@learncard/sss-key-manager 0.1.23 → 0.1.24

package/dist/sss-key-manager.esm.js

@@ -49,6 +49,7 @@ var require_types_cjs_development = __commonJS({
     var __toCommonJS = /* @__PURE__ */ __name((mod) => __copyProps2(__defProp2({}, "__esModule", { value: true }), mod), "__toCommonJS");
     var index_exports = {};
     __export(index_exports, {
+      ACT_AS_HEADER: /* @__PURE__ */ __name(() => ACT_AS_HEADER, "ACT_AS_HEADER"),
       AUTH_GRANT_AUDIENCE_DOMAIN_PREFIX: /* @__PURE__ */ __name(() => AUTH_GRANT_AUDIENCE_DOMAIN_PREFIX, "AUTH_GRANT_AUDIENCE_DOMAIN_PREFIX"),
       AchievementCredentialValidator: /* @__PURE__ */ __name(() => AchievementCredentialValidator, "AchievementCredentialValidator"),
       AchievementCriteriaValidator: /* @__PURE__ */ __name(() => AchievementCriteriaValidator, "AchievementCriteriaValidator"),
@@ -188,10 +189,18 @@ var require_types_cjs_development = __commonJS({
       IdentifierTypeValidator: /* @__PURE__ */ __name(() => IdentifierTypeValidator, "IdentifierTypeValidator"),
       IdentityObjectValidator: /* @__PURE__ */ __name(() => IdentityObjectValidator, "IdentityObjectValidator"),
       ImageValidator: /* @__PURE__ */ __name(() => ImageValidator, "ImageValidator"),
+      InboxBatchErrorReasonValidator: /* @__PURE__ */ __name(() => InboxBatchErrorReasonValidator, "InboxBatchErrorReasonValidator"),
+      InboxBatchReceiptValidator: /* @__PURE__ */ __name(() => InboxBatchReceiptValidator, "InboxBatchReceiptValidator"),
+      InboxBatchStatusValidator: /* @__PURE__ */ __name(() => InboxBatchStatusValidator, "InboxBatchStatusValidator"),
       InboxCredentialQueryValidator: /* @__PURE__ */ __name(() => InboxCredentialQueryValidator, "InboxCredentialQueryValidator"),
+      InboxCredentialRefreshReceiptValidator: /* @__PURE__ */ __name(() => InboxCredentialRefreshReceiptValidator, "InboxCredentialRefreshReceiptValidator"),
       InboxCredentialValidator: /* @__PURE__ */ __name(() => InboxCredentialValidator, "InboxCredentialValidator"),
       IncrementCounterEventValidator: /* @__PURE__ */ __name(() => IncrementCounterEventValidator, "IncrementCounterEventValidator"),
       InstalledAppValidator: /* @__PURE__ */ __name(() => InstalledAppValidator, "InstalledAppValidator"),
+      IssueInboxCredentialBatchItemResultValidator: /* @__PURE__ */ __name(() => IssueInboxCredentialBatchItemResultValidator, "IssueInboxCredentialBatchItemResultValidator"),
+      IssueInboxCredentialBatchItemValidator: /* @__PURE__ */ __name(() => IssueInboxCredentialBatchItemValidator, "IssueInboxCredentialBatchItemValidator"),
+      IssueInboxCredentialBatchResponseValidator: /* @__PURE__ */ __name(() => IssueInboxCredentialBatchResponseValidator, "IssueInboxCredentialBatchResponseValidator"),
+      IssueInboxCredentialBatchValidator: /* @__PURE__ */ __name(() => IssueInboxCredentialBatchValidator, "IssueInboxCredentialBatchValidator"),
       IssueInboxCredentialResponseValidator: /* @__PURE__ */ __name(() => IssueInboxCredentialResponseValidator, "IssueInboxCredentialResponseValidator"),
       IssueInboxCredentialValidator: /* @__PURE__ */ __name(() => IssueInboxCredentialValidator, "IssueInboxCredentialValidator"),
       IssueInboxSigningAuthorityValidator: /* @__PURE__ */ __name(() => IssueInboxSigningAuthorityValidator, "IssueInboxSigningAuthorityValidator"),
@@ -240,6 +249,7 @@ var require_types_cjs_development = __commonJS({
       LaunchTypeValidator: /* @__PURE__ */ __name(() => LaunchTypeValidator, "LaunchTypeValidator"),
       LearnCardRefreshAuthorizationValidator: /* @__PURE__ */ __name(() => LearnCardRefreshAuthorizationValidator, "LearnCardRefreshAuthorizationValidator"),
       LinkProviderFrameworkInputValidator: /* @__PURE__ */ __name(() => LinkProviderFrameworkInputValidator, "LinkProviderFrameworkInputValidator"),
+      ManagedCredentialRefreshReceiptValidator: /* @__PURE__ */ __name(() => ManagedCredentialRefreshReceiptValidator, "ManagedCredentialRefreshReceiptValidator"),
       ManagedCredentialRefreshServiceValidator: /* @__PURE__ */ __name(() => ManagedCredentialRefreshServiceValidator, "ManagedCredentialRefreshServiceValidator"),
       PaginatedAppStoreListingsValidator: /* @__PURE__ */ __name(() => PaginatedAppStoreListingsValidator, "PaginatedAppStoreListingsValidator"),
       PaginatedBoostRecipientsValidator: /* @__PURE__ */ __name(() => PaginatedBoostRecipientsValidator, "PaginatedBoostRecipientsValidator"),
@@ -266,6 +276,8 @@ var require_types_cjs_development = __commonJS({
       PaginatedVisibleLCNProfilesValidator: /* @__PURE__ */ __name(() => PaginatedVisibleLCNProfilesValidator, "PaginatedVisibleLCNProfilesValidator"),
       PaginationOptionsValidator: /* @__PURE__ */ __name(() => PaginationOptionsValidator, "PaginationOptionsValidator"),
       PaginationResponseValidator: /* @__PURE__ */ __name(() => PaginationResponseValidator, "PaginationResponseValidator"),
+      PrepareRefreshableSendInputValidator: /* @__PURE__ */ __name(() => PrepareRefreshableSendInputValidator, "PrepareRefreshableSendInputValidator"),
+      PrepareRefreshableSendResultValidator: /* @__PURE__ */ __name(() => PrepareRefreshableSendResultValidator, "PrepareRefreshableSendResultValidator"),
       ProfileValidator: /* @__PURE__ */ __name(() => ProfileValidator, "ProfileValidator"),
       ProfileVisibilityEnum: /* @__PURE__ */ __name(() => ProfileVisibilityEnum, "ProfileVisibilityEnum"),
       PromotionLevelValidator: /* @__PURE__ */ __name(() => PromotionLevelValidator, "PromotionLevelValidator"),
@@ -291,6 +303,7 @@ var require_types_cjs_development = __commonJS({
       SendAiSessionCredentialEventValidator: /* @__PURE__ */ __name(() => SendAiSessionCredentialEventValidator, "SendAiSessionCredentialEventValidator"),
       SendBoostInputValidator: /* @__PURE__ */ __name(() => SendBoostInputValidator, "SendBoostInputValidator"),
       SendBoostResponseValidator: /* @__PURE__ */ __name(() => SendBoostResponseValidator, "SendBoostResponseValidator"),
+      SendBoostTemplateValidator: /* @__PURE__ */ __name(() => SendBoostTemplateValidator, "SendBoostTemplateValidator"),
       SendBrandingOptionsValidator: /* @__PURE__ */ __name(() => SendBrandingOptionsValidator, "SendBrandingOptionsValidator"),
       SendCredentialEventValidator: /* @__PURE__ */ __name(() => SendCredentialEventValidator, "SendCredentialEventValidator"),
       SendInboxResponseValidator: /* @__PURE__ */ __name(() => SendInboxResponseValidator, "SendInboxResponseValidator"),
@@ -16215,6 +16228,204 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
         $or: BaseStringQuery.array()
       })
     ]);
+    var LearnCardRefreshAuthorizationValidator = external_exports.object({ type: external_exports.literal("LearnCardDIDAuth") }).catchall(external_exports.any());
+    var ManagedCredentialRefreshServiceValidator = external_exports.object({
+      id: external_exports.string().min(1),
+      type: external_exports.literal("LearnCardCredentialRefresh2026"),
+      authorization: LearnCardRefreshAuthorizationValidator.optional()
+    }).catchall(external_exports.any());
+    var StandardCredentialRefreshServiceValidator = external_exports.object({
+      id: external_exports.string().min(1),
+      type: external_exports.literal("1EdTechCredentialRefresh")
+    }).catchall(external_exports.any());
+    var SupportedCredentialRefreshServiceValidator = external_exports.union([
+      ManagedCredentialRefreshServiceValidator,
+      StandardCredentialRefreshServiceValidator
+    ]);
+    var AllocateCredentialRefreshInputValidator = external_exports.object({
+      holder: external_exports.object({
+        profileId: external_exports.string().optional(),
+        did: external_exports.string().min(1)
+      }),
+      credentialId: external_exports.string().min(1)
+    });
+    var AllocateCredentialRefreshResultValidator = external_exports.object({
+      refreshId: external_exports.string().min(1),
+      refreshService: ManagedCredentialRefreshServiceValidator.extend({
+        authorization: LearnCardRefreshAuthorizationValidator
+      })
+    });
+    var ManagedCredentialRefreshReceiptValidator = external_exports.object({
+      refreshId: external_exports.string().min(1),
+      refreshService: ManagedCredentialRefreshServiceValidator,
+      credentialId: external_exports.string().min(1),
+      issuerDid: external_exports.string().min(1),
+      holderDid: external_exports.string().min(1),
+      credentialStatus: CredentialStatusValidator.or(
+        CredentialStatusValidator.array()
+      ).optional()
+    }).strip();
+    var InboxCredentialRefreshReceiptValidator = ManagedCredentialRefreshReceiptValidator.omit(
+      { holderDid: true }
+    ).extend({ holderDid: external_exports.string().min(1).optional() });
+    var CredentialRefreshSigningModeValidator = external_exports.enum(["issuer-signed", "signing-authority"]);
+    var PublishCredentialRefreshBaseFields = {
+      refreshId: external_exports.string().min(1),
+      notifyHolder: external_exports.boolean().optional(),
+      updateSummary: external_exports.string().optional(),
+      idempotencyKey: external_exports.string().optional()
+    };
+    var PublishIssuerSignedRefreshValidator = external_exports.object({
+      ...PublishCredentialRefreshBaseFields,
+      mode: external_exports.literal("issuer-signed"),
+      signedCredential: VCValidator
+    });
+    var PublishSigningAuthorityRefreshValidator = external_exports.object({
+      ...PublishCredentialRefreshBaseFields,
+      mode: external_exports.literal("signing-authority"),
+      credential: UnsignedVCValidator,
+      signingAuthority: external_exports.object({
+        type: external_exports.string().min(1)
+      }).catchall(external_exports.any())
+    });
+    var PublishCredentialRefreshInputValidator = external_exports.object({
+      ...PublishCredentialRefreshBaseFields,
+      mode: CredentialRefreshSigningModeValidator,
+      signedCredential: VCValidator.optional(),
+      credential: UnsignedVCValidator.optional(),
+      signingAuthority: external_exports.object({
+        type: external_exports.string().min(1)
+      }).catchall(external_exports.any()).optional()
+    }).superRefine((input, ctx) => {
+      if (input.mode === "issuer-signed" && !input.signedCredential) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["signedCredential"],
+          message: "signedCredential is required for issuer-signed publication"
+        });
+      }
+      if (input.mode === "issuer-signed" && (input.credential !== void 0 || input.signingAuthority !== void 0)) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["mode"],
+          message: "issuer-signed publication cannot include signing-authority fields"
+        });
+      }
+      if (input.mode === "signing-authority") {
+        if (input.signedCredential !== void 0) {
+          ctx.addIssue({
+            code: "custom",
+            path: ["signedCredential"],
+            message: "signing-authority publication cannot include signedCredential"
+          });
+        }
+        if (!input.credential) {
+          ctx.addIssue({
+            code: "custom",
+            path: ["credential"],
+            message: "credential is required for signing-authority publication"
+          });
+        }
+        if (!input.signingAuthority) {
+          ctx.addIssue({
+            code: "custom",
+            path: ["signingAuthority"],
+            message: "signingAuthority is required for signing-authority publication"
+          });
+        }
+      }
+    });
+    var PublishCredentialRefreshNotificationValidator = external_exports.enum([
+      "queued",
+      "suppressed",
+      "not-applicable",
+      /** Publication succeeded, but the post-commit notification enqueue must be retried. */
+      "delivery-failed"
+    ]);
+    var PublishCredentialRefreshResultValidator = external_exports.object({
+      refreshId: external_exports.string().min(1),
+      version: external_exports.number().int().positive(),
+      publishedAt: external_exports.string().min(1),
+      notification: PublishCredentialRefreshNotificationValidator
+    });
+    var CredentialRefreshVersionMetadataValidator = external_exports.object({
+      version: external_exports.number().int().positive(),
+      publishedAt: external_exports.string().min(1),
+      effectiveAt: external_exports.string().optional(),
+      etag: external_exports.string().optional(),
+      signingMode: CredentialRefreshSigningModeValidator.optional(),
+      updateSummary: external_exports.string().optional()
+    });
+    var GetCredentialRefreshHistoryInputValidator = external_exports.object({
+      refreshId: external_exports.string().min(1),
+      cursor: external_exports.string().optional(),
+      limit: external_exports.number().int().positive().optional()
+    });
+    var GetCredentialRefreshHistoryResultValidator = external_exports.object({
+      records: CredentialRefreshVersionMetadataValidator.array(),
+      hasMore: external_exports.boolean(),
+      cursor: external_exports.string().optional()
+    });
+    var CredentialRefreshChallengeValidator = external_exports.object({
+      challenge: external_exports.string().min(1),
+      expiresAt: external_exports.string().min(1),
+      domain: external_exports.string().optional(),
+      scheme: external_exports.literal("LearnCardDIDAuth").optional()
+    });
+    var PublicCredentialRefreshEnvelopeValidator = external_exports.object({
+      format: external_exports.literal("vc"),
+      credential: VCValidator,
+      etag: external_exports.string().optional()
+    });
+    var JweCredentialRefreshEnvelopeValidator = external_exports.object({
+      format: external_exports.literal("jwe"),
+      jwe: JWEValidator,
+      etag: external_exports.string().optional(),
+      /** Present on LearnCard-managed endpoints; optional for interoperable JWE services. */
+      version: external_exports.number().int().positive().optional()
+    });
+    var CredentialRefreshResponseEnvelopeValidator = external_exports.discriminatedUnion("format", [
+      PublicCredentialRefreshEnvelopeValidator,
+      JweCredentialRefreshEnvelopeValidator
+    ]);
+    var CredentialRefreshFailureCodeValidator = external_exports.enum([
+      "UNAVAILABLE",
+      "TIMEOUT",
+      "UNSUPPORTED_SERVICE",
+      "UNAUTHORIZED",
+      "MALFORMED_RESPONSE",
+      "INVALID_PROOF",
+      "ISSUER_MISMATCH",
+      "ID_MISMATCH",
+      "ROLLBACK",
+      "REVOKED",
+      "UNSAFE_ENDPOINT"
+    ]);
+    var CredentialRefreshUpdatedResultValidator = external_exports.object({
+      status: external_exports.literal("updated"),
+      credential: VCValidator,
+      etag: external_exports.string().optional(),
+      managedVersion: external_exports.number().int().positive().optional()
+    });
+    var CredentialRefreshUnchangedResultValidator = external_exports.object({
+      status: external_exports.literal("unchanged"),
+      checkedAt: external_exports.string().min(1),
+      etag: external_exports.string().optional()
+    });
+    var CredentialRefreshUnsupportedResultValidator = external_exports.object({
+      status: external_exports.literal("unsupported")
+    });
+    var CredentialRefreshFailedResultValidator = external_exports.object({
+      status: external_exports.literal("failed"),
+      code: CredentialRefreshFailureCodeValidator,
+      retryable: external_exports.boolean()
+    });
+    var CredentialRefreshResultValidator = external_exports.discriminatedUnion("status", [
+      CredentialRefreshUpdatedResultValidator,
+      CredentialRefreshUnchangedResultValidator,
+      CredentialRefreshUnsupportedResultValidator,
+      CredentialRefreshFailedResultValidator
+    ]);
     var LCNProfileDisplayValidator = external_exports.object({
       backgroundColor: external_exports.string().optional(),
       backgroundImage: external_exports.string().optional(),
@@ -16550,7 +16761,13 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
         "Options for email/phone recipients (Universal Inbox)"
       ),
       templateData: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
-      integrationId: external_exports.string().optional().describe("Integration ID for activity tracking")
+      integrationId: external_exports.string().optional().describe("Integration ID for activity tracking"),
+      refresh: external_exports.boolean().optional().describe(
+        "Request managed credential refresh for this send. Profile/DID recipients use immediate issuance; email/phone recipients use deferred Universal Inbox signing and bind the holder at claim."
+      ),
+      idempotencyKey: external_exports.string().min(1).max(200).optional().describe(
+        "Caller-chosen key that makes a managed refresh send (refresh: true) safe to retry as a whole: retries with the same key reuse the same boost, refresh allocation and result. Reusing a key for a different request is rejected. With signedCredential, requires prior tRPC prepareRefreshableSend; direct REST callers omit the key and retry the exact signed credential and templateUri."
+      )
     }).refine((data) => data.templateUri || data.template || data.signedCredential, {
       message: "Either templateUri, template, or signedCredential must be provided.",
       path: ["templateUri"]
@@ -16565,8 +16782,12 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
         message: "guardianEmail must differ from recipient (self-approval not allowed)",
         path: ["options", "guardianEmail"]
       }
-    );
+    ).refine((data) => !data.idempotencyKey || data.refresh === true, {
+      message: "idempotencyKey is only supported with refresh: true.",
+      path: ["idempotencyKey"]
+    });
     var SendInboxResponseValidator = external_exports.object({
+      refresh: InboxCredentialRefreshReceiptValidator.optional(),
       issuanceId: external_exports.string(),
       status: external_exports.enum(["PENDING", "ISSUED", "EXPIRED", "DELIVERED", "CLAIMED"]),
       claimUrl: external_exports.string().url().optional().describe("Present when suppressDelivery=true"),
@@ -16581,8 +16802,34 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       activityId: external_exports.string().describe("Links to the activity lifecycle for this issuance"),
       inbox: SendInboxResponseValidator.optional().describe(
         "Present when sent via email/phone (Universal Inbox)"
+      ),
+      refresh: ManagedCredentialRefreshReceiptValidator.optional().describe(
+        "Present when managed refresh was requested: issuance metadata the issuer keeps to publish future updates"
       )
     });
+    var PrepareRefreshableSendInputValidator = external_exports.object({
+      recipient: external_exports.string(),
+      templateUri: external_exports.string().optional(),
+      template: SendBoostTemplateValidator.optional(),
+      contractUri: external_exports.string().optional(),
+      templateData: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
+      integrationId: external_exports.string().optional(),
+      /** Credential ID to allocate for; generated server-side when omitted. */
+      credentialId: external_exports.string().min(1).optional(),
+      idempotencyKey: external_exports.string().min(1).max(200).optional()
+    }).refine((data) => Boolean(data.templateUri) !== Boolean(data.template), {
+      message: "Provide exactly one of templateUri or template."
+    });
+    var PrepareRefreshableSendResultValidator = external_exports.object({
+      boostUri: external_exports.string(),
+      credentialId: external_exports.string(),
+      refreshId: external_exports.string(),
+      refreshService: ManagedCredentialRefreshServiceValidator,
+      /** The DID to use as credentialSubject.id (recipient DID, or the profile's did:web). */
+      holderDid: external_exports.string(),
+      /** Present when this idempotencyKey already completed: return it without signing. */
+      completed: SendBoostResponseValidator.optional()
+    });
     var SendInputValidator = external_exports.discriminatedUnion("type", [SendBoostInputValidator]);
     var SendResponseValidator = external_exports.discriminatedUnion("type", [SendBoostResponseValidator]);
     var ConsentFlowTermsStatusValidator = external_exports.enum(["live", "stale", "withdrawn"]);
@@ -16901,6 +17148,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       webhookUrl: external_exports.string().optional()
     });
     var AUTH_GRANT_AUDIENCE_DOMAIN_PREFIX = "auth-grant:";
+    var ACT_AS_HEADER = "X-LearnCard-Act-As";
     var AuthGrantValidator = external_exports.object({
       id: external_exports.string(),
       name: external_exports.string(),
@@ -16913,6 +17161,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
         }, "error")
       }),
       scope: external_exports.string(),
+      actAs: external_exports.string().optional(),
       createdAt: external_exports.iso.datetime({ error: "createdAt must be a valid ISO 8601 datetime string" }),
       expiresAt: external_exports.iso.datetime({ error: "expiresAt must be a valid ISO 8601 datetime string" }).nullish().optional()
     });
@@ -16984,6 +17233,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       sessionJwt: external_exports.string()
     });
     var InboxCredentialValidator = external_exports.object({
+      refresh: InboxCredentialRefreshReceiptValidator.optional(),
+      refreshId: external_exports.string().optional(),
       id: external_exports.string(),
       credential: external_exports.string().optional(),
       isSigned: external_exports.boolean(),
@@ -17038,12 +17289,19 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       templateUri: external_exports.string().optional().describe(
         "URI of a boost template to use for issuance. The boost credential will be resolved and used. Mutually exclusive with credential field."
       ),
+      refresh: external_exports.boolean().optional().describe(
+        "Allocate managed refresh before signing. Requires unsigned content and a registered signing authority; binds the holder on claim."
+      ),
+      idempotencyKey: external_exports.string().min(1).max(200).optional(),
       // === OPTIONAL FEATURES ===
       // Add major, distinct features at the top level.
       //consentRequest: ConsentRequestValidator.optional(),
       // === PROCESS CONFIGURATION (Optional) ===
       // HOW should this issuance be handled?
       configuration: external_exports.object({
+        guardianEmail: external_exports.string().email().optional().describe(
+          "Require approval from this guardian before the recipient can claim. Must differ from the recipient email."
+        ),
         signingAuthority: IssueInboxSigningAuthorityValidator.optional().describe(
           "The signing authority to use for the credential. If not provided, the users default signing authority will be used if the credential is not signed."
         ),
@@ -17097,17 +17355,130 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       }).optional().describe(
         "Configuration for the credential issuance. If not provided, the default configuration will be used."
       )
+    }).refine((data) => !data.idempotencyKey || data.refresh === true, {
+      message: "idempotencyKey requires refresh: true."
     }).refine((data) => data.credential || data.templateUri, {
       message: "Either credential or templateUri must be provided.",
       path: ["credential"]
-    });
+    }).refine(
+      (data) => !data.configuration?.guardianEmail || data.recipient.type !== "email" || data.configuration.guardianEmail.toLowerCase() !== data.recipient.value.toLowerCase(),
+      {
+        message: "guardianEmail must differ from recipient (self-approval not allowed)",
+        path: ["configuration", "guardianEmail"]
+      }
+    );
     var IssueInboxCredentialResponseValidator = external_exports.object({
+      refresh: InboxCredentialRefreshReceiptValidator.optional(),
       issuanceId: external_exports.string(),
       status: LCNInboxStatusEnumValidator,
       recipient: ContactMethodQueryValidator,
       claimUrl: external_exports.string().url().optional(),
       recipientDid: external_exports.string().optional()
     });
+    var InboxBatchConfigurationValidator = IssueInboxCredentialValidator.shape.configuration.unwrap().extend({
+      refresh: IssueInboxCredentialValidator.shape.refresh.describe(
+        "Enable managed refresh by default. An item configuration.refresh overrides this value, including false."
+      ),
+      delivery: IssueInboxCredentialValidator.shape.configuration.unwrap().shape.delivery.unwrap().extend({ suppress: external_exports.boolean().optional() }).optional()
+    });
+    var InboxBatchItemConfigurationValidator = InboxBatchConfigurationValidator.extend({
+      guardianEmail: InboxBatchConfigurationValidator.shape.guardianEmail.nullable().describe(
+        "Require guardian approval, or set null to clear a batch-level guardianEmail for this item."
+      )
+    });
+    var IssueInboxCredentialBatchItemValidator = external_exports.object({
+      ...IssueInboxCredentialValidator.shape,
+      configuration: InboxBatchItemConfigurationValidator.optional(),
+      idempotencyKey: external_exports.string().max(256).optional()
+    }).refine((data) => data.credential || data.templateUri, {
+      message: "Either credential or templateUri must be provided.",
+      path: ["credential"]
+    }).describe(
+      "One issuance: provide credential or templateUri. Invalid input is rejected at submission with its item index."
+    );
+    var IssueInboxCredentialBatchValidator = external_exports.object({
+      requestId: external_exports.string().min(1).max(256).optional(),
+      items: external_exports.array(IssueInboxCredentialBatchItemValidator).min(1).max(100),
+      configuration: InboxBatchConfigurationValidator.optional()
+    }).superRefine((batch, ctx) => {
+      batch.items.forEach((item, index) => {
+        const itemGuardian = item.configuration?.guardianEmail;
+        const guardian = itemGuardian === null ? void 0 : itemGuardian ?? batch.configuration?.guardianEmail;
+        if (guardian && item.recipient.type === "email" && guardian.toLowerCase() === item.recipient.value.toLowerCase()) {
+          ctx.addIssue({
+            code: "custom",
+            path: ["items", index, "configuration", "guardianEmail"],
+            message: "guardianEmail must differ from recipient (self-approval not allowed)"
+          });
+        }
+      });
+    });
+    var InboxBatchErrorReasonValidator = external_exports.enum([
+      "DUPLICATE_KEY",
+      "IDEMPOTENCY_MISMATCH",
+      "IN_PROGRESS",
+      "UNCONFIRMED"
+    ]);
+    var IssueInboxCredentialBatchItemResultValidator = external_exports.discriminatedUnion("success", [
+      IssueInboxCredentialResponseValidator.extend({
+        success: external_exports.literal(true),
+        index: external_exports.number().int().nonnegative(),
+        deduplicated: external_exports.boolean().optional(),
+        guardianStatus: GuardianStatusValidator.optional(),
+        idempotencyKey: external_exports.string().optional()
+      }),
+      external_exports.object({
+        success: external_exports.literal(false),
+        index: external_exports.number().int().nonnegative(),
+        idempotencyKey: external_exports.string().optional(),
+        recipient: ContactMethodQueryValidator.optional(),
+        error: external_exports.object({
+          code: external_exports.string(),
+          message: external_exports.string(),
+          reason: InboxBatchErrorReasonValidator.optional()
+        }),
+        issuanceId: external_exports.string().optional().describe(
+          "Present when issuance completed but replay storage could not be confirmed. Reconcile this issuance; do not issue again with a new key."
+        ),
+        claimUrl: external_exports.string().url().optional().describe(
+          "Claim URL of the completed issuance, if available, when replay storage could not be confirmed."
+        )
+      })
+    ]);
+    var IssueInboxCredentialBatchResponseValidator = external_exports.object({
+      results: external_exports.array(IssueInboxCredentialBatchItemResultValidator),
+      summary: external_exports.object({
+        total: external_exports.number(),
+        succeeded: external_exports.number(),
+        failed: external_exports.number(),
+        deduplicated: external_exports.number()
+      })
+    });
+    var InboxBatchReceiptValidator = external_exports.object({
+      batchId: external_exports.string(),
+      status: external_exports.enum(["QUEUED", "PROCESSING", "COMPLETED", "NEEDS_RECONCILIATION"]),
+      createdAt: external_exports.string()
+    });
+    var InboxBatchStatusValidator = external_exports.object({
+      batchId: external_exports.string(),
+      createdAt: external_exports.string(),
+      done: external_exports.boolean().describe(
+        "True when no queued or processing items remain, including unconfirmed outcomes."
+      ),
+      status: external_exports.enum(["QUEUED", "PROCESSING", "COMPLETED", "NEEDS_RECONCILIATION"]),
+      items: external_exports.array(
+        external_exports.object({
+          index: external_exports.number().int().nonnegative(),
+          state: external_exports.enum(["QUEUED", "PROCESSING", "COMPLETED", "NEEDS_RECONCILIATION"]),
+          result: IssueInboxCredentialBatchItemResultValidator.optional()
+        })
+      ),
+      summary: IssueInboxCredentialBatchResponseValidator.shape.summary.extend({
+        completed: external_exports.number(),
+        pending: external_exports.number(),
+        unconfirmed: external_exports.number()
+      })
+    });
     var CredentialNameRefValidator = external_exports.object({ name: external_exports.string() }).passthrough();
     var ClaimInboxCredentialValidator = external_exports.object({
       credential: VCValidator.or(VPValidator).or(UnsignedVCValidator).or(CredentialNameRefValidator).describe("The credential to issue, or a { name } reference to resolve a boost template."),
@@ -17593,6 +17964,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       eventType: CredentialActivityEventTypeValidator,
       timestamp: external_exports.string(),
       actorProfileId: external_exports.string().optional(),
+      onBehalfOf: external_exports.string().optional(),
       recipientType: CredentialActivityRecipientTypeValidator,
       recipientIdentifier: external_exports.string(),
       boostUri: external_exports.string().optional(),
@@ -17753,191 +18125,6 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       const result = inAppMessagesFlagValidator.safeParse(raw);
       return result.success ? result.data : EMPTY_IN_APP_MESSAGES_FLAG;
     }, "parseInAppMessagesFlag");
-    var LearnCardRefreshAuthorizationValidator = external_exports.object({ type: external_exports.literal("LearnCardDIDAuth") }).catchall(external_exports.any());
-    var ManagedCredentialRefreshServiceValidator = external_exports.object({
-      id: external_exports.string().min(1),
-      type: external_exports.literal("LearnCardCredentialRefresh2026"),
-      authorization: LearnCardRefreshAuthorizationValidator.optional()
-    }).catchall(external_exports.any());
-    var StandardCredentialRefreshServiceValidator = external_exports.object({
-      id: external_exports.string().min(1),
-      type: external_exports.literal("1EdTechCredentialRefresh")
-    }).catchall(external_exports.any());
-    var SupportedCredentialRefreshServiceValidator = external_exports.union([
-      ManagedCredentialRefreshServiceValidator,
-      StandardCredentialRefreshServiceValidator
-    ]);
-    var AllocateCredentialRefreshInputValidator = external_exports.object({
-      holder: external_exports.object({
-        profileId: external_exports.string().optional(),
-        did: external_exports.string().min(1)
-      }),
-      credentialId: external_exports.string().min(1)
-    });
-    var AllocateCredentialRefreshResultValidator = external_exports.object({
-      refreshId: external_exports.string().min(1),
-      refreshService: ManagedCredentialRefreshServiceValidator.extend({
-        authorization: LearnCardRefreshAuthorizationValidator
-      })
-    });
-    var CredentialRefreshSigningModeValidator = external_exports.enum(["issuer-signed", "signing-authority"]);
-    var PublishCredentialRefreshBaseFields = {
-      refreshId: external_exports.string().min(1),
-      notifyHolder: external_exports.boolean().optional(),
-      updateSummary: external_exports.string().optional(),
-      idempotencyKey: external_exports.string().optional()
-    };
-    var PublishIssuerSignedRefreshValidator = external_exports.object({
-      ...PublishCredentialRefreshBaseFields,
-      mode: external_exports.literal("issuer-signed"),
-      signedCredential: VCValidator
-    });
-    var PublishSigningAuthorityRefreshValidator = external_exports.object({
-      ...PublishCredentialRefreshBaseFields,
-      mode: external_exports.literal("signing-authority"),
-      credential: UnsignedVCValidator,
-      signingAuthority: external_exports.object({
-        type: external_exports.string().min(1)
-      }).catchall(external_exports.any())
-    });
-    var PublishCredentialRefreshInputValidator = external_exports.object({
-      ...PublishCredentialRefreshBaseFields,
-      mode: CredentialRefreshSigningModeValidator,
-      signedCredential: VCValidator.optional(),
-      credential: UnsignedVCValidator.optional(),
-      signingAuthority: external_exports.object({
-        type: external_exports.string().min(1)
-      }).catchall(external_exports.any()).optional()
-    }).superRefine((input, ctx) => {
-      if (input.mode === "issuer-signed" && !input.signedCredential) {
-        ctx.addIssue({
-          code: "custom",
-          path: ["signedCredential"],
-          message: "signedCredential is required for issuer-signed publication"
-        });
-      }
-      if (input.mode === "issuer-signed" && (input.credential !== void 0 || input.signingAuthority !== void 0)) {
-        ctx.addIssue({
-          code: "custom",
-          path: ["mode"],
-          message: "issuer-signed publication cannot include signing-authority fields"
-        });
-      }
-      if (input.mode === "signing-authority") {
-        if (input.signedCredential !== void 0) {
-          ctx.addIssue({
-            code: "custom",
-            path: ["signedCredential"],
-            message: "signing-authority publication cannot include signedCredential"
-          });
-        }
-        if (!input.credential) {
-          ctx.addIssue({
-            code: "custom",
-            path: ["credential"],
-            message: "credential is required for signing-authority publication"
-          });
-        }
-        if (!input.signingAuthority) {
-          ctx.addIssue({
-            code: "custom",
-            path: ["signingAuthority"],
-            message: "signingAuthority is required for signing-authority publication"
-          });
-        }
-      }
-    });
-    var PublishCredentialRefreshNotificationValidator = external_exports.enum([
-      "queued",
-      "suppressed",
-      "not-applicable",
-      /** Publication succeeded, but the post-commit notification enqueue must be retried. */
-      "delivery-failed"
-    ]);
-    var PublishCredentialRefreshResultValidator = external_exports.object({
-      refreshId: external_exports.string().min(1),
-      version: external_exports.number().int().positive(),
-      publishedAt: external_exports.string().min(1),
-      notification: PublishCredentialRefreshNotificationValidator
-    });
-    var CredentialRefreshVersionMetadataValidator = external_exports.object({
-      version: external_exports.number().int().positive(),
-      publishedAt: external_exports.string().min(1),
-      effectiveAt: external_exports.string().optional(),
-      etag: external_exports.string().optional(),
-      signingMode: CredentialRefreshSigningModeValidator.optional(),
-      updateSummary: external_exports.string().optional()
-    });
-    var GetCredentialRefreshHistoryInputValidator = external_exports.object({
-      refreshId: external_exports.string().min(1),
-      cursor: external_exports.string().optional(),
-      limit: external_exports.number().int().positive().optional()
-    });
-    var GetCredentialRefreshHistoryResultValidator = external_exports.object({
-      records: CredentialRefreshVersionMetadataValidator.array(),
-      hasMore: external_exports.boolean(),
-      cursor: external_exports.string().optional()
-    });
-    var CredentialRefreshChallengeValidator = external_exports.object({
-      challenge: external_exports.string().min(1),
-      expiresAt: external_exports.string().min(1),
-      domain: external_exports.string().optional(),
-      scheme: external_exports.literal("LearnCardDIDAuth").optional()
-    });
-    var PublicCredentialRefreshEnvelopeValidator = external_exports.object({
-      format: external_exports.literal("vc"),
-      credential: VCValidator,
-      etag: external_exports.string().optional()
-    });
-    var JweCredentialRefreshEnvelopeValidator = external_exports.object({
-      format: external_exports.literal("jwe"),
-      jwe: JWEValidator,
-      etag: external_exports.string().optional(),
-      /** Present on LearnCard-managed endpoints; optional for interoperable JWE services. */
-      version: external_exports.number().int().positive().optional()
-    });
-    var CredentialRefreshResponseEnvelopeValidator = external_exports.discriminatedUnion("format", [
-      PublicCredentialRefreshEnvelopeValidator,
-      JweCredentialRefreshEnvelopeValidator
-    ]);
-    var CredentialRefreshFailureCodeValidator = external_exports.enum([
-      "UNAVAILABLE",
-      "TIMEOUT",
-      "UNSUPPORTED_SERVICE",
-      "UNAUTHORIZED",
-      "MALFORMED_RESPONSE",
-      "INVALID_PROOF",
-      "ISSUER_MISMATCH",
-      "ID_MISMATCH",
-      "ROLLBACK",
-      "REVOKED",
-      "UNSAFE_ENDPOINT"
-    ]);
-    var CredentialRefreshUpdatedResultValidator = external_exports.object({
-      status: external_exports.literal("updated"),
-      credential: VCValidator,
-      etag: external_exports.string().optional(),
-      managedVersion: external_exports.number().int().positive().optional()
-    });
-    var CredentialRefreshUnchangedResultValidator = external_exports.object({
-      status: external_exports.literal("unchanged"),
-      checkedAt: external_exports.string().min(1),
-      etag: external_exports.string().optional()
-    });
-    var CredentialRefreshUnsupportedResultValidator = external_exports.object({
-      status: external_exports.literal("unsupported")
-    });
-    var CredentialRefreshFailedResultValidator = external_exports.object({
-      status: external_exports.literal("failed"),
-      code: CredentialRefreshFailureCodeValidator,
-      retryable: external_exports.boolean()
-    });
-    var CredentialRefreshResultValidator = external_exports.discriminatedUnion("status", [
-      CredentialRefreshUpdatedResultValidator,
-      CredentialRefreshUnchangedResultValidator,
-      CredentialRefreshUnsupportedResultValidator,
-      CredentialRefreshFailedResultValidator
-    ]);
   }
 });