@learncard/sss-key-manager 0.1.4 → 0.1.7

package/dist/sss-key-manager.d.ts

@@ -705,6 +705,12 @@ export interface SSSStrategyConfig {
 	 * Defaults to false. Controlled by VITE_ENABLE_EMAIL_BACKUP_SHARE env var.
 	 */
 	enableEmailBackupShare?: boolean;
+	/**
+	 * Tenant identifier forwarded as `X-Tenant-Id` on every server request.
+	 * The lca-api uses this to brand recovery / OTP emails for the active
+	 * tenant. Defaults to the server's fallback tenant (learncard) when unset.
+	 */
+	tenantId?: string;
 }
 /**
  * Create an SSS key derivation strategy.

package/dist/sss-key-manager.esm.js

@@ -70,6 +70,8 @@ var require_types_cjs_development = __commonJS({
       AppStoreListingSubmitterValidator: /* @__PURE__ */ __name(() => AppStoreListingSubmitterValidator, "AppStoreListingSubmitterValidator"),
       AppStoreListingUpdateValidator: /* @__PURE__ */ __name(() => AppStoreListingUpdateValidator, "AppStoreListingUpdateValidator"),
       AppStoreListingValidator: /* @__PURE__ */ __name(() => AppStoreListingValidator, "AppStoreListingValidator"),
+      AssociationTypeValidator: /* @__PURE__ */ __name(() => AssociationTypeValidator, "AssociationTypeValidator"),
+      AssociationValidator: /* @__PURE__ */ __name(() => AssociationValidator, "AssociationValidator"),
       AuthGrantQueryValidator: /* @__PURE__ */ __name(() => AuthGrantQueryValidator, "AuthGrantQueryValidator"),
       AuthGrantStatusValidator: /* @__PURE__ */ __name(() => AuthGrantStatusValidator, "AuthGrantStatusValidator"),
       AuthGrantValidator: /* @__PURE__ */ __name(() => AuthGrantValidator, "AuthGrantValidator"),
@@ -88,6 +90,8 @@ var require_types_cjs_development = __commonJS({
       ClaimHookValidator: /* @__PURE__ */ __name(() => ClaimHookValidator, "ClaimHookValidator"),
       ClaimInboxCredentialValidator: /* @__PURE__ */ __name(() => ClaimInboxCredentialValidator, "ClaimInboxCredentialValidator"),
       ClaimTokenValidator: /* @__PURE__ */ __name(() => ClaimTokenValidator, "ClaimTokenValidator"),
+      ClrCredentialValidator: /* @__PURE__ */ __name(() => ClrCredentialValidator, "ClrCredentialValidator"),
+      ClrSubjectValidator: /* @__PURE__ */ __name(() => ClrSubjectValidator, "ClrSubjectValidator"),
       ConsentFlowContractDataForDidValidator: /* @__PURE__ */ __name(() => ConsentFlowContractDataForDidValidator, "ConsentFlowContractDataForDidValidator"),
       ConsentFlowContractDataValidator: /* @__PURE__ */ __name(() => ConsentFlowContractDataValidator, "ConsentFlowContractDataValidator"),
       ConsentFlowContractDetailsValidator: /* @__PURE__ */ __name(() => ConsentFlowContractDetailsValidator, "ConsentFlowContractDetailsValidator"),
@@ -146,17 +150,21 @@ var require_types_cjs_development = __commonJS({
       FrameworkWithSkillsValidator: /* @__PURE__ */ __name(() => FrameworkWithSkillsValidator, "FrameworkWithSkillsValidator"),
       FullClaimHookValidator: /* @__PURE__ */ __name(() => FullClaimHookValidator, "FullClaimHookValidator"),
       GeoCoordinatesValidator: /* @__PURE__ */ __name(() => GeoCoordinatesValidator, "GeoCoordinatesValidator"),
+      GetCounterEventValidator: /* @__PURE__ */ __name(() => GetCounterEventValidator, "GetCounterEventValidator"),
+      GetCountersEventValidator: /* @__PURE__ */ __name(() => GetCountersEventValidator, "GetCountersEventValidator"),
       GetFullSkillTreeInputValidator: /* @__PURE__ */ __name(() => GetFullSkillTreeInputValidator, "GetFullSkillTreeInputValidator"),
       GetFullSkillTreeResultValidator: /* @__PURE__ */ __name(() => GetFullSkillTreeResultValidator, "GetFullSkillTreeResultValidator"),
       GetSkillPathInputValidator: /* @__PURE__ */ __name(() => GetSkillPathInputValidator, "GetSkillPathInputValidator"),
       GetSkillPathResultValidator: /* @__PURE__ */ __name(() => GetSkillPathResultValidator, "GetSkillPathResultValidator"),
       GetTemplateRecipientsEventValidator: /* @__PURE__ */ __name(() => GetTemplateRecipientsEventValidator, "GetTemplateRecipientsEventValidator"),
+      GuardianStatusValidator: /* @__PURE__ */ __name(() => GuardianStatusValidator, "GuardianStatusValidator"),
       IdentifierEntryValidator: /* @__PURE__ */ __name(() => IdentifierEntryValidator, "IdentifierEntryValidator"),
       IdentifierTypeValidator: /* @__PURE__ */ __name(() => IdentifierTypeValidator, "IdentifierTypeValidator"),
       IdentityObjectValidator: /* @__PURE__ */ __name(() => IdentityObjectValidator, "IdentityObjectValidator"),
       ImageValidator: /* @__PURE__ */ __name(() => ImageValidator, "ImageValidator"),
       InboxCredentialQueryValidator: /* @__PURE__ */ __name(() => InboxCredentialQueryValidator, "InboxCredentialQueryValidator"),
       InboxCredentialValidator: /* @__PURE__ */ __name(() => InboxCredentialValidator, "InboxCredentialValidator"),
+      IncrementCounterEventValidator: /* @__PURE__ */ __name(() => IncrementCounterEventValidator, "IncrementCounterEventValidator"),
       InstalledAppValidator: /* @__PURE__ */ __name(() => InstalledAppValidator, "InstalledAppValidator"),
       IssueInboxCredentialResponseValidator: /* @__PURE__ */ __name(() => IssueInboxCredentialResponseValidator, "IssueInboxCredentialResponseValidator"),
       IssueInboxCredentialValidator: /* @__PURE__ */ __name(() => IssueInboxCredentialValidator, "IssueInboxCredentialValidator"),
@@ -231,17 +239,20 @@ var require_types_cjs_development = __commonJS({
       RelatedValidator: /* @__PURE__ */ __name(() => RelatedValidator, "RelatedValidator"),
       ReplaceSkillFrameworkSkillsInputValidator: /* @__PURE__ */ __name(() => ReplaceSkillFrameworkSkillsInputValidator, "ReplaceSkillFrameworkSkillsInputValidator"),
       ReplaceSkillFrameworkSkillsResultValidator: /* @__PURE__ */ __name(() => ReplaceSkillFrameworkSkillsResultValidator, "ReplaceSkillFrameworkSkillsResultValidator"),
+      RequestLearnerContextEventValidator: /* @__PURE__ */ __name(() => RequestLearnerContextEventValidator, "RequestLearnerContextEventValidator"),
       ResultDescriptionValidator: /* @__PURE__ */ __name(() => ResultDescriptionValidator, "ResultDescriptionValidator"),
       ResultStatusTypeValidator: /* @__PURE__ */ __name(() => ResultStatusTypeValidator, "ResultStatusTypeValidator"),
       ResultTypeValidator: /* @__PURE__ */ __name(() => ResultTypeValidator, "ResultTypeValidator"),
       ResultValidator: /* @__PURE__ */ __name(() => ResultValidator, "ResultValidator"),
       RubricCriterionValidator: /* @__PURE__ */ __name(() => RubricCriterionValidator, "RubricCriterionValidator"),
+      SendAiSessionCredentialEventValidator: /* @__PURE__ */ __name(() => SendAiSessionCredentialEventValidator, "SendAiSessionCredentialEventValidator"),
       SendBoostInputValidator: /* @__PURE__ */ __name(() => SendBoostInputValidator, "SendBoostInputValidator"),
       SendBoostResponseValidator: /* @__PURE__ */ __name(() => SendBoostResponseValidator, "SendBoostResponseValidator"),
       SendBrandingOptionsValidator: /* @__PURE__ */ __name(() => SendBrandingOptionsValidator, "SendBrandingOptionsValidator"),
       SendCredentialEventValidator: /* @__PURE__ */ __name(() => SendCredentialEventValidator, "SendCredentialEventValidator"),
       SendInboxResponseValidator: /* @__PURE__ */ __name(() => SendInboxResponseValidator, "SendInboxResponseValidator"),
       SendInputValidator: /* @__PURE__ */ __name(() => SendInputValidator, "SendInputValidator"),
+      SendNotificationEventValidator: /* @__PURE__ */ __name(() => SendNotificationEventValidator, "SendNotificationEventValidator"),
       SendOptionsValidator: /* @__PURE__ */ __name(() => SendOptionsValidator, "SendOptionsValidator"),
       SendResponseValidator: /* @__PURE__ */ __name(() => SendResponseValidator, "SendResponseValidator"),
       SentCredentialInfoValidator: /* @__PURE__ */ __name(() => SentCredentialInfoValidator, "SentCredentialInfoValidator"),
@@ -263,10 +274,13 @@ var require_types_cjs_development = __commonJS({
       SkillTreeNodeValidator: /* @__PURE__ */ __name(() => SkillTreeNodeValidator, "SkillTreeNodeValidator"),
       SkillValidator: /* @__PURE__ */ __name(() => SkillValidator, "SkillValidator"),
       StringQuery: /* @__PURE__ */ __name(() => StringQuery, "StringQuery"),
+      SummaryCredentialDataValidator: /* @__PURE__ */ __name(() => SummaryCredentialDataValidator, "SummaryCredentialDataValidator"),
+      SummaryCredentialKeywordValidator: /* @__PURE__ */ __name(() => SummaryCredentialKeywordValidator, "SummaryCredentialKeywordValidator"),
       SyncFrameworkInputValidator: /* @__PURE__ */ __name(() => SyncFrameworkInputValidator, "SyncFrameworkInputValidator"),
       TagValidator: /* @__PURE__ */ __name(() => TagValidator, "TagValidator"),
       TermsOfUseValidator: /* @__PURE__ */ __name(() => TermsOfUseValidator, "TermsOfUseValidator"),
       UnsignedAchievementCredentialValidator: /* @__PURE__ */ __name(() => UnsignedAchievementCredentialValidator, "UnsignedAchievementCredentialValidator"),
+      UnsignedClrCredentialValidator: /* @__PURE__ */ __name(() => UnsignedClrCredentialValidator, "UnsignedClrCredentialValidator"),
       UnsignedVCValidator: /* @__PURE__ */ __name(() => UnsignedVCValidator, "UnsignedVCValidator"),
       UnsignedVPValidator: /* @__PURE__ */ __name(() => UnsignedVPValidator, "UnsignedVPValidator"),
       UpdateFrameworkInputValidator: /* @__PURE__ */ __name(() => UpdateFrameworkInputValidator, "UpdateFrameworkInputValidator"),
@@ -14038,6 +14052,42 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
     var AchievementCredentialValidator = UnsignedAchievementCredentialValidator.extend({
       proof: ProofValidator.or(ProofValidator.array())
     });
+    var AssociationTypeValidator = external_exports.enum([
+      "exactMatchOf",
+      "extends",
+      "isChildOf",
+      "isParentOf",
+      "isPartOf",
+      "isPeerOf",
+      "isRelatedTo",
+      "precedes",
+      "replacedBy"
+    ]).or(external_exports.string());
+    var AssociationValidator = external_exports.object({
+      type: external_exports.string().array().nonempty(),
+      associationType: AssociationTypeValidator,
+      sourceId: external_exports.string().optional(),
+      targetId: external_exports.string()
+    }).catchall(external_exports.any());
+    var ClrSubjectValidator = external_exports.object({
+      id: external_exports.string().optional(),
+      type: external_exports.string().array().nonempty(),
+      identifier: external_exports.any().array().optional(),
+      achievement: AchievementValidator.array().optional(),
+      association: AssociationValidator.array().optional(),
+      verifiableCredential: external_exports.any().array().optional()
+    }).catchall(external_exports.any());
+    var UnsignedClrCredentialValidator = UnsignedVCValidator.extend({
+      name: external_exports.string().optional(),
+      description: external_exports.string().optional(),
+      image: ImageValidator.optional(),
+      credentialSubject: ClrSubjectValidator.or(ClrSubjectValidator.array()),
+      endorsement: EndorsementCredentialValidator.array().optional(),
+      partial: external_exports.boolean().optional()
+    });
+    var ClrCredentialValidator = UnsignedClrCredentialValidator.extend({
+      proof: ProofValidator.or(ProofValidator.array())
+    });
     var VerificationCheckValidator = external_exports.object({
       checks: external_exports.string().array(),
       warnings: external_exports.string().array(),
@@ -14389,10 +14439,16 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       credentialName: external_exports.string().optional().describe("Display name for the credential"),
       recipientName: external_exports.string().optional().describe("Name of the recipient for personalization")
     });
+    var GuardianStatusValidator = external_exports.enum([
+      "AWAITING_GUARDIAN",
+      "GUARDIAN_APPROVED",
+      "GUARDIAN_REJECTED"
+    ]);
     var SendOptionsValidator = external_exports.object({
       webhookUrl: external_exports.string().url().optional().describe("Webhook URL to receive claim notifications"),
       suppressDelivery: external_exports.boolean().optional().describe("If true, returns claimUrl without sending email/SMS"),
-      branding: SendBrandingOptionsValidator.optional().describe("Branding for email/SMS delivery")
+      branding: SendBrandingOptionsValidator.optional().describe("Branding for email/SMS delivery"),
+      guardianEmail: external_exports.string().email().optional().describe("Guardian email that must approve before student can claim")
     });
     var SendBoostInputValidator = external_exports.object({
       type: external_exports.literal("boost"),
@@ -14409,11 +14465,25 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
     }).refine((data) => data.templateUri || data.template || data.signedCredential, {
       message: "Either templateUri, template, or signedCredential must be provided.",
       path: ["templateUri"]
-    });
+    }).refine(
+      (data) => {
+        if (data.options?.guardianEmail) {
+          return data.options.guardianEmail.toLowerCase() !== data.recipient.toLowerCase();
+        }
+        return true;
+      },
+      {
+        message: "guardianEmail must differ from recipient (self-approval not allowed)",
+        path: ["options", "guardianEmail"]
+      }
+    );
     var SendInboxResponseValidator = external_exports.object({
       issuanceId: external_exports.string(),
       status: external_exports.enum(["PENDING", "ISSUED", "EXPIRED", "DELIVERED", "CLAIMED"]),
-      claimUrl: external_exports.string().url().optional().describe("Present when suppressDelivery=true")
+      claimUrl: external_exports.string().url().optional().describe("Present when suppressDelivery=true"),
+      guardianStatus: GuardianStatusValidator.optional().describe(
+        "Present when guardianEmail was specified"
+      )
     });
     var SendBoostResponseValidator = external_exports.object({
       type: external_exports.literal("boost"),
@@ -14650,7 +14720,11 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       "APP_LISTING_APPROVED",
       "APP_LISTING_REJECTED",
       "APP_LISTING_WITHDRAWN",
-      "DEVICE_LINK_REQUEST"
+      "DEVICE_LINK_REQUEST",
+      "GUARDIAN_APPROVAL_PENDING",
+      "GUARDIAN_APPROVED",
+      "GUARDIAN_REJECTED",
+      "APP_NOTIFICATION"
     ]);
     var LCNNotificationMessageValidator = external_exports.object({
       title: external_exports.string().optional(),
@@ -14688,7 +14762,10 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
     var LCNNotificationValidator = external_exports.object({
       type: LCNNotificationTypeEnumValidator,
       to: LCNProfileValidator.partial().and(external_exports.object({ did: external_exports.string() })),
-      from: LCNProfileValidator.partial().and(external_exports.object({ did: external_exports.string() })),
+      from: external_exports.union([
+        external_exports.string(),
+        LCNProfileValidator.partial().and(external_exports.object({ did: external_exports.string() }))
+      ]),
       message: LCNNotificationMessageValidator.optional(),
       data: LCNNotificationDataValidator.optional(),
       sent: external_exports.iso.datetime().optional(),
@@ -14793,7 +14870,12 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       signingAuthority: external_exports.object({
         endpoint: external_exports.string().optional(),
         name: external_exports.string().optional()
-      }).optional()
+      }).optional(),
+      // Guardian gate fields (all optional — absent on pre-existing credentials)
+      guardianEmail: external_exports.string().email().optional(),
+      guardianStatus: GuardianStatusValidator.optional(),
+      guardianApprovedAt: external_exports.string().optional(),
+      guardianApprovedByDid: external_exports.string().optional()
     });
     var PaginatedInboxCredentialsValidator = external_exports.object({
       hasMore: external_exports.boolean(),
@@ -15261,11 +15343,86 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
     }).refine((input) => Boolean(input.templateAlias) !== Boolean(input.boostUri), {
       message: "Exactly one of templateAlias or boostUri is required"
     });
+    var RequestLearnerContextEventValidator = external_exports.object({
+      type: external_exports.literal("request-learner-context"),
+      includeCredentials: external_exports.boolean().optional().default(true),
+      includePersonalData: external_exports.boolean().optional().default(false),
+      format: external_exports.enum(["prompt", "structured"]).optional().default("prompt"),
+      instructions: external_exports.string().optional(),
+      detailLevel: external_exports.enum(["compact", "expanded"]).optional().default("compact")
+    });
+    var SummaryCredentialKeywordValidator = external_exports.object({
+      occupations: external_exports.array(external_exports.string()).nullable(),
+      careers: external_exports.array(external_exports.string()).nullable(),
+      jobs: external_exports.array(external_exports.string()).nullable(),
+      skills: external_exports.array(external_exports.string()).nullable(),
+      fieldOfStudy: external_exports.string().nullable()
+    });
+    var SummaryCredentialDataValidator = external_exports.object({
+      title: external_exports.string().describe("Short, concise title for the learning session or credential"),
+      summary: external_exports.string().describe("Comprehensive summary of what happened during the session"),
+      learned: external_exports.array(external_exports.string()).describe("Bullet points of key knowledge gained"),
+      skills: external_exports.array(
+        external_exports.object({
+          title: external_exports.string().describe("Name of the skill category"),
+          description: external_exports.string().describe("Detailed description of what this skill category involves")
+        })
+      ).describe("Categorized skills learned during the session"),
+      nextSteps: external_exports.array(
+        external_exports.object({
+          title: external_exports.string().describe("Title of the suggested next step"),
+          description: external_exports.string().describe("Description explaining why this next step is recommended"),
+          keywords: SummaryCredentialKeywordValidator.optional().describe(
+            "Optional taxonomy keywords for occupations/careers/jobs/skills/fieldOfStudy. Omit if not relevant."
+          )
+        })
+      ).describe("Recommended follow-up activities or learning modules"),
+      reflections: external_exports.array(
+        external_exports.object({
+          title: external_exports.string().describe("Title of the reflection"),
+          description: external_exports.string().describe("Detailed description of what this reflection involves")
+        })
+      ).describe("Reflections on the learning experience")
+    });
+    var SendAiSessionCredentialEventValidator = external_exports.object({
+      type: external_exports.literal("send-ai-session-credential"),
+      sessionTitle: external_exports.string(),
+      summaryData: SummaryCredentialDataValidator,
+      metadata: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+    });
+    var SendNotificationEventValidator = external_exports.object({
+      type: external_exports.literal("send-notification"),
+      title: external_exports.string().optional(),
+      body: external_exports.string().optional(),
+      actionPath: external_exports.string().optional(),
+      category: external_exports.string().optional(),
+      priority: external_exports.enum(["normal", "high"]).optional()
+    });
+    var counterKeyValidator = external_exports.string().min(1).max(64).regex(/^[a-zA-Z0-9_-]+$/, "Key must be alphanumeric with _ or -");
+    var IncrementCounterEventValidator = external_exports.object({
+      type: external_exports.literal("increment-counter"),
+      key: counterKeyValidator,
+      amount: external_exports.number().int().finite()
+    });
+    var GetCounterEventValidator = external_exports.object({
+      type: external_exports.literal("get-counter"),
+      key: counterKeyValidator
+    });
+    var GetCountersEventValidator = external_exports.object({
+      type: external_exports.literal("get-counters"),
+      keys: external_exports.array(counterKeyValidator).min(1).max(50).optional()
+    });
     var AppEventValidator = external_exports.discriminatedUnion("type", [
       SendCredentialEventValidator,
       CheckCredentialEventValidator,
       CheckIssuanceStatusEventValidator,
-      GetTemplateRecipientsEventValidator
+      GetTemplateRecipientsEventValidator,
+      RequestLearnerContextEventValidator,
+      SendAiSessionCredentialEventValidator,
+      SendNotificationEventValidator,
+      IncrementCounterEventValidator,
+      GetCounterEventValidator,
+      GetCountersEventValidator
     ]);
     var AppEventInputValidator = external_exports.object({
       listingId: external_exports.string(),
@@ -15296,7 +15453,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       activityId: external_exports.string(),
       eventType: CredentialActivityEventTypeValidator,
       timestamp: external_exports.string(),
-      actorProfileId: external_exports.string(),
+      actorProfileId: external_exports.string().optional(),
       recipientType: CredentialActivityRecipientTypeValidator,
       recipientIdentifier: external_exports.string(),
       boostUri: external_exports.string().optional(),
@@ -16637,14 +16794,15 @@ var defaultStorage = {
   storeShareVersion,
   getShareVersion
 };
-var buildHeaders = /* @__PURE__ */ __name((token, didAuthVp) => ({
+var buildHeaders = /* @__PURE__ */ __name((token, didAuthVp, tenantId) => ({
   "Content-Type": "application/json",
-  ...didAuthVp ? { Authorization: `Bearer ${didAuthVp}` } : {}
+  ...didAuthVp ? { Authorization: `Bearer ${didAuthVp}` } : {},
+  ...tenantId ? { "X-Tenant-Id": tenantId } : {}
 }), "buildHeaders");
-var fetchAuthShareRaw = /* @__PURE__ */ __name(async (serverUrl, token, providerType, shareVersion) => {
+var fetchAuthShareRaw = /* @__PURE__ */ __name(async (serverUrl, token, providerType, shareVersion, tenantId) => {
   const response = await fetch(`${serverUrl}/keys/auth-share`, {
     method: "POST",
-    headers: buildHeaders(token),
+    headers: buildHeaders(token, void 0, tenantId),
     body: JSON.stringify({
       authToken: token,
       providerType,
@@ -16657,10 +16815,10 @@ var fetchAuthShareRaw = /* @__PURE__ */ __name(async (serverUrl, token, provider
   }
   return response.json();
 }, "fetchAuthShareRaw");
-var putAuthShare = /* @__PURE__ */ __name(async (serverUrl, token, providerType, authShare, primaryDid, didAuthVp) => {
+var putAuthShare = /* @__PURE__ */ __name(async (serverUrl, token, providerType, authShare, primaryDid, didAuthVp, tenantId) => {
   const response = await fetch(`${serverUrl}/keys/auth-share`, {
     method: "PUT",
-    headers: buildHeaders(token, didAuthVp),
+    headers: buildHeaders(token, didAuthVp, tenantId),
     body: JSON.stringify({
       authToken: token,
       providerType,
@@ -16675,24 +16833,24 @@ var putAuthShare = /* @__PURE__ */ __name(async (serverUrl, token, providerType,
   const data = await response.json();
   return { shareVersion: data.shareVersion ?? 1 };
 }, "putAuthShare");
-var fetchRecoveryShare = /* @__PURE__ */ __name(async (serverUrl, token, providerType, type, credentialId) => {
+var fetchRecoveryShare = /* @__PURE__ */ __name(async (serverUrl, token, providerType, type, credentialId, tenantId) => {
   const params = new URLSearchParams({ type, providerType, authToken: token });
   if (credentialId) {
     params.set("credentialId", credentialId);
   }
   const response = await fetch(`${serverUrl}/keys/recovery?${params}`, {
     method: "GET",
-    headers: { "Content-Type": "application/json" }
+    headers: buildHeaders(token, void 0, tenantId)
   });
   if (!response.ok) {
     throw new Error(`No ${type} recovery share found`);
   }
   return response.json();
 }, "fetchRecoveryShare");
-var postRecoveryMethod = /* @__PURE__ */ __name(async (serverUrl, token, providerType, body, didAuthVp) => {
+var postRecoveryMethod = /* @__PURE__ */ __name(async (serverUrl, token, providerType, body, didAuthVp, tenantId) => {
   const response = await fetch(`${serverUrl}/keys/recovery`, {
     method: "POST",
-    headers: buildHeaders(token, didAuthVp),
+    headers: buildHeaders(token, didAuthVp, tenantId),
     body: JSON.stringify({ authToken: token, providerType, ...body })
   });
   if (!response.ok) {
@@ -16711,12 +16869,12 @@ var parseVersionedEmailShare = /* @__PURE__ */ __name((input) => {
   }
   return { share: input, version: void 0 };
 }, "parseVersionedEmailShare");
-var sendEmailBackupShare = /* @__PURE__ */ __name(async (serverUrl, token, providerType, emailShare, email, shareVersion) => {
+var sendEmailBackupShare = /* @__PURE__ */ __name(async (serverUrl, token, providerType, emailShare, email, shareVersion, tenantId) => {
   try {
     const payload = shareVersion != null ? formatVersionedEmailShare(emailShare, shareVersion) : emailShare;
     const response = await fetch(`${serverUrl}/keys/email-backup`, {
       method: "POST",
-      headers: buildHeaders(token),
+      headers: buildHeaders(token, void 0, tenantId),
       body: JSON.stringify({ authToken: token, providerType, emailShare: payload, email })
     });
     if (!response.ok) {
@@ -16726,11 +16884,11 @@ var sendEmailBackupShare = /* @__PURE__ */ __name(async (serverUrl, token, provi
     console.warn("Email backup share delivery failed:", e);
   }
 }, "sendEmailBackupShare");
-var sendEmailShareToRecoveryEmail = /* @__PURE__ */ __name(async (serverUrl, token, providerType, emailShare, shareVersion) => {
+var sendEmailShareToRecoveryEmail = /* @__PURE__ */ __name(async (serverUrl, token, providerType, emailShare, shareVersion, tenantId) => {
   const payload = shareVersion != null ? formatVersionedEmailShare(emailShare, shareVersion) : emailShare;
   const response = await fetch(`${serverUrl}/keys/email-backup`, {
     method: "POST",
-    headers: buildHeaders(token),
+    headers: buildHeaders(token, void 0, tenantId),
     body: JSON.stringify({
       authToken: token,
       providerType,
@@ -16743,7 +16901,7 @@ var sendEmailShareToRecoveryEmail = /* @__PURE__ */ __name(async (serverUrl, tok
   }
 }, "sendEmailShareToRecoveryEmail");
 function createSSSStrategy(config) {
-  const { serverUrl, enableEmailBackupShare = false } = config;
+  const { serverUrl, enableEmailBackupShare = false, tenantId } = config;
   const storage = config.storage || defaultStorage;
   let activeStorageId;
   let lastEmailShare;
@@ -16816,7 +16974,8 @@ function createSSSStrategy(config) {
         serverUrl,
         token,
         providerType,
-        localVersion ?? void 0
+        localVersion ?? void 0,
+        tenantId
       );
       if (!data) {
         hasRecoveryEmail = false;
@@ -16848,14 +17007,14 @@ function createSSSStrategy(config) {
       };
     },
     async storeAuthShare(token, providerType, authShare, primaryDid, didAuthVp) {
-      const { shareVersion } = await putAuthShare(serverUrl, token, providerType, authShare, primaryDid, didAuthVp);
+      const { shareVersion } = await putAuthShare(serverUrl, token, providerType, authShare, primaryDid, didAuthVp, tenantId);
       await storage.storeShareVersion(shareVersion, activeStorageId);
       lastShareVersion = shareVersion;
     },
     async markMigrated(token, providerType, didAuthVp) {
       const response = await fetch(`${serverUrl}/keys/migrate`, {
         method: "POST",
-        headers: buildHeaders(token, didAuthVp),
+        headers: buildHeaders(token, didAuthVp, tenantId),
         body: JSON.stringify({ authToken: token, providerType })
       });
       if (!response.ok) {
@@ -16874,7 +17033,8 @@ function createSSSStrategy(config) {
             token,
             providerType,
             "passkey",
-            input.credentialId
+            input.credentialId,
+            tenantId
           );
           if (!result?.encryptedShare) {
             throw new Error("No passkey recovery share found");
@@ -16898,7 +17058,9 @@ function createSSSStrategy(config) {
               serverUrl,
               token,
               providerType,
-              "phrase"
+              "phrase",
+              void 0,
+              tenantId
             );
             recoveryShareVersion = phraseRecord?.shareVersion;
           } catch {
@@ -16931,7 +17093,8 @@ function createSSSStrategy(config) {
         serverUrl,
         token,
         providerType,
-        recoveryShareVersion
+        recoveryShareVersion,
+        tenantId
       );
       if (!serverData?.authShare) {
         throw new Error("No auth share found on server");
@@ -16968,12 +17131,12 @@ function createSSSStrategy(config) {
       const { shares } = await splitAndVerify(privateKey);
       lastEmailShare = shares.emailShare;
       await storage.storeDeviceShare(shares.deviceShare, activeStorageId);
-      const serverData = await fetchAuthShareRaw(serverUrl, token, providerType);
+      const serverData = await fetchAuthShareRaw(serverUrl, token, providerType, void 0, tenantId);
       const primaryDid = serverData?.primaryDid || "";
-      const { shareVersion } = await putAuthShare(serverUrl, token, providerType, shares.authShare, primaryDid, vpJwt);
+      const { shareVersion } = await putAuthShare(serverUrl, token, providerType, shares.authShare, primaryDid, vpJwt, tenantId);
       await storage.storeShareVersion(shareVersion, activeStorageId);
       if (enableEmailBackupShare && input.method !== "email" && lastEmailShare) {
-        const resend = hasRecoveryEmail ? sendEmailShareToRecoveryEmail(serverUrl, token, providerType, lastEmailShare, shareVersion) : authUser?.email ? sendEmailBackupShare(serverUrl, token, providerType, lastEmailShare, authUser.email, shareVersion) : Promise.resolve();
+        const resend = hasRecoveryEmail ? sendEmailShareToRecoveryEmail(serverUrl, token, providerType, lastEmailShare, shareVersion, tenantId) : authUser?.email ? sendEmailBackupShare(serverUrl, token, providerType, lastEmailShare, authUser.email, shareVersion, tenantId) : Promise.resolve();
         resend.catch((e) => console.warn("Email backup share re-send failed (non-fatal):", e));
         lastEmailShare = void 0;
       }
@@ -16992,7 +17155,7 @@ function createSSSStrategy(config) {
             },
             credentialId: credential.credentialId,
             shareVersion
-          }, vpJwt);
+          }, vpJwt, tenantId);
           return { method: "passkey", credentialId: credential.credentialId };
         }
         case "phrase": {
@@ -17000,7 +17163,7 @@ function createSSSStrategy(config) {
           await postRecoveryMethod(serverUrl, token, providerType, {
             type: "phrase",
             shareVersion
-          }, vpJwt);
+          }, vpJwt, tenantId);
           return { method: "phrase", phrase };
         }
         case "backup": {
@@ -17020,7 +17183,7 @@ function createSSSStrategy(config) {
           await postRecoveryMethod(serverUrl, token, providerType, {
             type: "backup",
             shareVersion
-          }, vpJwt);
+          }, vpJwt, tenantId);
           return { method: "backup", backupFile };
         }
         case "email": {
@@ -17029,12 +17192,13 @@ function createSSSStrategy(config) {
             token,
             providerType,
             shares.emailShare,
-            shareVersion
+            shareVersion,
+            tenantId
           );
           await postRecoveryMethod(serverUrl, token, providerType, {
             type: "email",
             shareVersion
-          }, vpJwt);
+          }, vpJwt, tenantId);
           hasRecoveryEmail = true;
           return { method: "email" };
         }
@@ -17042,7 +17206,7 @@ function createSSSStrategy(config) {
     },
     async getAvailableRecoveryMethods(token, providerType) {
       try {
-        const serverData = await fetchAuthShareRaw(serverUrl, token, providerType);
+        const serverData = await fetchAuthShareRaw(serverUrl, token, providerType, void 0, tenantId);
         const methods = serverData?.recoveryMethods || [];
         if (enableEmailBackupShare && !methods.some((m) => m.type === "email")) {
           methods.push({ type: "email", createdAt: /* @__PURE__ */ new Date() });
@@ -17057,7 +17221,7 @@ function createSSSStrategy(config) {
     async upgradeContactMethod(token, providerType, previousPhone, email, code) {
       const res = await fetch(`${serverUrl}/keys/upgrade-contact-method`, {
         method: "POST",
-        headers: { "Content-Type": "application/json" },
+        headers: buildHeaders(token, void 0, tenantId),
         body: JSON.stringify({
           authToken: token,
           providerType,
@@ -17087,14 +17251,15 @@ function createSSSStrategy(config) {
           token,
           providerType,
           lastEmailShare,
-          lastShareVersion
+          lastShareVersion,
+          tenantId
         );
       } else {
         if (!email) {
           console.warn("Cannot send email backup share: no email address");
           return;
         }
-        await sendEmailBackupShare(serverUrl, token, providerType, lastEmailShare, email, lastShareVersion);
+        await sendEmailBackupShare(serverUrl, token, providerType, lastEmailShare, email, lastShareVersion, tenantId);
       }
       lastEmailShare = void 0;
       lastShareVersion = void 0;