PURE__ */ __name2(() => ResolveShareLinkInputValidator2, "ResolveShareLinkInputValidator"),
       ResultDescriptionValidator: /* @__PURE__ */ __name2(() => ResultDescriptionValidator2, "ResultDescriptionValidator"),
       ResultStatusTypeValidator: /* @__PURE__ */ __name2(() => ResultStatusTypeValidator2, "ResultStatusTypeValidator"),
       ResultTypeValidator: /* @__PURE__ */ __name2(() => ResultTypeValidator2, "ResultTypeValidator"),
       ResultValidator: /* @__PURE__ */ __name2(() => ResultValidator2, "ResultValidator"),
       RubricCriterionValidator: /* @__PURE__ */ __name2(() => RubricCriterionValidator2, "RubricCriterionValidator"),
+      SHARE_AAD_PREFIX: /* @__PURE__ */ __name2(() => SHARE_AAD_PREFIX, "SHARE_AAD_PREFIX"),
+      SHARE_CONTENT_KEY_BYTES: /* @__PURE__ */ __name2(() => SHARE_CONTENT_KEY_BYTES2, "SHARE_CONTENT_KEY_BYTES"),
+      SHARE_IV_BYTES: /* @__PURE__ */ __name2(() => SHARE_IV_BYTES2, "SHARE_IV_BYTES"),
+      SHARE_LINK_ID_BYTES: /* @__PURE__ */ __name2(() => SHARE_LINK_ID_BYTES2, "SHARE_LINK_ID_BYTES"),
+      SHARE_LINK_PROTOCOL: /* @__PURE__ */ __name2(() => SHARE_LINK_PROTOCOL2, "SHARE_LINK_PROTOCOL"),
+      SHARE_RECOVERY_PROTOCOL: /* @__PURE__ */ __name2(() => SHARE_RECOVERY_PROTOCOL2, "SHARE_RECOVERY_PROTOCOL"),
+      SHARE_TAG_BYTES: /* @__PURE__ */ __name2(() => SHARE_TAG_BYTES2, "SHARE_TAG_BYTES"),
+      SHARE_VIEW_RECEIPT_TTL_SECONDS: /* @__PURE__ */ __name2(() => SHARE_VIEW_RECEIPT_TTL_SECONDS2, "SHARE_VIEW_RECEIPT_TTL_SECONDS"),
       SendAiSessionCredentialEventValidator: /* @__PURE__ */ __name2(() => SendAiSessionCredentialEventValidator2, "SendAiSessionCredentialEventValidator"),
       SendBoostInputValidator: /* @__PURE__ */ __name2(() => SendBoostInputValidator2, "SendBoostInputValidator"),
       SendBoostResponseValidator: /* @__PURE__ */ __name2(() => SendBoostResponseValidator2, "SendBoostResponseValidator"),
+      SendBoostTemplateValidator: /* @__PURE__ */ __name2(() => SendBoostTemplateValidator2, "SendBoostTemplateValidator"),
       SendBrandingOptionsValidator: /* @__PURE__ */ __name2(() => SendBrandingOptionsValidator2, "SendBrandingOptionsValidator"),
       SendCredentialEventValidator: /* @__PURE__ */ __name2(() => SendCredentialEventValidator2, "SendCredentialEventValidator"),
       SendInboxResponseValidator: /* @__PURE__ */ __name2(() => SendInboxResponseValidator2, "SendInboxResponseValidator"),
@@ -16201,6 +16239,32 @@ var require_types_cjs_development = __commonJS({
       SentCredentialInfoValidator: /* @__PURE__ */ __name2(() => SentCredentialInfoValidator2, "SentCredentialInfoValidator"),
       ServiceValidator: /* @__PURE__ */ __name2(() => ServiceValidator2, "ServiceValidator"),
       SetPrimaryContactMethodValidator: /* @__PURE__ */ __name2(() => SetPrimaryContactMethodValidator2, "SetPrimaryContactMethodValidator"),
+      ShareCiphertextValidator: /* @__PURE__ */ __name2(() => ShareCiphertextValidator2, "ShareCiphertextValidator"),
+      ShareContentKeyValidator: /* @__PURE__ */ __name2(() => ShareContentKeyValidator2, "ShareContentKeyValidator"),
+      ShareContentStateValidator: /* @__PURE__ */ __name2(() => ShareContentStateValidator2, "ShareContentStateValidator"),
+      ShareEndorsementEntryValidator: /* @__PURE__ */ __name2(() => ShareEndorsementEntryValidator2, "ShareEndorsementEntryValidator"),
+      ShareEnvelopeValidator: /* @__PURE__ */ __name2(() => ShareEnvelopeValidator2, "ShareEnvelopeValidator"),
+      ShareIvValidator: /* @__PURE__ */ __name2(() => ShareIvValidator2, "ShareIvValidator"),
+      ShareLinkIdInputValidator: /* @__PURE__ */ __name2(() => ShareLinkIdInputValidator2, "ShareLinkIdInputValidator"),
+      ShareLinkIdValidator: /* @__PURE__ */ __name2(() => ShareLinkIdValidator2, "ShareLinkIdValidator"),
+      ShareLinkOperationKeyInputValidator: /* @__PURE__ */ __name2(() => ShareLinkOperationKeyInputValidator2, "ShareLinkOperationKeyInputValidator"),
+      ShareLinkOwnerCommitOutputValidator: /* @__PURE__ */ __name2(() => ShareLinkOwnerCommitOutputValidator2, "ShareLinkOwnerCommitOutputValidator"),
+      ShareLinkOwnerContentOutputValidator: /* @__PURE__ */ __name2(() => ShareLinkOwnerContentOutputValidator2, "ShareLinkOwnerContentOutputValidator"),
+      ShareLinkOwnerRecoveryOutputValidator: /* @__PURE__ */ __name2(() => ShareLinkOwnerRecoveryOutputValidator2, "ShareLinkOwnerRecoveryOutputValidator"),
+      ShareLinkOwnerStatusOutputValidator: /* @__PURE__ */ __name2(() => ShareLinkOwnerStatusOutputValidator2, "ShareLinkOwnerStatusOutputValidator"),
+      ShareLinkPublicContentViewValidator: /* @__PURE__ */ __name2(() => ShareLinkPublicContentViewValidator2, "ShareLinkPublicContentViewValidator"),
+      ShareLinkPublicStateValidator: /* @__PURE__ */ __name2(() => ShareLinkPublicStateValidator2, "ShareLinkPublicStateValidator"),
+      ShareLinkStatusValidator: /* @__PURE__ */ __name2(() => ShareLinkStatusValidator2, "ShareLinkStatusValidator"),
+      ShareLinkValidator: /* @__PURE__ */ __name2(() => ShareLinkValidator2, "ShareLinkValidator"),
+      ShareManifestPresentationValidator: /* @__PURE__ */ __name2(() => ShareManifestPresentationValidator2, "ShareManifestPresentationValidator"),
+      ShareOwnerRecoveryValidator: /* @__PURE__ */ __name2(() => ShareOwnerRecoveryValidator2, "ShareOwnerRecoveryValidator"),
+      SharePayloadValidator: /* @__PURE__ */ __name2(() => SharePayloadValidator2, "SharePayloadValidator"),
+      SharePayloadValidatorShape: /* @__PURE__ */ __name2(() => SharePayloadValidatorShape2, "SharePayloadValidatorShape"),
+      ShareRecoveryEndorsementValidator: /* @__PURE__ */ __name2(() => ShareRecoveryEndorsementValidator2, "ShareRecoveryEndorsementValidator"),
+      ShareRecoveryPlaintextValidator: /* @__PURE__ */ __name2(() => ShareRecoveryPlaintextValidator2, "ShareRecoveryPlaintextValidator"),
+      ShareRecoverySelectionValidator: /* @__PURE__ */ __name2(() => ShareRecoverySelectionValidator2, "ShareRecoverySelectionValidator"),
+      ShareSelectionEntryValidator: /* @__PURE__ */ __name2(() => ShareSelectionEntryValidator2, "ShareSelectionEntryValidator"),
+      ShareSharerValidator: /* @__PURE__ */ __name2(() => ShareSharerValidator2, "ShareSharerValidator"),
       SkillDeletionStrategyValidator: /* @__PURE__ */ __name2(() => SkillDeletionStrategyValidator2, "SkillDeletionStrategyValidator"),
       SkillFrameworkAdminInputValidator: /* @__PURE__ */ __name2(() => SkillFrameworkAdminInputValidator2, "SkillFrameworkAdminInputValidator"),
       SkillFrameworkAdminsValidator: /* @__PURE__ */ __name2(() => SkillFrameworkAdminsValidator2, "SkillFrameworkAdminsValidator"),
@@ -16232,6 +16296,7 @@ var require_types_cjs_development = __commonJS({
       UnsignedVCValidator: /* @__PURE__ */ __name2(() => UnsignedVCValidator2, "UnsignedVCValidator"),
       UnsignedVPValidator: /* @__PURE__ */ __name2(() => UnsignedVPValidator2, "UnsignedVPValidator"),
       UpdateFrameworkInputValidator: /* @__PURE__ */ __name2(() => UpdateFrameworkInputValidator2, "UpdateFrameworkInputValidator"),
+      UpdateShareLinkInputValidator: /* @__PURE__ */ __name2(() => UpdateShareLinkInputValidator2, "UpdateShareLinkInputValidator"),
       UpdateSkillInputValidator: /* @__PURE__ */ __name2(() => UpdateSkillInputValidator2, "UpdateSkillInputValidator"),
       VC2EvidenceValidator: /* @__PURE__ */ __name2(() => VC2EvidenceValidator2, "VC2EvidenceValidator"),
       VCValidator: /* @__PURE__ */ __name2(() => VCValidator2, "VCValidator"),
@@ -16243,7 +16308,12 @@ var require_types_cjs_development = __commonJS({
       VerificationStatusValidator: /* @__PURE__ */ __name2(() => VerificationStatusValidator2, "VerificationStatusValidator"),
       appStoreActionValidator: /* @__PURE__ */ __name2(() => appStoreActionValidator2, "appStoreActionValidator"),
       capgoUpdateActionValidator: /* @__PURE__ */ __name2(() => capgoUpdateActionValidator2, "capgoUpdateActionValidator"),
+      classifyShareManifest: /* @__PURE__ */ __name2(() => classifyShareManifest2, "classifyShareManifest"),
+      decodeBase64Url: /* @__PURE__ */ __name2(() => decodeBase64Url2, "decodeBase64Url"),
+      decodedBase64UrlByteLength: /* @__PURE__ */ __name2(() => decodedBase64UrlByteLength, "decodedBase64UrlByteLength"),
       dismissActionValidator: /* @__PURE__ */ __name2(() => dismissActionValidator2, "dismissActionValidator"),
+      encodeBase64Url: /* @__PURE__ */ __name2(() => encodeBase64Url2, "encodeBase64Url"),
+      escrowPinMismatchMessage: /* @__PURE__ */ __name2(() => escrowPinMismatchMessage, "escrowPinMismatchMessage"),
       externalLinkActionValidator: /* @__PURE__ */ __name2(() => externalLinkActionValidator2, "externalLinkActionValidator"),
       inAppMessageActionStyleValidator: /* @__PURE__ */ __name2(() => inAppMessageActionStyleValidator2, "inAppMessageActionStyleValidator"),
       inAppMessageActionTargetValidator: /* @__PURE__ */ __name2(() => inAppMessageActionTargetValidator2, "inAppMessageActionTargetValidator"),
@@ -16258,10 +16328,12 @@ var require_types_cjs_development = __commonJS({
       inAppMessageVersionSourceValidator: /* @__PURE__ */ __name2(() => inAppMessageVersionSourceValidator2, "inAppMessageVersionSourceValidator"),
       inAppMessagesFlagValidator: /* @__PURE__ */ __name2(() => inAppMessagesFlagValidator2, "inAppMessagesFlagValidator"),
       internalLinkActionValidator: /* @__PURE__ */ __name2(() => internalLinkActionValidator2, "internalLinkActionValidator"),
+      isCanonicalBase64Url: /* @__PURE__ */ __name2(() => isCanonicalBase64Url2, "isCanonicalBase64Url"),
       isStoredCredentialEnvelope: /* @__PURE__ */ __name2(() => isStoredCredentialEnvelope2, "isStoredCredentialEnvelope"),
       parseInAppMessagesFlag: /* @__PURE__ */ __name2(() => parseInAppMessagesFlag, "parseInAppMessagesFlag"),
       platformPredicateValidator: /* @__PURE__ */ __name2(() => platformPredicateValidator2, "platformPredicateValidator"),
       rolePredicateValidator: /* @__PURE__ */ __name2(() => rolePredicateValidator2, "rolePredicateValidator"),
+      utf8ByteLength: /* @__PURE__ */ __name2(() => utf8ByteLength2, "utf8ByteLength"),
       versionPredicateValidator: /* @__PURE__ */ __name2(() => versionPredicateValidator2, "versionPredicateValidator")
     });
     module.exports = __toCommonJS(index_exports);
@@ -16783,7 +16855,7 @@ var require_types_cjs_development = __commonJS({
       util: /* @__PURE__ */ __name2(() => util_exports2, "util"),
       version: /* @__PURE__ */ __name2(() => version3, "version")
     });
-    var _a6;
+    var _a7;
     var NEVER2 = /* @__PURE__ */ Object.freeze({
       status: "aborted"
     });
@@ -16853,18 +16925,18 @@ var require_types_cjs_development = __commonJS({
     __name2($constructor2, "$constructor");
     __name22($constructor2, "$constructor");
     var $brand2 = /* @__PURE__ */ Symbol("zod_brand");
-    var $ZodAsyncError2 = (_a7 = class extends Error {
+    var $ZodAsyncError2 = (_a8 = class extends Error {
       constructor() {
         super(`Encountered Promise during synchronous parse. Use .parseAsync() instead.`);
       }
-    }, __name(_a7, "$ZodAsyncError"), __name2(_a7, "$ZodAsyncError"), __name22(_a7, "$ZodAsyncError"), _a7);
+    }, __name(_a8, "$ZodAsyncError"), __name2(_a8, "$ZodAsyncError"), __name22(_a8, "$ZodAsyncError"), _a8);
     var $ZodEncodeError2 = (_b = class extends Error {
       constructor(name) {
         super(`Encountered unidirectional transform during encode: ${name}`);
         this.name = "ZodEncodeError";
       }
     }, __name(_b, "$ZodEncodeError"), __name2(_b, "$ZodEncodeError"), __name22(_b, "$ZodEncodeError"), _b);
-    (_a6 = globalThis).__zod_globalConfig ?? (_a6.__zod_globalConfig = {});
+    (_a7 = globalThis).__zod_globalConfig ?? (_a7.__zod_globalConfig = {});
     var globalConfig2 = globalThis.__zod_globalConfig;
     function config2(newConfig) {
       if (newConfig)
@@ -16910,7 +16982,7 @@ var require_types_cjs_development = __commonJS({
       getSizableOrigin: /* @__PURE__ */ __name2(() => getSizableOrigin2, "getSizableOrigin"),
       hexToUint8Array: /* @__PURE__ */ __name2(() => hexToUint8Array2, "hexToUint8Array"),
       isObject: /* @__PURE__ */ __name2(() => isObject2, "isObject"),
-      isPlainObject: /* @__PURE__ */ __name2(() => isPlainObject3, "isPlainObject"),
+      isPlainObject: /* @__PURE__ */ __name2(() => isPlainObject22, "isPlainObject"),
       issue: /* @__PURE__ */ __name2(() => issue2, "issue"),
       joinValues: /* @__PURE__ */ __name2(() => joinValues2, "joinValues"),
       jsonStringifyReplacer: /* @__PURE__ */ __name2(() => jsonStringifyReplacer2, "jsonStringifyReplacer"),
@@ -17159,7 +17231,7 @@ var require_types_cjs_development = __commonJS({
         return false;
       }
     });
-    function isPlainObject3(o) {
+    function isPlainObject22(o) {
       if (isObject2(o) === false)
         return false;
       const ctor = o.constructor;
@@ -17175,11 +17247,11 @@ var require_types_cjs_development = __commonJS({
       }
       return true;
     }
-    __name(isPlainObject3, "isPlainObject");
-    __name2(isPlainObject3, "isPlainObject");
-    __name22(isPlainObject3, "isPlainObject");
+    __name(isPlainObject22, "isPlainObject2");
+    __name2(isPlainObject22, "isPlainObject");
+    __name22(isPlainObject22, "isPlainObject");
     function shallowClone2(o) {
-      if (isPlainObject3(o))
+      if (isPlainObject22(o))
         return { ...o };
       if (Array.isArray(o))
         return [...o];
@@ -17413,7 +17485,7 @@ var require_types_cjs_development = __commonJS({
     __name2(omit2, "omit");
     __name22(omit2, "omit");
     function extend2(schema, shape) {
-      if (!isPlainObject3(shape)) {
+      if (!isPlainObject22(shape)) {
         throw new Error("Invalid input to extend: expected a plain object");
       }
       const checks = schema._zod.def.checks;
@@ -17439,7 +17511,7 @@ var require_types_cjs_development = __commonJS({
     __name2(extend2, "extend");
     __name22(extend2, "extend");
     function safeExtend2(schema, shape) {
-      if (!isPlainObject3(shape)) {
+      if (!isPlainObject22(shape)) {
         throw new Error("Invalid input to safeExtend: expected a plain object");
       }
       const def = mergeDefs2(schema._zod.def, {
@@ -19895,7 +19967,7 @@ var require_types_cjs_development = __commonJS({
       if (a instanceof Date && b instanceof Date && +a === +b) {
         return { valid: true, data: a };
       }
-      if (isPlainObject3(a) && isPlainObject3(b)) {
+      if (isPlainObject22(a) && isPlainObject22(b)) {
         const bKeys = Object.keys(b);
         const sharedKeys = Object.keys(a).filter((key) => bKeys.indexOf(key) !== -1);
         const newObj = { ...a, ...b };
@@ -20096,7 +20168,7 @@ var require_types_cjs_development = __commonJS({
       $ZodType2.init(inst, def);
       inst._zod.parse = (payload, ctx) => {
         const input = payload.value;
-        if (!isPlainObject3(input)) {
+        if (!isPlainObject22(input)) {
           payload.issues.push({
             expected: "record",
             code: "invalid_type",
@@ -32508,6 +32580,204 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
         $or: BaseStringQuery2.array()
       })
     ]);
+    var LearnCardRefreshAuthorizationValidator2 = external_exports2.object({ type: external_exports2.literal("LearnCardDIDAuth") }).catchall(external_exports2.any());
+    var ManagedCredentialRefreshServiceValidator2 = external_exports2.object({
+      id: external_exports2.string().min(1),
+      type: external_exports2.literal("LearnCardCredentialRefresh2026"),
+      authorization: LearnCardRefreshAuthorizationValidator2.optional()
+    }).catchall(external_exports2.any());
+    var StandardCredentialRefreshServiceValidator2 = external_exports2.object({
+      id: external_exports2.string().min(1),
+      type: external_exports2.literal("1EdTechCredentialRefresh")
+    }).catchall(external_exports2.any());
+    var SupportedCredentialRefreshServiceValidator2 = external_exports2.union([
+      ManagedCredentialRefreshServiceValidator2,
+      StandardCredentialRefreshServiceValidator2
+    ]);
+    var AllocateCredentialRefreshInputValidator2 = external_exports2.object({
+      holder: external_exports2.object({
+        profileId: external_exports2.string().optional(),
+        did: external_exports2.string().min(1)
+      }),
+      credentialId: external_exports2.string().min(1)
+    });
+    var AllocateCredentialRefreshResultValidator2 = external_exports2.object({
+      refreshId: external_exports2.string().min(1),
+      refreshService: ManagedCredentialRefreshServiceValidator2.extend({
+        authorization: LearnCardRefreshAuthorizationValidator2
+      })
+    });
+    var ManagedCredentialRefreshReceiptValidator2 = external_exports2.object({
+      refreshId: external_exports2.string().min(1),
+      refreshService: ManagedCredentialRefreshServiceValidator2,
+      credentialId: external_exports2.string().min(1),
+      issuerDid: external_exports2.string().min(1),
+      holderDid: external_exports2.string().min(1),
+      credentialStatus: CredentialStatusValidator2.or(
+        CredentialStatusValidator2.array()
+      ).optional()
+    }).strip();
+    var InboxCredentialRefreshReceiptValidator2 = ManagedCredentialRefreshReceiptValidator2.omit(
+      { holderDid: true }
+    ).extend({ holderDid: external_exports2.string().min(1).optional() });
+    var CredentialRefreshSigningModeValidator2 = external_exports2.enum(["issuer-signed", "signing-authority"]);
+    var PublishCredentialRefreshBaseFields2 = {
+      refreshId: external_exports2.string().min(1),
+      notifyHolder: external_exports2.boolean().optional(),
+      updateSummary: external_exports2.string().optional(),
+      idempotencyKey: external_exports2.string().optional()
+    };
+    var PublishIssuerSignedRefreshValidator2 = external_exports2.object({
+      ...PublishCredentialRefreshBaseFields2,
+      mode: external_exports2.literal("issuer-signed"),
+      signedCredential: VCValidator2
+    });
+    var PublishSigningAuthorityRefreshValidator2 = external_exports2.object({
+      ...PublishCredentialRefreshBaseFields2,
+      mode: external_exports2.literal("signing-authority"),
+      credential: UnsignedVCValidator2,
+      signingAuthority: external_exports2.object({
+        type: external_exports2.string().min(1)
+      }).catchall(external_exports2.any())
+    });
+    var PublishCredentialRefreshInputValidator2 = external_exports2.object({
+      ...PublishCredentialRefreshBaseFields2,
+      mode: CredentialRefreshSigningModeValidator2,
+      signedCredential: VCValidator2.optional(),
+      credential: UnsignedVCValidator2.optional(),
+      signingAuthority: external_exports2.object({
+        type: external_exports2.string().min(1)
+      }).catchall(external_exports2.any()).optional()
+    }).superRefine((input, ctx) => {
+      if (input.mode === "issuer-signed" && !input.signedCredential) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["signedCredential"],
+          message: "signedCredential is required for issuer-signed publication"
+        });
+      }
+      if (input.mode === "issuer-signed" && (input.credential !== void 0 || input.signingAuthority !== void 0)) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["mode"],
+          message: "issuer-signed publication cannot include signing-authority fields"
+        });
+      }
+      if (input.mode === "signing-authority") {
+        if (input.signedCredential !== void 0) {
+          ctx.addIssue({
+            code: "custom",
+            path: ["signedCredential"],
+            message: "signing-authority publication cannot include signedCredential"
+          });
+        }
+        if (!input.credential) {
+          ctx.addIssue({
+            code: "custom",
+            path: ["credential"],
+            message: "credential is required for signing-authority publication"
+          });
+        }
+        if (!input.signingAuthority) {
+          ctx.addIssue({
+            code: "custom",
+            path: ["signingAuthority"],
+            message: "signingAuthority is required for signing-authority publication"
+          });
+        }
+      }
+    });
+    var PublishCredentialRefreshNotificationValidator2 = external_exports2.enum([
+      "queued",
+      "suppressed",
+      "not-applicable",
+      /** Publication succeeded, but the post-commit notification enqueue must be retried. */
+      "delivery-failed"
+    ]);
+    var PublishCredentialRefreshResultValidator2 = external_exports2.object({
+      refreshId: external_exports2.string().min(1),
+      version: external_exports2.number().int().positive(),
+      publishedAt: external_exports2.string().min(1),
+      notification: PublishCredentialRefreshNotificationValidator2
+    });
+    var CredentialRefreshVersionMetadataValidator2 = external_exports2.object({
+      version: external_exports2.number().int().positive(),
+      publishedAt: external_exports2.string().min(1),
+      effectiveAt: external_exports2.string().optional(),
+      etag: external_exports2.string().optional(),
+      signingMode: CredentialRefreshSigningModeValidator2.optional(),
+      updateSummary: external_exports2.string().optional()
+    });
+    var GetCredentialRefreshHistoryInputValidator2 = external_exports2.object({
+      refreshId: external_exports2.string().min(1),
+      cursor: external_exports2.string().optional(),
+      limit: external_exports2.number().int().positive().optional()
+    });
+    var GetCredentialRefreshHistoryResultValidator2 = external_exports2.object({
+      records: CredentialRefreshVersionMetadataValidator2.array(),
+      hasMore: external_exports2.boolean(),
+      cursor: external_exports2.string().optional()
+    });
+    var CredentialRefreshChallengeValidator2 = external_exports2.object({
+      challenge: external_exports2.string().min(1),
+      expiresAt: external_exports2.string().min(1),
+      domain: external_exports2.string().optional(),
+      scheme: external_exports2.literal("LearnCardDIDAuth").optional()
+    });
+    var PublicCredentialRefreshEnvelopeValidator2 = external_exports2.object({
+      format: external_exports2.literal("vc"),
+      credential: VCValidator2,
+      etag: external_exports2.string().optional()
+    });
+    var JweCredentialRefreshEnvelopeValidator2 = external_exports2.object({
+      format: external_exports2.literal("jwe"),
+      jwe: JWEValidator2,
+      etag: external_exports2.string().optional(),
+      /** Present on LearnCard-managed endpoints; optional for interoperable JWE services. */
+      version: external_exports2.number().int().positive().optional()
+    });
+    var CredentialRefreshResponseEnvelopeValidator2 = external_exports2.discriminatedUnion("format", [
+      PublicCredentialRefreshEnvelopeValidator2,
+      JweCredentialRefreshEnvelopeValidator2
+    ]);
+    var CredentialRefreshFailureCodeValidator2 = external_exports2.enum([
+      "UNAVAILABLE",
+      "TIMEOUT",
+      "UNSUPPORTED_SERVICE",
+      "UNAUTHORIZED",
+      "MALFORMED_RESPONSE",
+      "INVALID_PROOF",
+      "ISSUER_MISMATCH",
+      "ID_MISMATCH",
+      "ROLLBACK",
+      "REVOKED",
+      "UNSAFE_ENDPOINT"
+    ]);
+    var CredentialRefreshUpdatedResultValidator2 = external_exports2.object({
+      status: external_exports2.literal("updated"),
+      credential: VCValidator2,
+      etag: external_exports2.string().optional(),
+      managedVersion: external_exports2.number().int().positive().optional()
+    });
+    var CredentialRefreshUnchangedResultValidator2 = external_exports2.object({
+      status: external_exports2.literal("unchanged"),
+      checkedAt: external_exports2.string().min(1),
+      etag: external_exports2.string().optional()
+    });
+    var CredentialRefreshUnsupportedResultValidator2 = external_exports2.object({
+      status: external_exports2.literal("unsupported")
+    });
+    var CredentialRefreshFailedResultValidator2 = external_exports2.object({
+      status: external_exports2.literal("failed"),
+      code: CredentialRefreshFailureCodeValidator2,
+      retryable: external_exports2.boolean()
+    });
+    var CredentialRefreshResultValidator2 = external_exports2.discriminatedUnion("status", [
+      CredentialRefreshUpdatedResultValidator2,
+      CredentialRefreshUnchangedResultValidator2,
+      CredentialRefreshUnsupportedResultValidator2,
+      CredentialRefreshFailedResultValidator2
+    ]);
     var LCNProfileDisplayValidator2 = external_exports2.object({
       backgroundColor: external_exports2.string().optional(),
       backgroundImage: external_exports2.string().optional(),
@@ -32843,7 +33113,13 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
         "Options for email/phone recipients (Universal Inbox)"
       ),
       templateData: external_exports2.record(external_exports2.string(), external_exports2.unknown()).optional(),
-      integrationId: external_exports2.string().optional().describe("Integration ID for activity tracking")
+      integrationId: external_exports2.string().optional().describe("Integration ID for activity tracking"),
+      refresh: external_exports2.boolean().optional().describe(
+        "Request managed credential refresh for this send. Profile/DID recipients use immediate issuance; email/phone recipients use deferred Universal Inbox signing and bind the holder at claim."
+      ),
+      idempotencyKey: external_exports2.string().min(1).max(200).optional().describe(
+        "Caller-chosen key that makes a managed refresh send (refresh: true) safe to retry as a whole: retries with the same key reuse the same boost, refresh allocation and result. Reusing a key for a different request is rejected. With signedCredential, requires prior tRPC prepareRefreshableSend; direct REST callers omit the key and retry the exact signed credential and templateUri."
+      )
     }).refine((data) => data.templateUri || data.template || data.signedCredential, {
       message: "Either templateUri, template, or signedCredential must be provided.",
       path: ["templateUri"]
@@ -32858,8 +33134,12 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
         message: "guardianEmail must differ from recipient (self-approval not allowed)",
         path: ["options", "guardianEmail"]
       }
-    );
+    ).refine((data) => !data.idempotencyKey || data.refresh === true, {
+      message: "idempotencyKey is only supported with refresh: true.",
+      path: ["idempotencyKey"]
+    });
     var SendInboxResponseValidator2 = external_exports2.object({
+      refresh: InboxCredentialRefreshReceiptValidator2.optional(),
       issuanceId: external_exports2.string(),
       status: external_exports2.enum(["PENDING", "ISSUED", "EXPIRED", "DELIVERED", "CLAIMED"]),
       claimUrl: external_exports2.string().url().optional().describe("Present when suppressDelivery=true"),
@@ -32874,8 +33154,34 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       activityId: external_exports2.string().describe("Links to the activity lifecycle for this issuance"),
       inbox: SendInboxResponseValidator2.optional().describe(
         "Present when sent via email/phone (Universal Inbox)"
+      ),
+      refresh: ManagedCredentialRefreshReceiptValidator2.optional().describe(
+        "Present when managed refresh was requested: issuance metadata the issuer keeps to publish future updates"
       )
     });
+    var PrepareRefreshableSendInputValidator2 = external_exports2.object({
+      recipient: external_exports2.string(),
+      templateUri: external_exports2.string().optional(),
+      template: SendBoostTemplateValidator2.optional(),
+      contractUri: external_exports2.string().optional(),
+      templateData: external_exports2.record(external_exports2.string(), external_exports2.unknown()).optional(),
+      integrationId: external_exports2.string().optional(),
+      /** Credential ID to allocate for; generated server-side when omitted. */
+      credentialId: external_exports2.string().min(1).optional(),
+      idempotencyKey: external_exports2.string().min(1).max(200).optional()
+    }).refine((data) => Boolean(data.templateUri) !== Boolean(data.template), {
+      message: "Provide exactly one of templateUri or template."
+    });
+    var PrepareRefreshableSendResultValidator2 = external_exports2.object({
+      boostUri: external_exports2.string(),
+      credentialId: external_exports2.string(),
+      refreshId: external_exports2.string(),
+      refreshService: ManagedCredentialRefreshServiceValidator2,
+      /** The DID to use as credentialSubject.id (recipient DID, or the profile's did:web). */
+      holderDid: external_exports2.string(),
+      /** Present when this idempotencyKey already completed: return it without signing. */
+      completed: SendBoostResponseValidator2.optional()
+    });
     var SendInputValidator2 = external_exports2.discriminatedUnion("type", [SendBoostInputValidator2]);
     var SendResponseValidator2 = external_exports2.discriminatedUnion("type", [SendBoostResponseValidator2]);
     var ConsentFlowTermsStatusValidator2 = external_exports2.enum(["live", "stale", "withdrawn"]);
@@ -33194,6 +33500,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       webhookUrl: external_exports2.string().optional()
     });
     var AUTH_GRANT_AUDIENCE_DOMAIN_PREFIX2 = "auth-grant:";
+    var ACT_AS_HEADER = "X-LearnCard-Act-As";
     var AuthGrantValidator2 = external_exports2.object({
       id: external_exports2.string(),
       name: external_exports2.string(),
@@ -33206,6 +33513,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
         }, "error")
       }),
       scope: external_exports2.string(),
+      actAs: external_exports2.string().optional(),
       createdAt: external_exports2.iso.datetime({ error: "createdAt must be a valid ISO 8601 datetime string" }),
       expiresAt: external_exports2.iso.datetime({ error: "expiresAt must be a valid ISO 8601 datetime string" }).nullish().optional()
     });
@@ -33277,6 +33585,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       sessionJwt: external_exports2.string()
     });
     var InboxCredentialValidator2 = external_exports2.object({
+      refresh: InboxCredentialRefreshReceiptValidator2.optional(),
+      refreshId: external_exports2.string().optional(),
       id: external_exports2.string(),
       credential: external_exports2.string().optional(),
       isSigned: external_exports2.boolean(),
@@ -33331,12 +33641,19 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       templateUri: external_exports2.string().optional().describe(
         "URI of a boost template to use for issuance. The boost credential will be resolved and used. Mutually exclusive with credential field."
       ),
+      refresh: external_exports2.boolean().optional().describe(
+        "Allocate managed refresh before signing. Requires unsigned content and a registered signing authority; binds the holder on claim."
+      ),
+      idempotencyKey: external_exports2.string().min(1).max(200).optional(),
       // === OPTIONAL FEATURES ===
       // Add major, distinct features at the top level.
       //consentRequest: ConsentRequestValidator.optional(),
       // === PROCESS CONFIGURATION (Optional) ===
       // HOW should this issuance be handled?
       configuration: external_exports2.object({
+        guardianEmail: external_exports2.string().email().optional().describe(
+          "Require approval from this guardian before the recipient can claim. Must differ from the recipient email."
+        ),
         signingAuthority: IssueInboxSigningAuthorityValidator2.optional().describe(
           "The signing authority to use for the credential. If not provided, the users default signing authority will be used if the credential is not signed."
         ),
@@ -33390,17 +33707,130 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       }).optional().describe(
         "Configuration for the credential issuance. If not provided, the default configuration will be used."
       )
+    }).refine((data) => !data.idempotencyKey || data.refresh === true, {
+      message: "idempotencyKey requires refresh: true."
     }).refine((data) => data.credential || data.templateUri, {
       message: "Either credential or templateUri must be provided.",
       path: ["credential"]
-    });
+    }).refine(
+      (data) => !data.configuration?.guardianEmail || data.recipient.type !== "email" || data.configuration.guardianEmail.toLowerCase() !== data.recipient.value.toLowerCase(),
+      {
+        message: "guardianEmail must differ from recipient (self-approval not allowed)",
+        path: ["configuration", "guardianEmail"]
+      }
+    );
     var IssueInboxCredentialResponseValidator2 = external_exports2.object({
+      refresh: InboxCredentialRefreshReceiptValidator2.optional(),
       issuanceId: external_exports2.string(),
       status: LCNInboxStatusEnumValidator2,
       recipient: ContactMethodQueryValidator2,
       claimUrl: external_exports2.string().url().optional(),
       recipientDid: external_exports2.string().optional()
     });
+    var InboxBatchConfigurationValidator2 = IssueInboxCredentialValidator2.shape.configuration.unwrap().extend({
+      refresh: IssueInboxCredentialValidator2.shape.refresh.describe(
+        "Enable managed refresh by default. An item configuration.refresh overrides this value, including false."
+      ),
+      delivery: IssueInboxCredentialValidator2.shape.configuration.unwrap().shape.delivery.unwrap().extend({ suppress: external_exports2.boolean().optional() }).optional()
+    });
+    var InboxBatchItemConfigurationValidator2 = InboxBatchConfigurationValidator2.extend({
+      guardianEmail: InboxBatchConfigurationValidator2.shape.guardianEmail.nullable().describe(
+        "Require guardian approval, or set null to clear a batch-level guardianEmail for this item."
+      )
+    });
+    var IssueInboxCredentialBatchItemValidator2 = external_exports2.object({
+      ...IssueInboxCredentialValidator2.shape,
+      configuration: InboxBatchItemConfigurationValidator2.optional(),
+      idempotencyKey: external_exports2.string().max(256).optional()
+    }).refine((data) => data.credential || data.templateUri, {
+      message: "Either credential or templateUri must be provided.",
+      path: ["credential"]
+    }).describe(
+      "One issuance: provide credential or templateUri. Invalid input is rejected at submission with its item index."
+    );
+    var IssueInboxCredentialBatchValidator2 = external_exports2.object({
+      requestId: external_exports2.string().min(1).max(256).optional(),
+      items: external_exports2.array(IssueInboxCredentialBatchItemValidator2).min(1).max(100),
+      configuration: InboxBatchConfigurationValidator2.optional()
+    }).superRefine((batch, ctx) => {
+      batch.items.forEach((item, index) => {
+        const itemGuardian = item.configuration?.guardianEmail;
+        const guardian = itemGuardian === null ? void 0 : itemGuardian ?? batch.configuration?.guardianEmail;
+        if (guardian && item.recipient.type === "email" && guardian.toLowerCase() === item.recipient.value.toLowerCase()) {
+          ctx.addIssue({
+            code: "custom",
+            path: ["items", index, "configuration", "guardianEmail"],
+            message: "guardianEmail must differ from recipient (self-approval not allowed)"
+          });
+        }
+      });
+    });
+    var InboxBatchErrorReasonValidator2 = external_exports2.enum([
+      "DUPLICATE_KEY",
+      "IDEMPOTENCY_MISMATCH",
+      "IN_PROGRESS",
+      "UNCONFIRMED"
+    ]);
+    var IssueInboxCredentialBatchItemResultValidator2 = external_exports2.discriminatedUnion("success", [
+      IssueInboxCredentialResponseValidator2.extend({
+        success: external_exports2.literal(true),
+        index: external_exports2.number().int().nonnegative(),
+        deduplicated: external_exports2.boolean().optional(),
+        guardianStatus: GuardianStatusValidator2.optional(),
+        idempotencyKey: external_exports2.string().optional()
+      }),
+      external_exports2.object({
+        success: external_exports2.literal(false),
+        index: external_exports2.number().int().nonnegative(),
+        idempotencyKey: external_exports2.string().optional(),
+        recipient: ContactMethodQueryValidator2.optional(),
+        error: external_exports2.object({
+          code: external_exports2.string(),
+          message: external_exports2.string(),
+          reason: InboxBatchErrorReasonValidator2.optional()
+        }),
+        issuanceId: external_exports2.string().optional().describe(
+          "Present when issuance completed but replay storage could not be confirmed. Reconcile this issuance; do not issue again with a new key."
+        ),
+        claimUrl: external_exports2.string().url().optional().describe(
+          "Claim URL of the completed issuance, if available, when replay storage could not be confirmed."
+        )
+      })
+    ]);
+    var IssueInboxCredentialBatchResponseValidator2 = external_exports2.object({
+      results: external_exports2.array(IssueInboxCredentialBatchItemResultValidator2),
+      summary: external_exports2.object({
+        total: external_exports2.number(),
+        succeeded: external_exports2.number(),
+        failed: external_exports2.number(),
+        deduplicated: external_exports2.number()
+      })
+    });
+    var InboxBatchReceiptValidator2 = external_exports2.object({
+      batchId: external_exports2.string(),
+      status: external_exports2.enum(["QUEUED", "PROCESSING", "COMPLETED", "NEEDS_RECONCILIATION"]),
+      createdAt: external_exports2.string()
+    });
+    var InboxBatchStatusValidator2 = external_exports2.object({
+      batchId: external_exports2.string(),
+      createdAt: external_exports2.string(),
+      done: external_exports2.boolean().describe(
+        "True when no queued or processing items remain, including unconfirmed outcomes."
+      ),
+      status: external_exports2.enum(["QUEUED", "PROCESSING", "COMPLETED", "NEEDS_RECONCILIATION"]),
+      items: external_exports2.array(
+        external_exports2.object({
+          index: external_exports2.number().int().nonnegative(),
+          state: external_exports2.enum(["QUEUED", "PROCESSING", "COMPLETED", "NEEDS_RECONCILIATION"]),
+          result: IssueInboxCredentialBatchItemResultValidator2.optional()
+        })
+      ),
+      summary: IssueInboxCredentialBatchResponseValidator2.shape.summary.extend({
+        completed: external_exports2.number(),
+        pending: external_exports2.number(),
+        unconfirmed: external_exports2.number()
+      })
+    });
     var CredentialNameRefValidator2 = external_exports2.object({ name: external_exports2.string() }).passthrough();
     var ClaimInboxCredentialValidator2 = external_exports2.object({
       credential: VCValidator2.or(VPValidator2).or(UnsignedVCValidator2).or(CredentialNameRefValidator2).describe("The credential to issue, or a { name } reference to resolve a boost template."),
@@ -33886,6 +34316,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       eventType: CredentialActivityEventTypeValidator2,
       timestamp: external_exports2.string(),
       actorProfileId: external_exports2.string().optional(),
+      onBehalfOf: external_exports2.string().optional(),
       recipientType: CredentialActivityRecipientTypeValidator2,
       recipientIdentifier: external_exports2.string(),
       boostUri: external_exports2.string().optional(),
@@ -33926,6 +34357,16 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
         this.name = "AuthSessionError";
       }
     }, __name(_g, "AuthSessionError"), __name2(_g, "AuthSessionError"), __name22(_g, "AuthSessionError"), _g);
+    var ESCROW_PIN_LOCKED_MESSAGE = "Too many incorrect PIN attempts. You can still recover by waiting.";
+    var ESCROW_PIN_UNAVAILABLE_MESSAGE = "PIN recovery is not available for this account.";
+    var ESCROW_PIN_MISMATCH_PATTERN = /^Incorrect PIN\. (\d+) attempts left\.$/;
+    var escrowPinMismatchMessage = /* @__PURE__ */ __name22((attemptsRemaining) => `Incorrect PIN. ${attemptsRemaining} attempts left.`, "escrowPinMismatchMessage");
+    var EscrowPinStatusValidator2 = external_exports2.object({
+      state: external_exports2.enum(["none", "enabled", "locked", "stale"]),
+      enabled: external_exports2.boolean(),
+      attemptsRemaining: external_exports2.number().int().nonnegative(),
+      salt: external_exports2.string().optional()
+    });
     var BITSTRING_STATUS_PURPOSES2 = ["revocation", "suspension"];
     var DEFAULT_BITSTRING_STATUS_LIST_SIZE = 131072;
     var BitstringStatusPurposeValidator2 = external_exports2.enum(BITSTRING_STATUS_PURPOSES2);
@@ -34040,191 +34481,458 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       const result = inAppMessagesFlagValidator2.safeParse(raw);
       return result.success ? result.data : EMPTY_IN_APP_MESSAGES_FLAG;
     }, "parseInAppMessagesFlag");
-    var LearnCardRefreshAuthorizationValidator2 = external_exports2.object({ type: external_exports2.literal("LearnCardDIDAuth") }).catchall(external_exports2.any());
-    var ManagedCredentialRefreshServiceValidator2 = external_exports2.object({
-      id: external_exports2.string().min(1),
-      type: external_exports2.literal("LearnCardCredentialRefresh2026"),
-      authorization: LearnCardRefreshAuthorizationValidator2.optional()
-    }).catchall(external_exports2.any());
-    var StandardCredentialRefreshServiceValidator2 = external_exports2.object({
-      id: external_exports2.string().min(1),
-      type: external_exports2.literal("1EdTechCredentialRefresh")
-    }).catchall(external_exports2.any());
-    var SupportedCredentialRefreshServiceValidator2 = external_exports2.union([
-      ManagedCredentialRefreshServiceValidator2,
-      StandardCredentialRefreshServiceValidator2
-    ]);
-    var AllocateCredentialRefreshInputValidator2 = external_exports2.object({
-      holder: external_exports2.object({
-        profileId: external_exports2.string().optional(),
-        did: external_exports2.string().min(1)
-      }),
-      credentialId: external_exports2.string().min(1)
-    });
-    var AllocateCredentialRefreshResultValidator2 = external_exports2.object({
-      refreshId: external_exports2.string().min(1),
-      refreshService: ManagedCredentialRefreshServiceValidator2.extend({
-        authorization: LearnCardRefreshAuthorizationValidator2
-      })
-    });
-    var CredentialRefreshSigningModeValidator2 = external_exports2.enum(["issuer-signed", "signing-authority"]);
-    var PublishCredentialRefreshBaseFields2 = {
-      refreshId: external_exports2.string().min(1),
-      notifyHolder: external_exports2.boolean().optional(),
-      updateSummary: external_exports2.string().optional(),
-      idempotencyKey: external_exports2.string().optional()
-    };
-    var PublishIssuerSignedRefreshValidator2 = external_exports2.object({
-      ...PublishCredentialRefreshBaseFields2,
-      mode: external_exports2.literal("issuer-signed"),
-      signedCredential: VCValidator2
-    });
-    var PublishSigningAuthorityRefreshValidator2 = external_exports2.object({
-      ...PublishCredentialRefreshBaseFields2,
-      mode: external_exports2.literal("signing-authority"),
-      credential: UnsignedVCValidator2,
-      signingAuthority: external_exports2.object({
-        type: external_exports2.string().min(1)
-      }).catchall(external_exports2.any())
-    });
-    var PublishCredentialRefreshInputValidator2 = external_exports2.object({
-      ...PublishCredentialRefreshBaseFields2,
-      mode: CredentialRefreshSigningModeValidator2,
-      signedCredential: VCValidator2.optional(),
-      credential: UnsignedVCValidator2.optional(),
-      signingAuthority: external_exports2.object({
-        type: external_exports2.string().min(1)
-      }).catchall(external_exports2.any()).optional()
-    }).superRefine((input, ctx) => {
-      if (input.mode === "issuer-signed" && !input.signedCredential) {
-        ctx.addIssue({
-          code: "custom",
-          path: ["signedCredential"],
-          message: "signedCredential is required for issuer-signed publication"
-        });
+    var SHARE_LINK_ID_BYTES2 = 16;
+    var SHARE_CONTENT_KEY_BYTES2 = 32;
+    var SHARE_IV_BYTES2 = 12;
+    var SHARE_TAG_BYTES2 = 16;
+    var MAX_SHARE_CIPHERTEXT_BYTES2 = 512 * 1024;
+    var MAX_SHARE_RECOVERY_JWE_BYTES2 = 64 * 1024;
+    var MAX_SELECTED_CREDENTIALS2 = 50;
+    var MAX_ENDORSEMENTS2 = 200;
+    var MAX_VP_MEMBERS2 = MAX_SELECTED_CREDENTIALS2 + MAX_ENDORSEMENTS2;
+    var MAX_SHARE_SOURCE_URI_CHARS2 = 2048;
+    var MAX_SHARE_LINK_REQUEST_BYTES2 = 1024 * 1024;
+    var SHARE_LINK_PROTOCOL2 = "lc-share/v1";
+    var SHARE_RECOVERY_PROTOCOL2 = "lc-share-recovery/v1";
+    var SHARE_AAD_PREFIX = "lc-share:v1";
+    var BASE64URL_ALPHABET2 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+    var BASE64URL_LOOKUP2 = (() => {
+      const table = new Int16Array(128).fill(-1);
+      for (let index = 0; index < BASE64URL_ALPHABET2.length; index += 1) {
+        table[BASE64URL_ALPHABET2.charCodeAt(index)] = index;
+      }
+      return table;
+    })();
+    var encodeBase64Url2 = /* @__PURE__ */ __name22((bytes) => {
+      let output = "";
+      for (let index = 0; index < bytes.length; index += 3) {
+        const first = bytes[index];
+        const second = bytes[index + 1];
+        const third = bytes[index + 2];
+        output += BASE64URL_ALPHABET2[first >> 2];
+        output += BASE64URL_ALPHABET2[(first & 3) << 4 | (second ?? 0) >> 4];
+        if (second === void 0) break;
+        output += BASE64URL_ALPHABET2[(second & 15) << 2 | (third ?? 0) >> 6];
+        if (third === void 0) break;
+        output += BASE64URL_ALPHABET2[third & 63];
+      }
+      return output;
+    }, "encodeBase64Url");
+    var decodeBase64Url2 = /* @__PURE__ */ __name22((value) => {
+      if (typeof value !== "string") return null;
+      const output = new Uint8Array(Math.floor(value.length * 6 / 8));
+      let bits = 0;
+      let bitCount = 0;
+      let outputIndex = 0;
+      for (let index = 0; index < value.length; index += 1) {
+        const code = value.charCodeAt(index);
+        const digit = code < 128 ? BASE64URL_LOOKUP2[code] : -1;
+        if (digit < 0) return null;
+        bits = bits << 6 | digit;
+        bitCount += 6;
+        if (bitCount >= 8) {
+          bitCount -= 8;
+          output[outputIndex] = bits >> bitCount & 255;
+          outputIndex += 1;
+        }
+      }
+      return output;
+    }, "decodeBase64Url");
+    var isCanonicalBase64Url2 = /* @__PURE__ */ __name22((value, expectedBytes) => {
+      if (typeof value !== "string") return false;
+      if (expectedBytes !== void 0 && value.length !== Math.ceil(expectedBytes * 4 / 3))
+        return false;
+      const decoded = decodeBase64Url2(value);
+      if (decoded === null) return false;
+      if (expectedBytes !== void 0 && decoded.length !== expectedBytes) return false;
+      return encodeBase64Url2(decoded) === value;
+    }, "isCanonicalBase64Url");
+    var decodedBase64UrlByteLength = /* @__PURE__ */ __name22((value) => decodeBase64Url2(value)?.length ?? null, "decodedBase64UrlByteLength");
+    var utf8ByteLength2 = /* @__PURE__ */ __name22((value) => new TextEncoder().encode(value).length, "utf8ByteLength");
+    var canonicalBase64Url2 = /* @__PURE__ */ __name22((bytes) => external_exports2.string().refine((value) => isCanonicalBase64Url2(value, bytes), {
+      message: `must be canonical base64url for exactly ${bytes} bytes`
+    }), "canonicalBase64Url");
+    var ShareLinkIdValidator2 = canonicalBase64Url2(SHARE_LINK_ID_BYTES2);
+    var ShareContentKeyValidator2 = canonicalBase64Url2(SHARE_CONTENT_KEY_BYTES2);
+    var ShareIvValidator2 = canonicalBase64Url2(SHARE_IV_BYTES2);
+    var ShareCiphertextValidator2 = external_exports2.string().refine(
+      (value) => {
+        if (value.length > Math.ceil(MAX_SHARE_CIPHERTEXT_BYTES2 * 4 / 3)) return false;
+        const decoded = decodeBase64Url2(value);
+        if (decoded === null) return false;
+        if (encodeBase64Url2(decoded) !== value) return false;
+        return decoded.length >= SHARE_TAG_BYTES2 && decoded.length <= MAX_SHARE_CIPHERTEXT_BYTES2;
+      },
+      {
+        message: `must be canonical base64url decoding to ${SHARE_TAG_BYTES2}..${MAX_SHARE_CIPHERTEXT_BYTES2} bytes`
       }
-      if (input.mode === "issuer-signed" && (input.credential !== void 0 || input.signingAuthority !== void 0)) {
+    );
+    var ShareEnvelopeValidator2 = external_exports2.object({
+      v: external_exports2.literal(1),
+      alg: external_exports2.literal("A256GCM"),
+      iv: ShareIvValidator2,
+      ct: ShareCiphertextValidator2
+    }).strict();
+    var safeVersion2 = external_exports2.number().int().min(1).max(2 ** 31 - 1);
+    var safeCredentialIndex2 = external_exports2.number().int().min(0).max(MAX_VP_MEMBERS2 - 1);
+    var ShareSelectionEntryValidator2 = external_exports2.object({ credentialIndex: safeCredentialIndex2 }).strict();
+    var ShareEndorsementEntryValidator2 = external_exports2.object({ credentialIndex: safeCredentialIndex2, targetCredentialIndex: safeCredentialIndex2 }).strict();
+    var ShareSharerValidator2 = external_exports2.object({
+      profileId: external_exports2.string().min(1).max(128),
+      displayName: external_exports2.string().min(1).max(120),
+      avatar: external_exports2.string().max(2048).optional()
+    }).strict();
+    var presentationShape2 = VPValidator2.extend({
+      verifiableCredential: VCValidator2.array().min(1).max(MAX_VP_MEMBERS2)
+    });
+    var hasBoundedPresentation2 = /* @__PURE__ */ __name22((value) => {
+      let credentialCount = 0;
+      const ancestors = /* @__PURE__ */ new Set();
+      const visit = /* @__PURE__ */ __name22((node, depth) => {
+        if (node === null || typeof node !== "object") return true;
+        if (depth > 32 || ancestors.has(node)) return false;
+        ancestors.add(node);
+        try {
+          for (const [key, child] of Object.entries(node)) {
+            if (key === "verifiableCredential") {
+              credentialCount += Array.isArray(child) ? child.length : 1;
+              if (credentialCount > MAX_VP_MEMBERS2) return false;
+            }
+            if (!visit(child, depth + 1)) return false;
+          }
+          return true;
+        } finally {
+          ancestors.delete(node);
+        }
+      }, "visit");
+      return visit(value, 0);
+    }, "hasBoundedPresentation");
+    var ShareManifestPresentationValidator2 = external_exports2.custom(
+      (value) => hasBoundedPresentation2(value) && presentationShape2.safeParse(value).success,
+      { message: "invalid share presentation" }
+    );
+    var SharePayloadValidatorShape2 = external_exports2.object({
+      protocol: external_exports2.literal(SHARE_LINK_PROTOCOL2),
+      shareId: ShareLinkIdValidator2,
+      contentVersion: safeVersion2,
+      createdAt: external_exports2.iso.datetime(),
+      sharer: ShareSharerValidator2,
+      presentation: ShareManifestPresentationValidator2,
+      selection: ShareSelectionEntryValidator2.array().min(1).max(MAX_SELECTED_CREDENTIALS2),
+      endorsements: ShareEndorsementEntryValidator2.array().max(MAX_ENDORSEMENTS2).default([])
+    }).strict();
+    var classificationFailure2 = /* @__PURE__ */ __name22((code, message, path = []) => ({ ok: false, code, message, path }), "classificationFailure");
+    var readSignedClaimId2 = /* @__PURE__ */ __name22((member) => {
+      if (member === null || typeof member !== "object") return void 0;
+      const record22 = member;
+      const claim = record22.credentialSubject ?? record22.endorsement;
+      if (claim === null || typeof claim !== "object") return void 0;
+      const claimRecord = claim;
+      const nested = claimRecord.endorsement;
+      const nestedId = nested !== null && typeof nested === "object" ? nested.id : void 0;
+      return claimRecord.id ?? nestedId;
+    }, "readSignedClaimId");
+    var classifyShareManifest2 = /* @__PURE__ */ __name22((payload) => {
+      const members = payload.presentation?.verifiableCredential;
+      if (!Array.isArray(members) || members.length === 0) {
+        return classificationFailure2("NO_PRESENTATION_MEMBERS", "presentation has no credentials");
+      }
+      if (members.length > MAX_VP_MEMBERS2) {
+        return classificationFailure2(
+          "TOO_MANY_VP_MEMBERS",
+          `presentation has ${members.length} members, over the ${MAX_VP_MEMBERS2} bound`
+        );
+      }
+      const selection = payload.selection;
+      const endorsements = payload.endorsements ?? [];
+      if (!Array.isArray(selection) || selection.length < 1 || selection.length > MAX_SELECTED_CREDENTIALS2) {
+        return classificationFailure2("BAD_SELECTION", "selection must contain 1..50 entries");
+      }
+      if (!Array.isArray(endorsements) || endorsements.length > MAX_ENDORSEMENTS2) {
+        return classificationFailure2(
+          "BAD_ENDORSEMENTS",
+          "endorsements must contain at most 200 entries"
+        );
+      }
+      const selectedIndices = [];
+      const selected = /* @__PURE__ */ new Set();
+      for (let index = 0; index < selection.length; index += 1) {
+        const entry = selection[index];
+        const credentialIndex = entry?.credentialIndex;
+        if (!Number.isSafeInteger(credentialIndex) || credentialIndex < 0 || credentialIndex >= members.length) {
+          return classificationFailure2(
+            "SELECTION_INDEX_OUT_OF_BOUNDS",
+            `selection[${index}].credentialIndex is out of bounds`,
+            ["selection", index, "credentialIndex"]
+          );
+        }
+        if (selected.has(credentialIndex)) {
+          return classificationFailure2(
+            "SELECTION_INDEX_DUPLICATE",
+            `selection[${index}].credentialIndex is duplicated`,
+            ["selection", index, "credentialIndex"]
+          );
+        }
+        selected.add(credentialIndex);
+        selectedIndices.push(credentialIndex);
+      }
+      const classified = new Set(selected);
+      const endorsementIndices = [];
+      for (let index = 0; index < endorsements.length; index += 1) {
+        const entry = endorsements[index];
+        const credentialIndex = entry?.credentialIndex;
+        const targetIndex = entry?.targetCredentialIndex;
+        if (!Number.isSafeInteger(credentialIndex) || credentialIndex < 0 || credentialIndex >= members.length) {
+          return classificationFailure2(
+            "ENDORSEMENT_INDEX_OUT_OF_BOUNDS",
+            `endorsements[${index}].credentialIndex is out of bounds`,
+            ["endorsements", index, "credentialIndex"]
+          );
+        }
+        if (classified.has(credentialIndex)) {
+          return classificationFailure2(
+            "VP_MEMBER_CLASSIFIED_TWICE",
+            `endorsements[${index}].credentialIndex was already classified`,
+            ["endorsements", index, "credentialIndex"]
+          );
+        }
+        if (!selected.has(targetIndex)) {
+          return classificationFailure2(
+            "ENDORSEMENT_TARGET_NOT_SELECTED",
+            `endorsements[${index}].targetCredentialIndex must reference a selected credential`,
+            ["endorsements", index, "targetCredentialIndex"]
+          );
+        }
+        const referenced = readSignedClaimId2(members[credentialIndex]);
+        const target = members[targetIndex];
+        const targetId = target !== null && typeof target === "object" ? target.id : void 0;
+        if (typeof referenced !== "string" || typeof targetId !== "string" || referenced !== targetId) {
+          return classificationFailure2(
+            "ENDORSEMENT_TARGET_UNBOUND",
+            `endorsements[${index}] claim does not reference the target credential id`,
+            ["endorsements", index]
+          );
+        }
+        classified.add(credentialIndex);
+        endorsementIndices.push(credentialIndex);
+      }
+      if (classified.size !== members.length) {
+        return classificationFailure2(
+          "UNCLASSIFIED_VP_MEMBER",
+          "every presentation member must be classified exactly once",
+          ["presentation", "verifiableCredential"]
+        );
+      }
+      return {
+        ok: true,
+        classification: { selectedIndices, endorsementIndices, memberCount: members.length }
+      };
+    }, "classifyShareManifest");
+    var SharePayloadValidator2 = SharePayloadValidatorShape2.superRefine((payload, ctx) => {
+      const result = classifyShareManifest2(payload);
+      if (!result.ok) {
         ctx.addIssue({
           code: "custom",
-          path: ["mode"],
-          message: "issuer-signed publication cannot include signing-authority fields"
+          message: result.message,
+          path: result.path,
+          params: { shareLinkCode: result.code }
         });
       }
-      if (input.mode === "signing-authority") {
-        if (input.signedCredential !== void 0) {
-          ctx.addIssue({
-            code: "custom",
-            path: ["signedCredential"],
-            message: "signing-authority publication cannot include signedCredential"
-          });
-        }
-        if (!input.credential) {
+    });
+    var ShareRecoverySelectionValidator2 = external_exports2.object({
+      ref: external_exports2.string().min(1).max(MAX_SHARE_SOURCE_URI_CHARS2),
+      order: external_exports2.number().int().min(0).max(MAX_SELECTED_CREDENTIALS2 - 1)
+    }).strict();
+    var ShareRecoveryEndorsementValidator2 = external_exports2.object({ targetRef: external_exports2.string().min(1).max(MAX_SHARE_SOURCE_URI_CHARS2) }).strict();
+    var ShareRecoveryPlaintextValidator2 = external_exports2.object({
+      protocol: external_exports2.literal(SHARE_RECOVERY_PROTOCOL2),
+      shareId: ShareLinkIdValidator2,
+      ownerProfileId: external_exports2.string().min(1).max(128),
+      createdAt: external_exports2.iso.datetime(),
+      latest: external_exports2.object({ contentVersion: safeVersion2, key: ShareContentKeyValidator2 }).strict(),
+      selection: ShareRecoverySelectionValidator2.array().min(1).max(MAX_SELECTED_CREDENTIALS2),
+      endorsements: ShareRecoveryEndorsementValidator2.array().max(MAX_ENDORSEMENTS2).default([])
+    }).strict().superRefine((recovery, ctx) => {
+      const orders = /* @__PURE__ */ new Set();
+      recovery.selection.forEach((entry, index) => {
+        if (entry.order >= recovery.selection.length) {
           ctx.addIssue({
             code: "custom",
-            path: ["credential"],
-            message: "credential is required for signing-authority publication"
+            message: "order must be within the selection bounds",
+            path: ["selection", index, "order"]
           });
         }
-        if (!input.signingAuthority) {
+        if (orders.has(entry.order)) {
           ctx.addIssue({
             code: "custom",
-            path: ["signingAuthority"],
-            message: "signingAuthority is required for signing-authority publication"
+            message: "order must be unique within the selection",
+            path: ["selection", index, "order"]
           });
         }
+        orders.add(entry.order);
+      });
+    });
+    var ShareOwnerRecoveryValidator2 = JWEValidator2.refine(
+      (value) => utf8ByteLength2(JSON.stringify(value)) <= MAX_SHARE_RECOVERY_JWE_BYTES2,
+      { message: `serialized recovery JWE must be at most ${MAX_SHARE_RECOVERY_JWE_BYTES2} bytes` }
+    );
+    var ShareLinkStatusValidator2 = external_exports2.enum(["pending", "active", "stopped"]);
+    var ShareContentStateValidator2 = external_exports2.enum(["staging", "finalized", "content_missing"]);
+    var ShareLinkValidator2 = external_exports2.object({
+      id: ShareLinkIdValidator2,
+      title: external_exports2.string().min(1).max(120),
+      note: external_exports2.string().max(500).optional(),
+      selectedCount: external_exports2.number().int().min(1).max(MAX_SELECTED_CREDENTIALS2),
+      version: safeVersion2,
+      contentVersion: safeVersion2,
+      status: ShareLinkStatusValidator2,
+      contentState: ShareContentStateValidator2,
+      createdAt: external_exports2.iso.datetime(),
+      updatedAt: external_exports2.iso.datetime(),
+      expiresAt: external_exports2.iso.datetime().nullable(),
+      stoppedAt: external_exports2.iso.datetime().nullable(),
+      lastViewedAt: external_exports2.iso.datetime().nullable(),
+      viewCount: external_exports2.number().int().min(0).optional(),
+      passcodeProtected: external_exports2.boolean(),
+      notifyOnView: external_exports2.boolean(),
+      minorPolicy: external_exports2.object({
+        isMinor: external_exports2.boolean().nullable(),
+        policyResolved: external_exports2.boolean(),
+        defaultExpiryDays: external_exports2.union([external_exports2.literal(30), external_exports2.literal(365)]),
+        viewCountingEnabled: external_exports2.boolean()
+      }),
+      /**
+       * Guarded application/API URL for the content. Optional because owner APIs in
+       * D1 have no public resolve/content endpoint yet; it must never be a
+       * LearnCloud object URL or carry a fabricated decryption key.
+       */
+      contentUrl: external_exports2.string().optional()
+    });
+    var clientRequestId2 = external_exports2.string().uuid();
+    var CreateShareLinkInputValidator2 = external_exports2.object({
+      id: ShareLinkIdValidator2,
+      clientRequestId: clientRequestId2,
+      title: external_exports2.string().min(1).max(120),
+      note: external_exports2.string().max(500).optional(),
+      expiresAt: external_exports2.iso.datetime().nullable().optional(),
+      passcode: external_exports2.string().min(8).max(64).optional(),
+      notifyOnView: external_exports2.boolean().default(false),
+      selectedCount: external_exports2.number().int().min(1).max(MAX_SELECTED_CREDENTIALS2),
+      contentVersion: external_exports2.literal(1),
+      envelope: ShareEnvelopeValidator2,
+      ownerEncryptedRecovery: ShareOwnerRecoveryValidator2
+    }).strict();
+    var UpdateShareLinkInputValidator2 = external_exports2.object({
+      id: ShareLinkIdValidator2,
+      expectedVersion: safeVersion2,
+      clientRequestId: clientRequestId2,
+      title: external_exports2.string().min(1).max(120).optional(),
+      note: external_exports2.string().max(500).nullable().optional(),
+      expiresAt: external_exports2.iso.datetime().nullable().optional(),
+      /** Omitted preserves the current passcode, null removes it, and a string replaces it. */
+      passcode: external_exports2.string().min(8).max(64).nullable().optional(),
+      notifyOnView: external_exports2.boolean().optional(),
+      contentVersion: safeVersion2.optional(),
+      selectedCount: external_exports2.number().int().min(1).max(MAX_SELECTED_CREDENTIALS2).optional(),
+      envelope: ShareEnvelopeValidator2.optional(),
+      ownerEncryptedRecovery: ShareOwnerRecoveryValidator2.optional()
+    }).strict().superRefine((value, ctx) => {
+      const provided = [
+        value.contentVersion,
+        value.selectedCount,
+        value.envelope,
+        value.ownerEncryptedRecovery
+      ].filter((field) => field !== void 0).length;
+      if (provided !== 0 && provided !== 4) {
+        ctx.addIssue({
+          code: "custom",
+          message: "content replacement requires contentVersion, selectedCount, envelope and ownerEncryptedRecovery together"
+        });
       }
     });
-    var PublishCredentialRefreshNotificationValidator2 = external_exports2.enum([
-      "queued",
-      "suppressed",
-      "not-applicable",
-      /** Publication succeeded, but the post-commit notification enqueue must be retried. */
-      "delivery-failed"
+    var ShareLinkIdInputValidator2 = external_exports2.object({ id: ShareLinkIdValidator2 }).strict();
+    var ShareLinkOperationKeyInputValidator2 = external_exports2.object({ id: ShareLinkIdValidator2, operationId: external_exports2.string().uuid() }).strict();
+    var ShareLinkOwnerCommitOutputValidator2 = external_exports2.discriminatedUnion("status", [
+      external_exports2.object({ status: external_exports2.literal("completed"), share: ShareLinkValidator2 }).strict(),
+      external_exports2.object({
+        status: external_exports2.literal("pending"),
+        id: ShareLinkIdValidator2,
+        operationId: external_exports2.string().uuid()
+      }).strict()
     ]);
-    var PublishCredentialRefreshResultValidator2 = external_exports2.object({
-      refreshId: external_exports2.string().min(1),
-      version: external_exports2.number().int().positive(),
-      publishedAt: external_exports2.string().min(1),
-      notification: PublishCredentialRefreshNotificationValidator2
-    });
-    var CredentialRefreshVersionMetadataValidator2 = external_exports2.object({
-      version: external_exports2.number().int().positive(),
-      publishedAt: external_exports2.string().min(1),
-      effectiveAt: external_exports2.string().optional(),
-      etag: external_exports2.string().optional(),
-      signingMode: CredentialRefreshSigningModeValidator2.optional(),
-      updateSummary: external_exports2.string().optional()
-    });
-    var GetCredentialRefreshHistoryInputValidator2 = external_exports2.object({
-      refreshId: external_exports2.string().min(1),
-      cursor: external_exports2.string().optional(),
-      limit: external_exports2.number().int().positive().optional()
-    });
-    var GetCredentialRefreshHistoryResultValidator2 = external_exports2.object({
-      records: CredentialRefreshVersionMetadataValidator2.array(),
-      hasMore: external_exports2.boolean(),
-      cursor: external_exports2.string().optional()
-    });
-    var CredentialRefreshChallengeValidator2 = external_exports2.object({
-      challenge: external_exports2.string().min(1),
-      expiresAt: external_exports2.string().min(1),
-      domain: external_exports2.string().optional(),
-      scheme: external_exports2.literal("LearnCardDIDAuth").optional()
-    });
-    var PublicCredentialRefreshEnvelopeValidator2 = external_exports2.object({
-      format: external_exports2.literal("vc"),
-      credential: VCValidator2,
-      etag: external_exports2.string().optional()
-    });
-    var JweCredentialRefreshEnvelopeValidator2 = external_exports2.object({
-      format: external_exports2.literal("jwe"),
-      jwe: JWEValidator2,
-      etag: external_exports2.string().optional(),
-      /** Present on LearnCard-managed endpoints; optional for interoperable JWE services. */
-      version: external_exports2.number().int().positive().optional()
-    });
-    var CredentialRefreshResponseEnvelopeValidator2 = external_exports2.discriminatedUnion("format", [
-      PublicCredentialRefreshEnvelopeValidator2,
-      JweCredentialRefreshEnvelopeValidator2
+    var ShareLinkOwnerStatusOutputValidator2 = external_exports2.discriminatedUnion("status", [
+      external_exports2.object({ status: external_exports2.literal("found"), share: ShareLinkValidator2 }).strict(),
+      external_exports2.object({
+        status: external_exports2.literal("pending"),
+        id: ShareLinkIdValidator2,
+        operationId: external_exports2.string().uuid()
+      }).strict(),
+      external_exports2.object({ status: external_exports2.literal("not_found"), id: ShareLinkIdValidator2 }).strict()
     ]);
-    var CredentialRefreshFailureCodeValidator2 = external_exports2.enum([
-      "UNAVAILABLE",
-      "TIMEOUT",
-      "UNSUPPORTED_SERVICE",
-      "UNAUTHORIZED",
-      "MALFORMED_RESPONSE",
-      "INVALID_PROOF",
-      "ISSUER_MISMATCH",
-      "ID_MISMATCH",
-      "ROLLBACK",
-      "REVOKED",
-      "UNSAFE_ENDPOINT"
+    var ShareLinkOwnerRecoveryOutputValidator2 = external_exports2.object({ recovery: ShareOwnerRecoveryValidator2 }).strict();
+    var ShareLinkOwnerContentOutputValidator2 = external_exports2.object({
+      id: ShareLinkIdValidator2,
+      contentVersion: safeVersion2,
+      envelope: ShareEnvelopeValidator2
+    }).strict();
+    var ResolveShareLinkInputValidator2 = external_exports2.object({
+      id: ShareLinkIdValidator2,
+      /** Sent only in a POST body; it must never be placed in a share URL. */
+      passcode: external_exports2.string().min(4).max(64).optional()
+    }).strict();
+    var ShareLinkPublicStateValidator2 = external_exports2.discriminatedUnion("state", [
+      external_exports2.object({
+        state: external_exports2.literal("passcode_required"),
+        id: ShareLinkIdValidator2
+      }).strict(),
+      external_exports2.object({ state: external_exports2.literal("try_later"), id: ShareLinkIdValidator2 }).strict(),
+      external_exports2.object({
+        state: external_exports2.literal("active"),
+        id: ShareLinkIdValidator2,
+        title: external_exports2.string().max(120),
+        note: external_exports2.string().max(500).optional(),
+        selectedCount: external_exports2.number().int().min(1).max(MAX_SELECTED_CREDENTIALS2),
+        contentVersion: safeVersion2,
+        contentUrl: external_exports2.string(),
+        sharer: external_exports2.object({
+          displayName: external_exports2.string().max(120),
+          avatar: external_exports2.string().max(2048).optional()
+        }),
+        createdAt: external_exports2.iso.datetime(),
+        updatedAt: external_exports2.iso.datetime(),
+        expiresAt: external_exports2.iso.datetime().nullable()
+      }).strict(),
+      external_exports2.object({
+        state: external_exports2.literal("expired"),
+        id: ShareLinkIdValidator2,
+        expiresAt: external_exports2.iso.datetime()
+      }).strict(),
+      external_exports2.object({
+        state: external_exports2.literal("stopped"),
+        id: ShareLinkIdValidator2,
+        stoppedAt: external_exports2.iso.datetime()
+      }).strict(),
+      external_exports2.object({ state: external_exports2.literal("not_found"), id: ShareLinkIdValidator2 }).strict()
     ]);
-    var CredentialRefreshUpdatedResultValidator2 = external_exports2.object({
-      status: external_exports2.literal("updated"),
-      credential: VCValidator2,
-      etag: external_exports2.string().optional(),
-      managedVersion: external_exports2.number().int().positive().optional()
-    });
-    var CredentialRefreshUnchangedResultValidator2 = external_exports2.object({
-      status: external_exports2.literal("unchanged"),
-      checkedAt: external_exports2.string().min(1),
-      etag: external_exports2.string().optional()
-    });
-    var CredentialRefreshUnsupportedResultValidator2 = external_exports2.object({
-      status: external_exports2.literal("unsupported")
-    });
-    var CredentialRefreshFailedResultValidator2 = external_exports2.object({
-      status: external_exports2.literal("failed"),
-      code: CredentialRefreshFailureCodeValidator2,
-      retryable: external_exports2.boolean()
+    var ListShareLinksInputValidator2 = external_exports2.object({
+      limit: external_exports2.number().int().min(1).max(50).default(25),
+      cursor: external_exports2.string().max(512).optional()
+    }).strict();
+    var PaginatedShareLinksValidator2 = PaginationResponseValidator2.extend({
+      records: ShareLinkValidator2.array()
     });
-    var CredentialRefreshResultValidator2 = external_exports2.discriminatedUnion("status", [
-      CredentialRefreshUpdatedResultValidator2,
-      CredentialRefreshUnchangedResultValidator2,
-      CredentialRefreshUnsupportedResultValidator2,
-      CredentialRefreshFailedResultValidator2
-    ]);
+    var AcknowledgeViewInputValidator2 = external_exports2.object({
+      receipt: external_exports2.string().min(22).max(128).regex(/^[A-Za-z0-9_-]+$/)
+    }).strict();
+    var AcknowledgeViewOutputValidator2 = external_exports2.object({ ok: external_exports2.literal(true) }).strict();
+    var SHARE_VIEW_RECEIPT_TTL_SECONDS2 = 10 * 60;
+    var ShareLinkPublicContentViewValidator2 = external_exports2.object({
+      id: ShareLinkIdValidator2,
+      contentVersion: safeVersion2,
+      envelope: ShareEnvelopeValidator2,
+      contentUrl: external_exports2.string(),
+      receipt: external_exports2.string().min(22).max(128).regex(/^[A-Za-z0-9_-]+$/)
+    }).strict();
   }
 });
 var require_dist = __commonJS({
@@ -34520,6 +35228,18 @@ var ImageWithLoadingStateValdator = external_exports.object({
 });
 var import_types2 = __toESM(require_dist());
 var import_types22 = __toESM(require_dist());
+var MANAGED_REFRESH_TYPE_TERM = "LearnCardCredentialRefresh2026";
+var MANAGED_REFRESH_DID_AUTH_TERM = "LearnCardDIDAuth";
+var MANAGED_REFRESH_TYPE_IRI = "https://learncard.com/refresh#LearnCardCredentialRefresh2026";
+var MANAGED_REFRESH_AUTHORIZATION_IRI = "https://purl.imsglobal.org/spec/ob/v3p0#authorization";
+var MANAGED_REFRESH_DID_AUTH_IRI = "https://docs.learncard.com/definitions#LearnCardDIDAuth";
+var MANAGED_REFRESH_SERVICE_CONTEXT = {
+  [MANAGED_REFRESH_TYPE_TERM]: MANAGED_REFRESH_TYPE_IRI,
+  authorization: {
+    "@id": MANAGED_REFRESH_AUTHORIZATION_IRI,
+    "@context": { [MANAGED_REFRESH_DID_AUTH_TERM]: MANAGED_REFRESH_DID_AUTH_IRI }
+  }
+};
 var _a4;
 var EnvironmentConfigurationError = (_a4 = class extends Error {
   constructor(message) {
@@ -34546,6 +35266,15 @@ var optionalEnvironmentPort = external_exports.preprocess(
   (value) => value === "" || value === void 0 ? void 0 : value,
   environmentPort.optional()
 );
+var DEFAULT_MAX_CANONICAL_BYTES = 2 * 1024 * 1024;
+var _a5;
+var ShareContentCanonicalizationError = (_a5 = class extends Error {
+  constructor(message) {
+    super(message);
+    this.code = "UNSUPPORTED_REQUEST_VALUE";
+    this.name = "ShareContentCanonicalizationError";
+  }
+}, __name(_a5, "ShareContentCanonicalizationError"), __name2(_a5, "ShareContentCanonicalizationError"), _a5);
 var unwrapBoostCredential = /* @__PURE__ */ __name2((vc) => {
   if (vc?.type?.includes("CertifiedBoostCredential") && vc?.boostCredential) {
     return vc.boostCredential;
@@ -35142,6 +35871,204 @@ var StringQuery = external_exports.union([
     $or: BaseStringQuery.array()
   })
 ]);
+var LearnCardRefreshAuthorizationValidator = external_exports.object({ type: external_exports.literal("LearnCardDIDAuth") }).catchall(external_exports.any());
+var ManagedCredentialRefreshServiceValidator = external_exports.object({
+  id: external_exports.string().min(1),
+  type: external_exports.literal("LearnCardCredentialRefresh2026"),
+  authorization: LearnCardRefreshAuthorizationValidator.optional()
+}).catchall(external_exports.any());
+var StandardCredentialRefreshServiceValidator = external_exports.object({
+  id: external_exports.string().min(1),
+  type: external_exports.literal("1EdTechCredentialRefresh")
+}).catchall(external_exports.any());
+var SupportedCredentialRefreshServiceValidator = external_exports.union([
+  ManagedCredentialRefreshServiceValidator,
+  StandardCredentialRefreshServiceValidator
+]);
+var AllocateCredentialRefreshInputValidator = external_exports.object({
+  holder: external_exports.object({
+    profileId: external_exports.string().optional(),
+    did: external_exports.string().min(1)
+  }),
+  credentialId: external_exports.string().min(1)
+});
+var AllocateCredentialRefreshResultValidator = external_exports.object({
+  refreshId: external_exports.string().min(1),
+  refreshService: ManagedCredentialRefreshServiceValidator.extend({
+    authorization: LearnCardRefreshAuthorizationValidator
+  })
+});
+var ManagedCredentialRefreshReceiptValidator = external_exports.object({
+  refreshId: external_exports.string().min(1),
+  refreshService: ManagedCredentialRefreshServiceValidator,
+  credentialId: external_exports.string().min(1),
+  issuerDid: external_exports.string().min(1),
+  holderDid: external_exports.string().min(1),
+  credentialStatus: CredentialStatusValidator.or(
+    CredentialStatusValidator.array()
+  ).optional()
+}).strip();
+var InboxCredentialRefreshReceiptValidator = ManagedCredentialRefreshReceiptValidator.omit(
+  { holderDid: true }
+).extend({ holderDid: external_exports.string().min(1).optional() });
+var CredentialRefreshSigningModeValidator = external_exports.enum(["issuer-signed", "signing-authority"]);
+var PublishCredentialRefreshBaseFields = {
+  refreshId: external_exports.string().min(1),
+  notifyHolder: external_exports.boolean().optional(),
+  updateSummary: external_exports.string().optional(),
+  idempotencyKey: external_exports.string().optional()
+};
+var PublishIssuerSignedRefreshValidator = external_exports.object({
+  ...PublishCredentialRefreshBaseFields,
+  mode: external_exports.literal("issuer-signed"),
+  signedCredential: VCValidator
+});
+var PublishSigningAuthorityRefreshValidator = external_exports.object({
+  ...PublishCredentialRefreshBaseFields,
+  mode: external_exports.literal("signing-authority"),
+  credential: UnsignedVCValidator,
+  signingAuthority: external_exports.object({
+    type: external_exports.string().min(1)
+  }).catchall(external_exports.any())
+});
+var PublishCredentialRefreshInputValidator = external_exports.object({
+  ...PublishCredentialRefreshBaseFields,
+  mode: CredentialRefreshSigningModeValidator,
+  signedCredential: VCValidator.optional(),
+  credential: UnsignedVCValidator.optional(),
+  signingAuthority: external_exports.object({
+    type: external_exports.string().min(1)
+  }).catchall(external_exports.any()).optional()
+}).superRefine((input, ctx) => {
+  if (input.mode === "issuer-signed" && !input.signedCredential) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["signedCredential"],
+      message: "signedCredential is required for issuer-signed publication"
+    });
+  }
+  if (input.mode === "issuer-signed" && (input.credential !== void 0 || input.signingAuthority !== void 0)) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["mode"],
+      message: "issuer-signed publication cannot include signing-authority fields"
+    });
+  }
+  if (input.mode === "signing-authority") {
+    if (input.signedCredential !== void 0) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["signedCredential"],
+        message: "signing-authority publication cannot include signedCredential"
+      });
+    }
+    if (!input.credential) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["credential"],
+        message: "credential is required for signing-authority publication"
+      });
+    }
+    if (!input.signingAuthority) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["signingAuthority"],
+        message: "signingAuthority is required for signing-authority publication"
+      });
+    }
+  }
+});
+var PublishCredentialRefreshNotificationValidator = external_exports.enum([
+  "queued",
+  "suppressed",
+  "not-applicable",
+  /** Publication succeeded, but the post-commit notification enqueue must be retried. */
+  "delivery-failed"
+]);
+var PublishCredentialRefreshResultValidator = external_exports.object({
+  refreshId: external_exports.string().min(1),
+  version: external_exports.number().int().positive(),
+  publishedAt: external_exports.string().min(1),
+  notification: PublishCredentialRefreshNotificationValidator
+});
+var CredentialRefreshVersionMetadataValidator = external_exports.object({
+  version: external_exports.number().int().positive(),
+  publishedAt: external_exports.string().min(1),
+  effectiveAt: external_exports.string().optional(),
+  etag: external_exports.string().optional(),
+  signingMode: CredentialRefreshSigningModeValidator.optional(),
+  updateSummary: external_exports.string().optional()
+});
+var GetCredentialRefreshHistoryInputValidator = external_exports.object({
+  refreshId: external_exports.string().min(1),
+  cursor: external_exports.string().optional(),
+  limit: external_exports.number().int().positive().optional()
+});
+var GetCredentialRefreshHistoryResultValidator = external_exports.object({
+  records: CredentialRefreshVersionMetadataValidator.array(),
+  hasMore: external_exports.boolean(),
+  cursor: external_exports.string().optional()
+});
+var CredentialRefreshChallengeValidator = external_exports.object({
+  challenge: external_exports.string().min(1),
+  expiresAt: external_exports.string().min(1),
+  domain: external_exports.string().optional(),
+  scheme: external_exports.literal("LearnCardDIDAuth").optional()
+});
+var PublicCredentialRefreshEnvelopeValidator = external_exports.object({
+  format: external_exports.literal("vc"),
+  credential: VCValidator,
+  etag: external_exports.string().optional()
+});
+var JweCredentialRefreshEnvelopeValidator = external_exports.object({
+  format: external_exports.literal("jwe"),
+  jwe: JWEValidator,
+  etag: external_exports.string().optional(),
+  /** Present on LearnCard-managed endpoints; optional for interoperable JWE services. */
+  version: external_exports.number().int().positive().optional()
+});
+var CredentialRefreshResponseEnvelopeValidator = external_exports.discriminatedUnion("format", [
+  PublicCredentialRefreshEnvelopeValidator,
+  JweCredentialRefreshEnvelopeValidator
+]);
+var CredentialRefreshFailureCodeValidator = external_exports.enum([
+  "UNAVAILABLE",
+  "TIMEOUT",
+  "UNSUPPORTED_SERVICE",
+  "UNAUTHORIZED",
+  "MALFORMED_RESPONSE",
+  "INVALID_PROOF",
+  "ISSUER_MISMATCH",
+  "ID_MISMATCH",
+  "ROLLBACK",
+  "REVOKED",
+  "UNSAFE_ENDPOINT"
+]);
+var CredentialRefreshUpdatedResultValidator = external_exports.object({
+  status: external_exports.literal("updated"),
+  credential: VCValidator,
+  etag: external_exports.string().optional(),
+  managedVersion: external_exports.number().int().positive().optional()
+});
+var CredentialRefreshUnchangedResultValidator = external_exports.object({
+  status: external_exports.literal("unchanged"),
+  checkedAt: external_exports.string().min(1),
+  etag: external_exports.string().optional()
+});
+var CredentialRefreshUnsupportedResultValidator = external_exports.object({
+  status: external_exports.literal("unsupported")
+});
+var CredentialRefreshFailedResultValidator = external_exports.object({
+  status: external_exports.literal("failed"),
+  code: CredentialRefreshFailureCodeValidator,
+  retryable: external_exports.boolean()
+});
+var CredentialRefreshResultValidator = external_exports.discriminatedUnion("status", [
+  CredentialRefreshUpdatedResultValidator,
+  CredentialRefreshUnchangedResultValidator,
+  CredentialRefreshUnsupportedResultValidator,
+  CredentialRefreshFailedResultValidator
+]);
 var LCNProfileDisplayValidator = external_exports.object({
   backgroundColor: external_exports.string().optional(),
   backgroundImage: external_exports.string().optional(),
@@ -35477,7 +36404,13 @@ var SendBoostInputValidator = external_exports.object({
     "Options for email/phone recipients (Universal Inbox)"
   ),
   templateData: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
-  integrationId: external_exports.string().optional().describe("Integration ID for activity tracking")
+  integrationId: external_exports.string().optional().describe("Integration ID for activity tracking"),
+  refresh: external_exports.boolean().optional().describe(
+    "Request managed credential refresh for this send. Profile/DID recipients use immediate issuance; email/phone recipients use deferred Universal Inbox signing and bind the holder at claim."
+  ),
+  idempotencyKey: external_exports.string().min(1).max(200).optional().describe(
+    "Caller-chosen key that makes a managed refresh send (refresh: true) safe to retry as a whole: retries with the same key reuse the same boost, refresh allocation and result. Reusing a key for a different request is rejected. With signedCredential, requires prior tRPC prepareRefreshableSend; direct REST callers omit the key and retry the exact signed credential and templateUri."
+  )
 }).refine((data) => data.templateUri || data.template || data.signedCredential, {
   message: "Either templateUri, template, or signedCredential must be provided.",
   path: ["templateUri"]
@@ -35492,8 +36425,12 @@ var SendBoostInputValidator = external_exports.object({
     message: "guardianEmail must differ from recipient (self-approval not allowed)",
     path: ["options", "guardianEmail"]
   }
-);
+).refine((data) => !data.idempotencyKey || data.refresh === true, {
+  message: "idempotencyKey is only supported with refresh: true.",
+  path: ["idempotencyKey"]
+});
 var SendInboxResponseValidator = external_exports.object({
+  refresh: InboxCredentialRefreshReceiptValidator.optional(),
   issuanceId: external_exports.string(),
   status: external_exports.enum(["PENDING", "ISSUED", "EXPIRED", "DELIVERED", "CLAIMED"]),
   claimUrl: external_exports.string().url().optional().describe("Present when suppressDelivery=true"),
@@ -35508,8 +36445,34 @@ var SendBoostResponseValidator = external_exports.object({
   activityId: external_exports.string().describe("Links to the activity lifecycle for this issuance"),
   inbox: SendInboxResponseValidator.optional().describe(
     "Present when sent via email/phone (Universal Inbox)"
+  ),
+  refresh: ManagedCredentialRefreshReceiptValidator.optional().describe(
+    "Present when managed refresh was requested: issuance metadata the issuer keeps to publish future updates"
   )
 });
+var PrepareRefreshableSendInputValidator = external_exports.object({
+  recipient: external_exports.string(),
+  templateUri: external_exports.string().optional(),
+  template: SendBoostTemplateValidator.optional(),
+  contractUri: external_exports.string().optional(),
+  templateData: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
+  integrationId: external_exports.string().optional(),
+  /** Credential ID to allocate for; generated server-side when omitted. */
+  credentialId: external_exports.string().min(1).optional(),
+  idempotencyKey: external_exports.string().min(1).max(200).optional()
+}).refine((data) => Boolean(data.templateUri) !== Boolean(data.template), {
+  message: "Provide exactly one of templateUri or template."
+});
+var PrepareRefreshableSendResultValidator = external_exports.object({
+  boostUri: external_exports.string(),
+  credentialId: external_exports.string(),
+  refreshId: external_exports.string(),
+  refreshService: ManagedCredentialRefreshServiceValidator,
+  /** The DID to use as credentialSubject.id (recipient DID, or the profile's did:web). */
+  holderDid: external_exports.string(),
+  /** Present when this idempotencyKey already completed: return it without signing. */
+  completed: SendBoostResponseValidator.optional()
+});
 var SendInputValidator = external_exports.discriminatedUnion("type", [SendBoostInputValidator]);
 var SendResponseValidator = external_exports.discriminatedUnion("type", [SendBoostResponseValidator]);
 var ConsentFlowTermsStatusValidator = external_exports.enum(["live", "stale", "withdrawn"]);
@@ -35840,6 +36803,7 @@ var AuthGrantValidator = external_exports.object({
     }, "error")
   }),
   scope: external_exports.string(),
+  actAs: external_exports.string().optional(),
   createdAt: external_exports.iso.datetime({ error: "createdAt must be a valid ISO 8601 datetime string" }),
   expiresAt: external_exports.iso.datetime({ error: "expiresAt must be a valid ISO 8601 datetime string" }).nullish().optional()
 });
@@ -35911,6 +36875,8 @@ var CreateContactMethodSessionResponseValidator = external_exports.object({
   sessionJwt: external_exports.string()
 });
 var InboxCredentialValidator = external_exports.object({
+  refresh: InboxCredentialRefreshReceiptValidator.optional(),
+  refreshId: external_exports.string().optional(),
   id: external_exports.string(),
   credential: external_exports.string().optional(),
   isSigned: external_exports.boolean(),
@@ -35965,12 +36931,19 @@ var IssueInboxCredentialValidator = external_exports.object({
   templateUri: external_exports.string().optional().describe(
     "URI of a boost template to use for issuance. The boost credential will be resolved and used. Mutually exclusive with credential field."
   ),
+  refresh: external_exports.boolean().optional().describe(
+    "Allocate managed refresh before signing. Requires unsigned content and a registered signing authority; binds the holder on claim."
+  ),
+  idempotencyKey: external_exports.string().min(1).max(200).optional(),
   // === OPTIONAL FEATURES ===
   // Add major, distinct features at the top level.
   //consentRequest: ConsentRequestValidator.optional(),
   // === PROCESS CONFIGURATION (Optional) ===
   // HOW should this issuance be handled?
   configuration: external_exports.object({
+    guardianEmail: external_exports.string().email().optional().describe(
+      "Require approval from this guardian before the recipient can claim. Must differ from the recipient email."
+    ),
     signingAuthority: IssueInboxSigningAuthorityValidator.optional().describe(
       "The signing authority to use for the credential. If not provided, the users default signing authority will be used if the credential is not signed."
     ),
@@ -36024,17 +36997,130 @@ var IssueInboxCredentialValidator = external_exports.object({
   }).optional().describe(
     "Configuration for the credential issuance. If not provided, the default configuration will be used."
   )
+}).refine((data) => !data.idempotencyKey || data.refresh === true, {
+  message: "idempotencyKey requires refresh: true."
 }).refine((data) => data.credential || data.templateUri, {
   message: "Either credential or templateUri must be provided.",
   path: ["credential"]
-});
+}).refine(
+  (data) => !data.configuration?.guardianEmail || data.recipient.type !== "email" || data.configuration.guardianEmail.toLowerCase() !== data.recipient.value.toLowerCase(),
+  {
+    message: "guardianEmail must differ from recipient (self-approval not allowed)",
+    path: ["configuration", "guardianEmail"]
+  }
+);
 var IssueInboxCredentialResponseValidator = external_exports.object({
+  refresh: InboxCredentialRefreshReceiptValidator.optional(),
   issuanceId: external_exports.string(),
   status: LCNInboxStatusEnumValidator,
   recipient: ContactMethodQueryValidator,
   claimUrl: external_exports.string().url().optional(),
   recipientDid: external_exports.string().optional()
 });
+var InboxBatchConfigurationValidator = IssueInboxCredentialValidator.shape.configuration.unwrap().extend({
+  refresh: IssueInboxCredentialValidator.shape.refresh.describe(
+    "Enable managed refresh by default. An item configuration.refresh overrides this value, including false."
+  ),
+  delivery: IssueInboxCredentialValidator.shape.configuration.unwrap().shape.delivery.unwrap().extend({ suppress: external_exports.boolean().optional() }).optional()
+});
+var InboxBatchItemConfigurationValidator = InboxBatchConfigurationValidator.extend({
+  guardianEmail: InboxBatchConfigurationValidator.shape.guardianEmail.nullable().describe(
+    "Require guardian approval, or set null to clear a batch-level guardianEmail for this item."
+  )
+});
+var IssueInboxCredentialBatchItemValidator = external_exports.object({
+  ...IssueInboxCredentialValidator.shape,
+  configuration: InboxBatchItemConfigurationValidator.optional(),
+  idempotencyKey: external_exports.string().max(256).optional()
+}).refine((data) => data.credential || data.templateUri, {
+  message: "Either credential or templateUri must be provided.",
+  path: ["credential"]
+}).describe(
+  "One issuance: provide credential or templateUri. Invalid input is rejected at submission with its item index."
+);
+var IssueInboxCredentialBatchValidator = external_exports.object({
+  requestId: external_exports.string().min(1).max(256).optional(),
+  items: external_exports.array(IssueInboxCredentialBatchItemValidator).min(1).max(100),
+  configuration: InboxBatchConfigurationValidator.optional()
+}).superRefine((batch, ctx) => {
+  batch.items.forEach((item, index) => {
+    const itemGuardian = item.configuration?.guardianEmail;
+    const guardian = itemGuardian === null ? void 0 : itemGuardian ?? batch.configuration?.guardianEmail;
+    if (guardian && item.recipient.type === "email" && guardian.toLowerCase() === item.recipient.value.toLowerCase()) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["items", index, "configuration", "guardianEmail"],
+        message: "guardianEmail must differ from recipient (self-approval not allowed)"
+      });
+    }
+  });
+});
+var InboxBatchErrorReasonValidator = external_exports.enum([
+  "DUPLICATE_KEY",
+  "IDEMPOTENCY_MISMATCH",
+  "IN_PROGRESS",
+  "UNCONFIRMED"
+]);
+var IssueInboxCredentialBatchItemResultValidator = external_exports.discriminatedUnion("success", [
+  IssueInboxCredentialResponseValidator.extend({
+    success: external_exports.literal(true),
+    index: external_exports.number().int().nonnegative(),
+    deduplicated: external_exports.boolean().optional(),
+    guardianStatus: GuardianStatusValidator.optional(),
+    idempotencyKey: external_exports.string().optional()
+  }),
+  external_exports.object({
+    success: external_exports.literal(false),
+    index: external_exports.number().int().nonnegative(),
+    idempotencyKey: external_exports.string().optional(),
+    recipient: ContactMethodQueryValidator.optional(),
+    error: external_exports.object({
+      code: external_exports.string(),
+      message: external_exports.string(),
+      reason: InboxBatchErrorReasonValidator.optional()
+    }),
+    issuanceId: external_exports.string().optional().describe(
+      "Present when issuance completed but replay storage could not be confirmed. Reconcile this issuance; do not issue again with a new key."
+    ),
+    claimUrl: external_exports.string().url().optional().describe(
+      "Claim URL of the completed issuance, if available, when replay storage could not be confirmed."
+    )
+  })
+]);
+var IssueInboxCredentialBatchResponseValidator = external_exports.object({
+  results: external_exports.array(IssueInboxCredentialBatchItemResultValidator),
+  summary: external_exports.object({
+    total: external_exports.number(),
+    succeeded: external_exports.number(),
+    failed: external_exports.number(),
+    deduplicated: external_exports.number()
+  })
+});
+var InboxBatchReceiptValidator = external_exports.object({
+  batchId: external_exports.string(),
+  status: external_exports.enum(["QUEUED", "PROCESSING", "COMPLETED", "NEEDS_RECONCILIATION"]),
+  createdAt: external_exports.string()
+});
+var InboxBatchStatusValidator = external_exports.object({
+  batchId: external_exports.string(),
+  createdAt: external_exports.string(),
+  done: external_exports.boolean().describe(
+    "True when no queued or processing items remain, including unconfirmed outcomes."
+  ),
+  status: external_exports.enum(["QUEUED", "PROCESSING", "COMPLETED", "NEEDS_RECONCILIATION"]),
+  items: external_exports.array(
+    external_exports.object({
+      index: external_exports.number().int().nonnegative(),
+      state: external_exports.enum(["QUEUED", "PROCESSING", "COMPLETED", "NEEDS_RECONCILIATION"]),
+      result: IssueInboxCredentialBatchItemResultValidator.optional()
+    })
+  ),
+  summary: IssueInboxCredentialBatchResponseValidator.shape.summary.extend({
+    completed: external_exports.number(),
+    pending: external_exports.number(),
+    unconfirmed: external_exports.number()
+  })
+});
 var CredentialNameRefValidator = external_exports.object({ name: external_exports.string() }).passthrough();
 var ClaimInboxCredentialValidator = external_exports.object({
   credential: VCValidator.or(VPValidator).or(UnsignedVCValidator).or(CredentialNameRefValidator).describe("The credential to issue, or a { name } reference to resolve a boost template."),
@@ -36520,6 +37606,7 @@ var CredentialActivityValidator = external_exports.object({
   eventType: CredentialActivityEventTypeValidator,
   timestamp: external_exports.string(),
   actorProfileId: external_exports.string().optional(),
+  onBehalfOf: external_exports.string().optional(),
   recipientType: CredentialActivityRecipientTypeValidator,
   recipientIdentifier: external_exports.string(),
   boostUri: external_exports.string().optional(),
@@ -36553,14 +37640,20 @@ var CredentialActivityStatsValidator = external_exports.object({
   failed: external_exports.number(),
   claimRate: external_exports.number()
 });
-var _a5;
-var AuthSessionError = (_a5 = class extends Error {
+var _a6;
+var AuthSessionError = (_a6 = class extends Error {
   constructor(message, reason) {
     super(message);
     this.reason = reason;
     this.name = "AuthSessionError";
   }
-}, __name(_a5, "AuthSessionError"), __name3(_a5, "AuthSessionError"), _a5);
+}, __name(_a6, "AuthSessionError"), __name3(_a6, "AuthSessionError"), _a6);
+var EscrowPinStatusValidator = external_exports.object({
+  state: external_exports.enum(["none", "enabled", "locked", "stale"]),
+  enabled: external_exports.boolean(),
+  attemptsRemaining: external_exports.number().int().nonnegative(),
+  salt: external_exports.string().optional()
+});
 var BITSTRING_STATUS_PURPOSES = ["revocation", "suspension"];
 var BitstringStatusPurposeValidator = external_exports.enum(BITSTRING_STATUS_PURPOSES);
 var BitstringStatusListEntryValidator = external_exports.object({
@@ -36669,191 +37762,456 @@ var inAppMessagesFlagValidator = external_exports.object({
   version: external_exports.number().default(1),
   messages: external_exports.array(inAppMessageValidator).default([])
 }).passthrough();
-var LearnCardRefreshAuthorizationValidator = external_exports.object({ type: external_exports.literal("LearnCardDIDAuth") }).catchall(external_exports.any());
-var ManagedCredentialRefreshServiceValidator = external_exports.object({
-  id: external_exports.string().min(1),
-  type: external_exports.literal("LearnCardCredentialRefresh2026"),
-  authorization: LearnCardRefreshAuthorizationValidator.optional()
-}).catchall(external_exports.any());
-var StandardCredentialRefreshServiceValidator = external_exports.object({
-  id: external_exports.string().min(1),
-  type: external_exports.literal("1EdTechCredentialRefresh")
-}).catchall(external_exports.any());
-var SupportedCredentialRefreshServiceValidator = external_exports.union([
-  ManagedCredentialRefreshServiceValidator,
-  StandardCredentialRefreshServiceValidator
-]);
-var AllocateCredentialRefreshInputValidator = external_exports.object({
-  holder: external_exports.object({
-    profileId: external_exports.string().optional(),
-    did: external_exports.string().min(1)
-  }),
-  credentialId: external_exports.string().min(1)
-});
-var AllocateCredentialRefreshResultValidator = external_exports.object({
-  refreshId: external_exports.string().min(1),
-  refreshService: ManagedCredentialRefreshServiceValidator.extend({
-    authorization: LearnCardRefreshAuthorizationValidator
-  })
-});
-var CredentialRefreshSigningModeValidator = external_exports.enum(["issuer-signed", "signing-authority"]);
-var PublishCredentialRefreshBaseFields = {
-  refreshId: external_exports.string().min(1),
-  notifyHolder: external_exports.boolean().optional(),
-  updateSummary: external_exports.string().optional(),
-  idempotencyKey: external_exports.string().optional()
-};
-var PublishIssuerSignedRefreshValidator = external_exports.object({
-  ...PublishCredentialRefreshBaseFields,
-  mode: external_exports.literal("issuer-signed"),
-  signedCredential: VCValidator
-});
-var PublishSigningAuthorityRefreshValidator = external_exports.object({
-  ...PublishCredentialRefreshBaseFields,
-  mode: external_exports.literal("signing-authority"),
-  credential: UnsignedVCValidator,
-  signingAuthority: external_exports.object({
-    type: external_exports.string().min(1)
-  }).catchall(external_exports.any())
-});
-var PublishCredentialRefreshInputValidator = external_exports.object({
-  ...PublishCredentialRefreshBaseFields,
-  mode: CredentialRefreshSigningModeValidator,
-  signedCredential: VCValidator.optional(),
-  credential: UnsignedVCValidator.optional(),
-  signingAuthority: external_exports.object({
-    type: external_exports.string().min(1)
-  }).catchall(external_exports.any()).optional()
-}).superRefine((input, ctx) => {
-  if (input.mode === "issuer-signed" && !input.signedCredential) {
-    ctx.addIssue({
-      code: "custom",
-      path: ["signedCredential"],
-      message: "signedCredential is required for issuer-signed publication"
-    });
+var SHARE_LINK_ID_BYTES = 16;
+var SHARE_CONTENT_KEY_BYTES = 32;
+var SHARE_IV_BYTES = 12;
+var SHARE_TAG_BYTES = 16;
+var MAX_SHARE_CIPHERTEXT_BYTES = 512 * 1024;
+var MAX_SHARE_RECOVERY_JWE_BYTES = 64 * 1024;
+var MAX_SELECTED_CREDENTIALS = 50;
+var MAX_ENDORSEMENTS = 200;
+var MAX_VP_MEMBERS = MAX_SELECTED_CREDENTIALS + MAX_ENDORSEMENTS;
+var MAX_SHARE_SOURCE_URI_CHARS = 2048;
+var MAX_SHARE_LINK_REQUEST_BYTES = 1024 * 1024;
+var SHARE_LINK_PROTOCOL = "lc-share/v1";
+var SHARE_RECOVERY_PROTOCOL = "lc-share-recovery/v1";
+var BASE64URL_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+var BASE64URL_LOOKUP = (() => {
+  const table = new Int16Array(128).fill(-1);
+  for (let index = 0; index < BASE64URL_ALPHABET.length; index += 1) {
+    table[BASE64URL_ALPHABET.charCodeAt(index)] = index;
+  }
+  return table;
+})();
+var encodeBase64Url = /* @__PURE__ */ __name3((bytes) => {
+  let output = "";
+  for (let index = 0; index < bytes.length; index += 3) {
+    const first = bytes[index];
+    const second = bytes[index + 1];
+    const third = bytes[index + 2];
+    output += BASE64URL_ALPHABET[first >> 2];
+    output += BASE64URL_ALPHABET[(first & 3) << 4 | (second ?? 0) >> 4];
+    if (second === void 0) break;
+    output += BASE64URL_ALPHABET[(second & 15) << 2 | (third ?? 0) >> 6];
+    if (third === void 0) break;
+    output += BASE64URL_ALPHABET[third & 63];
+  }
+  return output;
+}, "encodeBase64Url");
+var decodeBase64Url = /* @__PURE__ */ __name3((value) => {
+  if (typeof value !== "string") return null;
+  const output = new Uint8Array(Math.floor(value.length * 6 / 8));
+  let bits = 0;
+  let bitCount = 0;
+  let outputIndex = 0;
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    const digit = code < 128 ? BASE64URL_LOOKUP[code] : -1;
+    if (digit < 0) return null;
+    bits = bits << 6 | digit;
+    bitCount += 6;
+    if (bitCount >= 8) {
+      bitCount -= 8;
+      output[outputIndex] = bits >> bitCount & 255;
+      outputIndex += 1;
+    }
+  }
+  return output;
+}, "decodeBase64Url");
+var isCanonicalBase64Url = /* @__PURE__ */ __name3((value, expectedBytes) => {
+  if (typeof value !== "string") return false;
+  if (expectedBytes !== void 0 && value.length !== Math.ceil(expectedBytes * 4 / 3))
+    return false;
+  const decoded = decodeBase64Url(value);
+  if (decoded === null) return false;
+  if (expectedBytes !== void 0 && decoded.length !== expectedBytes) return false;
+  return encodeBase64Url(decoded) === value;
+}, "isCanonicalBase64Url");
+var utf8ByteLength = /* @__PURE__ */ __name3((value) => new TextEncoder().encode(value).length, "utf8ByteLength");
+var canonicalBase64Url = /* @__PURE__ */ __name3((bytes) => external_exports.string().refine((value) => isCanonicalBase64Url(value, bytes), {
+  message: `must be canonical base64url for exactly ${bytes} bytes`
+}), "canonicalBase64Url");
+var ShareLinkIdValidator = canonicalBase64Url(SHARE_LINK_ID_BYTES);
+var ShareContentKeyValidator = canonicalBase64Url(SHARE_CONTENT_KEY_BYTES);
+var ShareIvValidator = canonicalBase64Url(SHARE_IV_BYTES);
+var ShareCiphertextValidator = external_exports.string().refine(
+  (value) => {
+    if (value.length > Math.ceil(MAX_SHARE_CIPHERTEXT_BYTES * 4 / 3)) return false;
+    const decoded = decodeBase64Url(value);
+    if (decoded === null) return false;
+    if (encodeBase64Url(decoded) !== value) return false;
+    return decoded.length >= SHARE_TAG_BYTES && decoded.length <= MAX_SHARE_CIPHERTEXT_BYTES;
+  },
+  {
+    message: `must be canonical base64url decoding to ${SHARE_TAG_BYTES}..${MAX_SHARE_CIPHERTEXT_BYTES} bytes`
   }
-  if (input.mode === "issuer-signed" && (input.credential !== void 0 || input.signingAuthority !== void 0)) {
+);
+var ShareEnvelopeValidator = external_exports.object({
+  v: external_exports.literal(1),
+  alg: external_exports.literal("A256GCM"),
+  iv: ShareIvValidator,
+  ct: ShareCiphertextValidator
+}).strict();
+var safeVersion = external_exports.number().int().min(1).max(2 ** 31 - 1);
+var safeCredentialIndex = external_exports.number().int().min(0).max(MAX_VP_MEMBERS - 1);
+var ShareSelectionEntryValidator = external_exports.object({ credentialIndex: safeCredentialIndex }).strict();
+var ShareEndorsementEntryValidator = external_exports.object({ credentialIndex: safeCredentialIndex, targetCredentialIndex: safeCredentialIndex }).strict();
+var ShareSharerValidator = external_exports.object({
+  profileId: external_exports.string().min(1).max(128),
+  displayName: external_exports.string().min(1).max(120),
+  avatar: external_exports.string().max(2048).optional()
+}).strict();
+var presentationShape = VPValidator.extend({
+  verifiableCredential: VCValidator.array().min(1).max(MAX_VP_MEMBERS)
+});
+var hasBoundedPresentation = /* @__PURE__ */ __name3((value) => {
+  let credentialCount = 0;
+  const ancestors = /* @__PURE__ */ new Set();
+  const visit = /* @__PURE__ */ __name3((node, depth) => {
+    if (node === null || typeof node !== "object") return true;
+    if (depth > 32 || ancestors.has(node)) return false;
+    ancestors.add(node);
+    try {
+      for (const [key, child] of Object.entries(node)) {
+        if (key === "verifiableCredential") {
+          credentialCount += Array.isArray(child) ? child.length : 1;
+          if (credentialCount > MAX_VP_MEMBERS) return false;
+        }
+        if (!visit(child, depth + 1)) return false;
+      }
+      return true;
+    } finally {
+      ancestors.delete(node);
+    }
+  }, "visit");
+  return visit(value, 0);
+}, "hasBoundedPresentation");
+var ShareManifestPresentationValidator = external_exports.custom(
+  (value) => hasBoundedPresentation(value) && presentationShape.safeParse(value).success,
+  { message: "invalid share presentation" }
+);
+var SharePayloadValidatorShape = external_exports.object({
+  protocol: external_exports.literal(SHARE_LINK_PROTOCOL),
+  shareId: ShareLinkIdValidator,
+  contentVersion: safeVersion,
+  createdAt: external_exports.iso.datetime(),
+  sharer: ShareSharerValidator,
+  presentation: ShareManifestPresentationValidator,
+  selection: ShareSelectionEntryValidator.array().min(1).max(MAX_SELECTED_CREDENTIALS),
+  endorsements: ShareEndorsementEntryValidator.array().max(MAX_ENDORSEMENTS).default([])
+}).strict();
+var classificationFailure = /* @__PURE__ */ __name3((code, message, path = []) => ({ ok: false, code, message, path }), "classificationFailure");
+var readSignedClaimId = /* @__PURE__ */ __name3((member) => {
+  if (member === null || typeof member !== "object") return void 0;
+  const record2 = member;
+  const claim = record2.credentialSubject ?? record2.endorsement;
+  if (claim === null || typeof claim !== "object") return void 0;
+  const claimRecord = claim;
+  const nested = claimRecord.endorsement;
+  const nestedId = nested !== null && typeof nested === "object" ? nested.id : void 0;
+  return claimRecord.id ?? nestedId;
+}, "readSignedClaimId");
+var classifyShareManifest = /* @__PURE__ */ __name3((payload) => {
+  const members = payload.presentation?.verifiableCredential;
+  if (!Array.isArray(members) || members.length === 0) {
+    return classificationFailure("NO_PRESENTATION_MEMBERS", "presentation has no credentials");
+  }
+  if (members.length > MAX_VP_MEMBERS) {
+    return classificationFailure(
+      "TOO_MANY_VP_MEMBERS",
+      `presentation has ${members.length} members, over the ${MAX_VP_MEMBERS} bound`
+    );
+  }
+  const selection = payload.selection;
+  const endorsements = payload.endorsements ?? [];
+  if (!Array.isArray(selection) || selection.length < 1 || selection.length > MAX_SELECTED_CREDENTIALS) {
+    return classificationFailure("BAD_SELECTION", "selection must contain 1..50 entries");
+  }
+  if (!Array.isArray(endorsements) || endorsements.length > MAX_ENDORSEMENTS) {
+    return classificationFailure(
+      "BAD_ENDORSEMENTS",
+      "endorsements must contain at most 200 entries"
+    );
+  }
+  const selectedIndices = [];
+  const selected = /* @__PURE__ */ new Set();
+  for (let index = 0; index < selection.length; index += 1) {
+    const entry = selection[index];
+    const credentialIndex = entry?.credentialIndex;
+    if (!Number.isSafeInteger(credentialIndex) || credentialIndex < 0 || credentialIndex >= members.length) {
+      return classificationFailure(
+        "SELECTION_INDEX_OUT_OF_BOUNDS",
+        `selection[${index}].credentialIndex is out of bounds`,
+        ["selection", index, "credentialIndex"]
+      );
+    }
+    if (selected.has(credentialIndex)) {
+      return classificationFailure(
+        "SELECTION_INDEX_DUPLICATE",
+        `selection[${index}].credentialIndex is duplicated`,
+        ["selection", index, "credentialIndex"]
+      );
+    }
+    selected.add(credentialIndex);
+    selectedIndices.push(credentialIndex);
+  }
+  const classified = new Set(selected);
+  const endorsementIndices = [];
+  for (let index = 0; index < endorsements.length; index += 1) {
+    const entry = endorsements[index];
+    const credentialIndex = entry?.credentialIndex;
+    const targetIndex = entry?.targetCredentialIndex;
+    if (!Number.isSafeInteger(credentialIndex) || credentialIndex < 0 || credentialIndex >= members.length) {
+      return classificationFailure(
+        "ENDORSEMENT_INDEX_OUT_OF_BOUNDS",
+        `endorsements[${index}].credentialIndex is out of bounds`,
+        ["endorsements", index, "credentialIndex"]
+      );
+    }
+    if (classified.has(credentialIndex)) {
+      return classificationFailure(
+        "VP_MEMBER_CLASSIFIED_TWICE",
+        `endorsements[${index}].credentialIndex was already classified`,
+        ["endorsements", index, "credentialIndex"]
+      );
+    }
+    if (!selected.has(targetIndex)) {
+      return classificationFailure(
+        "ENDORSEMENT_TARGET_NOT_SELECTED",
+        `endorsements[${index}].targetCredentialIndex must reference a selected credential`,
+        ["endorsements", index, "targetCredentialIndex"]
+      );
+    }
+    const referenced = readSignedClaimId(members[credentialIndex]);
+    const target = members[targetIndex];
+    const targetId = target !== null && typeof target === "object" ? target.id : void 0;
+    if (typeof referenced !== "string" || typeof targetId !== "string" || referenced !== targetId) {
+      return classificationFailure(
+        "ENDORSEMENT_TARGET_UNBOUND",
+        `endorsements[${index}] claim does not reference the target credential id`,
+        ["endorsements", index]
+      );
+    }
+    classified.add(credentialIndex);
+    endorsementIndices.push(credentialIndex);
+  }
+  if (classified.size !== members.length) {
+    return classificationFailure(
+      "UNCLASSIFIED_VP_MEMBER",
+      "every presentation member must be classified exactly once",
+      ["presentation", "verifiableCredential"]
+    );
+  }
+  return {
+    ok: true,
+    classification: { selectedIndices, endorsementIndices, memberCount: members.length }
+  };
+}, "classifyShareManifest");
+var SharePayloadValidator = SharePayloadValidatorShape.superRefine((payload, ctx) => {
+  const result = classifyShareManifest(payload);
+  if (!result.ok) {
     ctx.addIssue({
       code: "custom",
-      path: ["mode"],
-      message: "issuer-signed publication cannot include signing-authority fields"
+      message: result.message,
+      path: result.path,
+      params: { shareLinkCode: result.code }
     });
   }
-  if (input.mode === "signing-authority") {
-    if (input.signedCredential !== void 0) {
-      ctx.addIssue({
-        code: "custom",
-        path: ["signedCredential"],
-        message: "signing-authority publication cannot include signedCredential"
-      });
-    }
-    if (!input.credential) {
+});
+var ShareRecoverySelectionValidator = external_exports.object({
+  ref: external_exports.string().min(1).max(MAX_SHARE_SOURCE_URI_CHARS),
+  order: external_exports.number().int().min(0).max(MAX_SELECTED_CREDENTIALS - 1)
+}).strict();
+var ShareRecoveryEndorsementValidator = external_exports.object({ targetRef: external_exports.string().min(1).max(MAX_SHARE_SOURCE_URI_CHARS) }).strict();
+var ShareRecoveryPlaintextValidator = external_exports.object({
+  protocol: external_exports.literal(SHARE_RECOVERY_PROTOCOL),
+  shareId: ShareLinkIdValidator,
+  ownerProfileId: external_exports.string().min(1).max(128),
+  createdAt: external_exports.iso.datetime(),
+  latest: external_exports.object({ contentVersion: safeVersion, key: ShareContentKeyValidator }).strict(),
+  selection: ShareRecoverySelectionValidator.array().min(1).max(MAX_SELECTED_CREDENTIALS),
+  endorsements: ShareRecoveryEndorsementValidator.array().max(MAX_ENDORSEMENTS).default([])
+}).strict().superRefine((recovery, ctx) => {
+  const orders = /* @__PURE__ */ new Set();
+  recovery.selection.forEach((entry, index) => {
+    if (entry.order >= recovery.selection.length) {
       ctx.addIssue({
         code: "custom",
-        path: ["credential"],
-        message: "credential is required for signing-authority publication"
+        message: "order must be within the selection bounds",
+        path: ["selection", index, "order"]
       });
     }
-    if (!input.signingAuthority) {
+    if (orders.has(entry.order)) {
       ctx.addIssue({
         code: "custom",
-        path: ["signingAuthority"],
-        message: "signingAuthority is required for signing-authority publication"
+        message: "order must be unique within the selection",
+        path: ["selection", index, "order"]
       });
     }
+    orders.add(entry.order);
+  });
+});
+var ShareOwnerRecoveryValidator = JWEValidator.refine(
+  (value) => utf8ByteLength(JSON.stringify(value)) <= MAX_SHARE_RECOVERY_JWE_BYTES,
+  { message: `serialized recovery JWE must be at most ${MAX_SHARE_RECOVERY_JWE_BYTES} bytes` }
+);
+var ShareLinkStatusValidator = external_exports.enum(["pending", "active", "stopped"]);
+var ShareContentStateValidator = external_exports.enum(["staging", "finalized", "content_missing"]);
+var ShareLinkValidator = external_exports.object({
+  id: ShareLinkIdValidator,
+  title: external_exports.string().min(1).max(120),
+  note: external_exports.string().max(500).optional(),
+  selectedCount: external_exports.number().int().min(1).max(MAX_SELECTED_CREDENTIALS),
+  version: safeVersion,
+  contentVersion: safeVersion,
+  status: ShareLinkStatusValidator,
+  contentState: ShareContentStateValidator,
+  createdAt: external_exports.iso.datetime(),
+  updatedAt: external_exports.iso.datetime(),
+  expiresAt: external_exports.iso.datetime().nullable(),
+  stoppedAt: external_exports.iso.datetime().nullable(),
+  lastViewedAt: external_exports.iso.datetime().nullable(),
+  viewCount: external_exports.number().int().min(0).optional(),
+  passcodeProtected: external_exports.boolean(),
+  notifyOnView: external_exports.boolean(),
+  minorPolicy: external_exports.object({
+    isMinor: external_exports.boolean().nullable(),
+    policyResolved: external_exports.boolean(),
+    defaultExpiryDays: external_exports.union([external_exports.literal(30), external_exports.literal(365)]),
+    viewCountingEnabled: external_exports.boolean()
+  }),
+  /**
+   * Guarded application/API URL for the content. Optional because owner APIs in
+   * D1 have no public resolve/content endpoint yet; it must never be a
+   * LearnCloud object URL or carry a fabricated decryption key.
+   */
+  contentUrl: external_exports.string().optional()
+});
+var clientRequestId = external_exports.string().uuid();
+var CreateShareLinkInputValidator = external_exports.object({
+  id: ShareLinkIdValidator,
+  clientRequestId,
+  title: external_exports.string().min(1).max(120),
+  note: external_exports.string().max(500).optional(),
+  expiresAt: external_exports.iso.datetime().nullable().optional(),
+  passcode: external_exports.string().min(8).max(64).optional(),
+  notifyOnView: external_exports.boolean().default(false),
+  selectedCount: external_exports.number().int().min(1).max(MAX_SELECTED_CREDENTIALS),
+  contentVersion: external_exports.literal(1),
+  envelope: ShareEnvelopeValidator,
+  ownerEncryptedRecovery: ShareOwnerRecoveryValidator
+}).strict();
+var UpdateShareLinkInputValidator = external_exports.object({
+  id: ShareLinkIdValidator,
+  expectedVersion: safeVersion,
+  clientRequestId,
+  title: external_exports.string().min(1).max(120).optional(),
+  note: external_exports.string().max(500).nullable().optional(),
+  expiresAt: external_exports.iso.datetime().nullable().optional(),
+  /** Omitted preserves the current passcode, null removes it, and a string replaces it. */
+  passcode: external_exports.string().min(8).max(64).nullable().optional(),
+  notifyOnView: external_exports.boolean().optional(),
+  contentVersion: safeVersion.optional(),
+  selectedCount: external_exports.number().int().min(1).max(MAX_SELECTED_CREDENTIALS).optional(),
+  envelope: ShareEnvelopeValidator.optional(),
+  ownerEncryptedRecovery: ShareOwnerRecoveryValidator.optional()
+}).strict().superRefine((value, ctx) => {
+  const provided = [
+    value.contentVersion,
+    value.selectedCount,
+    value.envelope,
+    value.ownerEncryptedRecovery
+  ].filter((field) => field !== void 0).length;
+  if (provided !== 0 && provided !== 4) {
+    ctx.addIssue({
+      code: "custom",
+      message: "content replacement requires contentVersion, selectedCount, envelope and ownerEncryptedRecovery together"
+    });
   }
 });
-var PublishCredentialRefreshNotificationValidator = external_exports.enum([
-  "queued",
-  "suppressed",
-  "not-applicable",
-  /** Publication succeeded, but the post-commit notification enqueue must be retried. */
-  "delivery-failed"
+var ShareLinkIdInputValidator = external_exports.object({ id: ShareLinkIdValidator }).strict();
+var ShareLinkOperationKeyInputValidator = external_exports.object({ id: ShareLinkIdValidator, operationId: external_exports.string().uuid() }).strict();
+var ShareLinkOwnerCommitOutputValidator = external_exports.discriminatedUnion("status", [
+  external_exports.object({ status: external_exports.literal("completed"), share: ShareLinkValidator }).strict(),
+  external_exports.object({
+    status: external_exports.literal("pending"),
+    id: ShareLinkIdValidator,
+    operationId: external_exports.string().uuid()
+  }).strict()
 ]);
-var PublishCredentialRefreshResultValidator = external_exports.object({
-  refreshId: external_exports.string().min(1),
-  version: external_exports.number().int().positive(),
-  publishedAt: external_exports.string().min(1),
-  notification: PublishCredentialRefreshNotificationValidator
-});
-var CredentialRefreshVersionMetadataValidator = external_exports.object({
-  version: external_exports.number().int().positive(),
-  publishedAt: external_exports.string().min(1),
-  effectiveAt: external_exports.string().optional(),
-  etag: external_exports.string().optional(),
-  signingMode: CredentialRefreshSigningModeValidator.optional(),
-  updateSummary: external_exports.string().optional()
-});
-var GetCredentialRefreshHistoryInputValidator = external_exports.object({
-  refreshId: external_exports.string().min(1),
-  cursor: external_exports.string().optional(),
-  limit: external_exports.number().int().positive().optional()
-});
-var GetCredentialRefreshHistoryResultValidator = external_exports.object({
-  records: CredentialRefreshVersionMetadataValidator.array(),
-  hasMore: external_exports.boolean(),
-  cursor: external_exports.string().optional()
-});
-var CredentialRefreshChallengeValidator = external_exports.object({
-  challenge: external_exports.string().min(1),
-  expiresAt: external_exports.string().min(1),
-  domain: external_exports.string().optional(),
-  scheme: external_exports.literal("LearnCardDIDAuth").optional()
-});
-var PublicCredentialRefreshEnvelopeValidator = external_exports.object({
-  format: external_exports.literal("vc"),
-  credential: VCValidator,
-  etag: external_exports.string().optional()
-});
-var JweCredentialRefreshEnvelopeValidator = external_exports.object({
-  format: external_exports.literal("jwe"),
-  jwe: JWEValidator,
-  etag: external_exports.string().optional(),
-  /** Present on LearnCard-managed endpoints; optional for interoperable JWE services. */
-  version: external_exports.number().int().positive().optional()
-});
-var CredentialRefreshResponseEnvelopeValidator = external_exports.discriminatedUnion("format", [
-  PublicCredentialRefreshEnvelopeValidator,
-  JweCredentialRefreshEnvelopeValidator
+var ShareLinkOwnerStatusOutputValidator = external_exports.discriminatedUnion("status", [
+  external_exports.object({ status: external_exports.literal("found"), share: ShareLinkValidator }).strict(),
+  external_exports.object({
+    status: external_exports.literal("pending"),
+    id: ShareLinkIdValidator,
+    operationId: external_exports.string().uuid()
+  }).strict(),
+  external_exports.object({ status: external_exports.literal("not_found"), id: ShareLinkIdValidator }).strict()
 ]);
-var CredentialRefreshFailureCodeValidator = external_exports.enum([
-  "UNAVAILABLE",
-  "TIMEOUT",
-  "UNSUPPORTED_SERVICE",
-  "UNAUTHORIZED",
-  "MALFORMED_RESPONSE",
-  "INVALID_PROOF",
-  "ISSUER_MISMATCH",
-  "ID_MISMATCH",
-  "ROLLBACK",
-  "REVOKED",
-  "UNSAFE_ENDPOINT"
+var ShareLinkOwnerRecoveryOutputValidator = external_exports.object({ recovery: ShareOwnerRecoveryValidator }).strict();
+var ShareLinkOwnerContentOutputValidator = external_exports.object({
+  id: ShareLinkIdValidator,
+  contentVersion: safeVersion,
+  envelope: ShareEnvelopeValidator
+}).strict();
+var ResolveShareLinkInputValidator = external_exports.object({
+  id: ShareLinkIdValidator,
+  /** Sent only in a POST body; it must never be placed in a share URL. */
+  passcode: external_exports.string().min(4).max(64).optional()
+}).strict();
+var ShareLinkPublicStateValidator = external_exports.discriminatedUnion("state", [
+  external_exports.object({
+    state: external_exports.literal("passcode_required"),
+    id: ShareLinkIdValidator
+  }).strict(),
+  external_exports.object({ state: external_exports.literal("try_later"), id: ShareLinkIdValidator }).strict(),
+  external_exports.object({
+    state: external_exports.literal("active"),
+    id: ShareLinkIdValidator,
+    title: external_exports.string().max(120),
+    note: external_exports.string().max(500).optional(),
+    selectedCount: external_exports.number().int().min(1).max(MAX_SELECTED_CREDENTIALS),
+    contentVersion: safeVersion,
+    contentUrl: external_exports.string(),
+    sharer: external_exports.object({
+      displayName: external_exports.string().max(120),
+      avatar: external_exports.string().max(2048).optional()
+    }),
+    createdAt: external_exports.iso.datetime(),
+    updatedAt: external_exports.iso.datetime(),
+    expiresAt: external_exports.iso.datetime().nullable()
+  }).strict(),
+  external_exports.object({
+    state: external_exports.literal("expired"),
+    id: ShareLinkIdValidator,
+    expiresAt: external_exports.iso.datetime()
+  }).strict(),
+  external_exports.object({
+    state: external_exports.literal("stopped"),
+    id: ShareLinkIdValidator,
+    stoppedAt: external_exports.iso.datetime()
+  }).strict(),
+  external_exports.object({ state: external_exports.literal("not_found"), id: ShareLinkIdValidator }).strict()
 ]);
-var CredentialRefreshUpdatedResultValidator = external_exports.object({
-  status: external_exports.literal("updated"),
-  credential: VCValidator,
-  etag: external_exports.string().optional(),
-  managedVersion: external_exports.number().int().positive().optional()
-});
-var CredentialRefreshUnchangedResultValidator = external_exports.object({
-  status: external_exports.literal("unchanged"),
-  checkedAt: external_exports.string().min(1),
-  etag: external_exports.string().optional()
-});
-var CredentialRefreshUnsupportedResultValidator = external_exports.object({
-  status: external_exports.literal("unsupported")
-});
-var CredentialRefreshFailedResultValidator = external_exports.object({
-  status: external_exports.literal("failed"),
-  code: CredentialRefreshFailureCodeValidator,
-  retryable: external_exports.boolean()
+var ListShareLinksInputValidator = external_exports.object({
+  limit: external_exports.number().int().min(1).max(50).default(25),
+  cursor: external_exports.string().max(512).optional()
+}).strict();
+var PaginatedShareLinksValidator = PaginationResponseValidator.extend({
+  records: ShareLinkValidator.array()
 });
-var CredentialRefreshResultValidator = external_exports.discriminatedUnion("status", [
-  CredentialRefreshUpdatedResultValidator,
-  CredentialRefreshUnchangedResultValidator,
-  CredentialRefreshUnsupportedResultValidator,
-  CredentialRefreshFailedResultValidator
-]);
+var AcknowledgeViewInputValidator = external_exports.object({
+  receipt: external_exports.string().min(22).max(128).regex(/^[A-Za-z0-9_-]+$/)
+}).strict();
+var AcknowledgeViewOutputValidator = external_exports.object({ ok: external_exports.literal(true) }).strict();
+var SHARE_VIEW_RECEIPT_TTL_SECONDS = 10 * 60;
+var ShareLinkPublicContentViewValidator = external_exports.object({
+  id: ShareLinkIdValidator,
+  contentVersion: safeVersion,
+  envelope: ShareEnvelopeValidator,
+  contentUrl: external_exports.string(),
+  receipt: external_exports.string().min(22).max(128).regex(/^[A-Za-z0-9_-]+$/)
+}).strict();
 
 // src/read.ts
 var isTemplateRenderMethod = /* @__PURE__ */ __name((rm) => TemplateRenderMethodValidator.safeParse(rm).success, "isTemplateRenderMethod");