@learncard/types 5.21.0 → 5.23.0

package/dist/types.esm.js

@@ -440,7 +440,8 @@ var AssociationTypeValidator = z5.enum([
   "replacedBy"
 ]).or(z5.string());
 var AssociationValidator = z5.object({
-  type: z5.string().array().nonempty(),
+  // Accept compacted scalars while retaining the existing permissive array contract.
+  type: z5.string().min(1).or(z5.string().array().nonempty()),
   associationType: AssociationTypeValidator,
   sourceId: z5.string().optional(),
   targetId: z5.string()
@@ -1288,11 +1289,48 @@ var ConsentFlowContractDetailsValidator = z12.object({
   updatedAt: z12.string(),
   expiresAt: z12.string().optional(),
   autoBoosts: z12.string().array().optional(),
-  writers: z12.array(LCNProfileValidator).optional()
+  writers: z12.array(LCNProfileValidator).optional(),
+  recipients: z12.array(LCNPublicProfileValidator.extend({ did: z12.string() })).optional(),
+  audienceVersion: z12.number().int().nonnegative().optional()
 });
-var ConsentFlowContractRequestStatusValidator = z12.enum(["pending", "accepted", "denied"]).nullable();
+var ConsentFlowContractRequestStatusValidator = z12.enum(["pending", "accepted", "denied", "cancelled"]).nullable();
 var ConsentFlowContractRequestReadStatusValidator = z12.enum(["unseen", "seen"]).nullable();
-var ConsentFlowContractRequestForProfileValidator = z12.object({
+var ConsentFlowReferralValidator = z12.object({
+  requestId: z12.string(),
+  requestedBy: z12.string(),
+  externalReferenceId: z12.string().max(256).optional()
+});
+var ContractRequestFieldsValidator = ConsentFlowReferralValidator.partial().extend({
+  requestedAt: z12.string().optional(),
+  message: z12.string().max(500).optional()
+});
+var SendContractRequestValidator = z12.object({
+  contractUri: z12.string(),
+  targetProfileId: z12.string(),
+  externalReferenceId: z12.string().trim().min(1).max(256).optional(),
+  message: z12.string().trim().max(500).optional()
+});
+var ConsentFlowWebhookMetadataValidator = z12.object({
+  eventId: z12.string(),
+  deliveryKey: z12.string(),
+  event: z12.enum([
+    "request_sent",
+    "request_accepted",
+    "request_denied",
+    "request_cancelled",
+    "consent_created",
+    "consent_updated",
+    "consent_withdrawn",
+    "credentials_synced"
+  ]),
+  contractUri: z12.string(),
+  termsUri: z12.string().optional(),
+  requestId: z12.string().optional(),
+  requestedBy: z12.string().optional(),
+  externalReferenceId: z12.string().optional(),
+  recipientRole: z12.enum(["owner", "recipient", "requester", "target"])
+});
+var ConsentFlowContractRequestForProfileValidator = ContractRequestFieldsValidator.extend({
   profile: LCNProfileValidator,
   status: ConsentFlowContractRequestStatusValidator,
   readStatus: ConsentFlowContractRequestReadStatusValidator.optional()
@@ -1338,6 +1376,7 @@ var PaginatedConsentFlowTermsValidator = PaginationResponseValidator.extend({
     expiresAt: z12.string().optional(),
     oneTime: z12.boolean().optional(),
     terms: ConsentFlowTermsValidator,
+    referral: ConsentFlowReferralValidator.optional(),
     contract: ConsentFlowContractDetailsValidator,
     uri: z12.string(),
     consenter: LCNProfileValidator,
@@ -1433,6 +1472,7 @@ var ConsentFlowTransactionValidator = z12.object({
   oneTime: z12.boolean().optional(),
   terms: ConsentFlowTermsValidator.optional(),
   guardianApproval: ConsentFlowGuardianApprovalValidator.optional(),
+  referral: ConsentFlowReferralValidator.optional(),
   id: z12.string(),
   action: ConsentFlowTransactionActionValidator,
   date: z12.string(),
@@ -1443,6 +1483,7 @@ var HolderExportConsentRecordValidator = z12.object({
   status: ConsentFlowTermsStatusValidator,
   contract: ConsentFlowContractDetailsValidator,
   terms: ConsentFlowTermsValidator,
+  referral: ConsentFlowReferralValidator.optional(),
   transactions: ConsentFlowTransactionValidator.array()
 });
 var HolderExportMetadataValidator = z12.object({
@@ -2179,7 +2220,7 @@ var AppStoreListingSubmitterValidator = z12.object({
   displayName: z12.string(),
   email: z12.string().optional()
 });
-var AppStoreListingValidator = z12.object({
+var AppStoreListingFieldsValidator = z12.object({
   listing_id: z12.string(),
   slug: z12.string().optional(),
   display_name: z12.string(),
@@ -2205,15 +2246,33 @@ var AppStoreListingValidator = z12.object({
   submitter: AppStoreListingSubmitterValidator.optional(),
   contact_email: z12.string().email().optional()
 });
+var PendingListingUpdateStatusValidator = z12.enum(["DRAFT", "PENDING_REVIEW"]);
+var PendingListingUpdateValidator = z12.object({
+  status: PendingListingUpdateStatusValidator,
+  submitted_at: z12.string().optional(),
+  changes: AppStoreListingFieldsValidator.omit({
+    listing_id: true,
+    app_listing_status: true,
+    promotion_level: true,
+    submitted_at: true,
+    submitter: true
+  }).partial(),
+  manifest_version: z12.number().int().min(1).optional()
+});
+var AppStoreListingValidator = AppStoreListingFieldsValidator.extend({
+  pending_update: PendingListingUpdateValidator.optional()
+});
 var AppStoreListingCreateValidator = AppStoreListingValidator.omit({
   listing_id: true,
   app_listing_status: true,
-  promotion_level: true
+  promotion_level: true,
+  pending_update: true
 });
 var AppStoreListingUpdateValidator = AppStoreListingValidator.partial().omit({
   listing_id: true,
   app_listing_status: true,
-  promotion_level: true
+  promotion_level: true,
+  pending_update: true
 });
 var InstalledAppValidator = AppStoreListingValidator.extend({
   installed_at: z12.string()
@@ -2228,12 +2287,87 @@ var AppBoostValidator = z12.object({
   templateAlias: z12.string().min(1).max(50).regex(/^[a-z0-9-]+$/),
   boostUri: z12.string()
 });
-var SendCredentialEventValidator = z12.object({
+var InlineWalletCategoryValidator = z12.enum([
+  "Achievement",
+  "Skill",
+  "ID",
+  "Learning History",
+  "Work History",
+  "Social Badges",
+  "Membership",
+  "Accomplishment",
+  "Experiences",
+  "Accommodation",
+  "Family"
+]);
+var InlineAlignmentValidator = z12.object({
+  name: z12.string(),
+  url: z12.string(),
+  framework: z12.string().optional(),
+  code: z12.string().optional()
+}).passthrough();
+var InlineEvidenceValidator = z12.object({
+  id: z12.string().optional(),
+  name: z12.string().optional(),
+  narrative: z12.string().optional()
+}).passthrough();
+var InlineWalletSkillTagValidator = z12.object({
+  frameworkId: z12.string(),
+  id: z12.string(),
+  proficiencyLevel: z12.string().optional()
+}).passthrough();
+var SimpleInlineCredentialTemplateValidator = z12.object({
+  rawCredential: z12.undefined().optional(),
+  name: z12.string(),
+  description: z12.string().optional(),
+  image: z12.string().optional(),
+  issuerName: z12.string().optional(),
+  achievementType: z12.string().optional(),
+  category: InlineWalletCategoryValidator.optional(),
+  criteria: z12.object({
+    narrative: z12.string().optional(),
+    url: z12.string().optional()
+  }).passthrough().optional(),
+  alignments: z12.array(InlineAlignmentValidator).optional(),
+  tags: z12.array(z12.string()).optional(),
+  activity: z12.object({
+    startDate: z12.string().optional(),
+    endDate: z12.string().optional()
+  }).passthrough().optional(),
+  credits: z12.object({
+    earned: z12.union([z12.number(), z12.string()]).optional(),
+    available: z12.union([z12.number(), z12.string()]).optional()
+  }).passthrough().optional(),
+  validUntil: z12.string().optional(),
+  evidence: z12.array(InlineEvidenceValidator).optional(),
+  walletSkills: z12.array(InlineWalletSkillTagValidator).optional()
+}).passthrough();
+var RawInlineCredentialTemplateValidator = z12.object({
+  rawCredential: z12.record(z12.string(), z12.unknown()),
+  category: InlineWalletCategoryValidator.optional(),
+  walletSkills: z12.array(InlineWalletSkillTagValidator).optional()
+}).passthrough();
+var InlineCredentialTemplateValidator = z12.union([
+  RawInlineCredentialTemplateValidator,
+  SimpleInlineCredentialTemplateValidator
+]);
+var LegacySendCredentialEventValidator = z12.object({
   type: z12.literal("send-credential"),
   templateAlias: z12.string(),
   templateData: z12.record(z12.string(), z12.unknown()).optional(),
   preventDuplicateClaim: z12.boolean().optional()
 });
+var InlineSendCredentialEventValidator = z12.object({
+  type: z12.literal("send-credential"),
+  alias: z12.string(),
+  template: InlineCredentialTemplateValidator,
+  templateData: z12.record(z12.string(), z12.unknown()).optional(),
+  preventDuplicateClaim: z12.boolean().optional()
+});
+var SendCredentialEventValidator = z12.union([
+  LegacySendCredentialEventValidator,
+  InlineSendCredentialEventValidator
+]);
 var CheckCredentialEventValidator = z12.object({
   type: z12.literal("check-credential"),
   templateAlias: z12.string().optional(),
@@ -2328,7 +2462,119 @@ var GetCountersEventValidator = z12.object({
   type: z12.literal("get-counters"),
   keys: z12.array(counterKeyValidator).min(1).max(50).optional()
 });
-var AppEventValidator = z12.discriminatedUnion("type", [
+var ConsentRequestWalletCategoryValidator = z12.enum([
+  "Achievement",
+  "Skill",
+  "ID",
+  "Learning History",
+  "Work History",
+  "Social Badges",
+  "Membership",
+  "Accomplishment",
+  "Experiences",
+  "Accommodation",
+  "Family"
+]);
+var ConsentRequestPersonalFieldValidator = z12.enum([
+  "name",
+  "email",
+  "phone",
+  "birthDate",
+  "country",
+  "avatar"
+]);
+var ConsentRequestValidator = z12.object({
+  read: z12.object({
+    credentialCategories: z12.array(ConsentRequestWalletCategoryValidator).optional(),
+    personalFields: z12.array(ConsentRequestPersonalFieldValidator).optional()
+  }).optional(),
+  write: z12.object({
+    credentialCategories: z12.array(ConsentRequestWalletCategoryValidator).optional()
+  }).optional(),
+  reason: z12.string().optional()
+});
+var NormalizedConsentScopesValidator = z12.object({
+  read: z12.object({
+    credentialCategories: z12.array(ConsentRequestWalletCategoryValidator).default([]),
+    personalFields: z12.array(ConsentRequestPersonalFieldValidator).default([])
+  }),
+  write: z12.object({
+    credentialCategories: z12.array(ConsentRequestWalletCategoryValidator).default([])
+  })
+});
+var CapturedTemplateRecordValidator = z12.object({
+  alias: z12.string(),
+  template: InlineCredentialTemplateValidator,
+  version: z12.number().int().min(1),
+  lastUsedAt: z12.string()
+}).passthrough();
+var CapturedConsentRecordValidator = z12.object({
+  scopes: NormalizedConsentScopesValidator,
+  reason: z12.string().optional(),
+  lastUsedAt: z12.string()
+}).passthrough();
+var AppManifestValidator = z12.object({
+  manifestVersion: z12.literal(1),
+  appUrl: z12.string(),
+  appKey: z12.string().max(200).optional(),
+  suggestedName: z12.string().optional(),
+  suggestedIconUrl: z12.string().optional(),
+  permissions: z12.array(z12.string()).default([]),
+  templates: z12.array(CapturedTemplateRecordValidator).default([]),
+  consentRequests: z12.array(CapturedConsentRecordValidator).default([]),
+  usedConsentContract: z12.boolean().optional(),
+  featuresLaunched: z12.array(z12.string()).default([]),
+  counterKeys: z12.array(z12.string()).default([]),
+  usedLearnerContext: z12.boolean(),
+  usedNotifications: z12.boolean(),
+  firstCapturedAt: z12.string(),
+  lastUpdatedAt: z12.string()
+}).passthrough();
+var AppManifestVersionStatusValidator = z12.enum(["draft", "active", "superseded"]);
+var AppManifestVersionValidator = z12.object({
+  id: z12.string(),
+  version: z12.number().int().min(1),
+  manifestHash: z12.string(),
+  manifest: AppManifestValidator,
+  status: AppManifestVersionStatusValidator,
+  createdAt: z12.string(),
+  activatedAt: z12.string().optional()
+});
+var AppManifestStringDiffValidator = z12.object({
+  added: z12.array(z12.string()),
+  removed: z12.array(z12.string()),
+  changed: z12.array(z12.string())
+});
+var AppManifestTemplateRefValidator = z12.object({
+  alias: z12.string(),
+  version: z12.number().int().min(1)
+});
+var AppManifestTemplateChangeValidator = z12.object({
+  alias: z12.string(),
+  fromVersion: z12.number().int().min(1),
+  toVersion: z12.number().int().min(1)
+});
+var AppManifestDiffValidator = z12.object({
+  permissions: AppManifestStringDiffValidator,
+  templates: z12.object({
+    added: z12.array(AppManifestTemplateRefValidator),
+    removed: z12.array(AppManifestTemplateRefValidator),
+    changed: z12.array(AppManifestTemplateChangeValidator)
+  }),
+  consentScopes: AppManifestStringDiffValidator,
+  featurePaths: AppManifestStringDiffValidator,
+  counterKeys: AppManifestStringDiffValidator,
+  requiresReview: z12.boolean()
+});
+var UpsertConsentContractEventValidator = z12.object({
+  type: z12.literal("upsert-consent-contract"),
+  scopes: ConsentRequestValidator
+});
+var UpsertConsentContractResponseValidator = z12.object({
+  contractUri: z12.string(),
+  created: z12.boolean()
+});
+var AppEventValidator = z12.union([
   SendCredentialEventValidator,
   CheckCredentialEventValidator,
   CheckIssuanceStatusEventValidator,
@@ -2338,7 +2584,8 @@ var AppEventValidator = z12.discriminatedUnion("type", [
   SendNotificationEventValidator,
   IncrementCounterEventValidator,
   GetCounterEventValidator,
-  GetCountersEventValidator
+  GetCountersEventValidator,
+  UpsertConsentContractEventValidator
 ]);
 var AppEventInputValidator = z12.object({
   listingId: z12.string(),
@@ -2406,6 +2653,7 @@ var CredentialActivityStatsValidator = z12.object({
 });
 
 // src/auth.ts
+import { z as z13 } from "zod";
 var AuthSessionError = class extends Error {
   constructor(message, reason) {
     super(message);
@@ -2416,126 +2664,646 @@ var AuthSessionError = class extends Error {
     __name(this, "AuthSessionError");
   }
 };
+var UnsupportedSignInOperationError = class extends Error {
+  constructor(operation, providerType) {
+    super(`${operation} is not supported by ${providerType}`);
+    this.operation = operation;
+    this.providerType = providerType;
+    this.name = "UnsupportedSignInOperationError";
+  }
+  static {
+    __name(this, "UnsupportedSignInOperationError");
+  }
+};
+var ESCROW_PIN_LOCKED_MESSAGE = "Too many incorrect PIN attempts. You can still recover by waiting.";
+var ESCROW_PIN_UNAVAILABLE_MESSAGE = "PIN recovery is not available for this account.";
+var ESCROW_PIN_MISMATCH_PATTERN = /^Incorrect PIN\. (\d+) attempts left\.$/;
+var escrowPinMismatchMessage = /* @__PURE__ */ __name((attemptsRemaining) => `Incorrect PIN. ${attemptsRemaining} attempts left.`, "escrowPinMismatchMessage");
+var EscrowPinStatusValidator = z13.object({
+  state: z13.enum(["none", "enabled", "locked", "stale"]),
+  enabled: z13.boolean(),
+  attemptsRemaining: z13.number().int().nonnegative(),
+  salt: z13.string().optional()
+});
 
 // src/bitstring-status-list.ts
-import { z as z13 } from "zod/v4";
+import { z as z14 } from "zod/v4";
 var BITSTRING_STATUS_PURPOSES = ["revocation", "suspension"];
 var DEFAULT_BITSTRING_STATUS_LIST_SIZE = 131072;
-var BitstringStatusPurposeValidator = z13.enum(BITSTRING_STATUS_PURPOSES);
-var BitstringStatusListEntryValidator = z13.object({
-  id: z13.string().optional(),
-  type: z13.literal("BitstringStatusListEntry"),
+var BitstringStatusPurposeValidator = z14.enum(BITSTRING_STATUS_PURPOSES);
+var BitstringStatusListEntryValidator = z14.object({
+  id: z14.string().optional(),
+  type: z14.literal("BitstringStatusListEntry"),
   statusPurpose: BitstringStatusPurposeValidator,
-  statusListIndex: z13.string().or(z13.number().int().nonnegative()),
-  statusListCredential: z13.string()
+  statusListIndex: z14.string().or(z14.number().int().nonnegative()),
+  statusListCredential: z14.string()
 });
 var AllocatedBitstringStatusListEntryValidator = BitstringStatusListEntryValidator.extend({
-  id: z13.string()
+  id: z14.string()
 });
-var BitstringStatusListCredentialSubjectValidator = z13.object({
-  id: z13.string().optional(),
-  type: z13.literal("BitstringStatusList"),
+var BitstringStatusListCredentialSubjectValidator = z14.object({
+  id: z14.string().optional(),
+  type: z14.literal("BitstringStatusList"),
   statusPurpose: BitstringStatusPurposeValidator,
-  encodedList: z13.string()
+  encodedList: z14.string()
 });
-var AllocateCredentialStatusInputValidator = z13.object({
-  statusPurposes: z13.array(BitstringStatusPurposeValidator).optional(),
-  listSize: z13.number().int().positive().optional()
+var AllocateCredentialStatusInputValidator = z14.object({
+  statusPurposes: z14.array(BitstringStatusPurposeValidator).optional(),
+  listSize: z14.number().int().positive().optional()
 }).default({});
 
 // src/inAppMessages.ts
-import { z as z14 } from "zod";
-var inAppMessagePlatformValidator = z14.enum(["ios", "android", "web"]);
-var inAppMessageVersionSourceValidator = z14.enum(["native", "web", "capgo"]);
-var inAppMessageVersionOpValidator = z14.enum(["lt", "lte", "eq", "gte", "gt"]);
-var platformPredicateValidator = z14.object({ platform: z14.array(inAppMessagePlatformValidator).nonempty() }).strict();
-var rolePredicateValidator = z14.object({ role: z14.array(z14.string()).nonempty() }).strict();
-var versionPredicateValidator = z14.object({
-  version: z14.object({
+import { z as z15 } from "zod";
+var inAppMessagePlatformValidator = z15.enum(["ios", "android", "web"]);
+var inAppMessageVersionSourceValidator = z15.enum(["native", "web", "capgo"]);
+var inAppMessageVersionOpValidator = z15.enum(["lt", "lte", "eq", "gte", "gt"]);
+var platformPredicateValidator = z15.object({ platform: z15.array(inAppMessagePlatformValidator).nonempty() }).strict();
+var rolePredicateValidator = z15.object({ role: z15.array(z15.string()).nonempty() }).strict();
+var versionPredicateValidator = z15.object({
+  version: z15.object({
     source: inAppMessageVersionSourceValidator,
     op: inAppMessageVersionOpValidator,
-    value: z14.string()
+    value: z15.string()
   }).strict()
 }).strict();
-var inAppMessagePredicateValidator = z14.lazy(
-  () => z14.union([
+var inAppMessagePredicateValidator = z15.lazy(
+  () => z15.union([
     platformPredicateValidator,
     rolePredicateValidator,
     versionPredicateValidator,
-    z14.object({ all: z14.array(inAppMessagePredicateValidator) }).strict(),
-    z14.object({ any: z14.array(inAppMessagePredicateValidator) }).strict(),
-    z14.object({ not: inAppMessagePredicateValidator }).strict()
+    z15.object({ all: z15.array(inAppMessagePredicateValidator) }).strict(),
+    z15.object({ any: z15.array(inAppMessagePredicateValidator) }).strict(),
+    z15.object({ not: inAppMessagePredicateValidator }).strict()
   ])
 );
-var inAppMessageActionStyleValidator = z14.enum(["primary", "secondary", "positive", "dismiss"]).default("secondary");
-var internalLinkActionValidator = z14.object({ type: z14.literal("internalLink"), path: z14.string() }).passthrough();
-var externalLinkActionValidator = z14.object({ type: z14.literal("externalLink"), url: z14.string() }).passthrough();
-var appStoreActionValidator = z14.object({
-  type: z14.literal("appStore"),
-  iosUrl: z14.string().optional(),
-  androidUrl: z14.string().optional(),
-  webUrl: z14.string().optional()
+var inAppMessageActionStyleValidator = z15.enum(["primary", "secondary", "positive", "dismiss"]).default("secondary");
+var internalLinkActionValidator = z15.object({ type: z15.literal("internalLink"), path: z15.string() }).passthrough();
+var externalLinkActionValidator = z15.object({ type: z15.literal("externalLink"), url: z15.string() }).passthrough();
+var appStoreActionValidator = z15.object({
+  type: z15.literal("appStore"),
+  iosUrl: z15.string().optional(),
+  androidUrl: z15.string().optional(),
+  webUrl: z15.string().optional()
 }).passthrough();
-var capgoUpdateActionValidator = z14.object({ type: z14.literal("capgoUpdate") }).passthrough();
-var dismissActionValidator = z14.object({ type: z14.literal("dismiss") }).passthrough();
-var inAppMessageActionTargetValidator = z14.union([
+var capgoUpdateActionValidator = z15.object({ type: z15.literal("capgoUpdate") }).passthrough();
+var dismissActionValidator = z15.object({ type: z15.literal("dismiss") }).passthrough();
+var inAppMessageActionTargetValidator = z15.union([
   internalLinkActionValidator,
   externalLinkActionValidator,
   appStoreActionValidator,
   capgoUpdateActionValidator,
   dismissActionValidator
 ]);
-var inAppMessageActionValidator = z14.object({
-  label: z14.string(),
+var inAppMessageActionValidator = z15.object({
+  label: z15.string(),
   style: inAppMessageActionStyleValidator,
   action: inAppMessageActionTargetValidator,
   /** When true, the message closes after this action runs (default true). */
-  closeOnComplete: z14.boolean().default(true)
+  closeOnComplete: z15.boolean().default(true)
 }).passthrough();
-var inAppMessageMediaValidator = z14.object({
-  type: z14.enum(["youtube", "image", "gif"]),
-  url: z14.string(),
+var inAppMessageMediaValidator = z15.object({
+  type: z15.enum(["youtube", "image", "gif"]),
+  url: z15.string(),
   /** Aspect ratio hint, e.g. "16:9" or "1:1". Defaults to 16:9. */
-  aspect: z14.string().default("16:9"),
+  aspect: z15.string().default("16:9"),
   /** Alt text for images/gifs (accessibility). */
-  alt: z14.string().optional()
+  alt: z15.string().optional()
 }).passthrough();
-var inAppMessageFrequencyValidator = z14.union([
-  z14.literal("once"),
-  z14.literal("session"),
-  z14.literal("always"),
-  z14.object({ everyDays: z14.number().positive() }).strict()
+var inAppMessageFrequencyValidator = z15.union([
+  z15.literal("once"),
+  z15.literal("session"),
+  z15.literal("always"),
+  z15.object({ everyDays: z15.number().positive() }).strict()
 ]).default("once");
-var inAppMessagePresentationValidator = z14.enum(["modal", "banner", "toast"]).default("modal");
-var inAppMessageValidator = z14.object({
+var inAppMessagePresentationValidator = z15.enum(["modal", "banner", "toast"]).default("modal");
+var inAppMessageValidator = z15.object({
   /** Stable identifier — used to persist dismissal / frequency state. */
-  id: z14.string(),
+  id: z15.string(),
   /** Higher priority wins when multiple messages match. Default 0. */
-  priority: z14.number().default(0),
+  priority: z15.number().default(0),
   /** When false, the message is required/blocking (no dismiss affordance). */
-  dismissible: z14.boolean().default(true),
+  dismissible: z15.boolean().default(true),
   frequency: inAppMessageFrequencyValidator,
   presentation: inAppMessagePresentationValidator,
   media: inAppMessageMediaValidator.optional(),
   /** Optional emoji hero glyph — rendered only when `media` is not set. */
-  emoji: z14.string().optional(),
-  title: z14.string(),
-  body: z14.string().optional(),
-  actions: z14.array(inAppMessageActionValidator).default([]),
+  emoji: z15.string().optional(),
+  title: z15.string(),
+  body: z15.string().optional(),
+  actions: z15.array(inAppMessageActionValidator).default([]),
   /** Targeting predicate tree. Omitted → matches everyone. */
   targeting: inAppMessagePredicateValidator.optional(),
   /** Allow disabling a message without removing it from the flag. */
-  enabled: z14.boolean().default(true)
+  enabled: z15.boolean().default(true)
 }).passthrough();
-var inAppMessagesFlagValidator = z14.object({
-  version: z14.number().default(1),
-  messages: z14.array(inAppMessageValidator).default([])
+var inAppMessagesFlagValidator = z15.object({
+  version: z15.number().default(1),
+  messages: z15.array(inAppMessageValidator).default([])
 }).passthrough();
 var EMPTY_IN_APP_MESSAGES_FLAG = { version: 1, messages: [] };
 var parseInAppMessagesFlag = /* @__PURE__ */ __name((raw) => {
   const result = inAppMessagesFlagValidator.safeParse(raw);
   return result.success ? result.data : EMPTY_IN_APP_MESSAGES_FLAG;
 }, "parseInAppMessagesFlag");
+
+// src/share-links.ts
+import { z as z16 } from "zod/v4";
+var SHARE_LINK_ID_BYTES = 16;
+var SHARE_CONTENT_KEY_BYTES = 32;
+var SHARE_IV_BYTES = 12;
+var SHARE_TAG_BYTES = 16;
+var MAX_SHARE_CIPHERTEXT_BYTES = 512 * 1024;
+var MAX_SHARE_RECOVERY_JWE_BYTES = 64 * 1024;
+var MAX_SELECTED_CREDENTIALS = 50;
+var MAX_ENDORSEMENTS = 200;
+var MAX_VP_MEMBERS = MAX_SELECTED_CREDENTIALS + MAX_ENDORSEMENTS;
+var MAX_SHARE_SOURCE_URI_CHARS = 2048;
+var MAX_SHARE_LINK_REQUEST_BYTES = 1024 * 1024;
+var SHARE_LINK_PROTOCOL = "lc-share/v1";
+var SHARE_RECOVERY_PROTOCOL = "lc-share-recovery/v1";
+var SHARE_AAD_PREFIX = "lc-share:v1";
+var BASE64URL_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+var BASE64URL_LOOKUP = (() => {
+  const table = new Int16Array(128).fill(-1);
+  for (let index = 0; index < BASE64URL_ALPHABET.length; index += 1) {
+    table[BASE64URL_ALPHABET.charCodeAt(index)] = index;
+  }
+  return table;
+})();
+var encodeBase64Url = /* @__PURE__ */ __name((bytes) => {
+  let output = "";
+  for (let index = 0; index < bytes.length; index += 3) {
+    const first = bytes[index];
+    const second = bytes[index + 1];
+    const third = bytes[index + 2];
+    output += BASE64URL_ALPHABET[first >> 2];
+    output += BASE64URL_ALPHABET[(first & 3) << 4 | (second ?? 0) >> 4];
+    if (second === void 0) break;
+    output += BASE64URL_ALPHABET[(second & 15) << 2 | (third ?? 0) >> 6];
+    if (third === void 0) break;
+    output += BASE64URL_ALPHABET[third & 63];
+  }
+  return output;
+}, "encodeBase64Url");
+var decodeBase64Url = /* @__PURE__ */ __name((value) => {
+  if (typeof value !== "string") return null;
+  const output = new Uint8Array(Math.floor(value.length * 6 / 8));
+  let bits = 0;
+  let bitCount = 0;
+  let outputIndex = 0;
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    const digit = code < 128 ? BASE64URL_LOOKUP[code] : -1;
+    if (digit < 0) return null;
+    bits = bits << 6 | digit;
+    bitCount += 6;
+    if (bitCount >= 8) {
+      bitCount -= 8;
+      output[outputIndex] = bits >> bitCount & 255;
+      outputIndex += 1;
+    }
+  }
+  return output;
+}, "decodeBase64Url");
+var isCanonicalBase64Url = /* @__PURE__ */ __name((value, expectedBytes) => {
+  if (typeof value !== "string") return false;
+  if (expectedBytes !== void 0 && value.length !== Math.ceil(expectedBytes * 4 / 3))
+    return false;
+  const decoded = decodeBase64Url(value);
+  if (decoded === null) return false;
+  if (expectedBytes !== void 0 && decoded.length !== expectedBytes) return false;
+  return encodeBase64Url(decoded) === value;
+}, "isCanonicalBase64Url");
+var decodedBase64UrlByteLength = /* @__PURE__ */ __name((value) => decodeBase64Url(value)?.length ?? null, "decodedBase64UrlByteLength");
+var utf8ByteLength = /* @__PURE__ */ __name((value) => new TextEncoder().encode(value).length, "utf8ByteLength");
+var canonicalBase64Url = /* @__PURE__ */ __name((bytes) => z16.string().refine((value) => isCanonicalBase64Url(value, bytes), {
+  message: `must be canonical base64url for exactly ${bytes} bytes`
+}), "canonicalBase64Url");
+var ShareLinkIdValidator = canonicalBase64Url(SHARE_LINK_ID_BYTES);
+var ShareContentKeyValidator = canonicalBase64Url(SHARE_CONTENT_KEY_BYTES);
+var ShareIvValidator = canonicalBase64Url(SHARE_IV_BYTES);
+var ShareCiphertextValidator = z16.string().refine(
+  (value) => {
+    if (value.length > Math.ceil(MAX_SHARE_CIPHERTEXT_BYTES * 4 / 3)) return false;
+    const decoded = decodeBase64Url(value);
+    if (decoded === null) return false;
+    if (encodeBase64Url(decoded) !== value) return false;
+    return decoded.length >= SHARE_TAG_BYTES && decoded.length <= MAX_SHARE_CIPHERTEXT_BYTES;
+  },
+  {
+    message: `must be canonical base64url decoding to ${SHARE_TAG_BYTES}..${MAX_SHARE_CIPHERTEXT_BYTES} bytes`
+  }
+);
+var ShareEnvelopeValidator = z16.object({
+  v: z16.literal(1),
+  alg: z16.literal("A256GCM"),
+  iv: ShareIvValidator,
+  ct: ShareCiphertextValidator
+}).strict();
+var safeVersion = z16.number().int().min(1).max(2 ** 31 - 1);
+var safeCredentialIndex = z16.number().int().min(0).max(MAX_VP_MEMBERS - 1);
+var ShareSelectionEntryValidator = z16.object({ credentialIndex: safeCredentialIndex }).strict();
+var ShareEndorsementEntryValidator = z16.object({ credentialIndex: safeCredentialIndex, targetCredentialIndex: safeCredentialIndex }).strict();
+var ShareSharerValidator = z16.object({
+  profileId: z16.string().min(1).max(128),
+  displayName: z16.string().min(1).max(120),
+  avatar: z16.string().max(2048).optional()
+}).strict();
+var presentationShape = VPValidator.extend({
+  verifiableCredential: VCValidator.array().min(1).max(MAX_VP_MEMBERS)
+});
+var hasBoundedPresentation = /* @__PURE__ */ __name((value) => {
+  let credentialCount = 0;
+  const ancestors = /* @__PURE__ */ new Set();
+  const visit = /* @__PURE__ */ __name((node, depth) => {
+    if (node === null || typeof node !== "object") return true;
+    if (depth > 32 || ancestors.has(node)) return false;
+    ancestors.add(node);
+    try {
+      for (const [key, child] of Object.entries(node)) {
+        if (key === "verifiableCredential") {
+          credentialCount += Array.isArray(child) ? child.length : 1;
+          if (credentialCount > MAX_VP_MEMBERS) return false;
+        }
+        if (!visit(child, depth + 1)) return false;
+      }
+      return true;
+    } finally {
+      ancestors.delete(node);
+    }
+  }, "visit");
+  return visit(value, 0);
+}, "hasBoundedPresentation");
+var ShareManifestPresentationValidator = z16.custom(
+  (value) => hasBoundedPresentation(value) && presentationShape.safeParse(value).success,
+  { message: "invalid share presentation" }
+);
+var SharePayloadValidatorShape = z16.object({
+  protocol: z16.literal(SHARE_LINK_PROTOCOL),
+  shareId: ShareLinkIdValidator,
+  contentVersion: safeVersion,
+  createdAt: z16.iso.datetime(),
+  sharer: ShareSharerValidator,
+  presentation: ShareManifestPresentationValidator,
+  selection: ShareSelectionEntryValidator.array().min(1).max(MAX_SELECTED_CREDENTIALS),
+  endorsements: ShareEndorsementEntryValidator.array().max(MAX_ENDORSEMENTS).default([])
+}).strict();
+var classificationFailure = /* @__PURE__ */ __name((code, message, path = []) => ({ ok: false, code, message, path }), "classificationFailure");
+var readSignedClaimId = /* @__PURE__ */ __name((member) => {
+  if (member === null || typeof member !== "object") return void 0;
+  const record = member;
+  const claim = record.credentialSubject ?? record.endorsement;
+  if (claim === null || typeof claim !== "object") return void 0;
+  const claimRecord = claim;
+  const nested = claimRecord.endorsement;
+  const nestedId = nested !== null && typeof nested === "object" ? nested.id : void 0;
+  return claimRecord.id ?? nestedId;
+}, "readSignedClaimId");
+var classifyShareManifest = /* @__PURE__ */ __name((payload) => {
+  const members = payload.presentation?.verifiableCredential;
+  if (!Array.isArray(members) || members.length === 0) {
+    return classificationFailure("NO_PRESENTATION_MEMBERS", "presentation has no credentials");
+  }
+  if (members.length > MAX_VP_MEMBERS) {
+    return classificationFailure(
+      "TOO_MANY_VP_MEMBERS",
+      `presentation has ${members.length} members, over the ${MAX_VP_MEMBERS} bound`
+    );
+  }
+  const selection = payload.selection;
+  const endorsements = payload.endorsements ?? [];
+  if (!Array.isArray(selection) || selection.length < 1 || selection.length > MAX_SELECTED_CREDENTIALS) {
+    return classificationFailure("BAD_SELECTION", "selection must contain 1..50 entries");
+  }
+  if (!Array.isArray(endorsements) || endorsements.length > MAX_ENDORSEMENTS) {
+    return classificationFailure(
+      "BAD_ENDORSEMENTS",
+      "endorsements must contain at most 200 entries"
+    );
+  }
+  const selectedIndices = [];
+  const selected = /* @__PURE__ */ new Set();
+  for (let index = 0; index < selection.length; index += 1) {
+    const entry = selection[index];
+    const credentialIndex = entry?.credentialIndex;
+    if (!Number.isSafeInteger(credentialIndex) || credentialIndex < 0 || credentialIndex >= members.length) {
+      return classificationFailure(
+        "SELECTION_INDEX_OUT_OF_BOUNDS",
+        `selection[${index}].credentialIndex is out of bounds`,
+        ["selection", index, "credentialIndex"]
+      );
+    }
+    if (selected.has(credentialIndex)) {
+      return classificationFailure(
+        "SELECTION_INDEX_DUPLICATE",
+        `selection[${index}].credentialIndex is duplicated`,
+        ["selection", index, "credentialIndex"]
+      );
+    }
+    selected.add(credentialIndex);
+    selectedIndices.push(credentialIndex);
+  }
+  const classified = new Set(selected);
+  const endorsementIndices = [];
+  for (let index = 0; index < endorsements.length; index += 1) {
+    const entry = endorsements[index];
+    const credentialIndex = entry?.credentialIndex;
+    const targetIndex = entry?.targetCredentialIndex;
+    if (!Number.isSafeInteger(credentialIndex) || credentialIndex < 0 || credentialIndex >= members.length) {
+      return classificationFailure(
+        "ENDORSEMENT_INDEX_OUT_OF_BOUNDS",
+        `endorsements[${index}].credentialIndex is out of bounds`,
+        ["endorsements", index, "credentialIndex"]
+      );
+    }
+    if (classified.has(credentialIndex)) {
+      return classificationFailure(
+        "VP_MEMBER_CLASSIFIED_TWICE",
+        `endorsements[${index}].credentialIndex was already classified`,
+        ["endorsements", index, "credentialIndex"]
+      );
+    }
+    if (!selected.has(targetIndex)) {
+      return classificationFailure(
+        "ENDORSEMENT_TARGET_NOT_SELECTED",
+        `endorsements[${index}].targetCredentialIndex must reference a selected credential`,
+        ["endorsements", index, "targetCredentialIndex"]
+      );
+    }
+    const referenced = readSignedClaimId(members[credentialIndex]);
+    const target = members[targetIndex];
+    const targetId = target !== null && typeof target === "object" ? target.id : void 0;
+    if (typeof referenced !== "string" || typeof targetId !== "string" || referenced !== targetId) {
+      return classificationFailure(
+        "ENDORSEMENT_TARGET_UNBOUND",
+        `endorsements[${index}] claim does not reference the target credential id`,
+        ["endorsements", index]
+      );
+    }
+    classified.add(credentialIndex);
+    endorsementIndices.push(credentialIndex);
+  }
+  if (classified.size !== members.length) {
+    return classificationFailure(
+      "UNCLASSIFIED_VP_MEMBER",
+      "every presentation member must be classified exactly once",
+      ["presentation", "verifiableCredential"]
+    );
+  }
+  return {
+    ok: true,
+    classification: { selectedIndices, endorsementIndices, memberCount: members.length }
+  };
+}, "classifyShareManifest");
+var SharePayloadValidator = SharePayloadValidatorShape.superRefine((payload, ctx) => {
+  const result = classifyShareManifest(payload);
+  if (!result.ok) {
+    ctx.addIssue({
+      code: "custom",
+      message: result.message,
+      path: result.path,
+      params: { shareLinkCode: result.code }
+    });
+  }
+});
+var ShareRecoverySelectionValidator = z16.object({
+  ref: z16.string().min(1).max(MAX_SHARE_SOURCE_URI_CHARS),
+  order: z16.number().int().min(0).max(MAX_SELECTED_CREDENTIALS - 1)
+}).strict();
+var ShareRecoveryEndorsementValidator = z16.object({ targetRef: z16.string().min(1).max(MAX_SHARE_SOURCE_URI_CHARS) }).strict();
+var ShareRecoveryPlaintextValidator = z16.object({
+  protocol: z16.literal(SHARE_RECOVERY_PROTOCOL),
+  shareId: ShareLinkIdValidator,
+  ownerProfileId: z16.string().min(1).max(128),
+  createdAt: z16.iso.datetime(),
+  latest: z16.object({ contentVersion: safeVersion, key: ShareContentKeyValidator }).strict(),
+  selection: ShareRecoverySelectionValidator.array().min(1).max(MAX_SELECTED_CREDENTIALS),
+  endorsements: ShareRecoveryEndorsementValidator.array().max(MAX_ENDORSEMENTS).default([])
+}).strict().superRefine((recovery, ctx) => {
+  const orders = /* @__PURE__ */ new Set();
+  recovery.selection.forEach((entry, index) => {
+    if (entry.order >= recovery.selection.length) {
+      ctx.addIssue({
+        code: "custom",
+        message: "order must be within the selection bounds",
+        path: ["selection", index, "order"]
+      });
+    }
+    if (orders.has(entry.order)) {
+      ctx.addIssue({
+        code: "custom",
+        message: "order must be unique within the selection",
+        path: ["selection", index, "order"]
+      });
+    }
+    orders.add(entry.order);
+  });
+});
+var ShareOwnerRecoveryValidator = JWEValidator.refine(
+  (value) => utf8ByteLength(JSON.stringify(value)) <= MAX_SHARE_RECOVERY_JWE_BYTES,
+  { message: `serialized recovery JWE must be at most ${MAX_SHARE_RECOVERY_JWE_BYTES} bytes` }
+);
+var ShareLinkStatusValidator = z16.enum(["pending", "active", "stopped"]);
+var ShareContentStateValidator = z16.enum(["staging", "finalized", "content_missing"]);
+var ShareLinkValidator = z16.object({
+  id: ShareLinkIdValidator,
+  title: z16.string().min(1).max(120),
+  note: z16.string().max(500).optional(),
+  selectedCount: z16.number().int().min(1).max(MAX_SELECTED_CREDENTIALS),
+  version: safeVersion,
+  contentVersion: safeVersion,
+  status: ShareLinkStatusValidator,
+  attachmentId: z16.string().uuid().nullable().optional(),
+  attachmentChunkCount: z16.number().int().min(1).max(16).nullable().optional(),
+  contentState: ShareContentStateValidator,
+  createdAt: z16.iso.datetime(),
+  updatedAt: z16.iso.datetime(),
+  expiresAt: z16.iso.datetime().nullable(),
+  stoppedAt: z16.iso.datetime().nullable(),
+  lastViewedAt: z16.iso.datetime().nullable(),
+  viewCount: z16.number().int().min(0).optional(),
+  passcodeProtected: z16.boolean(),
+  notifyOnView: z16.boolean(),
+  minorPolicy: z16.object({
+    isMinor: z16.boolean().nullable(),
+    policyResolved: z16.boolean(),
+    defaultExpiryDays: z16.union([z16.literal(30), z16.literal(365)]),
+    viewCountingEnabled: z16.boolean()
+  }),
+  /**
+   * Guarded application/API URL for the content. Optional because owner APIs in
+   * D1 have no public resolve/content endpoint yet; it must never be a
+   * LearnCloud object URL or carry a fabricated decryption key.
+   */
+  contentUrl: z16.string().optional()
+});
+var clientRequestId = z16.string().uuid();
+var ShareLinkAttachmentValidator = z16.object({
+  id: z16.string().uuid(),
+  chunkCount: z16.number().int().min(1).max(16)
+}).strict();
+var attachmentChunkKey = {
+  id: ShareLinkIdValidator,
+  contentVersion: safeVersion,
+  attachmentId: z16.string().uuid(),
+  chunkIndex: z16.number().int().min(0).max(15)
+};
+var ShareLinkAttachmentChunkEnvelopeValidator = ShareEnvelopeValidator.refine(
+  (value) => (decodedBase64UrlByteLength(value.ct) ?? Infinity) <= 256 * 1024 + SHARE_TAG_BYTES
+);
+var PutShareLinkAttachmentChunkInputValidator = z16.object({
+  ...attachmentChunkKey,
+  chunkCount: z16.number().int().min(1).max(16),
+  envelope: ShareLinkAttachmentChunkEnvelopeValidator,
+  ownerEncryptedRecovery: ShareOwnerRecoveryValidator
+}).strict().refine((value) => value.chunkIndex < value.chunkCount);
+var GetShareLinkAttachmentChunkInputValidator = z16.object({
+  ...attachmentChunkKey,
+  passcode: z16.string().min(4).max(64).optional(),
+  accessToken: z16.string().min(1).max(2048).optional()
+}).strict();
+var ShareLinkAttachmentChunkOutputValidator = z16.object({
+  ...attachmentChunkKey,
+  envelope: ShareLinkAttachmentChunkEnvelopeValidator,
+  accessToken: z16.string().min(1).max(2048).optional()
+}).strict();
+var DeleteShareLinkAttachmentChunksInputValidator = z16.object({
+  id: ShareLinkIdValidator,
+  contentVersion: safeVersion,
+  attachmentId: z16.string().uuid(),
+  chunkCount: z16.number().int().min(1).max(16)
+}).strict();
+var PutShareLinkAttachmentChunkOutputValidator = z16.object({ ok: z16.literal(true) }).strict();
+var DeleteShareLinkAttachmentChunksOutputValidator = z16.object({ ok: z16.boolean() }).strict();
+var CreateShareLinkInputValidator = z16.object({
+  id: ShareLinkIdValidator,
+  clientRequestId,
+  title: z16.string().min(1).max(120),
+  note: z16.string().max(500).optional(),
+  expiresAt: z16.iso.datetime().nullable().optional(),
+  passcode: z16.string().min(8).max(64).optional(),
+  notifyOnView: z16.boolean().default(false),
+  selectedCount: z16.number().int().min(1).max(MAX_SELECTED_CREDENTIALS),
+  contentVersion: z16.literal(1),
+  envelope: ShareEnvelopeValidator,
+  ownerEncryptedRecovery: ShareOwnerRecoveryValidator,
+  attachment: ShareLinkAttachmentValidator.optional()
+}).strict();
+var UpdateShareLinkInputValidator = z16.object({
+  id: ShareLinkIdValidator,
+  expectedVersion: safeVersion,
+  clientRequestId,
+  title: z16.string().min(1).max(120).optional(),
+  note: z16.string().max(500).nullable().optional(),
+  expiresAt: z16.iso.datetime().nullable().optional(),
+  /** Omitted preserves the current passcode, null removes it, and a string replaces it. */
+  passcode: z16.string().min(8).max(64).nullable().optional(),
+  notifyOnView: z16.boolean().optional(),
+  contentVersion: safeVersion.optional(),
+  selectedCount: z16.number().int().min(1).max(MAX_SELECTED_CREDENTIALS).optional(),
+  envelope: ShareEnvelopeValidator.optional(),
+  ownerEncryptedRecovery: ShareOwnerRecoveryValidator.optional(),
+  attachment: ShareLinkAttachmentValidator.optional()
+}).strict().superRefine((value, ctx) => {
+  const provided = [
+    value.contentVersion,
+    value.selectedCount,
+    value.envelope,
+    value.ownerEncryptedRecovery
+  ].filter((field) => field !== void 0).length;
+  if (provided !== 0 && provided !== 4) {
+    ctx.addIssue({
+      code: "custom",
+      message: "content replacement requires contentVersion, selectedCount, envelope and ownerEncryptedRecovery together"
+    });
+  }
+  if (value.attachment !== void 0 && provided !== 4) {
+    ctx.addIssue({ code: "custom", message: "attachment requires a content replacement" });
+  }
+});
+var ShareLinkIdInputValidator = z16.object({ id: ShareLinkIdValidator }).strict();
+var ShareLinkOperationKeyInputValidator = z16.object({ id: ShareLinkIdValidator, operationId: z16.string().uuid() }).strict();
+var ShareLinkOwnerCommitOutputValidator = z16.discriminatedUnion("status", [
+  z16.object({ status: z16.literal("completed"), share: ShareLinkValidator }).strict(),
+  z16.object({
+    status: z16.literal("pending"),
+    id: ShareLinkIdValidator,
+    operationId: z16.string().uuid()
+  }).strict()
+]);
+var ShareLinkOwnerStatusOutputValidator = z16.discriminatedUnion("status", [
+  z16.object({ status: z16.literal("found"), share: ShareLinkValidator }).strict(),
+  z16.object({
+    status: z16.literal("pending"),
+    id: ShareLinkIdValidator,
+    operationId: z16.string().uuid()
+  }).strict(),
+  z16.object({ status: z16.literal("not_found"), id: ShareLinkIdValidator }).strict()
+]);
+var ShareLinkOwnerRecoveryOutputValidator = z16.object({ recovery: ShareOwnerRecoveryValidator }).strict();
+var ShareLinkOwnerContentOutputValidator = z16.object({
+  id: ShareLinkIdValidator,
+  contentVersion: safeVersion,
+  envelope: ShareEnvelopeValidator
+}).strict();
+var ResolveShareLinkInputValidator = z16.object({
+  id: ShareLinkIdValidator,
+  /** Sent only in a POST body; it must never be placed in a share URL. */
+  passcode: z16.string().min(4).max(64).optional()
+}).strict();
+var ShareLinkPublicStateValidator = z16.discriminatedUnion("state", [
+  z16.object({
+    state: z16.literal("passcode_required"),
+    id: ShareLinkIdValidator
+  }).strict(),
+  z16.object({ state: z16.literal("try_later"), id: ShareLinkIdValidator }).strict(),
+  z16.object({
+    state: z16.literal("active"),
+    id: ShareLinkIdValidator,
+    title: z16.string().max(120),
+    note: z16.string().max(500).optional(),
+    selectedCount: z16.number().int().min(1).max(MAX_SELECTED_CREDENTIALS),
+    contentVersion: safeVersion,
+    contentUrl: z16.string(),
+    sharer: z16.object({
+      displayName: z16.string().max(120),
+      avatar: z16.string().max(2048).optional()
+    }),
+    createdAt: z16.iso.datetime(),
+    updatedAt: z16.iso.datetime(),
+    expiresAt: z16.iso.datetime().nullable()
+  }).strict(),
+  z16.object({
+    state: z16.literal("expired"),
+    id: ShareLinkIdValidator,
+    expiresAt: z16.iso.datetime()
+  }).strict(),
+  z16.object({
+    state: z16.literal("stopped"),
+    id: ShareLinkIdValidator,
+    stoppedAt: z16.iso.datetime()
+  }).strict(),
+  z16.object({ state: z16.literal("not_found"), id: ShareLinkIdValidator }).strict()
+]);
+var ListShareLinksInputValidator = z16.object({
+  limit: z16.number().int().min(1).max(50).default(25),
+  cursor: z16.string().max(512).optional()
+}).strict();
+var PaginatedShareLinksValidator = PaginationResponseValidator.extend({
+  records: ShareLinkValidator.array()
+});
+var AcknowledgeViewInputValidator = z16.object({
+  receipt: z16.string().min(22).max(128).regex(/^[A-Za-z0-9_-]+$/)
+}).strict();
+var AcknowledgeViewOutputValidator = z16.object({ ok: z16.literal(true) }).strict();
+var SHARE_VIEW_RECEIPT_TTL_SECONDS = 10 * 60;
+var ShareLinkPublicContentViewValidator = z16.object({
+  id: ShareLinkIdValidator,
+  contentVersion: safeVersion,
+  envelope: ShareEnvelopeValidator,
+  contentUrl: z16.string(),
+  receipt: z16.string().min(22).max(128).regex(/^[A-Za-z0-9_-]+$/)
+}).strict();
 export {
   ACT_AS_HEADER,
   AUTH_GRANT_AUDIENCE_DOMAIN_PREFIX,
@@ -2544,6 +3312,8 @@ export {
   AchievementSubjectValidator,
   AchievementTypeValidator,
   AchievementValidator,
+  AcknowledgeViewInputValidator,
+  AcknowledgeViewOutputValidator,
   AddTagInputValidator,
   AddressValidator,
   AgeRatingValidator,
@@ -2559,6 +3329,12 @@ export {
   AppEventResponseValidator,
   AppEventValidator,
   AppListingStatusValidator,
+  AppManifestDiffValidator,
+  AppManifestTemplateChangeValidator,
+  AppManifestTemplateRefValidator,
+  AppManifestValidator,
+  AppManifestVersionStatusValidator,
+  AppManifestVersionValidator,
   AppStoreListingCreateValidator,
   AppStoreListingSubmitterValidator,
   AppStoreListingUpdateValidator,
@@ -2580,6 +3356,8 @@ export {
   BoostRecipientValidator,
   BoostRecipientWithChildrenValidator,
   BoostValidator,
+  CapturedConsentRecordValidator,
+  CapturedTemplateRecordValidator,
   CheckCredentialEventValidator,
   CheckIssuanceStatusEventValidator,
   ClaimHookQueryValidator,
@@ -2601,6 +3379,7 @@ export {
   ConsentFlowDataForDidQueryValidator,
   ConsentFlowDataQueryValidator,
   ConsentFlowGuardianApprovalValidator,
+  ConsentFlowReferralValidator,
   ConsentFlowTermValidator,
   ConsentFlowTermsQueryValidator,
   ConsentFlowTermsStatusValidator,
@@ -2608,6 +3387,10 @@ export {
   ConsentFlowTransactionActionValidator,
   ConsentFlowTransactionValidator,
   ConsentFlowTransactionsQueryValidator,
+  ConsentFlowWebhookMetadataValidator,
+  ConsentRequestPersonalFieldValidator,
+  ConsentRequestValidator,
+  ConsentRequestWalletCategoryValidator,
   ContactMethodCreateValidator,
   ContactMethodQueryValidator,
   ContactMethodValidator,
@@ -2615,12 +3398,14 @@ export {
   ContactMethodVerificationValidator,
   ContextValidator,
   ContractCredentialValidator,
+  ContractRequestFieldsValidator,
   CountSkillsInputValidator,
   CountSkillsResultValidator,
   CreateContactMethodSessionResponseValidator,
   CreateContactMethodSessionValidator,
   CreateManagedFrameworkBatchInputValidator,
   CreateManagedFrameworkInputValidator,
+  CreateShareLinkInputValidator,
   CreateSkillInputValidator,
   CreateSkillsBatchInputValidator,
   CredentialActivityEventTypeValidator,
@@ -2649,13 +3434,19 @@ export {
   CriteriaValidator,
   DEFAULT_BITSTRING_STATUS_LIST_SIZE,
   DeleteFrameworkInputValidator,
+  DeleteShareLinkAttachmentChunksInputValidator,
+  DeleteShareLinkAttachmentChunksOutputValidator,
   DeleteSkillInputValidator,
   DidDocumentValidator,
   EMPTY_IN_APP_MESSAGES_FLAG,
+  ESCROW_PIN_LOCKED_MESSAGE,
+  ESCROW_PIN_MISMATCH_PATTERN,
+  ESCROW_PIN_UNAVAILABLE_MESSAGE,
   EncryptedCredentialRecordValidator,
   EncryptedRecordValidator,
   EndorsementCredentialValidator,
   EndorsementSubjectValidator,
+  EscrowPinStatusValidator,
   EvidenceValidator,
   FlatAuthGrantValidator,
   FrameworkWithSkillsValidator,
@@ -2667,6 +3458,7 @@ export {
   GetCredentialRefreshHistoryResultValidator,
   GetFullSkillTreeInputValidator,
   GetFullSkillTreeResultValidator,
+  GetShareLinkAttachmentChunkInputValidator,
   GetSkillPathInputValidator,
   GetSkillPathResultValidator,
   GetTemplateRecipientsEventValidator,
@@ -2684,6 +3476,12 @@ export {
   InboxCredentialRefreshReceiptValidator,
   InboxCredentialValidator,
   IncrementCounterEventValidator,
+  InlineAlignmentValidator,
+  InlineCredentialTemplateValidator,
+  InlineEvidenceValidator,
+  InlineSendCredentialEventValidator,
+  InlineWalletCategoryValidator,
+  InlineWalletSkillTagValidator,
   InstalledAppValidator,
   IssueInboxCredentialBatchItemResultValidator,
   IssueInboxCredentialBatchItemValidator,
@@ -2736,9 +3534,19 @@ export {
   LCNVisibleProfileValidator,
   LaunchTypeValidator,
   LearnCardRefreshAuthorizationValidator,
+  LegacySendCredentialEventValidator,
   LinkProviderFrameworkInputValidator,
+  ListShareLinksInputValidator,
+  MAX_ENDORSEMENTS,
+  MAX_SELECTED_CREDENTIALS,
+  MAX_SHARE_CIPHERTEXT_BYTES,
+  MAX_SHARE_LINK_REQUEST_BYTES,
+  MAX_SHARE_RECOVERY_JWE_BYTES,
+  MAX_SHARE_SOURCE_URI_CHARS,
+  MAX_VP_MEMBERS,
   ManagedCredentialRefreshReceiptValidator,
   ManagedCredentialRefreshServiceValidator,
+  NormalizedConsentScopesValidator,
   PaginatedAppStoreListingsValidator,
   PaginatedBoostRecipientsValidator,
   PaginatedBoostRecipientsWithChildrenValidator,
@@ -2759,11 +3567,14 @@ export {
   PaginatedLCNProfileManagersValidator,
   PaginatedLCNProfilesAndManagersValidator,
   PaginatedLCNProfilesValidator,
+  PaginatedShareLinksValidator,
   PaginatedSkillFrameworksValidator,
   PaginatedSkillTreeValidator,
   PaginatedVisibleLCNProfilesValidator,
   PaginationOptionsValidator,
   PaginationResponseValidator,
+  PendingListingUpdateStatusValidator,
+  PendingListingUpdateValidator,
   PrepareRefreshableSendInputValidator,
   PrepareRefreshableSendResultValidator,
   ProfileValidator,
@@ -2776,6 +3587,9 @@ export {
   PublishCredentialRefreshResultValidator,
   PublishIssuerSignedRefreshValidator,
   PublishSigningAuthorityRefreshValidator,
+  PutShareLinkAttachmentChunkInputValidator,
+  PutShareLinkAttachmentChunkOutputValidator,
+  RawInlineCredentialTemplateValidator,
   RefreshServiceValidator,
   RegExpValidator,
   RelatedValidator,
@@ -2783,16 +3597,26 @@ export {
   ReplaceSkillFrameworkSkillsInputValidator,
   ReplaceSkillFrameworkSkillsResultValidator,
   RequestLearnerContextEventValidator,
+  ResolveShareLinkInputValidator,
   ResultDescriptionValidator,
   ResultStatusTypeValidator,
   ResultTypeValidator,
   ResultValidator,
   RubricCriterionValidator,
+  SHARE_AAD_PREFIX,
+  SHARE_CONTENT_KEY_BYTES,
+  SHARE_IV_BYTES,
+  SHARE_LINK_ID_BYTES,
+  SHARE_LINK_PROTOCOL,
+  SHARE_RECOVERY_PROTOCOL,
+  SHARE_TAG_BYTES,
+  SHARE_VIEW_RECEIPT_TTL_SECONDS,
   SendAiSessionCredentialEventValidator,
   SendBoostInputValidator,
   SendBoostResponseValidator,
   SendBoostTemplateValidator,
   SendBrandingOptionsValidator,
+  SendContractRequestValidator,
   SendCredentialEventValidator,
   SendInboxResponseValidator,
   SendInputValidator,
@@ -2802,6 +3626,36 @@ export {
   SentCredentialInfoValidator,
   ServiceValidator,
   SetPrimaryContactMethodValidator,
+  ShareCiphertextValidator,
+  ShareContentKeyValidator,
+  ShareContentStateValidator,
+  ShareEndorsementEntryValidator,
+  ShareEnvelopeValidator,
+  ShareIvValidator,
+  ShareLinkAttachmentChunkEnvelopeValidator,
+  ShareLinkAttachmentChunkOutputValidator,
+  ShareLinkAttachmentValidator,
+  ShareLinkIdInputValidator,
+  ShareLinkIdValidator,
+  ShareLinkOperationKeyInputValidator,
+  ShareLinkOwnerCommitOutputValidator,
+  ShareLinkOwnerContentOutputValidator,
+  ShareLinkOwnerRecoveryOutputValidator,
+  ShareLinkOwnerStatusOutputValidator,
+  ShareLinkPublicContentViewValidator,
+  ShareLinkPublicStateValidator,
+  ShareLinkStatusValidator,
+  ShareLinkValidator,
+  ShareManifestPresentationValidator,
+  ShareOwnerRecoveryValidator,
+  SharePayloadValidator,
+  SharePayloadValidatorShape,
+  ShareRecoveryEndorsementValidator,
+  ShareRecoveryPlaintextValidator,
+  ShareRecoverySelectionValidator,
+  ShareSelectionEntryValidator,
+  ShareSharerValidator,
+  SimpleInlineCredentialTemplateValidator,
   SkillDeletionStrategyValidator,
   SkillFrameworkAdminInputValidator,
   SkillFrameworkAdminsValidator,
@@ -2832,8 +3686,12 @@ export {
   UnsignedClrCredentialValidator,
   UnsignedVCValidator,
   UnsignedVPValidator,
+  UnsupportedSignInOperationError,
   UpdateFrameworkInputValidator,
+  UpdateShareLinkInputValidator,
   UpdateSkillInputValidator,
+  UpsertConsentContractEventValidator,
+  UpsertConsentContractResponseValidator,
   VC2EvidenceValidator,
   VCValidator,
   VPValidator,
@@ -2844,7 +3702,12 @@ export {
   VerificationStatusValidator,
   appStoreActionValidator,
   capgoUpdateActionValidator,
+  classifyShareManifest,
+  decodeBase64Url,
+  decodedBase64UrlByteLength,
   dismissActionValidator,
+  encodeBase64Url,
+  escrowPinMismatchMessage,
   externalLinkActionValidator,
   inAppMessageActionStyleValidator,
   inAppMessageActionTargetValidator,
@@ -2859,9 +3722,11 @@ export {
   inAppMessageVersionSourceValidator,
   inAppMessagesFlagValidator,
   internalLinkActionValidator,
+  isCanonicalBase64Url,
   isStoredCredentialEnvelope,
   parseInAppMessagesFlag,
   platformPredicateValidator,
   rolePredicateValidator,
+  utf8ByteLength,
   versionPredicateValidator
 };