@learncard/sss-key-manager 0.1.20 → 0.1.22

package/dist/qr-login.d.ts

@@ -0,0 +1,122 @@
+/**
+ * QR Login Client
+ *
+ * High-level orchestrator for cross-device login via QR code or short code.
+ * Coordinates between the relay API and the ECDH crypto layer.
+ *
+ * Two roles:
+ *   - **Requester** (Device B, new device): creates session, renders QR, polls
+ *   - **Approver** (Device A, logged-in device): reads QR/code, encrypts share, approves
+ */
+import type { EphemeralKeypair } from './qr-crypto';
+export interface QrLoginSession {
+    sessionId: string;
+    shortCode: string;
+    expiresInSeconds: number;
+}
+export interface QrLoginSessionInfo {
+    sessionId: string;
+    publicKey: string;
+    status: 'pending' | 'approved';
+    encryptedPayload?: string;
+    approverDid?: string;
+}
+export interface QrLoginClientConfig {
+    serverUrl: string;
+}
+export interface QrPayload {
+    /** Session ID for the relay */
+    sessionId: string;
+    /** Base64-encoded ephemeral X25519 public key */
+    publicKey: string;
+    /** Server URL for the relay */
+    serverUrl: string;
+}
+/** Result of polling — either still waiting or the device share is ready */
+export type PollResult = {
+    status: 'pending';
+} | {
+    status: 'approved';
+    deviceShare: string;
+    approverDid: string;
+    accountHint?: string;
+    shareVersion?: number;
+};
+/**
+ * Create a QR login session and generate the ephemeral keypair.
+ *
+ * Returns everything Device B needs to display a QR and start polling.
+ * The ephemeral private key is kept in memory — never serialized.
+ */
+export declare const createQrLoginSession: (config: QrLoginClientConfig) => Promise<{
+    session: QrLoginSession;
+    ephemeralKeypair: EphemeralKeypair;
+    qrPayload: QrPayload;
+}>;
+/**
+ * Poll a QR login session for approval.
+ *
+ * When Device A approves, this returns the decrypted device share.
+ *
+ * @param config - Server config
+ * @param sessionId - The session to poll
+ * @param ephemeralPrivateKey - Device B's ephemeral private key (for decryption)
+ */
+export declare const pollQrLoginSession: (config: QrLoginClientConfig, sessionId: string, ephemeralPrivateKey: CryptoKey) => Promise<PollResult>;
+/**
+ * Convenience: poll in a loop until approved or timeout.
+ *
+ * @param config - Server config
+ * @param sessionId - The session to poll
+ * @param ephemeralPrivateKey - Device B's ephemeral private key
+ * @param intervalMs - Polling interval (default 2000ms)
+ * @param timeoutMs - Total timeout (default 120000ms)
+ * @param onPoll - Optional callback on each poll (for UI updates)
+ */
+export declare const pollUntilApproved: (config: QrLoginClientConfig, sessionId: string, ephemeralPrivateKey: CryptoKey, options?: {
+    intervalMs?: number;
+    timeoutMs?: number;
+    onPoll?: (attempt: number) => void;
+    signal?: AbortSignal;
+}) => Promise<{
+    deviceShare: string;
+    approverDid: string;
+    accountHint?: string;
+    shareVersion?: number;
+}>;
+/**
+ * Fetch a QR login session's public key (for Device A to encrypt against).
+ *
+ * @param config - Server config
+ * @param lookup - Session ID or 6-digit short code
+ */
+export declare const getQrLoginSessionInfo: (config: QrLoginClientConfig, lookup: string) => Promise<QrLoginSessionInfo>;
+/**
+ * Approve a QR login session by encrypting and pushing the device share.
+ *
+ * Called by Device A (the logged-in device).
+ *
+ * @param config - Server config
+ * @param sessionId - The session to approve
+ * @param deviceShare - Plaintext device share from Device A's local storage
+ * @param approverDid - DID of the approving device
+ * @param recipientPublicKey - Base64 X25519 public key from the session
+ * @param accountHint - Optional email or phone of the approver's account (sent to Device B as a login hint)
+ * @param shareVersion - Optional share version so Device B can fetch the matching auth share
+ */
+export declare const approveQrLoginSession: (config: QrLoginClientConfig, sessionId: string, deviceShare: string, approverDid: string, recipientPublicKey: string, accountHint?: string, shareVersion?: number) => Promise<void>;
+export interface NotifyDevicesResult {
+    sent: boolean;
+    deviceCount: number;
+}
+/**
+ * Send a push notification to the authenticated user's other devices,
+ * prompting them to open the approver flow for the given QR session.
+ *
+ * Called by Device B (in needs_recovery) after creating a session.
+ * Requires the user's Firebase (or other auth provider) token.
+ *
+ * This is fire-and-forget — failure does not block the QR login flow.
+ */
+export declare const notifyDevicesForQrSession: (config: QrLoginClientConfig, sessionId: string, shortCode: string, authToken: string, providerType?: string) => Promise<NotifyDevicesResult>;
+//# sourceMappingURL=qr-login.d.ts.map

package/dist/qr-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"qr-login.d.ts","sourceRoot":"","sources":["../src/qr-login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAUH,OAAO,KAAK,EAAE,gBAAgB,EAAyB,MAAM,aAAa,CAAC;AAM3E,MAAM,WAAW,cAAc;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,SAAS,GAAG,UAAU,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAChC,SAAS,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,SAAS;IACtB,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;IAElB,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAC;IAElB,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;CACrB;AAED,4EAA4E;AAC5E,MAAM,MAAM,UAAU,GAChB;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAoBpH;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,GAC7B,QAAQ,mBAAmB,KAC5B,OAAO,CAAC;IACP,OAAO,EAAE,cAAc,CAAC;IACxB,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,SAAS,EAAE,SAAS,CAAC;CACxB,CAsBA,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAC3B,QAAQ,mBAAmB,EAC3B,WAAW,MAAM,EACjB,qBAAqB,SAAS,KAC/B,OAAO,CAAC,UAAU,CAkCpB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAC1B,QAAQ,mBAAmB,EAC3B,WAAW,MAAM,EACjB,qBAAqB,SAAS,EAC9B,UAAU;IACN,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,MAAM,CAAC,EAAE,WAAW,CAAC;CACxB,KACF,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAwCnG,CAAC;AAMF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GAC9B,QAAQ,mBAAmB,EAC3B,QAAQ,MAAM,KACf,OAAO,CAAC,kBAAkB,CAW5B,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,qBAAqB,GAC9B,QAAQ,mBAAmB,EAC3B,WAAW,MAAM,EACjB,aAAa,MAAM,EACnB,aAAa,MAAM,EACnB,oBAAoB,MAAM,EAC1B,cAAc,MAAM,EACpB,eAAe,MAAM,KACtB,OAAO,CAAC,IAAI,CAoBd,CAAC;AAMF,MAAM,WAAW,mBAAmB;IAChC,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,GAClC,QAAQ,mBAAmB,EAC3B,WAAW,MAAM,EACjB,WAAW,MAAM,EACjB,WAAW,MAAM,EACjB,eAAc,MAAmB,KAClC,OAAO,CAAC,mBAAmB,CAqB7B,CAAC"}

package/dist/recovery-phrase.d.ts

@@ -0,0 +1,14 @@
+/**
+ * BIP39 Recovery Phrase utilities for SSS recovery
+ * The recovery phrase directly encodes a share (not encryption)
+ */
+export interface RecoveryPhraseData {
+    phrase: string;
+    shareHex: string;
+}
+export declare function shareToRecoveryPhrase(shareHex: string): Promise<string>;
+export declare function recoveryPhraseToShare(phrase: string): Promise<string>;
+export declare function generateRecoveryPhrase(shareHex: string): Promise<RecoveryPhraseData>;
+export declare function validateRecoveryPhrase(phrase: string): Promise<boolean>;
+export declare function countWords(phrase: string): number;
+//# sourceMappingURL=recovery-phrase.d.ts.map

package/dist/recovery-phrase.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-phrase.d.ts","sourceRoot":"","sources":["../src/recovery-phrase.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,WAAW,kBAAkB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CACpB;AAkCD,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAc7E;AAED,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAoD3E;AAED,wBAAsB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAG1F;AAED,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAO7E;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAKjD"}

package/dist/sss-key-manager.cjs.development.js

@@ -66,6 +66,8 @@ var require_types_cjs_development = __commonJS({
       AgeRatingValidator: /* @__PURE__ */ __name(() => AgeRatingValidator, "AgeRatingValidator"),
       AlignmentTargetTypeValidator: /* @__PURE__ */ __name(() => AlignmentTargetTypeValidator, "AlignmentTargetTypeValidator"),
       AlignmentValidator: /* @__PURE__ */ __name(() => AlignmentValidator, "AlignmentValidator"),
+      AllocateCredentialRefreshInputValidator: /* @__PURE__ */ __name(() => AllocateCredentialRefreshInputValidator, "AllocateCredentialRefreshInputValidator"),
+      AllocateCredentialRefreshResultValidator: /* @__PURE__ */ __name(() => AllocateCredentialRefreshResultValidator, "AllocateCredentialRefreshResultValidator"),
       AllocateCredentialStatusInputValidator: /* @__PURE__ */ __name(() => AllocateCredentialStatusInputValidator, "AllocateCredentialStatusInputValidator"),
       AllocatedBitstringStatusListEntryValidator: /* @__PURE__ */ __name(() => AllocatedBitstringStatusListEntryValidator, "AllocatedBitstringStatusListEntryValidator"),
       AllowConnectionRequestsEnum: /* @__PURE__ */ __name(() => AllowConnectionRequestsEnum, "AllowConnectionRequestsEnum"),
@@ -147,6 +149,16 @@ var require_types_cjs_development = __commonJS({
       CredentialInfoValidator: /* @__PURE__ */ __name(() => CredentialInfoValidator, "CredentialInfoValidator"),
       CredentialNameRefValidator: /* @__PURE__ */ __name(() => CredentialNameRefValidator, "CredentialNameRefValidator"),
       CredentialRecordValidator: /* @__PURE__ */ __name(() => CredentialRecordValidator, "CredentialRecordValidator"),
+      CredentialRefreshChallengeValidator: /* @__PURE__ */ __name(() => CredentialRefreshChallengeValidator, "CredentialRefreshChallengeValidator"),
+      CredentialRefreshFailedResultValidator: /* @__PURE__ */ __name(() => CredentialRefreshFailedResultValidator, "CredentialRefreshFailedResultValidator"),
+      CredentialRefreshFailureCodeValidator: /* @__PURE__ */ __name(() => CredentialRefreshFailureCodeValidator, "CredentialRefreshFailureCodeValidator"),
+      CredentialRefreshResponseEnvelopeValidator: /* @__PURE__ */ __name(() => CredentialRefreshResponseEnvelopeValidator, "CredentialRefreshResponseEnvelopeValidator"),
+      CredentialRefreshResultValidator: /* @__PURE__ */ __name(() => CredentialRefreshResultValidator, "CredentialRefreshResultValidator"),
+      CredentialRefreshSigningModeValidator: /* @__PURE__ */ __name(() => CredentialRefreshSigningModeValidator, "CredentialRefreshSigningModeValidator"),
+      CredentialRefreshUnchangedResultValidator: /* @__PURE__ */ __name(() => CredentialRefreshUnchangedResultValidator, "CredentialRefreshUnchangedResultValidator"),
+      CredentialRefreshUnsupportedResultValidator: /* @__PURE__ */ __name(() => CredentialRefreshUnsupportedResultValidator, "CredentialRefreshUnsupportedResultValidator"),
+      CredentialRefreshUpdatedResultValidator: /* @__PURE__ */ __name(() => CredentialRefreshUpdatedResultValidator, "CredentialRefreshUpdatedResultValidator"),
+      CredentialRefreshVersionMetadataValidator: /* @__PURE__ */ __name(() => CredentialRefreshVersionMetadataValidator, "CredentialRefreshVersionMetadataValidator"),
       CredentialSchemaValidator: /* @__PURE__ */ __name(() => CredentialSchemaValidator, "CredentialSchemaValidator"),
       CredentialStatusValidator: /* @__PURE__ */ __name(() => CredentialStatusValidator, "CredentialStatusValidator"),
       CredentialSubjectValidator: /* @__PURE__ */ __name(() => CredentialSubjectValidator, "CredentialSubjectValidator"),
@@ -167,6 +179,8 @@ var require_types_cjs_development = __commonJS({
       GeoCoordinatesValidator: /* @__PURE__ */ __name(() => GeoCoordinatesValidator, "GeoCoordinatesValidator"),
       GetCounterEventValidator: /* @__PURE__ */ __name(() => GetCounterEventValidator, "GetCounterEventValidator"),
       GetCountersEventValidator: /* @__PURE__ */ __name(() => GetCountersEventValidator, "GetCountersEventValidator"),
+      GetCredentialRefreshHistoryInputValidator: /* @__PURE__ */ __name(() => GetCredentialRefreshHistoryInputValidator, "GetCredentialRefreshHistoryInputValidator"),
+      GetCredentialRefreshHistoryResultValidator: /* @__PURE__ */ __name(() => GetCredentialRefreshHistoryResultValidator, "GetCredentialRefreshHistoryResultValidator"),
       GetFullSkillTreeInputValidator: /* @__PURE__ */ __name(() => GetFullSkillTreeInputValidator, "GetFullSkillTreeInputValidator"),
       GetFullSkillTreeResultValidator: /* @__PURE__ */ __name(() => GetFullSkillTreeResultValidator, "GetFullSkillTreeResultValidator"),
       GetSkillPathInputValidator: /* @__PURE__ */ __name(() => GetSkillPathInputValidator, "GetSkillPathInputValidator"),
@@ -191,6 +205,7 @@ var require_types_cjs_development = __commonJS({
       JWEValidator: /* @__PURE__ */ __name(() => JWEValidator, "JWEValidator"),
       JWKValidator: /* @__PURE__ */ __name(() => JWKValidator, "JWKValidator"),
       JWKWithPrivateKeyValidator: /* @__PURE__ */ __name(() => JWKWithPrivateKeyValidator, "JWKWithPrivateKeyValidator"),
+      JweCredentialRefreshEnvelopeValidator: /* @__PURE__ */ __name(() => JweCredentialRefreshEnvelopeValidator, "JweCredentialRefreshEnvelopeValidator"),
       KnownAchievementTypeValidator: /* @__PURE__ */ __name(() => KnownAchievementTypeValidator, "KnownAchievementTypeValidator"),
       LCNAuthedProfileValidator: /* @__PURE__ */ __name(() => LCNAuthedProfileValidator, "LCNAuthedProfileValidator"),
       LCNBoostClaimLinkOptionsValidator: /* @__PURE__ */ __name(() => LCNBoostClaimLinkOptionsValidator, "LCNBoostClaimLinkOptionsValidator"),
@@ -228,7 +243,9 @@ var require_types_cjs_development = __commonJS({
       LCNSigningAuthorityValidator: /* @__PURE__ */ __name(() => LCNSigningAuthorityValidator, "LCNSigningAuthorityValidator"),
       LCNVisibleProfileValidator: /* @__PURE__ */ __name(() => LCNVisibleProfileValidator, "LCNVisibleProfileValidator"),
       LaunchTypeValidator: /* @__PURE__ */ __name(() => LaunchTypeValidator, "LaunchTypeValidator"),
+      LearnCardRefreshAuthorizationValidator: /* @__PURE__ */ __name(() => LearnCardRefreshAuthorizationValidator, "LearnCardRefreshAuthorizationValidator"),
       LinkProviderFrameworkInputValidator: /* @__PURE__ */ __name(() => LinkProviderFrameworkInputValidator, "LinkProviderFrameworkInputValidator"),
+      ManagedCredentialRefreshServiceValidator: /* @__PURE__ */ __name(() => ManagedCredentialRefreshServiceValidator, "ManagedCredentialRefreshServiceValidator"),
       PaginatedAppStoreListingsValidator: /* @__PURE__ */ __name(() => PaginatedAppStoreListingsValidator, "PaginatedAppStoreListingsValidator"),
       PaginatedBoostRecipientsValidator: /* @__PURE__ */ __name(() => PaginatedBoostRecipientsValidator, "PaginatedBoostRecipientsValidator"),
       PaginatedBoostRecipientsWithChildrenValidator: /* @__PURE__ */ __name(() => PaginatedBoostRecipientsWithChildrenValidator, "PaginatedBoostRecipientsWithChildrenValidator"),
@@ -258,6 +275,12 @@ var require_types_cjs_development = __commonJS({
       ProfileVisibilityEnum: /* @__PURE__ */ __name(() => ProfileVisibilityEnum, "ProfileVisibilityEnum"),
       PromotionLevelValidator: /* @__PURE__ */ __name(() => PromotionLevelValidator, "PromotionLevelValidator"),
       ProofValidator: /* @__PURE__ */ __name(() => ProofValidator, "ProofValidator"),
+      PublicCredentialRefreshEnvelopeValidator: /* @__PURE__ */ __name(() => PublicCredentialRefreshEnvelopeValidator, "PublicCredentialRefreshEnvelopeValidator"),
+      PublishCredentialRefreshInputValidator: /* @__PURE__ */ __name(() => PublishCredentialRefreshInputValidator, "PublishCredentialRefreshInputValidator"),
+      PublishCredentialRefreshNotificationValidator: /* @__PURE__ */ __name(() => PublishCredentialRefreshNotificationValidator, "PublishCredentialRefreshNotificationValidator"),
+      PublishCredentialRefreshResultValidator: /* @__PURE__ */ __name(() => PublishCredentialRefreshResultValidator, "PublishCredentialRefreshResultValidator"),
+      PublishIssuerSignedRefreshValidator: /* @__PURE__ */ __name(() => PublishIssuerSignedRefreshValidator, "PublishIssuerSignedRefreshValidator"),
+      PublishSigningAuthorityRefreshValidator: /* @__PURE__ */ __name(() => PublishSigningAuthorityRefreshValidator, "PublishSigningAuthorityRefreshValidator"),
       RefreshServiceValidator: /* @__PURE__ */ __name(() => RefreshServiceValidator, "RefreshServiceValidator"),
       RegExpValidator: /* @__PURE__ */ __name(() => RegExpValidator, "RegExpValidator"),
       RelatedValidator: /* @__PURE__ */ __name(() => RelatedValidator, "RelatedValidator"),
@@ -298,11 +321,13 @@ var require_types_cjs_development = __commonJS({
       SkillTreeNodeInputValidator: /* @__PURE__ */ __name(() => SkillTreeNodeInputValidator, "SkillTreeNodeInputValidator"),
       SkillTreeNodeValidator: /* @__PURE__ */ __name(() => SkillTreeNodeValidator, "SkillTreeNodeValidator"),
       SkillValidator: /* @__PURE__ */ __name(() => SkillValidator, "SkillValidator"),
+      StandardCredentialRefreshServiceValidator: /* @__PURE__ */ __name(() => StandardCredentialRefreshServiceValidator, "StandardCredentialRefreshServiceValidator"),
       StatusCheckEntryValidator: /* @__PURE__ */ __name(() => StatusCheckEntryValidator, "StatusCheckEntryValidator"),
       StoredCredentialEnvelopeValidator: /* @__PURE__ */ __name(() => StoredCredentialEnvelopeValidator, "StoredCredentialEnvelopeValidator"),
       StringQuery: /* @__PURE__ */ __name(() => StringQuery, "StringQuery"),
       SummaryCredentialDataValidator: /* @__PURE__ */ __name(() => SummaryCredentialDataValidator, "SummaryCredentialDataValidator"),
       SummaryCredentialKeywordValidator: /* @__PURE__ */ __name(() => SummaryCredentialKeywordValidator, "SummaryCredentialKeywordValidator"),
+      SupportedCredentialRefreshServiceValidator: /* @__PURE__ */ __name(() => SupportedCredentialRefreshServiceValidator, "SupportedCredentialRefreshServiceValidator"),
       SyncFrameworkInputValidator: /* @__PURE__ */ __name(() => SyncFrameworkInputValidator, "SyncFrameworkInputValidator"),
       TagValidator: /* @__PURE__ */ __name(() => TagValidator, "TagValidator"),
       TemplateRenderMethodValidator: /* @__PURE__ */ __name(() => TemplateRenderMethodValidator, "TemplateRenderMethodValidator"),
@@ -16272,7 +16297,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       did: LCNProfileValidator.shape.did
     });
     var LCNConnectionProfileValidator = LCNAuthedProfileValidator.extend({
-      email: LCNProfileValidator.shape.email
+      email: LCNProfileValidator.shape.email,
+      connectedAt: external_exports.iso.datetime().optional().describe("When the viewer and this profile became connected.")
     });
     var LCNVisibleProfileValidator = external_exports.union([
       LCNConnectionProfileValidator.strict(),
@@ -16505,7 +16531,10 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       webhookUrl: external_exports.string().url().optional().describe("Webhook URL to receive claim notifications"),
       suppressDelivery: external_exports.boolean().optional().describe("If true, returns claimUrl without sending email/SMS"),
       branding: SendBrandingOptionsValidator.optional().describe("Branding for email/SMS delivery"),
-      guardianEmail: external_exports.string().email().optional().describe("Guardian email that must approve before student can claim")
+      guardianEmail: external_exports.string().email().optional().describe("Guardian email that must approve before student can claim"),
+      expiresInDays: external_exports.number().int().min(1).max(720).optional().describe(
+        "How many days the credential stays claimable in the Universal Inbox (default 30). Does not change the credential validity period."
+      )
     });
     var SendBoostInputValidator = external_exports.object({
       type: external_exports.literal("boost"),
@@ -16800,7 +16829,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       "APP_NOTIFICATION",
       "CREDENTIAL_REVOKED",
       "CREDENTIAL_SUSPENDED",
-      "CREDENTIAL_UNSUSPENDED"
+      "CREDENTIAL_UNSUSPENDED",
+      "CREDENTIAL_REFRESHED"
     ]);
     var LCNNotificationMessageValidator = external_exports.object({
       title: external_exports.string().optional(),
@@ -16932,12 +16962,16 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
     });
     var InboxCredentialValidator = external_exports.object({
       id: external_exports.string(),
-      credential: external_exports.string(),
+      credential: external_exports.string().optional(),
       isSigned: external_exports.boolean(),
       currentStatus: LCNInboxStatusEnumValidator,
       isAccepted: external_exports.boolean().optional(),
       expiresAt: external_exports.string(),
       createdAt: external_exports.string(),
+      finalizedAt: external_exports.string().optional(),
+      expiredAt: external_exports.string().optional(),
+      credentialName: external_exports.string().optional(),
+      achievementType: external_exports.string().optional(),
       issuerDid: external_exports.string(),
       webhookUrl: external_exports.string().optional(),
       boostUri: external_exports.string().optional(),
@@ -16991,7 +17025,9 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
           "The signing authority to use for the credential. If not provided, the users default signing authority will be used if the credential is not signed."
         ),
         webhookUrl: external_exports.string().url().optional().describe("The webhook URL to receive credential issuance events."),
-        expiresInDays: external_exports.number().min(1).max(365).optional().describe("The number of days the credential will be valid for."),
+        expiresInDays: external_exports.number().int().min(1).max(720).optional().describe(
+          "How many days the encrypted inbox payload remains claimable. This does not change the credential validity period."
+        ),
         templateData: external_exports.record(external_exports.string(), external_exports.unknown()).optional().describe(
           "Template data to render into the boost credential template using Mustache syntax. Only used when boostUri is provided."
         ),
@@ -17054,6 +17090,9 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       credential: VCValidator.or(VPValidator).or(UnsignedVCValidator).or(CredentialNameRefValidator).describe("The credential to issue, or a { name } reference to resolve a boost template."),
       configuration: external_exports.object({
         publishableKey: external_exports.string(),
+        expiresInDays: external_exports.number().int().min(1).max(720).optional().describe(
+          "Inbox claim window in days. Defaults to 720; use a shorter window for sensitive records."
+        ),
         signingAuthorityName: external_exports.string().optional(),
         listingId: external_exports.string().optional(),
         listingSlug: external_exports.string().optional()
@@ -17691,6 +17730,191 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       const result = inAppMessagesFlagValidator.safeParse(raw);
       return result.success ? result.data : EMPTY_IN_APP_MESSAGES_FLAG;
     }, "parseInAppMessagesFlag");
+    var LearnCardRefreshAuthorizationValidator = external_exports.object({ type: external_exports.literal("LearnCardDIDAuth") }).catchall(external_exports.any());
+    var ManagedCredentialRefreshServiceValidator = external_exports.object({
+      id: external_exports.string().min(1),
+      type: external_exports.literal("LearnCardCredentialRefresh2026"),
+      authorization: LearnCardRefreshAuthorizationValidator.optional()
+    }).catchall(external_exports.any());
+    var StandardCredentialRefreshServiceValidator = external_exports.object({
+      id: external_exports.string().min(1),
+      type: external_exports.literal("1EdTechCredentialRefresh")
+    }).catchall(external_exports.any());
+    var SupportedCredentialRefreshServiceValidator = external_exports.union([
+      ManagedCredentialRefreshServiceValidator,
+      StandardCredentialRefreshServiceValidator
+    ]);
+    var AllocateCredentialRefreshInputValidator = external_exports.object({
+      holder: external_exports.object({
+        profileId: external_exports.string().optional(),
+        did: external_exports.string().min(1)
+      }),
+      credentialId: external_exports.string().min(1)
+    });
+    var AllocateCredentialRefreshResultValidator = external_exports.object({
+      refreshId: external_exports.string().min(1),
+      refreshService: ManagedCredentialRefreshServiceValidator.extend({
+        authorization: LearnCardRefreshAuthorizationValidator
+      })
+    });
+    var CredentialRefreshSigningModeValidator = external_exports.enum(["issuer-signed", "signing-authority"]);
+    var PublishCredentialRefreshBaseFields = {
+      refreshId: external_exports.string().min(1),
+      notifyHolder: external_exports.boolean().optional(),
+      updateSummary: external_exports.string().optional(),
+      idempotencyKey: external_exports.string().optional()
+    };
+    var PublishIssuerSignedRefreshValidator = external_exports.object({
+      ...PublishCredentialRefreshBaseFields,
+      mode: external_exports.literal("issuer-signed"),
+      signedCredential: VCValidator
+    });
+    var PublishSigningAuthorityRefreshValidator = external_exports.object({
+      ...PublishCredentialRefreshBaseFields,
+      mode: external_exports.literal("signing-authority"),
+      credential: UnsignedVCValidator,
+      signingAuthority: external_exports.object({
+        type: external_exports.string().min(1)
+      }).catchall(external_exports.any())
+    });
+    var PublishCredentialRefreshInputValidator = external_exports.object({
+      ...PublishCredentialRefreshBaseFields,
+      mode: CredentialRefreshSigningModeValidator,
+      signedCredential: VCValidator.optional(),
+      credential: UnsignedVCValidator.optional(),
+      signingAuthority: external_exports.object({
+        type: external_exports.string().min(1)
+      }).catchall(external_exports.any()).optional()
+    }).superRefine((input, ctx) => {
+      if (input.mode === "issuer-signed" && !input.signedCredential) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["signedCredential"],
+          message: "signedCredential is required for issuer-signed publication"
+        });
+      }
+      if (input.mode === "issuer-signed" && (input.credential !== void 0 || input.signingAuthority !== void 0)) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["mode"],
+          message: "issuer-signed publication cannot include signing-authority fields"
+        });
+      }
+      if (input.mode === "signing-authority") {
+        if (input.signedCredential !== void 0) {
+          ctx.addIssue({
+            code: "custom",
+            path: ["signedCredential"],
+            message: "signing-authority publication cannot include signedCredential"
+          });
+        }
+        if (!input.credential) {
+          ctx.addIssue({
+            code: "custom",
+            path: ["credential"],
+            message: "credential is required for signing-authority publication"
+          });
+        }
+        if (!input.signingAuthority) {
+          ctx.addIssue({
+            code: "custom",
+            path: ["signingAuthority"],
+            message: "signingAuthority is required for signing-authority publication"
+          });
+        }
+      }
+    });
+    var PublishCredentialRefreshNotificationValidator = external_exports.enum([
+      "queued",
+      "suppressed",
+      "not-applicable",
+      /** Publication succeeded, but the post-commit notification enqueue must be retried. */
+      "delivery-failed"
+    ]);
+    var PublishCredentialRefreshResultValidator = external_exports.object({
+      refreshId: external_exports.string().min(1),
+      version: external_exports.number().int().positive(),
+      publishedAt: external_exports.string().min(1),
+      notification: PublishCredentialRefreshNotificationValidator
+    });
+    var CredentialRefreshVersionMetadataValidator = external_exports.object({
+      version: external_exports.number().int().positive(),
+      publishedAt: external_exports.string().min(1),
+      effectiveAt: external_exports.string().optional(),
+      etag: external_exports.string().optional(),
+      signingMode: CredentialRefreshSigningModeValidator.optional(),
+      updateSummary: external_exports.string().optional()
+    });
+    var GetCredentialRefreshHistoryInputValidator = external_exports.object({
+      refreshId: external_exports.string().min(1),
+      cursor: external_exports.string().optional(),
+      limit: external_exports.number().int().positive().optional()
+    });
+    var GetCredentialRefreshHistoryResultValidator = external_exports.object({
+      records: CredentialRefreshVersionMetadataValidator.array(),
+      hasMore: external_exports.boolean(),
+      cursor: external_exports.string().optional()
+    });
+    var CredentialRefreshChallengeValidator = external_exports.object({
+      challenge: external_exports.string().min(1),
+      expiresAt: external_exports.string().min(1),
+      domain: external_exports.string().optional(),
+      scheme: external_exports.literal("LearnCardDIDAuth").optional()
+    });
+    var PublicCredentialRefreshEnvelopeValidator = external_exports.object({
+      format: external_exports.literal("vc"),
+      credential: VCValidator,
+      etag: external_exports.string().optional()
+    });
+    var JweCredentialRefreshEnvelopeValidator = external_exports.object({
+      format: external_exports.literal("jwe"),
+      jwe: JWEValidator,
+      etag: external_exports.string().optional(),
+      /** Present on LearnCard-managed endpoints; optional for interoperable JWE services. */
+      version: external_exports.number().int().positive().optional()
+    });
+    var CredentialRefreshResponseEnvelopeValidator = external_exports.discriminatedUnion("format", [
+      PublicCredentialRefreshEnvelopeValidator,
+      JweCredentialRefreshEnvelopeValidator
+    ]);
+    var CredentialRefreshFailureCodeValidator = external_exports.enum([
+      "UNAVAILABLE",
+      "TIMEOUT",
+      "UNSUPPORTED_SERVICE",
+      "UNAUTHORIZED",
+      "MALFORMED_RESPONSE",
+      "INVALID_PROOF",
+      "ISSUER_MISMATCH",
+      "ID_MISMATCH",
+      "ROLLBACK",
+      "REVOKED",
+      "UNSAFE_ENDPOINT"
+    ]);
+    var CredentialRefreshUpdatedResultValidator = external_exports.object({
+      status: external_exports.literal("updated"),
+      credential: VCValidator,
+      etag: external_exports.string().optional(),
+      managedVersion: external_exports.number().int().positive().optional()
+    });
+    var CredentialRefreshUnchangedResultValidator = external_exports.object({
+      status: external_exports.literal("unchanged"),
+      checkedAt: external_exports.string().min(1),
+      etag: external_exports.string().optional()
+    });
+    var CredentialRefreshUnsupportedResultValidator = external_exports.object({
+      status: external_exports.literal("unsupported")
+    });
+    var CredentialRefreshFailedResultValidator = external_exports.object({
+      status: external_exports.literal("failed"),
+      code: CredentialRefreshFailureCodeValidator,
+      retryable: external_exports.boolean()
+    });
+    var CredentialRefreshResultValidator = external_exports.discriminatedUnion("status", [
+      CredentialRefreshUpdatedResultValidator,
+      CredentialRefreshUnchangedResultValidator,
+      CredentialRefreshUnsupportedResultValidator,
+      CredentialRefreshFailedResultValidator
+    ]);
   }
 });
 
@@ -17999,7 +18223,7 @@ async function deriveKeyFromPassword(password, salt, params = DEFAULT_KDF_PARAMS
     hashLength: ARGON2_HASH_LENGTH,
     outputType: "binary"
   });
-  return new Uint8Array(hash);
+  return Uint8Array.from(hash);
 }
 __name(deriveKeyFromPassword, "deriveKeyFromPassword");
 async function encryptWithPassword(plaintext, password) {