@learncard/vc-plugin 1.5.13 → 1.6.0

package/dist/vc-plugin.esm.js

@@ -513,6 +513,638 @@ var verifyPresentation = /* @__PURE__ */ __name((initLearnCard) => {
   };
 }, "verifyPresentation");
 
+// src/refreshCredential.ts
+import {
+  CredentialRefreshChallengeValidator,
+  JWEValidator,
+  VCValidator
+} from "@learncard/types";
+import {
+  credentialContentsEqual,
+  getCredentialEffectiveTime,
+  getCredentialIssuerId,
+  getSupportedRefreshService
+} from "@learncard/helpers";
+
+// src/refreshCredential.fetch.ts
+var isNodeRuntime = typeof process !== "undefined" && !!process.versions?.node;
+var toResponseHeaders = /* @__PURE__ */ __name((headers) => {
+  const result = new Headers();
+  for (const [name, value] of Object.entries(headers)) {
+    if (Array.isArray(value)) value.forEach((entry) => result.append(name, entry));
+    else if (value !== void 0) result.append(name, value);
+  }
+  return result;
+}, "toResponseHeaders");
+var fetchWithPinnedAddress = /* @__PURE__ */ __name(async (url, init, pinnedAddress) => {
+  if (!isNodeRuntime || !pinnedAddress) return globalThis.fetch(url.href, init);
+  const specifier = url.protocol === "https:" ? "node:https" : "node:http";
+  const client = await import(
+    /* @vite-ignore */
+    specifier
+  );
+  return new Promise((resolve, reject) => {
+    const lookup = /* @__PURE__ */ __name((_hostname, options, callback) => {
+      if (options?.all) callback(null, [pinnedAddress]);
+      else callback(null, pinnedAddress.address, pinnedAddress.family);
+    }, "lookup");
+    let request;
+    try {
+      const headers = Object.fromEntries(new Headers(init.headers).entries());
+      headers["accept-encoding"] = "identity";
+      request = client.request(
+        url,
+        {
+          method: init.method,
+          headers,
+          signal: init.signal,
+          lookup,
+          // A shared agent could reuse a socket created for a different DNS
+          // answer and bypass this request's validated pin.
+          agent: false,
+          ...url.protocol === "https:" ? { servername: url.hostname } : {}
+        },
+        (nodeResponse) => {
+          try {
+            const status = nodeResponse.statusCode;
+            if (status === void 0 || !Number.isInteger(status) || status < 200 || status > 599) {
+              reject(new RangeError("Invalid refresh response status"));
+              nodeResponse.destroy();
+              return;
+            }
+            const hasBody = status !== 204 && status !== 205 && status !== 304;
+            const body = hasBody ? new ReadableStream({
+              start(controller) {
+                nodeResponse.on("data", (chunk) => {
+                  if (typeof chunk === "string") {
+                    controller.enqueue(new TextEncoder().encode(chunk));
+                  } else if (chunk instanceof Uint8Array) {
+                    controller.enqueue(chunk);
+                  } else {
+                    controller.error(
+                      new TypeError("Unsupported response chunk")
+                    );
+                  }
+                });
+                nodeResponse.on("end", () => controller.close());
+                nodeResponse.on("error", (error) => controller.error(error));
+                nodeResponse.on(
+                  "aborted",
+                  () => controller.error(
+                    new DOMException(
+                      "The operation was aborted",
+                      "AbortError"
+                    )
+                  )
+                );
+              },
+              cancel(reason) {
+                nodeResponse.destroy(
+                  reason instanceof Error ? reason : new Error(String(reason))
+                );
+              }
+            }) : null;
+            resolve(
+              new Response(body, {
+                status,
+                statusText: nodeResponse.statusMessage,
+                headers: toResponseHeaders(nodeResponse.headers)
+              })
+            );
+          } catch (error) {
+            reject(error);
+            nodeResponse.destroy();
+          }
+        }
+      );
+    } catch (error) {
+      reject(error);
+      return;
+    }
+    request.on("error", reject);
+    request.end();
+  });
+}, "fetchWithPinnedAddress");
+
+// src/refreshCredential.ts
+var DID_AUTH_SCHEME = "learncarddidauth";
+var DEFAULT_TIMEOUT_MS = 1e4;
+var HEADER_CHALLENGE_TTL_MS = 3e5;
+var MAX_TRACKED_CHALLENGES = 1024;
+var DEFAULT_MAX_REDIRECTS = 3;
+var DEFAULT_MAX_RESPONSE_BYTES = 1048576;
+var ACCEPTED_MEDIA_TYPES = /* @__PURE__ */ new Set([
+  "application/json",
+  "application/ld+json",
+  "application/vc+ld+json",
+  "application/vc-ld+json",
+  "application/jwe+json"
+]);
+var ACCEPT_HEADER = [...ACCEPTED_MEDIA_TYPES].join(", ");
+var REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+var failed = /* @__PURE__ */ __name((code, retryable) => ({
+  status: "failed",
+  code,
+  retryable
+}), "failed");
+var unsafeEndpoint = /* @__PURE__ */ __name(() => failed("UNSAFE_ENDPOINT", false), "unsafeEndpoint");
+var malformedResponse = /* @__PURE__ */ __name(() => failed("MALFORMED_RESPONSE", false), "malformedResponse");
+var invalidProof = /* @__PURE__ */ __name(() => failed("INVALID_PROOF", false), "invalidProof");
+var unauthorized = /* @__PURE__ */ __name(() => failed("UNAUTHORIZED", false), "unauthorized");
+var proofVerified = /* @__PURE__ */ __name((check) => !!check && check.errors.length === 0 && check.warnings.length === 0 && check.checks.includes("proof"), "proofVerified");
+var parseIPv4Octets = /* @__PURE__ */ __name((ip) => {
+  const parts = ip.split(".");
+  if (parts.length !== 4 || parts.some((part) => !/^\d{1,3}$/.test(part) || Number(part) < 0 || Number(part) > 255)) {
+    return void 0;
+  }
+  return parts.map(Number);
+}, "parseIPv4Octets");
+var isPrivateOrReservedIPv4 = /* @__PURE__ */ __name((ip) => {
+  const octets = parseIPv4Octets(ip);
+  if (!octets) return true;
+  const [a, b, c] = octets;
+  return a === 0 || // "this" network
+  a === 10 || // RFC 1918
+  a === 127 || // loopback
+  a === 100 && b >= 64 && b <= 127 || // CGNAT
+  a === 169 && b === 254 || // link-local + cloud metadata
+  a === 172 && b >= 16 && b <= 31 || // RFC 1918
+  a === 192 && b === 0 || // IETF protocol assignments + TEST-NET-1
+  a === 192 && b === 168 || // RFC 1918
+  a === 198 && (b === 18 || b === 19) || // benchmarking
+  a === 198 && b === 51 && c === 100 || // TEST-NET-2
+  a === 203 && b === 0 && c === 113 || // TEST-NET-3
+  a >= 224;
+}, "isPrivateOrReservedIPv4");
+var parseIPv6Hextets = /* @__PURE__ */ __name((raw) => {
+  const hasOpeningBracket = raw.startsWith("[");
+  const hasClosingBracket = raw.endsWith("]");
+  if (hasOpeningBracket !== hasClosingBracket) return void 0;
+  const ip = (hasOpeningBracket ? raw.slice(1, -1) : raw).toLowerCase();
+  if (!ip || ip.includes("%") || (ip.match(/::/g)?.length ?? 0) > 1) return void 0;
+  let normalized = ip;
+  const dottedTail = normalized.match(/(?:^|:)(\d{1,3}(?:\.\d{1,3}){3})$/)?.[1];
+  if (dottedTail) {
+    const octets = parseIPv4Octets(dottedTail);
+    if (!octets) return void 0;
+    normalized = normalized.slice(0, -dottedTail.length);
+    normalized += `${(octets[0] << 8 | octets[1]).toString(16)}:${(octets[2] << 8 | octets[3]).toString(16)}`;
+  }
+  const hasCompression = normalized.includes("::");
+  const [leftRaw, rightRaw = ""] = normalized.split("::");
+  const left = leftRaw ? leftRaw.split(":") : [];
+  const right = rightRaw ? rightRaw.split(":") : [];
+  const tokens = [...left, ...right];
+  if (tokens.some((token) => !/^[0-9a-f]{1,4}$/.test(token)) || (hasCompression ? tokens.length >= 8 : tokens.length !== 8)) {
+    return void 0;
+  }
+  const omitted = hasCompression ? 8 - tokens.length : 0;
+  return [...left, ...Array(omitted).fill(0), ...right].map(
+    (token) => typeof token === "number" ? token : Number.parseInt(token, 16)
+  );
+}, "parseIPv6Hextets");
+var isIPv4TranslationOrTransitionPrefix = /* @__PURE__ */ __name((hextets) => {
+  const [first, second, third] = hextets;
+  const isNat64WellKnown = first === 100 && second === 65435 && hextets.slice(2, 6).every((part) => part === 0);
+  const isNat64Local = first === 100 && second === 65435 && third === 1;
+  const is6to4 = first === 8194;
+  return isNat64WellKnown || isNat64Local || is6to4;
+}, "isIPv4TranslationOrTransitionPrefix");
+var isPrivateOrReservedIPv6 = /* @__PURE__ */ __name((raw) => {
+  const hextets = parseIPv6Hextets(raw);
+  if (!hextets) return true;
+  if (isIPv4TranslationOrTransitionPrefix(hextets)) return true;
+  const [first = 0, second = 0] = hextets;
+  const isEmbeddedIPv4Prefix = hextets.slice(0, 5).every((part) => part === 0);
+  if (isEmbeddedIPv4Prefix && (hextets[5] === 0 || hextets[5] === 65535)) {
+    const embedded = `${(hextets[6] ?? 0) >> 8}.${(hextets[6] ?? 0) & 255}.${(hextets[7] ?? 0) >> 8}.${(hextets[7] ?? 0) & 255}`;
+    if (isPrivateOrReservedIPv4(embedded)) return true;
+  }
+  if (hextets.every((part) => part === 0)) return true;
+  if (hextets.slice(0, 7).every((part) => part === 0) && hextets[7] === 1) return true;
+  if ((first & 65024) === 64512) return true;
+  if ((first & 65472) === 65152) return true;
+  if ((first & 65280) === 65280) return true;
+  if (first === 8193 && second === 3512) return true;
+  return false;
+}, "isPrivateOrReservedIPv6");
+var parsePinnedAddress = /* @__PURE__ */ __name((raw) => {
+  if (raw.includes(":")) {
+    const hextets = parseIPv6Hextets(raw);
+    if (!hextets) return void 0;
+    return { address: hextets.map((part) => part.toString(16)).join(":"), family: 6 };
+  }
+  const octets = parseIPv4Octets(raw);
+  if (!octets) return void 0;
+  return { address: octets.join("."), family: 4 };
+}, "parsePinnedAddress");
+var isNodeRuntime2 = typeof process !== "undefined" && !!process.versions?.node;
+var resolveHostnameWithNodeDns = /* @__PURE__ */ __name(async (hostname) => {
+  const specifier = "node:dns/promises";
+  const dns = await import(
+    /* @vite-ignore */
+    specifier
+  );
+  const answers = await dns.lookup(hostname, { all: true, verbatim: true });
+  return answers.map((answer) => answer.address);
+}, "resolveHostnameWithNodeDns");
+var validateRefreshUrl = /* @__PURE__ */ __name(async (rawUrl, options) => {
+  let url;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    return { result: unsafeEndpoint() };
+  }
+  if (url.username || url.password) return { result: unsafeEndpoint() };
+  const isHttps = url.protocol === "https:";
+  const isHttp = url.protocol === "http:";
+  if (!isHttps && !(isHttp && options.allowInsecureHttp)) return { result: unsafeEndpoint() };
+  const isIpv6Literal = url.hostname.startsWith("[");
+  const hostname = url.hostname.replace(/^\[|\]$/g, "");
+  if (!hostname) return { result: unsafeEndpoint() };
+  if (isIpv6Literal) {
+    if (!options.allowPrivateAddresses && isPrivateOrReservedIPv6(hostname)) {
+      return { result: unsafeEndpoint() };
+    }
+  } else if (/^\d{1,3}(?:\.\d{1,3}){3}$/.test(hostname)) {
+    if (!options.allowPrivateAddresses && isPrivateOrReservedIPv4(hostname)) {
+      return { result: unsafeEndpoint() };
+    }
+  } else if (options.resolveHost) {
+    let addresses;
+    try {
+      addresses = await options.resolveHost(hostname);
+    } catch {
+      return { result: failed("UNAVAILABLE", true) };
+    }
+    if (addresses.length === 0) return { result: failed("UNAVAILABLE", true) };
+    const parsedAddresses = addresses.map(parsePinnedAddress);
+    const pinnedAddress = parsedAddresses[0];
+    const hasUnsafeAnswer = parsedAddresses.some(
+      (address) => !address || (address.family === 6 ? isPrivateOrReservedIPv6(address.address) : isPrivateOrReservedIPv4(address.address))
+    );
+    if (!pinnedAddress || hasUnsafeAnswer && !options.allowPrivateAddresses) {
+      return { result: unsafeEndpoint() };
+    }
+    return { url, pinnedAddress };
+  }
+  return { url };
+}, "validateRefreshUrl");
+var discardGuardedResponse = /* @__PURE__ */ __name(async (guarded) => {
+  try {
+    await guarded.response.body?.cancel();
+  } catch {
+  } finally {
+    guarded.finish();
+  }
+}, "discardGuardedResponse");
+var fetchWithGuards = /* @__PURE__ */ __name(async (initialEndpoint, options, authorization) => {
+  if (typeof globalThis.fetch !== "function") {
+    return { result: failed("UNAVAILABLE", false) };
+  }
+  let current = initialEndpoint;
+  const initialOrigin = initialEndpoint.url.origin;
+  let redirectsRemaining = options.maxRedirects;
+  let auth = authorization;
+  const deadline = Date.now() + options.timeoutMs;
+  for (; ; ) {
+    const remainingMs = deadline - Date.now();
+    if (remainingMs <= 0) return { result: failed("TIMEOUT", true) };
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), remainingMs);
+    let response;
+    try {
+      const headers = { accept: ACCEPT_HEADER };
+      if (options.etag) headers["if-none-match"] = options.etag;
+      if (auth) headers.authorization = auth;
+      response = await fetchWithPinnedAddress(
+        current.url,
+        {
+          method: "GET",
+          redirect: "manual",
+          signal: controller.signal,
+          headers
+        },
+        current.pinnedAddress
+      );
+    } catch (error) {
+      clearTimeout(timer);
+      const timedOut = controller.signal.aborted || error?.name === "AbortError";
+      return { result: failed(timedOut ? "TIMEOUT" : "UNAVAILABLE", true) };
+    }
+    if (!REDIRECT_STATUSES.has(response.status)) {
+      return {
+        response,
+        endpoint: current,
+        signal: controller.signal,
+        finish: /* @__PURE__ */ __name(() => clearTimeout(timer), "finish")
+      };
+    }
+    clearTimeout(timer);
+    await response.body?.cancel().catch(() => void 0);
+    if (redirectsRemaining <= 0) return { result: failed("UNAVAILABLE", false) };
+    const location = response.headers.get("location");
+    if (!location) return { result: malformedResponse() };
+    let next;
+    try {
+      next = new URL(location, current.url);
+    } catch {
+      return { result: unsafeEndpoint() };
+    }
+    const validated = await validateRefreshUrl(next.href, options);
+    if ("result" in validated) return validated;
+    if (validated.url.origin !== initialOrigin) auth = void 0;
+    redirectsRemaining -= 1;
+    current = validated;
+  }
+}, "fetchWithGuards");
+var readBodyWithLimit = /* @__PURE__ */ __name(async (response, maxBytes, signal) => {
+  const declared = Number(response.headers.get("content-length"));
+  if (Number.isFinite(declared) && declared > maxBytes) {
+    return { result: malformedResponse(), reason: "malformed" };
+  }
+  if (!response.body) {
+    try {
+      const body = await response.text();
+      return new TextEncoder().encode(body).byteLength > maxBytes ? { result: malformedResponse(), reason: "malformed" } : { body };
+    } catch {
+      return signal.aborted ? { result: failed("TIMEOUT", true), reason: "timeout" } : { result: malformedResponse(), reason: "malformed" };
+    }
+  }
+  const reader = response.body.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      total += value?.byteLength ?? 0;
+      if (total > maxBytes) {
+        await reader.cancel().catch(() => void 0);
+        return { result: malformedResponse(), reason: "malformed" };
+      }
+      if (value) chunks.push(value);
+    }
+  } catch {
+    return signal.aborted ? { result: failed("TIMEOUT", true), reason: "timeout" } : { result: malformedResponse(), reason: "malformed" };
+  }
+  const merged = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    merged.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return { body: new TextDecoder().decode(merged) };
+}, "readBodyWithLimit");
+var isAcceptedMediaType = /* @__PURE__ */ __name((contentType) => {
+  if (!contentType) return false;
+  const mediaType = contentType.split(";", 1)[0]?.trim().toLowerCase() ?? "";
+  return ACCEPTED_MEDIA_TYPES.has(mediaType);
+}, "isAcceptedMediaType");
+var parseAuthParams = /* @__PURE__ */ __name((header) => {
+  const params = {};
+  const pattern = /([a-zA-Z][a-zA-Z0-9_-]*)\s*=\s*"([^"]*)"/g;
+  let match;
+  while (match = pattern.exec(header)) {
+    const key = match[1]?.toLowerCase();
+    if (key && match[2]) params[key] = match[2];
+  }
+  return params;
+}, "parseAuthParams");
+var parseDidAuthChallenge = /* @__PURE__ */ __name((response, bodyText, expectedDomain) => {
+  const header = response.headers.get("www-authenticate") ?? "";
+  const scheme = header.trim().split(/\s/, 1)[0]?.toLowerCase();
+  if (scheme !== DID_AUTH_SCHEME) return void 0;
+  const headerParams = parseAuthParams(header);
+  let challenge = headerParams.challenge;
+  let domain = headerParams.domain;
+  let expiresAt = Date.now() + HEADER_CHALLENGE_TTL_MS;
+  if (bodyText) {
+    let body;
+    try {
+      body = JSON.parse(bodyText);
+    } catch {
+      return void 0;
+    }
+    const parsed = CredentialRefreshChallengeValidator.safeParse(body);
+    if (!parsed.success) return void 0;
+    if (challenge && parsed.data.challenge !== challenge) return void 0;
+    if (domain && parsed.data.domain && parsed.data.domain !== domain) return void 0;
+    challenge = parsed.data.challenge;
+    domain = parsed.data.domain ?? domain;
+    expiresAt = Date.parse(parsed.data.expiresAt);
+    if (Number.isNaN(expiresAt) || expiresAt <= Date.now()) return void 0;
+  }
+  if (!challenge || domain && domain !== expectedDomain) return void 0;
+  return { challenge, domain: expectedDomain, expiresAt };
+}, "parseDidAuthChallenge");
+var asManagedVersion = /* @__PURE__ */ __name((value) => typeof value === "number" && Number.isInteger(value) && value > 0 ? value : void 0, "asManagedVersion");
+var decodeCandidate = /* @__PURE__ */ __name(async (learnCard, json, response) => {
+  const headerEtag = response.headers.get("etag") ?? void 0;
+  const decryptJwe = /* @__PURE__ */ __name(async (jwe) => {
+    const decrypt = learnCard.invoke.decryptDagJwe;
+    if (typeof decrypt !== "function") return { failure: failed("UNSUPPORTED_SERVICE", false) };
+    let decrypted;
+    try {
+      decrypted = await decrypt(jwe);
+    } catch {
+      return { failure: malformedResponse() };
+    }
+    const parsed = VCValidator.safeParse(decrypted);
+    if (!parsed.success) return { failure: malformedResponse() };
+    return { credential: parsed.data };
+  }, "decryptJwe");
+  const envelopeEtag = /* @__PURE__ */ __name((value) => typeof value === "string" ? value : headerEtag, "envelopeEtag");
+  if (json !== null && typeof json === "object" && "format" in json) {
+    const envelope = json;
+    if (envelope.format === "jwe") {
+      const jwe = JWEValidator.safeParse(envelope.jwe);
+      if (!jwe.success) return malformedResponse();
+      const decrypted = await decryptJwe(jwe.data);
+      if ("failure" in decrypted) return decrypted.failure;
+      return {
+        credential: decrypted.credential,
+        etag: envelopeEtag(envelope.etag),
+        managedVersion: asManagedVersion(envelope.version)
+      };
+    }
+    if (envelope.format === "vc") {
+      const parsed = VCValidator.safeParse(envelope.credential);
+      if (!parsed.success) return malformedResponse();
+      return {
+        credential: parsed.data,
+        etag: envelopeEtag(envelope.etag),
+        managedVersion: asManagedVersion(envelope.version)
+      };
+    }
+    return malformedResponse();
+  }
+  const bareVc = VCValidator.safeParse(json);
+  if (bareVc.success) return { credential: bareVc.data, etag: headerEtag };
+  const bareJwe = JWEValidator.safeParse(json);
+  if (bareJwe.success) {
+    const decrypted = await decryptJwe(bareJwe.data);
+    if ("failure" in decrypted) return decrypted.failure;
+    return { credential: decrypted.credential, etag: headerEtag };
+  }
+  return malformedResponse();
+}, "decodeCandidate");
+var getHolderIds = /* @__PURE__ */ __name((vc) => {
+  const subject = vc.credentialSubject;
+  const subjects = Array.isArray(subject) ? subject : [subject];
+  return subjects.map((entry) => typeof entry?.id === "string" ? entry.id : "").sort();
+}, "getHolderIds");
+var holdersEqual = /* @__PURE__ */ __name((first, second) => {
+  const firstIds = getHolderIds(first);
+  const secondIds = getHolderIds(second);
+  return firstIds.length === secondIds.length && firstIds.every((id, index) => id === secondIds[index]);
+}, "holdersEqual");
+var refreshCredential = /* @__PURE__ */ __name((_initLearnCard) => {
+  const usedChallenges = /* @__PURE__ */ new Map();
+  return async (_learnCard, credential, options = {}) => {
+    const resolved = {
+      etag: options.etag,
+      timeoutMs: options.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+      maxRedirects: options.maxRedirects ?? DEFAULT_MAX_REDIRECTS,
+      maxResponseBytes: options.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES,
+      allowInsecureHttp: options.allowInsecureHttp ?? false,
+      allowPrivateAddresses: options.allowPrivateAddresses ?? false,
+      resolveHost: options.resolveHost ?? (isNodeRuntime2 ? resolveHostnameWithNodeDns : void 0)
+    };
+    const service = getSupportedRefreshService(credential);
+    if (!service) return { status: "unsupported" };
+    try {
+      const check = await _learnCard.invoke.verifyCredential(credential);
+      if (!proofVerified(check)) return invalidProof();
+    } catch {
+      return invalidProof();
+    }
+    if (service.type === "LearnCardCredentialRefresh2026" && (typeof credential.id !== "string" || credential.id.length === 0)) {
+      return failed("ID_MISMATCH", false);
+    }
+    const validated = await validateRefreshUrl(service.id, resolved);
+    if ("result" in validated) return validated.result;
+    const initial = await fetchWithGuards(validated, resolved);
+    if ("result" in initial) return initial.result;
+    let guardedResponse = initial;
+    let response = guardedResponse.response;
+    if (response.status === 401 && service.type === "LearnCardCredentialRefresh2026") {
+      if (guardedResponse.endpoint.url.origin !== validated.url.origin) {
+        await discardGuardedResponse(guardedResponse);
+        return unauthorized();
+      }
+      const challengeRead = await readBodyWithLimit(
+        response,
+        resolved.maxResponseBytes,
+        guardedResponse.signal
+      );
+      guardedResponse.finish();
+      if ("result" in challengeRead) {
+        return challengeRead.reason === "timeout" ? challengeRead.result : unauthorized();
+      }
+      const expectedDomain = guardedResponse.endpoint.url.host;
+      const challenge = parseDidAuthChallenge(response, challengeRead.body, expectedDomain);
+      if (!challenge) return unauthorized();
+      const challengeKey = `${guardedResponse.endpoint.url.origin}|${challenge.challenge}`;
+      const now = Date.now();
+      for (const [key, expiresAt] of usedChallenges) {
+        if (expiresAt <= now) usedChallenges.delete(key);
+      }
+      if (usedChallenges.has(challengeKey)) return unauthorized();
+      if (usedChallenges.size >= MAX_TRACKED_CHALLENGES) return unauthorized();
+      usedChallenges.set(challengeKey, challenge.expiresAt);
+      let vp;
+      try {
+        vp = await _learnCard.invoke.getDidAuthVp({
+          proofFormat: "jwt",
+          challenge: challenge.challenge,
+          domain: expectedDomain
+        });
+      } catch {
+        return unauthorized();
+      }
+      const retry = await fetchWithGuards(
+        guardedResponse.endpoint,
+        resolved,
+        `Bearer ${typeof vp === "string" ? vp : JSON.stringify(vp)}`
+      );
+      if ("result" in retry) return retry.result;
+      guardedResponse = retry;
+      response = guardedResponse.response;
+    }
+    if (response.status === 304) {
+      await discardGuardedResponse(guardedResponse);
+      return {
+        status: "unchanged",
+        checkedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        etag: response.headers.get("etag") ?? resolved.etag
+      };
+    }
+    if (response.status === 410) {
+      await discardGuardedResponse(guardedResponse);
+      return failed("REVOKED", false);
+    }
+    if (response.status === 401 || response.status === 403) {
+      await discardGuardedResponse(guardedResponse);
+      return unauthorized();
+    }
+    if (response.status < 200 || response.status > 299) {
+      await discardGuardedResponse(guardedResponse);
+      return failed("UNAVAILABLE", response.status >= 500);
+    }
+    if (!isAcceptedMediaType(response.headers.get("content-type"))) {
+      await discardGuardedResponse(guardedResponse);
+      return malformedResponse();
+    }
+    const bodyRead = await readBodyWithLimit(
+      response,
+      resolved.maxResponseBytes,
+      guardedResponse.signal
+    );
+    guardedResponse.finish();
+    if ("result" in bodyRead) return bodyRead.result;
+    let json;
+    try {
+      json = JSON.parse(bodyRead.body);
+    } catch {
+      return malformedResponse();
+    }
+    if (service.type === "1EdTechCredentialRefresh" && !VCValidator.safeParse(json).success) {
+      return malformedResponse();
+    }
+    const decoded = await decodeCandidate(_learnCard, json, response);
+    if ("status" in decoded) return decoded;
+    const candidate = decoded.credential;
+    try {
+      const check = await _learnCard.invoke.verifyCredential(candidate);
+      if (!proofVerified(check)) return invalidProof();
+    } catch {
+      return invalidProof();
+    }
+    if (candidate.id !== credential.id) {
+      return failed("ID_MISMATCH", false);
+    }
+    if (getCredentialIssuerId(candidate) !== getCredentialIssuerId(credential)) {
+      return failed("ISSUER_MISMATCH", false);
+    }
+    if (!holdersEqual(credential, candidate)) return failed("ID_MISMATCH", false);
+    const currentTime = getCredentialEffectiveTime(credential);
+    const candidateTime = getCredentialEffectiveTime(candidate);
+    if (currentTime !== void 0 && candidateTime !== void 0 && candidateTime < currentTime) {
+      return failed("ROLLBACK", false);
+    }
+    if (credentialContentsEqual(credential, candidate)) {
+      return { status: "unchanged", checkedAt: (/* @__PURE__ */ new Date()).toISOString(), etag: decoded.etag };
+    }
+    return {
+      status: "updated",
+      credential: candidate,
+      ...decoded.etag ? { etag: decoded.etag } : {},
+      ...decoded.managedVersion ? { managedVersion: decoded.managedVersion } : {}
+    };
+  };
+}, "refreshCredential");
+
 // src/vc.ts
 var getVCPlugin = /* @__PURE__ */ __name((learnCard) => {
   return {
@@ -524,6 +1156,7 @@ var getVCPlugin = /* @__PURE__ */ __name((learnCard) => {
       verifyCredential: verifyCredential(learnCard),
       issuePresentation: issuePresentation(learnCard),
       verifyPresentation: verifyPresentation(learnCard),
+      refreshCredential: refreshCredential(learnCard),
       getTestVc: /* @__PURE__ */ __name((_learnCard, subject = "did:example:d23dd687a7dc6787646f2eb98d0") => {
         const did = _learnCard.id.did();
         return {
@@ -561,6 +1194,7 @@ var getVCPlugin = /* @__PURE__ */ __name((learnCard) => {
   };
 }, "getVCPlugin");
 export {
-  getVCPlugin
+  getVCPlugin,
+  refreshCredential
 };
 //# sourceMappingURL=vc-plugin.esm.js.map