@learncard/lca-api-service 1.6.3 → 1.7.0

package/dist/routes/credentials.d.ts

@@ -154,8 +154,8 @@ export declare const credentialsRouter: import("@trpc/server").TRPCBuiltRouter<{
             };
             signingAuthority: {
                 did: string;
-                ownerDid: string;
                 name: string;
+                ownerDid: string;
             };
             options?: {
                 created?: string | undefined;

package/dist/routes/index.d.ts

@@ -25,6 +25,7 @@ export type Context = {
     debug?: boolean;
     clientIp?: string;
     providerToken?: string;
+    authorizationHeader?: string;
 };
 export declare const t: import("@trpc/server").TRPCRootObject<Context, OpenApiMeta, import("@trpc/server").TRPCRuntimeConfigOptions<Context, OpenApiMeta>, {
     ctx: Context;
@@ -45,6 +46,7 @@ export declare const openRoute: import("@trpc/server").TRPCProcedureBuilder<Cont
     domain: string;
     clientIp: string | undefined;
     providerToken: string | undefined;
+    authorizationHeader: string | undefined;
 }, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, false>;
 export declare const didRoute: import("@trpc/server").TRPCProcedureBuilder<Context, OpenApiMeta, {
     tenant: ResolvedTenant;
@@ -57,6 +59,7 @@ export declare const didRoute: import("@trpc/server").TRPCProcedureBuilder<Conte
     domain: string;
     clientIp: string | undefined;
     providerToken: string | undefined;
+    authorizationHeader: string | undefined;
 }, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, false>;
 export declare const authorizedDidRoute: import("@trpc/server").TRPCProcedureBuilder<Context, OpenApiMeta, {
     tenant: ResolvedTenant;
@@ -69,6 +72,7 @@ export declare const authorizedDidRoute: import("@trpc/server").TRPCProcedureBui
     domain: string;
     clientIp: string | undefined;
     providerToken: string | undefined;
+    authorizationHeader: string | undefined;
 }, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, false>;
 export declare const didAndChallengeRoute: import("@trpc/server").TRPCProcedureBuilder<Context, OpenApiMeta, {
     tenant: ResolvedTenant;
@@ -81,4 +85,5 @@ export declare const didAndChallengeRoute: import("@trpc/server").TRPCProcedureB
     domain: string;
     clientIp: string | undefined;
     providerToken: string | undefined;
+    authorizationHeader: string | undefined;
 }, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, false>;

package/dist/routes/keys.d.ts

@@ -199,6 +199,7 @@ export declare const keysRouter: import("@trpc/server").TRPCBuiltRouter<{
             };
             priorEscrowEnrollment: boolean;
             sssActivationState: "active" | "provisional";
+            isWeb3AuthLogin: boolean;
             escrowStale?: "mode-mismatch" | "key-rotated" | undefined;
             escrowBlobIdentity?: string | undefined;
             escrowUpdating?: boolean | undefined;

package/dist/routes/notifications.d.ts

@@ -16,7 +16,7 @@ export declare const notificationsRouter: import("@trpc/server").TRPCBuiltRouter
                 archived?: boolean | undefined;
                 read?: boolean | undefined;
                 actionStatus?: "PENDING" | "COMPLETED" | "REJECTED" | undefined;
-                type?: "GUARDIAN_APPROVED" | "GUARDIAN_REJECTED" | "CONNECTION_REQUEST" | "CONNECTION_REQUEST_EXPIRED_INVITE" | "CONNECTION_ACCEPTED" | "CREDENTIAL_RECEIVED" | "CREDENTIAL_ACCEPTED" | "BOOST_RECEIVED" | "BOOST_ACCEPTED" | "PRESENTATION_REQUEST" | "PRESENTATION_RECEIVED" | "CONSENT_FLOW_TRANSACTION" | "ISSUANCE_CLAIMED" | "ISSUANCE_DELIVERED" | "ISSUANCE_ERROR" | "PROFILE_PARENT_APPROVED" | "APP_LISTING_SUBMITTED" | "APP_LISTING_APPROVED" | "APP_LISTING_REJECTED" | "APP_LISTING_WITHDRAWN" | "DEVICE_LINK_REQUEST" | "GUARDIAN_APPROVAL_PENDING" | "APP_NOTIFICATION" | "CREDENTIAL_REVOKED" | "CREDENTIAL_SUSPENDED" | "CREDENTIAL_UNSUSPENDED" | "CREDENTIAL_REFRESHED" | undefined;
+                type?: "GUARDIAN_APPROVED" | "GUARDIAN_REJECTED" | "CONNECTION_REQUEST" | "CONNECTION_REQUEST_EXPIRED_INVITE" | "CONNECTION_ACCEPTED" | "CREDENTIAL_RECEIVED" | "CREDENTIAL_ACCEPTED" | "BOOST_RECEIVED" | "BOOST_ACCEPTED" | "PRESENTATION_REQUEST" | "PRESENTATION_RECEIVED" | "CONSENT_FLOW_TRANSACTION" | "ISSUANCE_CLAIMED" | "ISSUANCE_DELIVERED" | "ISSUANCE_ERROR" | "PROFILE_PARENT_APPROVED" | "APP_LISTING_SUBMITTED" | "APP_LISTING_APPROVED" | "APP_LISTING_REJECTED" | "APP_LISTING_WITHDRAWN" | "DEVICE_LINK_REQUEST" | "GUARDIAN_APPROVAL_PENDING" | "APP_NOTIFICATION" | "ANNOUNCEMENT" | "CREDENTIAL_REVOKED" | "CREDENTIAL_SUSPENDED" | "CREDENTIAL_UNSUSPENDED" | "CREDENTIAL_REFRESHED" | "CONSENT_FLOW_CONTRACT_UPDATED" | undefined;
             } | undefined;
         };
         output: {
@@ -29,7 +29,7 @@ export declare const notificationsRouter: import("@trpc/server").TRPCBuiltRouter
     queryNotifications: import("@trpc/server").TRPCQueryProcedure<{
         input: {
             query: {
-                type?: "GUARDIAN_APPROVED" | "GUARDIAN_REJECTED" | "CONNECTION_REQUEST" | "CONNECTION_REQUEST_EXPIRED_INVITE" | "CONNECTION_ACCEPTED" | "CREDENTIAL_RECEIVED" | "CREDENTIAL_ACCEPTED" | "BOOST_RECEIVED" | "BOOST_ACCEPTED" | "PRESENTATION_REQUEST" | "PRESENTATION_RECEIVED" | "CONSENT_FLOW_TRANSACTION" | "ISSUANCE_CLAIMED" | "ISSUANCE_DELIVERED" | "ISSUANCE_ERROR" | "PROFILE_PARENT_APPROVED" | "APP_LISTING_SUBMITTED" | "APP_LISTING_APPROVED" | "APP_LISTING_REJECTED" | "APP_LISTING_WITHDRAWN" | "DEVICE_LINK_REQUEST" | "GUARDIAN_APPROVAL_PENDING" | "APP_NOTIFICATION" | "CREDENTIAL_REVOKED" | "CREDENTIAL_SUSPENDED" | "CREDENTIAL_UNSUSPENDED" | "CREDENTIAL_REFRESHED" | undefined;
+                type?: "GUARDIAN_APPROVED" | "GUARDIAN_REJECTED" | "CONNECTION_REQUEST" | "CONNECTION_REQUEST_EXPIRED_INVITE" | "CONNECTION_ACCEPTED" | "CREDENTIAL_RECEIVED" | "CREDENTIAL_ACCEPTED" | "BOOST_RECEIVED" | "BOOST_ACCEPTED" | "PRESENTATION_REQUEST" | "PRESENTATION_RECEIVED" | "CONSENT_FLOW_TRANSACTION" | "ISSUANCE_CLAIMED" | "ISSUANCE_DELIVERED" | "ISSUANCE_ERROR" | "PROFILE_PARENT_APPROVED" | "APP_LISTING_SUBMITTED" | "APP_LISTING_APPROVED" | "APP_LISTING_REJECTED" | "APP_LISTING_WITHDRAWN" | "DEVICE_LINK_REQUEST" | "GUARDIAN_APPROVAL_PENDING" | "APP_NOTIFICATION" | "ANNOUNCEMENT" | "CREDENTIAL_REVOKED" | "CREDENTIAL_SUSPENDED" | "CREDENTIAL_UNSUSPENDED" | "CREDENTIAL_REFRESHED" | "CONSENT_FLOW_CONTRACT_UPDATED" | undefined;
                 'from.did'?: string | undefined;
                 'from.profileId'?: string | undefined;
                 'data.vcUris'?: string | string[] | undefined;
@@ -85,7 +85,7 @@ export declare const notificationsRouter: import("@trpc/server").TRPCBuiltRouter
     }>;
     sendNotification: import("@trpc/server").TRPCMutationProcedure<{
         input: {
-            type: "GUARDIAN_APPROVED" | "GUARDIAN_REJECTED" | "CONNECTION_REQUEST" | "CONNECTION_REQUEST_EXPIRED_INVITE" | "CONNECTION_ACCEPTED" | "CREDENTIAL_RECEIVED" | "CREDENTIAL_ACCEPTED" | "BOOST_RECEIVED" | "BOOST_ACCEPTED" | "PRESENTATION_REQUEST" | "PRESENTATION_RECEIVED" | "CONSENT_FLOW_TRANSACTION" | "ISSUANCE_CLAIMED" | "ISSUANCE_DELIVERED" | "ISSUANCE_ERROR" | "PROFILE_PARENT_APPROVED" | "APP_LISTING_SUBMITTED" | "APP_LISTING_APPROVED" | "APP_LISTING_REJECTED" | "APP_LISTING_WITHDRAWN" | "DEVICE_LINK_REQUEST" | "GUARDIAN_APPROVAL_PENDING" | "APP_NOTIFICATION" | "CREDENTIAL_REVOKED" | "CREDENTIAL_SUSPENDED" | "CREDENTIAL_UNSUSPENDED" | "CREDENTIAL_REFRESHED";
+            type: "GUARDIAN_APPROVED" | "GUARDIAN_REJECTED" | "CONNECTION_REQUEST" | "CONNECTION_REQUEST_EXPIRED_INVITE" | "CONNECTION_ACCEPTED" | "CREDENTIAL_RECEIVED" | "CREDENTIAL_ACCEPTED" | "BOOST_RECEIVED" | "BOOST_ACCEPTED" | "PRESENTATION_REQUEST" | "PRESENTATION_RECEIVED" | "CONSENT_FLOW_TRANSACTION" | "ISSUANCE_CLAIMED" | "ISSUANCE_DELIVERED" | "ISSUANCE_ERROR" | "PROFILE_PARENT_APPROVED" | "APP_LISTING_SUBMITTED" | "APP_LISTING_APPROVED" | "APP_LISTING_REJECTED" | "APP_LISTING_WITHDRAWN" | "DEVICE_LINK_REQUEST" | "GUARDIAN_APPROVAL_PENDING" | "APP_NOTIFICATION" | "ANNOUNCEMENT" | "CREDENTIAL_REVOKED" | "CREDENTIAL_SUSPENDED" | "CREDENTIAL_UNSUSPENDED" | "CREDENTIAL_REFRESHED" | "CONSENT_FLOW_CONTRACT_UPDATED";
             to: {
                 profileId?: string | undefined;
                 displayName?: string | undefined;
@@ -176,7 +176,7 @@ export declare const notificationsRouter: import("@trpc/server").TRPCBuiltRouter
                 vpUris?: string[] | undefined;
                 transaction?: {
                     id: string;
-                    action: "write" | "update" | "consent" | "sync" | "withdraw";
+                    action: "write" | "consent" | "update" | "sync" | "withdraw" | "reconsent";
                     date: string;
                     expiresAt?: string | undefined;
                     oneTime?: boolean | undefined;
@@ -214,7 +214,64 @@ export declare const notificationsRouter: import("@trpc/server").TRPCBuiltRouter
                         requestedBy: string;
                         externalReferenceId?: string | undefined;
                     } | undefined;
+                    kind?: "relaxed" | "expanded_optional" | "requires_consent" | undefined;
                     uris?: string[] | undefined;
+                    consentedVersion?: number | undefined;
+                    reconsentDeadline?: string | undefined;
+                    newOptionsUntil?: string | undefined;
+                } | undefined;
+                contractUri?: string | undefined;
+                contractName?: string | undefined;
+                fromVersion?: number | undefined;
+                toVersion?: number | undefined;
+                kind?: "relaxed" | "expanded_optional" | "requires_consent" | undefined;
+                reason?: string | undefined;
+                diff?: {
+                    added: {
+                        area: "read" | "write";
+                        type: "personal" | "credential";
+                        key: string;
+                        required: boolean;
+                        reason?: string | undefined;
+                    }[];
+                    removed: {
+                        area: "read" | "write";
+                        type: "personal" | "credential";
+                        key: string;
+                        required: boolean;
+                        reason?: string | undefined;
+                    }[];
+                    changed: {
+                        area: "read" | "write";
+                        type: "personal" | "credential";
+                        key: string;
+                        required: boolean;
+                        reason?: string | undefined;
+                    }[];
+                    details?: {
+                        field: "expiresAt" | "name" | "description" | "image" | "subtitle" | "reasonForAccessing" | "needsGuardianConsent" | "redirectUrl" | "frontDoorBoostUri" | "writers" | "autoboosts";
+                        before?: string | boolean | string[] | undefined;
+                        after?: string | boolean | string[] | undefined;
+                    }[] | undefined;
+                } | undefined;
+                reconsentDeadline?: string | undefined;
+                reviewUrl?: string | undefined;
+                preview?: {
+                    headline: string;
+                    subhead: string;
+                    rows: {
+                        scope: {
+                            area: "read" | "write";
+                            type: "personal" | "credential";
+                            key: string;
+                            required: boolean;
+                            reason?: string | undefined;
+                        };
+                        change: "added" | "removed" | "changed";
+                        label: string;
+                        subtitle: string;
+                    }[];
+                    primaryLabel: string;
                 } | undefined;
                 inbox?: {
                     issuanceId: string;
@@ -234,6 +291,10 @@ export declare const notificationsRouter: import("@trpc/server").TRPCBuiltRouter
                         promptId: string;
                         counterpartProfileId: string;
                     } | undefined;
+                    campaignId?: string | undefined;
+                    campaignCreatedAt?: string | undefined;
+                    campaignHasInApp?: boolean | undefined;
+                    campaignTestId?: string | undefined;
                 } | undefined;
             } | undefined;
             sent?: string | undefined;

package/dist/routes/preferences.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/routes/signing-authority.d.ts

@@ -10,8 +10,8 @@ export declare const signingAuthorityRouter: import("@trpc/server").TRPCBuiltRou
             ownerDid?: string | undefined;
         };
         output: {
-            ownerDid: string;
             name: string;
+            ownerDid: string;
             did: string;
             endpoint: string;
             _id?: string | undefined;
@@ -24,8 +24,8 @@ export declare const signingAuthorityRouter: import("@trpc/server").TRPCBuiltRou
             ownerDid: string;
         };
         output: {
-            ownerDid: string;
             name: string;
+            ownerDid: string;
             did: string;
             endpoint: string;
             _id?: string | undefined;
@@ -35,8 +35,8 @@ export declare const signingAuthorityRouter: import("@trpc/server").TRPCBuiltRou
     signingAuthorities: import("@trpc/server").TRPCQueryProcedure<{
         input: void;
         output: {
-            ownerDid: string;
             name: string;
+            ownerDid: string;
             did: string;
             endpoint: string;
             _id?: string | undefined;

package/dist/services/escrow-enclave/index.d.ts

@@ -5,8 +5,10 @@ export * from './softwareEnclave';
 export * from './remoteEnclave';
 export * from './notifications';
 export declare const isEscrowEnabled: () => boolean;
+export declare const checkEscrowRemoteConfig: () => void;
 export declare const isEscrowRemoteMode: () => boolean;
 export declare const activeEscrowClientMode: () => "software" | "nitro";
+export declare const getEscrowAuthorityTenant: () => string;
 export declare const getEscrowHoldDurationMs: () => number;
 export declare const getEscrowHoldRestartMinAgeMs: () => number;
 export declare const getEscrowEnclave: () => EscrowEnclave;

package/dist/services/escrow-enclave/logFailure.d.ts

@@ -1 +1,2 @@
 export declare const logEscrowFailure: (error: unknown) => void;
+export declare const emitEnclaveFailureMetric: (reason: string) => void;

package/dist/types/credentials.d.ts

@@ -159,8 +159,8 @@ export declare const IssueEndpointValidator: z.ZodObject<{
     }, z.core.$strip>>;
     signingAuthority: z.ZodObject<{
         did: z.ZodString;
-        ownerDid: z.ZodString;
         name: z.ZodString;
+        ownerDid: z.ZodString;
     }, z.core.$strip>;
     encryption: z.ZodOptional<z.ZodObject<{
         recipients: z.ZodArray<z.ZodString>;

package/dist/types/notifications.d.ts

@@ -52,10 +52,12 @@ export declare const NotificationQueryFiltersValidator: z.ZodObject<{
         DEVICE_LINK_REQUEST: "DEVICE_LINK_REQUEST";
         GUARDIAN_APPROVAL_PENDING: "GUARDIAN_APPROVAL_PENDING";
         APP_NOTIFICATION: "APP_NOTIFICATION";
+        ANNOUNCEMENT: "ANNOUNCEMENT";
         CREDENTIAL_REVOKED: "CREDENTIAL_REVOKED";
         CREDENTIAL_SUSPENDED: "CREDENTIAL_SUSPENDED";
         CREDENTIAL_UNSUSPENDED: "CREDENTIAL_UNSUSPENDED";
         CREDENTIAL_REFRESHED: "CREDENTIAL_REFRESHED";
+        CONSENT_FLOW_CONTRACT_UPDATED: "CONSENT_FLOW_CONTRACT_UPDATED";
     }>>;
 }, z.core.$strip>;
 export type NotificationQueryFiltersType = z.infer<typeof NotificationQueryFiltersValidator>;
@@ -101,10 +103,12 @@ export declare const PaginatedNotificationsValidator: z.ZodObject<{
             DEVICE_LINK_REQUEST: "DEVICE_LINK_REQUEST";
             GUARDIAN_APPROVAL_PENDING: "GUARDIAN_APPROVAL_PENDING";
             APP_NOTIFICATION: "APP_NOTIFICATION";
+            ANNOUNCEMENT: "ANNOUNCEMENT";
             CREDENTIAL_REVOKED: "CREDENTIAL_REVOKED";
             CREDENTIAL_SUSPENDED: "CREDENTIAL_SUSPENDED";
             CREDENTIAL_UNSUSPENDED: "CREDENTIAL_UNSUSPENDED";
             CREDENTIAL_REFRESHED: "CREDENTIAL_REFRESHED";
+            CONSENT_FLOW_CONTRACT_UPDATED: "CONSENT_FLOW_CONTRACT_UPDATED";
         }>;
         to: z.ZodIntersection<z.ZodObject<{
             profileId: z.ZodOptional<z.ZodString>;
@@ -246,14 +250,120 @@ export declare const PaginatedNotificationsValidator: z.ZodObject<{
                 }, z.core.$strip>>;
                 id: z.ZodString;
                 action: z.ZodEnum<{
-                    update: "update";
-                    write: "write";
                     consent: "consent";
+                    write: "write";
+                    update: "update";
                     sync: "sync";
                     withdraw: "withdraw";
+                    reconsent: "reconsent";
                 }>;
+                kind: z.ZodOptional<z.ZodEnum<{
+                    relaxed: "relaxed";
+                    expanded_optional: "expanded_optional";
+                    requires_consent: "requires_consent";
+                }>>;
                 date: z.ZodString;
                 uris: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                consentedVersion: z.ZodOptional<z.ZodNumber>;
+                reconsentDeadline: z.ZodOptional<z.ZodString>;
+                newOptionsUntil: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>;
+            contractUri: z.ZodOptional<z.ZodString>;
+            contractName: z.ZodOptional<z.ZodString>;
+            fromVersion: z.ZodOptional<z.ZodNumber>;
+            toVersion: z.ZodOptional<z.ZodNumber>;
+            kind: z.ZodOptional<z.ZodEnum<{
+                relaxed: "relaxed";
+                expanded_optional: "expanded_optional";
+                requires_consent: "requires_consent";
+            }>>;
+            reason: z.ZodOptional<z.ZodString>;
+            diff: z.ZodOptional<z.ZodObject<{
+                added: z.ZodArray<z.ZodObject<{
+                    area: z.ZodEnum<{
+                        read: "read";
+                        write: "write";
+                    }>;
+                    type: z.ZodEnum<{
+                        credential: "credential";
+                        personal: "personal";
+                    }>;
+                    key: z.ZodString;
+                    required: z.ZodBoolean;
+                    reason: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
+                removed: z.ZodArray<z.ZodObject<{
+                    area: z.ZodEnum<{
+                        read: "read";
+                        write: "write";
+                    }>;
+                    type: z.ZodEnum<{
+                        credential: "credential";
+                        personal: "personal";
+                    }>;
+                    key: z.ZodString;
+                    required: z.ZodBoolean;
+                    reason: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
+                changed: z.ZodArray<z.ZodObject<{
+                    area: z.ZodEnum<{
+                        read: "read";
+                        write: "write";
+                    }>;
+                    type: z.ZodEnum<{
+                        credential: "credential";
+                        personal: "personal";
+                    }>;
+                    key: z.ZodString;
+                    required: z.ZodBoolean;
+                    reason: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
+                details: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    field: z.ZodEnum<{
+                        name: "name";
+                        description: "description";
+                        image: "image";
+                        expiresAt: "expiresAt";
+                        subtitle: "subtitle";
+                        reasonForAccessing: "reasonForAccessing";
+                        needsGuardianConsent: "needsGuardianConsent";
+                        redirectUrl: "redirectUrl";
+                        frontDoorBoostUri: "frontDoorBoostUri";
+                        writers: "writers";
+                        autoboosts: "autoboosts";
+                    }>;
+                    before: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>]>>;
+                    after: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>]>>;
+                }, z.core.$strip>>>;
+            }, z.core.$strip>>;
+            reconsentDeadline: z.ZodOptional<z.ZodString>;
+            reviewUrl: z.ZodOptional<z.ZodString>;
+            preview: z.ZodOptional<z.ZodObject<{
+                headline: z.ZodString;
+                subhead: z.ZodString;
+                rows: z.ZodArray<z.ZodObject<{
+                    scope: z.ZodObject<{
+                        area: z.ZodEnum<{
+                            read: "read";
+                            write: "write";
+                        }>;
+                        type: z.ZodEnum<{
+                            credential: "credential";
+                            personal: "personal";
+                        }>;
+                        key: z.ZodString;
+                        required: z.ZodBoolean;
+                        reason: z.ZodOptional<z.ZodString>;
+                    }, z.core.$strip>;
+                    change: z.ZodEnum<{
+                        added: "added";
+                        removed: "removed";
+                        changed: "changed";
+                    }>;
+                    label: z.ZodString;
+                    subtitle: z.ZodString;
+                }, z.core.$strip>>;
+                primaryLabel: z.ZodString;
             }, z.core.$strip>>;
             inbox: z.ZodOptional<z.ZodObject<{
                 issuanceId: z.ZodString;
@@ -278,6 +388,10 @@ export declare const PaginatedNotificationsValidator: z.ZodObject<{
                     promptId: z.ZodString;
                     counterpartProfileId: z.ZodString;
                 }, z.core.$strip>>;
+                campaignId: z.ZodOptional<z.ZodString>;
+                campaignCreatedAt: z.ZodOptional<z.ZodISODateTime>;
+                campaignHasInApp: z.ZodOptional<z.ZodBoolean>;
+                campaignTestId: z.ZodOptional<z.ZodUUID>;
             }, z.core.$catchall<z.ZodUnknown>>>;
         }, z.core.$loose>>;
         sent: z.ZodOptional<z.ZodISODateTime>;
@@ -318,10 +432,12 @@ export declare const NotificationQueryInputValidator: z.ZodObject<{
         DEVICE_LINK_REQUEST: "DEVICE_LINK_REQUEST";
         GUARDIAN_APPROVAL_PENDING: "GUARDIAN_APPROVAL_PENDING";
         APP_NOTIFICATION: "APP_NOTIFICATION";
+        ANNOUNCEMENT: "ANNOUNCEMENT";
         CREDENTIAL_REVOKED: "CREDENTIAL_REVOKED";
         CREDENTIAL_SUSPENDED: "CREDENTIAL_SUSPENDED";
         CREDENTIAL_UNSUSPENDED: "CREDENTIAL_UNSUSPENDED";
         CREDENTIAL_REFRESHED: "CREDENTIAL_REFRESHED";
+        CONSENT_FLOW_CONTRACT_UPDATED: "CONSENT_FLOW_CONTRACT_UPDATED";
     }>>;
     'from.did': z.ZodOptional<z.ZodString>;
     'from.profileId': z.ZodOptional<z.ZodString>;

package/docs/bedrock-generation.md

@@ -88,16 +88,17 @@ explicit deployment approval. There is no runtime silent fallback to the old mod
 
 All LCA Lambda functions and the native DIDKit layer declare `nodejs24.x`; esbuild
 targets Node 24. The native addon uses stable N-API v4, supported by Node 24.
-Both Node 20 and Node 24 Lambda use AL2023. Before deployment, the LCA-only
-`verify-node24-layer.cjs` preflight requires the Linux x64 GNU artifact, both
+Both Node 20 and Node 24 Lambda use AL2023. Before deployment, the shared
+`scripts/verify-node24-didkit-layer.cjs` preflight (also used by brain-service and
+learn-cloud-service) requires the Linux x64 GNU artifact, both
 packaged runtime dependencies, libc symbols no newer than glibc 2.34, and an actual
 Node 24 native key-to-DID smoke check. Missing/incompatible artifacts stop the action
 before Serverless deployment; WASM fallback is not evidence of native compatibility.
 
-LCA pins serverless-esbuild 1.57.2 for Node 24 target support. The service-local
-`node24-runtime.cjs` plugin adds Node 24 to Serverless 3.40's older runtime schema
-without disabling validation or changing other services. Deployment tools run on
-Node 24.12.0 in the LCA action. Local offline configuration uses Node 24 too.
+LCA pins serverless-esbuild 1.57.2 for Node 24 target support. The shared
+`scripts/serverless-node24-runtime.cjs` plugin adds Node 24 to Serverless 3.40's older
+runtime schema without disabling validation. Deployment tools run on
+the repo `.nvmrc` Node 24 in the LCA action. Local offline configuration uses Node 24 too.
 
 The `LcaDevBedrockGenerationPolicy` CloudFormation resource attaches the scoped
 policy to `SigningAuthorityExecutionRole` only for stage `dev` in `us-east-1`.

package/lambdaApp.test.ts

@@ -0,0 +1,114 @@
+import type { APIGatewayProxyEventV2, Context } from 'aws-lambda';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const handlers = vi.hoisted(() => ({
+    api: vi.fn(async () => ({ statusCode: 200 })),
+    trpc: vi.fn(async () => ({ statusCode: 200 })),
+    ensureUserKeysIndexes: vi.fn(async () => undefined),
+    createEscrowHoldsIndexes: vi.fn(async () => {
+        throw new Error('Escrow hold index initialization failed', {
+            cause: { code: 11000, codeName: 'DuplicateKey' },
+        });
+    }),
+}));
+vi.mock('serverless-http', () => ({ default: () => vi.fn() }));
+vi.mock('@trpc/server/adapters/aws-lambda', () => ({
+    awsLambdaRequestHandler: () => handlers.trpc,
+}));
+vi.mock('@sentry/serverless', () => ({
+    AWSLambda: { init: vi.fn(), wrapHandler: (handler: unknown) => handler },
+    Integrations: { Console: class {}, Http: class {}, ContextLines: class {}, Mongo: class {} },
+}));
+vi.mock('./src/openapi', () => ({ default: {} }));
+vi.mock('./src/dids', () => ({ default: {} }));
+vi.mock('./src/app', () => ({ appRouter: {}, createContext: vi.fn() }));
+vi.mock('./src/helpers/learnCard.helpers', () => ({ getEmptyLearnCard: async () => ({}) }));
+vi.mock('./src/helpers/shim', () => ({ createOpenApiAwsLambdaHandler: () => handlers.api }));
+vi.mock('./src/helpers/sentry.helpers', () => ({
+    handleTrpcError: vi.fn(),
+    sentryBeforeSend: vi.fn(),
+    getTracesSampleRate: () => 0,
+}));
+vi.mock('./src/config/environment', () => ({ environment: {} }));
+vi.mock('./src/helpers/serverlessApplication', () => ({ toServerlessApplication: () => ({}) }));
+vi.mock('./src/models', () => handlers);
+vi.mock('./src/jobs/escrowHoldReminders', () => ({ runEscrowHoldReminders: vi.fn() }));
+vi.mock('./src/jobs/escrowBlobRewrap', () => ({ runEscrowBlobRewrap: vi.fn() }));
+vi.mock('./src/services/escrow-enclave', () => ({ checkEscrowRemoteConfig: vi.fn() }));
+
+const event = (method: string): APIGatewayProxyEventV2 => ({
+    version: '2.0',
+    routeKey: '$default',
+    rawPath: '/unrelated',
+    rawQueryString: '',
+    headers: {},
+    isBase64Encoded: false,
+    requestContext: {
+        accountId: 'test',
+        apiId: 'test',
+        domainName: 'localhost',
+        domainPrefix: 'localhost',
+        http: {
+            method,
+            path: '/unrelated',
+            protocol: 'HTTP/1.1',
+            sourceIp: '127.0.0.1',
+            userAgent: 'test',
+        },
+        requestId: 'test',
+        routeKey: '$default',
+        stage: '$default',
+        time: '',
+        timeEpoch: 0,
+    },
+});
+const context: Context = {
+    callbackWaitsForEmptyEventLoop: false,
+    functionName: 'test',
+    functionVersion: 'test',
+    invokedFunctionArn: 'test',
+    memoryLimitInMB: '128',
+    awsRequestId: 'test',
+    logGroupName: 'test',
+    logStreamName: 'test',
+    getRemainingTimeInMillis: () => 30_000,
+    done: () => undefined,
+    fail: () => undefined,
+    succeed: () => undefined,
+};
+
+beforeEach(() => {
+    vi.resetModules();
+    vi.clearAllMocks();
+});
+describe('Lambda startup isolation', () => {
+    it('retries transient non-escrow startup failures on the next request', async () => {
+        const diagnostic = vi.spyOn(console, 'error').mockImplementation(() => undefined);
+        handlers.ensureUserKeysIndexes.mockRejectedValueOnce(
+            new Error('transient startup failure')
+        );
+        const app = await import('./lambdaApp');
+        await vi.waitFor(() => expect(diagnostic).toHaveBeenCalled());
+        await expect(
+            app.openApiHandler(event('GET'), context, () => undefined)
+        ).resolves.toMatchObject({ statusCode: 200 });
+        expect(handlers.ensureUserKeysIndexes).toHaveBeenCalledTimes(2);
+        expect(handlers.createEscrowHoldsIndexes).not.toHaveBeenCalled();
+        diagnostic.mockRestore();
+    });
+
+    it.each(['openApiHandler', 'trpcHandler'] as const)(
+        '%s serves unrelated requests and OPTIONS without migrating escrow indexes',
+        async name => {
+            const app = await import('./lambdaApp');
+            await expect(app[name](event('GET'), context, () => undefined)).resolves.toMatchObject({
+                statusCode: 200,
+            });
+            await expect(
+                app[name](event('OPTIONS'), context, () => undefined)
+            ).resolves.toMatchObject({ statusCode: 200 });
+            expect(handlers.ensureUserKeysIndexes).toHaveBeenCalledOnce();
+            expect(handlers.createEscrowHoldsIndexes).not.toHaveBeenCalled();
+        }
+    );
+});

package/lambdaApp.ts

@@ -15,15 +15,27 @@ import {
 } from './src/helpers/sentry.helpers';
 import { environment } from './src/config/environment';
 import { toServerlessApplication } from './src/helpers/serverlessApplication';
-import { ensureUserKeysIndexes, createEscrowHoldsIndexes } from './src/models';
+import { ensureUserKeysIndexes } from './src/models';
 import { runEscrowHoldReminders } from './src/jobs/escrowHoldReminders';
 import { runEscrowBlobRewrap } from './src/jobs/escrowBlobRewrap';
+import { checkEscrowRemoteConfig } from './src/services/escrow-enclave';
+import { createRetryingOnce } from './src/helpers/retryingOnce';
+
+checkEscrowRemoteConfig();
+
+// Retry global startup (WASM + user-keys) without caching failures, and without
+// letting an escrow migration reject unrelated calls.
+const ensureStartup = createRetryingOnce(() =>
+    Promise.all([
+        getEmptyLearnCard(), // Load WASM in for better cold starts
+        ensureUserKeysIndexes(),
+    ])
+);
 
-const startupPromise = Promise.all([
-    getEmptyLearnCard(), // Load WASM in for better cold starts
-    ensureUserKeysIndexes(),
-    createEscrowHoldsIndexes(),
-]);
+// Start during init for faster first requests; handlers await (and retry) it.
+ensureStartup().catch(error => {
+    console.error('lca-api startup failed; the next request retries', error);
+});
 
 const isWarmupEvent = (event: APIGatewayProxyEventV2): boolean =>
     'source' in event && event.source === 'serverless-plugin-warmup';
@@ -79,7 +91,7 @@ export const _trpcHandler = awsLambdaRequestHandler({
 
 export const openApiHandler = Sentry.AWSLambda.wrapHandler(
     async (event: APIGatewayProxyEventV2, context: Context): Promise<APIGatewayProxyResultV2> => {
-        await startupPromise;
+        await ensureStartup();
 
         if (isWarmupEvent(event)) {
             console.log('[Warmup] Initializing LearnCard...');
@@ -105,7 +117,7 @@ export const openApiHandler = Sentry.AWSLambda.wrapHandler(
 
 export const trpcHandler = Sentry.AWSLambda.wrapHandler(
     async (event: APIGatewayProxyEventV2, context: Context): Promise<APIGatewayProxyResultV2> => {
-        await startupPromise;
+        await ensureStartup();
 
         if (isWarmupEvent(event)) {
             console.log('[Warmup] Initializing LearnCard...');
@@ -130,9 +142,9 @@ export const trpcHandler = Sentry.AWSLambda.wrapHandler(
 );
 
 // Scheduled (EventBridge) functions, not API-Gateway-triggered: they share
-// startupPromise with the handlers above; warmup/OPTIONS handling doesn't apply.
+// ensureStartup with the handlers above; warmup/OPTIONS handling doesn't apply.
 export const escrowHoldRemindersHandler = Sentry.AWSLambda.wrapHandler(async (): Promise<void> => {
-    await startupPromise;
+    await ensureStartup();
     const counts = await runEscrowHoldReminders();
     console.log('[escrow-hold-reminders] completed', counts);
 });
@@ -140,7 +152,7 @@ export const escrowHoldRemindersHandler = Sentry.AWSLambda.wrapHandler(async ():
 // P9.3: migrates escrow blobs off a retiring enclave key for accounts that
 // never sign in again (P9.2 already covers accounts that do, on next login).
 export const escrowBlobRewrapHandler = Sentry.AWSLambda.wrapHandler(async (): Promise<void> => {
-    await startupPromise;
+    await ensureStartup();
     const counts = await runEscrowBlobRewrap();
     console.log('[escrow-blob-rewrap] completed', counts);
 });