@learncard/lca-api-service 1.5.3 → 1.6.0

package/dist/routes/ai.skill-icons.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/routes/keys.d.ts

@@ -153,6 +153,7 @@ export declare const keysRouter: import("@trpc/server").TRPCBuiltRouter<{
                 attemptsRemaining: number;
                 salt?: string | undefined;
             };
+            priorEscrowEnrollment: boolean;
             sssActivationState: "active" | "provisional";
             escrowStale?: "mode-mismatch" | "key-rotated" | undefined;
         } | null;

package/dist/routes/notifications.d.ts

@@ -99,6 +99,7 @@ export declare const notificationsRouter: import("@trpc/server").TRPCBuiltRouter
                 email?: string | undefined;
                 image?: string | undefined;
                 heroImage?: string | undefined;
+                linkedInOrganizationId?: string | undefined;
                 websiteLink?: string | undefined;
                 isServiceProfile?: boolean | undefined;
                 type?: string | undefined;
@@ -138,6 +139,7 @@ export declare const notificationsRouter: import("@trpc/server").TRPCBuiltRouter
                 email?: string | undefined;
                 image?: string | undefined;
                 heroImage?: string | undefined;
+                linkedInOrganizationId?: string | undefined;
                 websiteLink?: string | undefined;
                 isServiceProfile?: boolean | undefined;
                 type?: string | undefined;
@@ -174,7 +176,7 @@ export declare const notificationsRouter: import("@trpc/server").TRPCBuiltRouter
                 vpUris?: string[] | undefined;
                 transaction?: {
                     id: string;
-                    action: "write" | "consent" | "update" | "sync" | "withdraw";
+                    action: "write" | "update" | "consent" | "sync" | "withdraw";
                     date: string;
                     expiresAt?: string | undefined;
                     oneTime?: boolean | undefined;

package/dist/types/notifications.d.ts

@@ -126,6 +126,7 @@ export declare const PaginatedNotificationsValidator: z.ZodObject<{
             email: z.ZodOptional<z.ZodOptional<z.ZodString>>;
             image: z.ZodOptional<z.ZodOptional<z.ZodString>>;
             heroImage: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+            linkedInOrganizationId: z.ZodOptional<z.ZodOptional<z.ZodString>>;
             websiteLink: z.ZodOptional<z.ZodOptional<z.ZodString>>;
             isServiceProfile: z.ZodOptional<z.ZodOptional<z.ZodDefault<z.ZodBoolean>>>;
             type: z.ZodOptional<z.ZodOptional<z.ZodString>>;
@@ -172,6 +173,7 @@ export declare const PaginatedNotificationsValidator: z.ZodObject<{
             email: z.ZodOptional<z.ZodOptional<z.ZodString>>;
             image: z.ZodOptional<z.ZodOptional<z.ZodString>>;
             heroImage: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+            linkedInOrganizationId: z.ZodOptional<z.ZodOptional<z.ZodString>>;
             websiteLink: z.ZodOptional<z.ZodOptional<z.ZodString>>;
             isServiceProfile: z.ZodOptional<z.ZodOptional<z.ZodDefault<z.ZodBoolean>>>;
             type: z.ZodOptional<z.ZodOptional<z.ZodString>>;
@@ -244,9 +246,9 @@ export declare const PaginatedNotificationsValidator: z.ZodObject<{
                 }, z.core.$strip>>;
                 id: z.ZodString;
                 action: z.ZodEnum<{
+                    update: "update";
                     write: "write";
                     consent: "consent";
-                    update: "update";
                     sync: "sync";
                     withdraw: "withdraw";
                 }>;

package/docs/bedrock-generation.md

@@ -0,0 +1,119 @@
+# Bedrock text generation (LC-2271)
+
+The three LCA text generation routes use the OpenAI SDK Responses API at
+`https://bedrock-runtime.us-east-1.amazonaws.com/openai/v1`. This follows the merged
+[AI Passport implementation](https://github.com/WeLibraryOS/AI-Passport/pull/92),
+inspected at main `300c0af3125a4f1b1785820a2d33866723a88f30`.
+
+| Route                 | Exact Runtime model profile | Effort   | Reason                                                                                 |
+| --------------------- | --------------------------- | -------- | -------------------------------------------------------------------------------------- |
+| `generateBoostInfo`   | `us.openai.gpt-6.1-sol`     | `medium` | Interpret arbitrary descriptions and generate coherent credential copy across locales. |
+| `generateBoostSkills` | `us.openai.gpt-6.1-sol`     | `medium` | Infer appropriate skills and subskills within the existing hierarchy.                  |
+| `generateSkillIcons`  | `us.openai.gpt-6-luna`      | `none`   | Straightforward semantic mapping of supplied names to emoji.                           |
+
+AWS's current [Sol model card](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-6-1-sol.html),
+[Luna model card](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-6-luna.html)
+and [Responses compatibility guide](https://docs.aws.amazon.com/bedrock/latest/userguide/inference-responses-api.html)
+confirm these Runtime profiles and API support. The 8,192-token request ceiling is below
+both documented model output limits. Although the current cards advertise native JSON
+Schema output, this migration retains AI Passport's required-function pattern and
+local validation to preserve existing optional-category semantics.
+
+`generateImage` defaults to Bedrock Stable Image Core (`stability.stable-image-core-v1:1`)
+in us-west-2, signed with SigV4 from the execution role, and still stores the result
+through Filestack. DALL-E 3 (`OPENAI_API_KEY`) is only an explicit `IMAGE_PROVIDER=openai`
+fallback; see `image-generation.md`. Embeddings and Nova are outside this migration.
+
+## Runtime contract
+
+- The official `@aws/bedrock-token-generator` resolves short-term bearer tokens from
+  the normal AWS SDK credential chain in `us-east-1`. On Lambda this means the execution
+  role and its rotating credentials. The SDK requests a token for every operation;
+  no process-lifetime static bearer is stored by LCA. AI Passport's Fly web-identity
+  override is specific to Fly and is not needed for this Lambda service.
+- `BEDROCK_BASE_URL` is optional; only the exact default URL above, with an optional
+  trailing slash, is accepted. No arbitrary endpoint, model alias or family override.
+  The option is scoped to API functions and can also come from `RUNTIME_SECRETS_ID`.
+- OpenAI SDK version is pinned to `6.47.0`, matching the inspected implementation.
+  No ambient OpenAI organization/project headers; SDK logging is off; redirects fail.
+- These routes remain non-streaming. Requests use `store:false`, required function
+  selection, `parallel_tool_calls:false`, and a non-strict projected JSON schema.
+  The original Zod validators enforce enums, optional categories, unions and string
+  bounds after JSON parsing. Native strict structured-output support is not assumed.
+- Requests have an 8,192 output-token ceiling (including reasoning) and a 25-second
+  SDK timeout (below the existing 29-second Lambda timeout). Failed/incomplete lifecycle, refusal, missing/wrong/duplicate tool,
+  malformed JSON and invalid output fail closed. Token-limit exhaustion is an error,
+  never a partial success. Input and output sizing still require staging acceptance.
+- No automatic retry, provider fallback, or model downgrade. HTTP 429 maps to
+  `TOO_MANY_REQUESTS`, 503/504 to `SERVICE_UNAVAILABLE`, and other failures to a
+  sanitized `INTERNAL_SERVER_ERROR`. Provider bodies, validation values and credential
+  causes are not retained in those errors. Quota failures are not automatically retried.
+- Icons still fill omitted requested names with `⭐` after a valid response and discard
+  unsolicited names. Provider failures now propagate instead of being logged raw and
+  subsequently crashing on an undefined completion. Learner DIDs are no longer sent
+  in text-generation provider metadata. Existing authenticated route access remains.
+
+## Deployment and coordination gates
+
+Before rollout, obtain approved staging tests for all three real schemas, locales,
+typical and maximum input sizes, token ceilings, timeout behavior and error handling.
+Offline tests do not establish provider acceptance, entitlement, latency or generation
+quality. Live model calls require separate approval.
+
+Responses does not support attaching native Bedrock Guardrails; if the approved data-handling
+policy requires filtering, a separately approved pre-invocation path is a rollout gate.
+
+The deployed Lambda role must have approved Bedrock/default-project access for both
+exact cross-region US profiles and access to the Runtime endpoint. Confirm rotating
+credential/token operation and the applicable retention, DPA, subprocessor, guardrail
+and invocation-logging posture before learner traffic. The reviewed dev policy is managed by
+Serverless/CloudFormation and is created with the stack on a `dev`/`us-east-1` deploy, so no
+manual IAM edits are needed. This PR does not port AI Passport's
+application-specific privacy gateway into LCA. US profiles can route across US regions;
+the endpoint is not a single-region processing guarantee.
+
+[LearnCard PR1670](https://github.com/learningeconomy/LearnCard/pull/1670) merged on
+2026-10-09 at `7656a57d30c6d80b8a25a8bb14bcd3b08b3648c2`. This branch is synced with
+main and preserves its `@learncard/service-config` bootstrap, `CONFIG_TENANT`,
+tenant/stage selection and runtime-bundle precedence. The optional endpoint is
+forwarded by the current API function-environment helper in both bundle and fallback
+modes; OIDC and provider environments do not receive it. There is no new bearer-token
+secret to provision. Configuration tests use the current deployment contract rather
+than restoring the superseded function-environment test.
+
+Rollback uses the prior application revision with its prior OpenAI credential, after
+explicit deployment approval. There is no runtime silent fallback to the old models.
+
+## Node 24 and owner-triggered staging deployment
+
+All LCA Lambda functions and the native DIDKit layer declare `nodejs24.x`; esbuild
+targets Node 24. The native addon uses stable N-API v4, supported by Node 24.
+Both Node 20 and Node 24 Lambda use AL2023. Before deployment, the LCA-only
+`verify-node24-layer.cjs` preflight requires the Linux x64 GNU artifact, both
+packaged runtime dependencies, libc symbols no newer than glibc 2.34, and an actual
+Node 24 native key-to-DID smoke check. Missing/incompatible artifacts stop the action
+before Serverless deployment; WASM fallback is not evidence of native compatibility.
+
+LCA pins serverless-esbuild 1.57.2 for Node 24 target support. The service-local
+`node24-runtime.cjs` plugin adds Node 24 to Serverless 3.40's older runtime schema
+without disabling validation or changing other services. Deployment tools run on
+Node 24.12.0 in the LCA action. Local offline configuration uses Node 24 too.
+
+The `LcaDevBedrockGenerationPolicy` CloudFormation resource attaches the scoped
+policy to `SigningAuthorityExecutionRole` only for stage `dev` in `us-east-1`.
+It preserves existing grants and also covers seedMigration, which shares that role.
+Production receives no new Bedrock grant from this resource. ARNs use the deployment
+account and partition; source profiles/default project stay in us-east-1, and the
+verified backing models are scoped to us-east-1/us-east-2/us-west-2. Short-term bearer
+use, matching model/profile conditions and default-project authorization are explicit.
+The same policy also carries `StableImageCoreUsWest2` (InvokeModel on the us-west-2
+Stable Image Core model only) for image generation; see `image-generation.md`.
+
+Owner workflow: select this branch in Deploy, target environment `staging`, and
+enable only `deploy-lca-api`. The LearnCard staging leg selects GitHub environment
+`learn-card-app-api-staging`; SERVERLESS_STAGE and SERVERLESS_REGION come from its
+variables and must be `dev`/`us-east-1` for this policy. The action downloads/builds
+the native artifact, runs the preflight, and Serverless owns role-policy and runtime
+updates. Do not trigger it until the owner approves deployment. After the stack
+finishes, repeat role simulations and runtime checks before separately approved
+synthetic model calls. CI and native preflight do not prove live model acceptance.

package/docs/image-generation.md

@@ -0,0 +1,120 @@
+# Configurable image generation
+
+`ai.generateImage({ prompt })` still requires a nonempty prompt and returns `{ url }`.
+The LCA SDK still returns the URL string. Text generation is unchanged.
+Amazon Bedrock Stable Image Core (`stability.stable-image-core-v1:1`, us-west-2) is
+the default provider, so with LC-2271 every LCA model call goes through Bedrock.
+Output intentionally differs from DALL-E (different model and style); the contract
+is unchanged: one square PNG, uploaded through Filestack, returned as `{ url }`.
+DALL-E 3 (one 1024 × 1024 image, URL stored through Filestack) remains available
+only as an explicit fallback with `IMAGE_PROVIDER=openai`.
+
+## Configuration
+
+Use the existing service-config layering: schema defaults → base/stage JSON →
+runtime secrets bundle → explicit nonempty environment. No new secrets loader is added.
+
+| Setting                | Default                          | Allowed values                   |
+| ---------------------- | -------------------------------- | -------------------------------- |
+| IMAGE_PROVIDER         | bedrock                          | bedrock, openai                  |
+| BEDROCK_IMAGE_REGION   | us-west-2                        | us-west-2                        |
+| BEDROCK_IMAGE_MODEL_ID | stability.stable-image-core-v1:1 | stability.stable-image-core-v1:1 |
+| IMAGE_TIMEOUT_MS       | 25000                            | integer 1000–25000               |
+
+Only the verified candidate and region are accepted for now. Additional models
+require their own request/response validation. Do not choose Nova Canvas (retired
+September 30, 2026). Lambda deployers can set these nonsecret values in existing stage JSON (rebuild
+and deploy) or explicit Lambda environment; Docker/local may use environment.
+The deadline is capped at 25 seconds, matching text generation, so the request
+finishes inside the 29-second Lambda timeout (and the API Gateway HTTP API's 30-second
+integration limit) rather than being killed mid-upload. Recycle functions after
+configuration changes.
+
+`OPENAI_API_KEY` is now only needed for the DALL-E fallback (`IMAGE_PROVIDER=openai`).
+Text routes use Bedrock since LC-2271 (#1684) and the default image provider uses
+Bedrock, so with the defaults no LCA model call needs an OpenAI key. To fall back
+(e.g. rollback), set `IMAGE_PROVIDER=openai` in the stage JSON or runtime-secrets
+bundle and make sure `OPENAI_API_KEY` is available, then recycle the functions.
+There is no automatic fallback between providers.
+
+## Access and approval prerequisites
+
+Because Bedrock is the default, every stage that deploys this code needs the
+following before `generateImage` will work (otherwise it returns the sanitized
+INTERNAL_SERVER_ERROR). No live calls, Marketplace subscriptions/terms acceptance,
+deployment, or merge were performed for this PR. An authorized operator must
+verify model availability and entitlement in **us-west-2** and approve any required
+Marketplace subscription/terms. Runtime access is model-scoped:
+
+- Action: `bedrock:InvokeModel` (no streaming action, no wildcard)
+- Resource: `arn:aws:bedrock:us-west-2::foundation-model/stability.stable-image-core-v1:1`
+
+Use the workload's normal AWS credential chain and existing execution role. The
+client pins SigV4 (`authSchemePreference: ['sigv4']`), so the rotating execution-role
+credentials are used and a long-term `AWS_BEARER_TOKEN_BEDROCK` API key is never
+picked up, consistent with the text adapter's short-term-bearer-only policy.
+`generateImage` runs in the `trpc`/`api` functions, which use
+`SigningAuthorityExecutionRole`.
+
+**Dev/staging (stage `dev`, us-east-1): managed in `serverless.yml`.** The grant is
+the `StableImageCoreUsWest2` statement in #1684's `LcaDevBedrockGenerationPolicy`,
+under the same `LcaDevBedrockGeneration` condition (stage `dev` in us-east-1), so
+Serverless/CloudFormation applies it with the stack and removes it on rollback. Do
+not add it by hand in the console. `.github/tests/test-lca-node24.test.cjs` pins the
+exact statement and rejects streaming actions and wildcard resources.
+
+**Production still needs a grant.** The condition excludes every other stage,
+so production (and ScoutPass stages) get no Bedrock access from this policy. Before
+deploying this default to production, add a reviewed production grant for the same
+single action/resource (alongside the production text-generation grant), or set
+`IMAGE_PROVIDER=openai` for that stage as a stopgap.
+
+Regional network connectivity (NAT egress from the VPC Lambdas to
+`bedrock-runtime.us-west-2.amazonaws.com`) and existing Filestack storage access
+must also be verified by the operator.
+
+## Behavior and evaluation
+
+The Bedrock adapter sends one InvokeModel request with `aspect_ratio: "1:1"`
+and `output_format: "png"`. It accepts exactly one successful image, validates
+base64, PNG header and square dimensions (640–1536), bounds decoded bytes to
+10 MiB, response bytes to 14 MiB and PNG decompression to 20 MiB, then uploads bytes through existing Filestack.
+Filtering (a `Filter reason:` finish reason, or a content-filter ValidationException) returns a
+sanitized BAD_REQUEST. Provider failures are classified by AWS error name as well as HTTP status:
+throttling and quota rejections (`ThrottlingException`, `ModelNotReadyException`, HTTP 429, and
+`ServiceQuotaExceededException`, which Bedrock returns as HTTP **400**) map to TOO_MANY_REQUESTS;
+`ServiceUnavailableException`/`InternalServerException`, HTTP 500/503, model timeouts (408/504)
+and our own deadline map to SERVICE_UNAVAILABLE. Access, validation, payload and storage failures
+return a generic INTERNAL_SERVER_ERROR. Client messages never include provider text.
+
+Throttling/quota and unavailable rejections (not billed) get at most two extra attempts with full
+jitter (≤ 500 ms, then ≤ 1 s), and only while at least 12 s of the deadline remains. Timeouts,
+access, validation and filter errors are never retried, and DALL-E is never retried.
+
+Every failure logs one `image_generation_failure` record (`console.error`, so CloudWatch) with
+allowlisted fields only: provider, modelId, region, stage (invoke/decode/storage/timeout/config),
+attempts, category, errorName, errorCode, httpStatus, awsRequestId, sdkRetryable, retryable,
+durationMs, promptLength, promptHash (first 12 hex of SHA-256), finishReason, decodeReason and
+the clientCode returned. Retries log `image_generation_retry`; success logs
+`image_generation_success` with attempts and duration. Prompts, provider messages, headers,
+credentials, URLs and image bytes are never logged or returned. A deadline bounds the request and
+aborts model work; storage already in flight may finish after the deadline. No automatic provider
+fallback is present. A manual retry after timeout may still incur another charge.
+
+Output differing from DALL-E is accepted. Before learner traffic, still smoke-test
+a small fixed prompt set on staging for badge/icon readability, filter behavior,
+latency, failure rate and actual storage/display behavior. Verify current
+[Bedrock pricing](https://aws.amazon.com/bedrock/pricing/) in the target region
+and model before any calls; record invocation count and total cost, including
+failed or timed-out requests.
+
+Request/response fields were checked against the
+[AWS Stable Image Core documentation](https://docs.aws.amazon.com/bedrock/latest/userguide/model-parameters-diffusion-stable-image-core-text-image-request-response.html).
+
+## Integration with text LLM PR #1684
+
+This branch now contains #1684 (merged in, base `feat/lca-bedrock-lc2205`): Node 24
+runtime, OpenAI SDK 6.47.0 and the Bedrock text adapter. Text routes use
+`generateStructuredOutput`; the image route uses `generateStoredImage`. Neither
+provider selection controls the other: `BEDROCK_BASE_URL` configures text only and
+`IMAGE_PROVIDER`/`BEDROCK_IMAGE_*` configure images only.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@learncard/lca-api-service",
-    "version": "1.5.3",
+    "version": "1.6.0",
     "description": "",
     "engines": {
         "node": ">=24.12 <25"
@@ -28,10 +28,11 @@
         "start-p-5000": "PORT=5000 serverless offline --httpPort 5000 --websocketPort 5001 --lambdaPort 5002 --albPort 5003 --config serverless-local.yml",
         "dev": "bun --conditions=development --watch src/docker-entry.ts",
         "start:docker": "bun --conditions=development src/docker-entry.ts",
-        "serverless-deploy": "node scripts/check-seed-encryption-infrastructure.mjs && node ../../../scripts/prepare-didkit-native-layer.cjs && serverless deploy",
+        "serverless-deploy": "node scripts/check-seed-encryption-infrastructure.mjs && node ../../../scripts/prepare-didkit-native-layer.cjs && node scripts/verify-node24-layer.cjs && serverless deploy",
         "serverless-deploy-scouts": "serverless deploy --config serverless-scouts.yml",
         "test:oidc:e2e": "node test/oidc-e2e/run.mjs",
-        "typecheck:oidc:e2e": "tsc --noEmit -p test/oidc-e2e/tsconfig.json"
+        "typecheck:oidc:e2e": "tsc --noEmit -p test/oidc-e2e/tsconfig.json",
+        "typecheck:bedrock": "tsc --noEmit -p tsconfig.bedrock.json"
     },
     "keywords": [],
     "author": "WeLibrary, LLC (www.welibrary.io)",
@@ -49,29 +50,31 @@
         "serverless": "3.40.0",
         "serverless-certificate-creator": "^1.6.0",
         "serverless-domain-manager": "^6.4.4",
-        "serverless-esbuild": "1.55.0",
+        "serverless-esbuild": "1.57.2",
         "serverless-http": "3.2.0",
         "serverless-offline": "^14.4.0",
         "serverless-prune-plugin": "^2.1.0",
         "shx": "^0.3.4",
-        "@playwright/test": "^1.42.0"
+        "@playwright/test": "^1.42.0",
+        "@types/pngjs": "^6.0.5"
     },
     "dependencies": {
+        "@aws-sdk/client-bedrock-runtime": "^3.1139.0",
         "@aws-sdk/client-kms": "^3.1139.0",
         "@aws-sdk/client-secrets-manager": "^3.1139.0",
         "@fastify/cors": "^11.2.0",
         "@fastify/formbody": "^8.0.2",
         "@fastify/rate-limit": "^10.2.0",
         "@fastify/static": "^10.1.1",
-        "@learncard/core": "9.4.40",
-        "@learncard/did-web-plugin": "1.1.40",
-        "@learncard/didkit-plugin": "1.10.5",
-        "@learncard/didkit-plugin-node": "0.3.5",
+        "@learncard/core": "9.4.41",
+        "@learncard/did-web-plugin": "1.1.41",
+        "@learncard/didkit-plugin": "1.10.6",
+        "@learncard/didkit-plugin-node": "0.3.6",
         "@learncard/email-templates": "1.2.1",
-        "@learncard/helpers": "1.7.0",
-        "@learncard/init": "2.5.5",
-        "@learncard/types": "5.23.2",
-        "@learncard/sss-key-manager": "0.2.3",
+        "@learncard/helpers": "1.7.1",
+        "@learncard/init": "2.5.6",
+        "@learncard/types": "5.24.0",
+        "@learncard/sss-key-manager": "0.2.4",
         "@sentry/serverless": "^7.61.0",
         "@trpc/server": "11.8.0",
         "@types/jsonwebtoken": "^9.0.8",
@@ -95,11 +98,13 @@
         "mongodb": "^6.2.0",
         "multiformats": "^11.0.1",
         "node-forge": "^1.4.0",
-        "openai": "^4.55.7",
+        "openai": "6.47.0",
         "postmark": "^4.0.5",
         "trpc-to-openapi": "^3.1.0",
         "uuid": "^14.0.0",
-        "zod": "4.4.3"
+        "zod": "4.6.6",
+        "pngjs": "^7.0.0",
+        "@aws/bedrock-token-generator": "1.1.0"
     },
     "repository": {
         "type": "git",

package/scripts/node24-runtime.cjs

@@ -0,0 +1,9 @@
+/* global module */
+// Serverless 3.40 predates Node 24. Extend only LCA's runtime enum, keeping
+// all other configuration validation enabled. AWS supports nodejs24.x.
+module.exports = class Node24Runtime {
+    constructor(serverless) {
+        const runtimes = serverless.configSchemaHandler.schema.definitions.awsLambdaRuntime.enum;
+        if (!runtimes.includes('nodejs24.x')) runtimes.push('nodejs24.x');
+    }
+};

package/scripts/verify-node24-layer.cjs

@@ -0,0 +1,49 @@
+/* global require, module, process, Buffer, console */
+/* eslint-disable @typescript-eslint/no-require-imports -- Node CommonJS deployment script. */
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+
+const verifyLayer = (layerRoot, nodeMajor = Number(process.versions.node.split('.')[0])) => {
+    assert.equal(nodeMajor, 24, 'LCA deployment must run with Node 24');
+    assert.equal(process.platform, 'linux', 'LCA native layer requires Linux');
+    assert.equal(process.arch, 'x64', 'LCA native layer requires x86_64');
+    const modules = path.join(layerRoot, 'nodejs/node_modules/@learncard');
+    const native = path.join(modules, 'didkit-plugin-node');
+    const binary = path.join(native, 'index.linux-x64-gnu.node');
+    assert.ok(fs.existsSync(binary), 'Missing Lambda Linux x64 GNU DIDKit addon');
+    const binaryNames = fs.readdirSync(native).filter(name => name.endsWith('.node'));
+    assert.deepEqual(
+        binaryNames,
+        ['index.linux-x64-gnu.node'],
+        'Layer must contain only the Lambda addon'
+    );
+    for (const pkg of ['didkit-plugin-node', 'didkit-plugin']) {
+        const directory = path.join(modules, pkg);
+        const manifest = JSON.parse(fs.readFileSync(path.join(directory, 'package.json'), 'utf8'));
+        assert.ok(
+            fs.existsSync(path.resolve(directory, manifest.main)),
+            `Missing ${pkg} runtime entry`
+        );
+    }
+    // Node 24 Lambda uses AL2023/glibc 2.34. Reject Ubuntu-built artifacts
+    // requiring newer libc symbols before Serverless can change the stack.
+    const versions = execFileSync('readelf', ['--version-info', binary], { encoding: 'utf8' });
+    for (const match of versions.matchAll(/GLIBC_(\d+)\.(\d+)/g)) {
+        assert.ok(
+            Number(match[1]) < 2 || (Number(match[1]) === 2 && Number(match[2]) <= 34),
+            `Addon requires ${match[0]}, newer than Lambda AL2023`
+        );
+    }
+    // Exercise stable N-API with a deterministic synthetic key; never log key material.
+    const addon = require(binary);
+    const key = addon.generateEd25519KeyFromBytes(Buffer.alloc(32, 1));
+    assert.match(addon.keyToDid('key', key), /^did:key:/);
+};
+
+module.exports = { verifyLayer };
+if (require.main === module) {
+    verifyLayer(path.resolve('didkit-native-layer'));
+    console.log('LCA Node 24 native layer ABI, libc and package checks passed');
+}

package/serverless-local.yml

@@ -7,6 +7,7 @@ frameworkVersion: '3'
 useDotenv: true
 
 plugins:
+    - ./scripts/node24-runtime.cjs
     - serverless-esbuild
     - serverless-offline
 
@@ -19,6 +20,7 @@ custom:
         packager: pnpm
         plugins: esbuildPlugins.cjs
         external: ['snappy', '@learncard/didkit-plugin/dist/didkit_wasm_bg.wasm']
+        target: node24
         sourcemap: external
         watch:
             pattern: ['src/**/*.ts', 'dids.ts']
@@ -30,7 +32,7 @@ package:
 
 provider:
     name: aws
-    runtime: nodejs20.x
+    runtime: nodejs24.x
     memorySize: 2048
     timeout: 29
     stage: ${opt:stage, "dev"}

package/serverless.function-env.cjs

@@ -24,10 +24,8 @@ const API_SECRETS = [
     'KEYCLOAK_JWKS_URL_OVERRIDES',
 ];
 
-// Non-secret operator toggles forwarded in bundle mode too, so enabling RUNTIME_SECRETS_ID
-// can never silently change them: escrow stays off unless ESCROW_ENCLAVE_MODE is set, and
-// ESCROW_RELEASE_KILL_SWITCH must be flippable without editing the bundle.
-const API_TOGGLES = ['ESCROW_ENCLAVE_MODE', 'ESCROW_RELEASE_KILL_SWITCH'];
+// Non-secret operator toggles are forwarded in both bundle and fallback modes.
+const API_TOGGLES = ['ESCROW_ENCLAVE_MODE', 'ESCROW_RELEASE_KILL_SWITCH', 'BEDROCK_BASE_URL'];
 
 // Serverless v3 supplies CLI options to file functions and preserves CF intrinsics.
 // No stage-file values are forwarded from the deployment environment.

package/serverless.yml

@@ -7,6 +7,7 @@ frameworkVersion: '3'
 useDotenv: true
 
 plugins:
+    - ./scripts/node24-runtime.cjs
     - serverless-esbuild
     - serverless-domain-manager
     - serverless-certificate-creator
@@ -47,7 +48,7 @@ custom:
         # serverless-esbuild default and must be preserved when overriding.
         exclude: ['aws-sdk', '@learncard/didkit-plugin-node']
         sourcemap: external
-        target: 'node20'
+        target: 'node24'
         watch:
             pattern: ['src/**/*.ts', 'dids.ts']
 
@@ -117,13 +118,13 @@ layers:
         name: ${self:service}-${opt:stage, 'dev'}-didkit-native
         description: Native DIDKit napi addon and runtime DIDKit dependency
         compatibleRuntimes:
-            - nodejs20.x
+            - nodejs24.x
         compatibleArchitectures:
             - x86_64
 
 provider:
     name: aws
-    runtime: nodejs20.x
+    runtime: nodejs24.x
     # Attach the native DIDKit layer to every function in this service.
     layers:
         - { Ref: DidkitNativeLambdaLayer }
@@ -272,6 +273,14 @@ resources:
     # ESCROW_ENCLAVE_ENDPOINT_SERVICE_NAME (the enclave account's endpoint
     # service). TLS trust for the hostname is pinned in enclaveTrustAnchors.ts.
     Conditions:
+        LcaDevBedrockGeneration:
+            Fn::And:
+                - Fn::Equals:
+                      - ${sls:stage}
+                      - dev
+                - Fn::Equals:
+                      - Ref: AWS::Region
+                      - us-east-1
         EscrowEnclavePrivateLink:
             Fn::Not:
                 - Fn::Equals: ['${env:ESCROW_ENCLAVE_ENDPOINT_SERVICE_NAME, ""}', '']
@@ -283,6 +292,70 @@ resources:
             Value:
                 Ref: SeedMigrationLambdaFunction
     Resources:
+        LcaDevBedrockGenerationPolicy:
+            Type: AWS::IAM::Policy
+            Condition: LcaDevBedrockGeneration
+            Properties:
+                PolicyName: lca-api-dev-bedrock-generation
+                Roles:
+                    - Ref: SigningAuthorityExecutionRole
+                PolicyDocument:
+                    Version: '2012-10-17'
+                    Statement:
+                        - Sid: ShortTermBearerOnly
+                          Effect: Allow
+                          Action: bedrock:CallWithBearerToken
+                          Resource: '*'
+                          Condition:
+                              StringEquals:
+                                  bedrock:bearerTokenType: SHORT_TERM
+                        - Sid: ApprovedProfiles
+                          Effect: Allow
+                          Action:
+                              - bedrock:GetInferenceProfile
+                              - bedrock:InvokeModel
+                          Resource:
+                              - Fn::Sub: arn:${AWS::Partition}:bedrock:us-east-1:${AWS::AccountId}:inference-profile/us.openai.gpt-6.1-sol
+                              - Fn::Sub: arn:${AWS::Partition}:bedrock:us-east-1:${AWS::AccountId}:inference-profile/us.openai.gpt-6-luna
+                        - Sid: DefaultProjectForApprovedProfiles
+                          Effect: Allow
+                          Action: bedrock:InvokeModel
+                          Resource:
+                              Fn::Sub: arn:${AWS::Partition}:bedrock:us-east-1:${AWS::AccountId}:project/default
+                          Condition:
+                              StringEquals:
+                                  bedrock:ModelArn:
+                                      - Fn::Sub: arn:${AWS::Partition}:bedrock:us-east-1:${AWS::AccountId}:inference-profile/us.openai.gpt-6.1-sol
+                                      - Fn::Sub: arn:${AWS::Partition}:bedrock:us-east-1:${AWS::AccountId}:inference-profile/us.openai.gpt-6-luna
+                        - Sid: SolBackingModelsThroughSolProfile
+                          Effect: Allow
+                          Action: bedrock:InvokeModel
+                          Resource:
+                              - Fn::Sub: arn:${AWS::Partition}:bedrock:us-east-1::foundation-model/openai.gpt-6.1-sol
+                              - Fn::Sub: arn:${AWS::Partition}:bedrock:us-east-2::foundation-model/openai.gpt-6.1-sol
+                              - Fn::Sub: arn:${AWS::Partition}:bedrock:us-west-2::foundation-model/openai.gpt-6.1-sol
+                          Condition:
+                              StringEquals:
+                                  bedrock:InferenceProfileArn:
+                                      Fn::Sub: arn:${AWS::Partition}:bedrock:us-east-1:${AWS::AccountId}:inference-profile/us.openai.gpt-6.1-sol
+                        - Sid: LunaBackingModelsThroughLunaProfile
+                          Effect: Allow
+                          Action: bedrock:InvokeModel
+                          Resource:
+                              - Fn::Sub: arn:${AWS::Partition}:bedrock:us-east-1::foundation-model/openai.gpt-6-luna
+                              - Fn::Sub: arn:${AWS::Partition}:bedrock:us-east-2::foundation-model/openai.gpt-6-luna
+                              - Fn::Sub: arn:${AWS::Partition}:bedrock:us-west-2::foundation-model/openai.gpt-6-luna
+                          Condition:
+                              StringEquals:
+                                  bedrock:InferenceProfileArn:
+                                      Fn::Sub: arn:${AWS::Partition}:bedrock:us-east-1:${AWS::AccountId}:inference-profile/us.openai.gpt-6-luna
+                        # generateImage default provider (docs/image-generation.md): one model,
+                        # one region, non-streaming InvokeModel only.
+                        - Sid: StableImageCoreUsWest2
+                          Effect: Allow
+                          Action: bedrock:InvokeModel
+                          Resource:
+                              Fn::Sub: arn:${AWS::Partition}:bedrock:us-west-2::foundation-model/stability.stable-image-core-v1:1
         # Only the two signing entry points and the migration worker assume this role.
         # Keep KMS references out of the role itself to avoid a Role -> Key -> Role cycle.
         SigningAuthorityExecutionRole:

package/src/config/environment.ts

@@ -31,6 +31,20 @@ export const lcaApiEnvironmentShape = {
     NETWORK_BRAIN_SERVICE_URL: optionalEnvironmentUrl,
     GOOGLE_APPLICATION_CREDENTIAL: optionalEnvironmentString,
     OPENAI_API_KEY: optionalEnvironmentString,
+    BEDROCK_BASE_URL: optionalEnvironmentString,
+    IMAGE_PROVIDER: optionalEnvironmentString
+        .transform(value => value ?? 'bedrock')
+        .pipe(z.enum(['openai', 'bedrock'])),
+    BEDROCK_IMAGE_REGION: optionalEnvironmentString
+        .transform(value => value ?? 'us-west-2')
+        .pipe(z.literal('us-west-2')),
+    BEDROCK_IMAGE_MODEL_ID: optionalEnvironmentString
+        .transform(value => value ?? 'stability.stable-image-core-v1:1')
+        .pipe(z.literal('stability.stable-image-core-v1:1')),
+    // Must finish inside the 29-second Lambda timeout (same 25-second ceiling as text generation).
+    IMAGE_TIMEOUT_MS: optionalEnvironmentString
+        .transform(value => (value === undefined ? 25_000 : Number(value)))
+        .pipe(z.number().int().min(1_000).max(25_000)),
     METABASE_SECRET_KEY: optionalEnvironmentString,
     SCOUTS_SSO_CLIENT_SECRET: optionalEnvironmentString,
     KEYCLOAK_ISSUERS: optionalEnvironmentString,