@learncard/network-brain-service 3.17.0 → 3.19.0

package/dist/types/credential-refresh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-refresh.d.ts","sourceRoot":"","sources":["../../src/types/credential-refresh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAcxB,eAAO,MAAM,+BAA+B;;;;EAAkD,CAAC;AAC/F,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAGrF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAwC3C,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAEvF,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;iBAajD,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AASnG,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2BhD,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAGjG,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;iBAElD,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAChD,OAAO,uCAAuC,CACjD,CAAC;AAEF,eAAO,MAAM,2CAA2C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqBtD,CAAC;AACH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CACpD,OAAO,2CAA2C,CACrD,CAAC;AAEF,eAAO,MAAM,2CAA2C;;;;EAOtD,CAAC;AACH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CACpD,OAAO,2CAA2C,CACrD,CAAC;AAEF,eAAO,MAAM,2CAA2C;;;;;;;;;iBAKtD,CAAC;AACH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CACpD,OAAO,2CAA2C,CACrD,CAAC"}
+{"version":3,"file":"credential-refresh.d.ts","sourceRoot":"","sources":["../../src/types/credential-refresh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAcxB,eAAO,MAAM,+BAA+B;;;;;EAK1C,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAGrF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkD3C,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAEvF,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;iBAajD,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AASnG,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6BhD,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAGjG,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAElD,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAChD,OAAO,uCAAuC,CACjD,CAAC;AAEF,eAAO,MAAM,2CAA2C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuBtD,CAAC;AACH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CACpD,OAAO,2CAA2C,CACrD,CAAC;AAEF,eAAO,MAAM,2CAA2C;;;;EAOtD,CAAC;AACH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CACpD,OAAO,2CAA2C,CACrD,CAAC;AAEF,eAAO,MAAM,2CAA2C;;;;;;;;;iBAKtD,CAAC;AACH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CACpD,OAAO,2CAA2C,CACrD,CAAC"}

package/dist/types/credential.d.ts

@@ -1,7 +1,14 @@
 import { z } from 'zod';
+import type { BitstringStatusListEntry, JWE, VC } from '@learncard/types';
+export interface IssuedCredential {
+    readonly kind: 'issued-credential';
+    readonly credential: VC | JWE;
+    readonly statusEntries: BitstringStatusListEntry[];
+}
 export declare const CredentialValidator: z.ZodObject<{
     id: z.ZodString;
     credential: z.ZodString;
+    statusEntries: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type CredentialType = z.infer<typeof CredentialValidator>;
 //# sourceMappingURL=credential.d.ts.map

package/dist/types/credential.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential.d.ts","sourceRoot":"","sources":["../../src/types/credential.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,mBAAmB;;;iBAAuD,CAAC;AACxF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}
+{"version":3,"file":"credential.d.ts","sourceRoot":"","sources":["../../src/types/credential.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,wBAAwB,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAG1E,MAAM,WAAW,gBAAgB;IAC7B,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,EAAE,GAAG,GAAG,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,wBAAwB,EAAE,CAAC;CACtD;AAED,eAAO,MAAM,mBAAmB;;;;iBAI9B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/types/did-metadata.d.ts

@@ -129,7 +129,7 @@ export declare const DidMetadataValidator: z.ZodObject<{
     }, z.core.$catchall<z.ZodAny>>>>>;
     proof: z.ZodOptional<z.ZodOptional<z.ZodUnion<[z.ZodObject<{
         type: z.ZodString;
-        created: z.ZodString;
+        created: z.ZodOptional<z.ZodString>;
         challenge: z.ZodOptional<z.ZodString>;
         domain: z.ZodOptional<z.ZodString>;
         nonce: z.ZodOptional<z.ZodString>;
@@ -138,7 +138,7 @@ export declare const DidMetadataValidator: z.ZodObject<{
         jws: z.ZodOptional<z.ZodString>;
     }, z.core.$catchall<z.ZodAny>>, z.ZodArray<z.ZodObject<{
         type: z.ZodString;
-        created: z.ZodString;
+        created: z.ZodOptional<z.ZodString>;
         challenge: z.ZodOptional<z.ZodString>;
         domain: z.ZodOptional<z.ZodString>;
         nonce: z.ZodOptional<z.ZodString>;

package/dist/types/inbox-batch.d.ts

@@ -0,0 +1,38 @@
+import type { InboxBatchStatus, IssueInboxCredentialBatch } from '@learncard/types';
+import type { Context } from '.././routes/index';
+export type BatchItem = {
+    id: string;
+    batchId: string;
+    index: number;
+    state: InboxBatchStatus['items'][number]['state'];
+    phase?: 'PREPARING' | 'ISSUING';
+    owner?: string;
+    leaseUntil?: number;
+    attempts: number;
+    result?: string;
+    replayKey: string;
+    duplicate: boolean;
+    correlation?: string;
+};
+export type InboxDispatchLease = {
+    id: string;
+    dispatchAt: number;
+};
+export type BatchJob = {
+    id: string;
+    issuer: string;
+    createdAt: number;
+    payload?: string;
+    completedAt?: number;
+};
+export type BatchJobPayload = {
+    batch: IssueInboxCredentialBatch;
+    context: Pick<Context, 'domain' | 'tenant'>;
+    scope?: string;
+};
+export type BatchReplayStore = {
+    get: (key: string) => Promise<string | null | undefined>;
+    setIfAbsent: (key: string, value: string, ttl: number) => Promise<'OK' | null | undefined>;
+    compareAndSet: (key: string, expected: string, value: string | null, ttl: number) => Promise<boolean | undefined>;
+};
+//# sourceMappingURL=inbox-batch.d.ts.map

package/dist/types/inbox-batch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inbox-batch.d.ts","sourceRoot":"","sources":["../../src/types/inbox-batch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AACpF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEvC,MAAM,MAAM,SAAS,GAAG;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC;IAClD,KAAK,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IAEnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpE,MAAM,MAAM,QAAQ,GAAG;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC1B,KAAK,EAAE,yBAAyB,CAAC;IACjC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,GAAG,QAAQ,CAAC,CAAC;IAE5C,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC3B,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IACzD,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAC3F,aAAa,EAAE,CACX,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,GAAG,EAAE,MAAM,KACV,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;CACrC,CAAC"}

package/inbox-e2e-setup.ts

@@ -1,18 +1,70 @@
 import { Neo4jContainer } from '@testcontainers/neo4j';
 import { GenericContainer } from 'testcontainers';
 import type { TestProject } from 'vitest/node';
+import { fileURLToPath } from 'node:url';
+import { SQSClient, CreateQueueCommand, GetQueueAttributesCommand } from '@aws-sdk/client-sqs';
 
 /** Random host ports and fresh containers keep these tests away from development data. */
 export default async function setup({ provide }: TestProject): Promise<() => Promise<void>> {
     const neo4j = await new Neo4jContainer('neo4j:5').start();
     try {
         const redis = await new GenericContainer('redis:7-alpine').withExposedPorts(6379).start();
+        let sqs: Awaited<ReturnType<GenericContainer['start']>> | undefined;
+        try {
+            sqs = await new GenericContainer('softwaremill/elasticmq-native:1.6.15')
+                .withCopyFilesToContainer([
+                    {
+                        source: fileURLToPath(new URL('./inbox-elasticmq.conf', import.meta.url)),
+                        target: '/opt/elasticmq.conf',
+                    },
+                ])
+                .withExposedPorts(9324)
+                .start();
+            const endpoint = `http://${sqs.getHost()}:${sqs.getMappedPort(9324)}`;
+            const client = new SQSClient({
+                endpoint,
+                region: 'us-east-1',
+                credentials: { accessKeyId: 'local', secretAccessKey: 'local' },
+            });
+            try {
+                const dlq = await client.send(
+                    new CreateQueueCommand({ QueueName: 'inbox-e2e-dlq' })
+                );
+                const dlqUrl = `${endpoint}${new URL(dlq.QueueUrl!).pathname}`;
+                const attributes = await client.send(
+                    new GetQueueAttributesCommand({
+                        QueueUrl: dlqUrl,
+                        AttributeNames: ['QueueArn'],
+                    })
+                );
+                const queue = await client.send(
+                    new CreateQueueCommand({
+                        QueueName: 'inbox-e2e',
+                        Attributes: {
+                            VisibilityTimeout: '1800',
+                            RedrivePolicy: JSON.stringify({
+                                deadLetterTargetArn: attributes.Attributes!.QueueArn,
+                                maxReceiveCount: '5',
+                            }),
+                        },
+                    })
+                );
+                provide('inbox-queue-endpoint', endpoint);
+                provide('inbox-queue-url', `${endpoint}${new URL(queue.QueueUrl!).pathname}`);
+                provide('inbox-dead-letter-url', dlqUrl);
+            } finally {
+                client.destroy();
+            }
+        } catch (error) {
+            await Promise.all([redis.stop(), sqs?.stop()]);
+            throw error;
+        }
         provide('neo4j-uri', neo4j.getBoltUri());
         provide('neo4j-password', neo4j.getPassword());
         provide('inbox-redis-host', redis.getHost());
         provide('inbox-redis-port', redis.getMappedPort(6379));
         return async () => {
-            await Promise.all([redis.stop(), neo4j.stop()]);
+            await Promise.all([redis.stop(), neo4j.stop(), sqs?.stop()]);
         };
     } catch (error) {
         await neo4j.stop();

package/inbox-elasticmq.conf

@@ -0,0 +1,10 @@
+include classpath("application.conf")
+node-address { protocol = http, host = localhost, port = 9324, context-path = "" }
+# Compose uses these queues; isolated tests create their own inbox-e2e queues dynamically.
+queues {
+  inbox-dlq { defaultVisibilityTimeout = 180 seconds }
+  inbox {
+    defaultVisibilityTimeout = 1800 seconds
+    deadLettersQueue { name = "inbox-dlq", maxReceiveCount = 5 }
+  }
+}

package/lambda.ts

@@ -25,6 +25,10 @@ import {
 import { environment } from './src/config/environment';
 import { toServerlessApplication } from './src/helpers/serverlessApplication';
 import { runInboxMaintenance } from './src/helpers/inbox-maintenance.helpers';
+import {
+    inboxBatchResponseMeta,
+    withInboxBatchBodyLimit,
+} from './src/helpers/inbox-batch-http.helpers';
 
 Sentry.AWSLambda.init({
     dsn: environment.SENTRY_DSN,
@@ -61,8 +65,9 @@ export const credentialRefreshHandler: typeof credentialRefreshProxy = async (ev
 
 export const _openApiHandler = createOpenApiAwsLambdaHandler({
     router: appRouter,
-    responseMeta: () => {
+    responseMeta: meta => {
         return {
+            ...inboxBatchResponseMeta(meta),
             headers: {
                 'Access-Control-Allow-Origin': '*',
                 'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, OPTIONS',
@@ -74,21 +79,24 @@ export const _openApiHandler = createOpenApiAwsLambdaHandler({
     onError: handleTrpcError,
 });
 
-export const _trpcHandler = awsLambdaRequestHandler({
-    allowMethodOverride: true,
-    router: appRouter,
-    createContext,
-    onError: handleTrpcError,
-    responseMeta: () => {
-        return {
-            headers: {
-                'Access-Control-Allow-Origin': '*',
-                'Access-Control-Allow-Methods': '*',
-                'Access-Control-Allow-Headers': 'authorization',
-            },
-        };
-    },
-});
+export const _trpcHandler = withInboxBatchBodyLimit(
+    awsLambdaRequestHandler({
+        allowMethodOverride: true,
+        router: appRouter,
+        createContext,
+        onError: handleTrpcError,
+        responseMeta: () => {
+            return {
+                headers: {
+                    'Access-Control-Allow-Origin': '*',
+                    'Access-Control-Allow-Methods': '*',
+                    'Access-Control-Allow-Headers': 'authorization',
+                },
+            };
+        },
+    }),
+    'trpc'
+);
 
 export const openApiHandler = Sentry.AWSLambda.wrapHandler(
     async (event: APIGatewayProxyEventV2, context: Context): Promise<APIGatewayProxyResultV2> => {
@@ -124,6 +132,43 @@ export const trpcHandler = Sentry.AWSLambda.wrapHandler(
     }
 );
 
+export const inboxQueueWorker: SQSHandler = Sentry.AWSLambda.wrapHandler(async event => {
+    const { processInboxQueueMessage } = await import('./src/helpers/inbox-queue.helpers');
+    const batchItemFailures = [];
+    for (const record of event.Records) {
+        try {
+            await processInboxQueueMessage(record.body);
+        } catch {
+            console.error('Inbox worker message failed', { messageId: record.messageId });
+            batchItemFailures.push({ itemIdentifier: record.messageId });
+        }
+    }
+    return { batchItemFailures } satisfies SQSBatchResponse;
+});
+
+export const inboxQueueDispatcher = Sentry.AWSLambda.wrapHandler(
+    async (_event: unknown, context: Context): Promise<void> => {
+        const { dispatchInboxJobs } = await import('./src/helpers/inbox-queue.helpers');
+        // Share one clock across publication and recovery, retaining five seconds for shutdown.
+        const deadline = Date.now() + Math.max(0, context.getRemainingTimeInMillis() - 5_000);
+        await dispatchInboxJobs(deadline);
+    }
+);
+
+export const inboxDeadLetterWorker: SQSHandler = Sentry.AWSLambda.wrapHandler(async event => {
+    const { processInboxDeadLetter } = await import('./src/helpers/inbox-queue.helpers');
+    const batchItemFailures = [];
+    for (const record of event.Records) {
+        try {
+            await processInboxDeadLetter(record.body);
+        } catch {
+            console.error('Inbox dead-letter processing failed', { messageId: record.messageId });
+            batchItemFailures.push({ itemIdentifier: record.messageId });
+        }
+    }
+    return { batchItemFailures } satisfies SQSBatchResponse;
+});
+
 export const notificationsWorker: SQSHandler = Sentry.AWSLambda.wrapHandler(async event => {
     const batchItemFailures = await Promise.all(
         event.Records.map(async record => {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@learncard/network-brain-service",
-    "version": "3.17.0",
+    "version": "3.19.0",
     "description": "",
     "engines": {
         "node": ">=24.12 <25"
@@ -9,6 +9,8 @@
     "main": "dist/index.js",
     "types": "dist/index.d.ts",
     "scripts": {
+        "inbox:setup-queues": "bun scripts/setup-inbox-queues.ts",
+        "inbox:worker": "bun --conditions=development src/inbox-queue-local.ts",
         "test": "vitest run --config vitest.config.ts",
         "test:watch": "vitest --config vitest.config.ts",
         "test:coverage": "vitest run --coverage --config vitest.config.ts",
@@ -59,21 +61,21 @@
         "@digitalcredentials/issuer-registry-client": "^3.2.0-beta.5",
         "@fastify/cors": "^11.2.0",
         "@google/genai": "^1.27.0",
-        "@learncard/core": "9.4.34",
-        "@learncard/crypto-plugin": "1.1.34",
-        "@learncard/did-web-plugin": "1.1.34",
-        "@learncard/didkey-plugin": "1.1.34",
-        "@learncard/didkit-plugin": "1.9.14",
-        "@learncard/didkit-plugin-node": "0.2.32",
-        "@learncard/dynamic-loader-plugin": "1.1.34",
-        "@learncard/encryption-plugin": "1.1.34",
-        "@learncard/expiration-plugin": "1.2.34",
-        "@learncard/email-templates": "1.0.6",
-        "@learncard/helpers": "1.5.0",
-        "@learncard/learn-card-plugin": "1.2.34",
-        "@learncard/types": "5.19.0",
-        "@learncard/vc-plugin": "1.6.0",
-        "@learncard/vc-templates-plugin": "1.1.34",
+        "@learncard/core": "9.4.36",
+        "@learncard/crypto-plugin": "1.1.36",
+        "@learncard/did-web-plugin": "1.1.36",
+        "@learncard/didkey-plugin": "1.1.36",
+        "@learncard/didkit-plugin": "1.10.1",
+        "@learncard/didkit-plugin-node": "0.3.1",
+        "@learncard/dynamic-loader-plugin": "1.1.36",
+        "@learncard/encryption-plugin": "1.1.36",
+        "@learncard/expiration-plugin": "1.2.36",
+        "@learncard/email-templates": "1.1.0",
+        "@learncard/helpers": "1.6.0",
+        "@learncard/learn-card-plugin": "1.2.36",
+        "@learncard/types": "5.21.0",
+        "@learncard/vc-plugin": "1.6.2",
+        "@learncard/vc-templates-plugin": "1.1.36",
         "@sentry/serverless": "7.61.0",
         "@trpc/server": "11.8.0",
         "@types/lodash": "^4.14.191",

package/scripts/setup-inbox-queues.ts

@@ -0,0 +1,60 @@
+import {
+    SQSClient,
+    CreateQueueCommand,
+    GetQueueUrlCommand,
+    GetQueueAttributesCommand,
+    SetQueueAttributesCommand,
+} from '@aws-sdk/client-sqs';
+
+const endpoint = process.env.INBOX_QUEUE_ENDPOINT ?? 'http://localhost:9324';
+const client = new SQSClient({
+    region: process.env.AWS_REGION ?? 'us-east-1',
+    endpoint,
+    credentials: { accessKeyId: 'local', secretAccessKey: 'local' },
+});
+
+const ensureQueue = async (name: string): Promise<string> => {
+    let url: string | undefined;
+    try {
+        url = (await client.send(new GetQueueUrlCommand({ QueueName: name }))).QueueUrl;
+    } catch (error) {
+        if (
+            !(error instanceof Error) ||
+            !['QueueDoesNotExist', 'AWS.SimpleQueueService.NonExistentQueue'].includes(error.name)
+        )
+            throw error;
+        url = (await client.send(new CreateQueueCommand({ QueueName: name }))).QueueUrl;
+    }
+    if (!url) throw new Error(`Missing URL for ${name}`);
+    // ElasticMQ may advertise its container hostname; use the caller's reachable endpoint.
+    return `${endpoint.replace(/\/$/, '')}${new URL(url).pathname}`;
+};
+
+try {
+    const dlqUrl = await ensureQueue('inbox-dlq');
+    const attributes = await client.send(
+        new GetQueueAttributesCommand({
+            QueueUrl: dlqUrl,
+            AttributeNames: ['QueueArn'],
+        })
+    );
+    if (!attributes.Attributes?.QueueArn)
+        throw new Error('Inbox dead-letter queue ARN is missing.');
+    const queueUrl = await ensureQueue('inbox');
+    await client.send(
+        new SetQueueAttributesCommand({
+            QueueUrl: queueUrl,
+            Attributes: {
+                VisibilityTimeout: '1800',
+                RedrivePolicy: JSON.stringify({
+                    deadLetterTargetArn: attributes.Attributes.QueueArn,
+                    maxReceiveCount: '5',
+                }),
+            },
+        })
+    );
+    console.log(`INBOX_QUEUE_URL=${queueUrl}`);
+    console.log(`INBOX_DEAD_LETTER_QUEUE_URL=${dlqUrl}`);
+} finally {
+    client.destroy();
+}

package/serverless-local.yml

@@ -47,6 +47,8 @@ provider:
     stage: ${opt:stage, "dev"}
     region: ${opt:region, "us-east-1"}
     environment:
+        INBOX_QUEUE_URL: ${env:INBOX_QUEUE_URL, ''}
+        INBOX_QUEUE_ENDPOINT: ${env:INBOX_QUEUE_ENDPOINT, ''}
         PORT: ${env:PORT, 3000}
         LAMBDA_STAGE: ${opt:stage, "dev"}
         SEED: ${env:SEED}

package/serverless.yml

@@ -15,6 +15,20 @@ plugins:
     - serverless-prune-plugin
 
 constructs:
+    inbox-queue:
+        type: queue
+        batchSize: 1
+        maxConcurrency: 10
+        maxRetries: 5
+        worker:
+            handler: lambda.inboxQueueWorker
+            timeout: 300
+            reservedConcurrency: 10
+            vpc:
+                securityGroupIds:
+                    - 'Fn::GetAtt': [ServerlessSecurityGroup, GroupId]
+                subnetIds:
+                    - Ref: PrivateSubnetA
     notifications-queue:
         type: queue
         worker:
@@ -128,6 +142,7 @@ provider:
         PORT: ${env:PORT, 3000}
         INBOX_DELETE_EXPIRED_RECORDS: ${env:INBOX_DELETE_EXPIRED_RECORDS, "false"}
         LAMBDA_STAGE: ${opt:stage, "dev"}
+        INBOX_BATCH_ITEMS_PER_HOUR: ${env:INBOX_BATCH_ITEMS_PER_HOUR, '10000'}
         SEED: ${env:SEED}
         DOMAIN_NAME: ${env:DOMAIN_NAME}
         CLIENT_APP_DOMAIN_NAME: ${env:CLIENT_APP_DOMAIN_NAME}
@@ -153,6 +168,7 @@ provider:
         REDIS_PORT:
             'Fn::GetAtt': [ElasticCacheCluster, RedisEndpoint.Port]
         NOTIFICATIONS_QUEUE_URL: ${construct:notifications-queue.queueUrl}
+        INBOX_QUEUE_URL: ${construct:inbox-queue.queueUrl}
         SKILL_EMBEDDING_GOOGLE_API_KEY: ${env:SKILL_EMBEDDING_GOOGLE_API_KEY, ""}
         SKILL_EMBEDDING_GOOGLE_MODEL: ${env:SKILL_EMBEDDING_GOOGLE_MODEL, "gemini-embedding-001"}
         SKILL_EMBEDDING_BATCH_SIZE: ${env:SKILL_EMBEDDING_BATCH_SIZE, "25"}
@@ -190,6 +206,31 @@ provider:
                 - ETag
 
 functions:
+    inboxDeadLetterWorker:
+        handler: lambda.inboxDeadLetterWorker
+        timeout: 30
+        reservedConcurrency: 2
+        vpc:
+            securityGroupIds:
+                - 'Fn::GetAtt': [ServerlessSecurityGroup, GroupId]
+            subnetIds:
+                - Ref: PrivateSubnetA
+        events:
+            - sqs:
+                  arn: ${construct:inbox-queue.dlqArn}
+                  batchSize: 1
+                  functionResponseType: ReportBatchItemFailures
+    inboxQueueDispatcher:
+        handler: lambda.inboxQueueDispatcher
+        timeout: 60
+        reservedConcurrency: 1
+        vpc:
+            securityGroupIds:
+                - 'Fn::GetAtt': [ServerlessSecurityGroup, GroupId]
+            subnetIds:
+                - Ref: PrivateSubnetA
+        events:
+            - schedule: rate(1 minute)
     inboxMaintenance:
         handler: lambda.inboxMaintenanceHandler
         timeout: 300
@@ -288,6 +329,40 @@ functions:
 
 resources:
     Resources:
+        InboxQueueAgeAlarm:
+            Type: AWS::CloudWatch::Alarm
+            Properties:
+                AlarmDescription: Inbox issuance has waited over five minutes
+                Namespace: AWS/SQS
+                MetricName: ApproximateAgeOfOldestMessage
+                Dimensions:
+                    - Name: QueueName
+                      Value:
+                          Fn::Select:
+                              - 4
+                              - Fn::Split: ['/', '${construct:inbox-queue.queueUrl}']
+                Statistic: Maximum
+                Period: 60
+                EvaluationPeriods: 2
+                Threshold: 300
+                ComparisonOperator: GreaterThanThreshold
+                TreatMissingData: notBreaching
+        InboxDispatcherErrorsAlarm:
+            Type: AWS::CloudWatch::Alarm
+            Properties:
+                AlarmDescription: Durable inbox dispatch or recovery failed in three of five minutes
+                Namespace: AWS/Lambda
+                MetricName: Errors
+                Dimensions:
+                    - Name: FunctionName
+                      Value: { Ref: InboxQueueDispatcherLambdaFunction }
+                Statistic: Sum
+                Period: 60
+                EvaluationPeriods: 5
+                DatapointsToAlarm: 3
+                Threshold: 0
+                ComparisonOperator: GreaterThanThreshold
+                TreatMissingData: notBreaching
         VPC:
             Type: AWS::EC2::VPC
             Properties:

package/src/accesslayer/app-store-listing/relationships/read.ts

@@ -192,11 +192,12 @@ export const getCredentialsSentByListingToProfile = async (
             const isReceived = record.get('isReceived');
             const sentStatus = record.get('sentStatus');
             const receivedStatus = record.get('receivedStatus');
-            const rawStatus = sentStatus ?? receivedStatus;
             let status: 'pending' | 'claimed' | 'revoked' | 'suspended' = 'pending';
 
-            if (rawStatus === 'revoked' || rawStatus === 'suspended') {
-                status = rawStatus;
+            if (sentStatus === 'revoked' || receivedStatus === 'revoked') {
+                status = 'revoked';
+            } else if (sentStatus === 'suspended' || receivedStatus === 'suspended') {
+                status = 'suspended';
             } else if (isReceived) {
                 status = 'claimed';
             }

package/src/accesslayer/auth-grant/read.ts

@@ -98,7 +98,7 @@ export const isAuthGrantAssociatedWithProfile = async (
 export const isAuthGrantChallengeValidForDID = async (
     challenge: string,
     did: string
-): Promise<{ isChallengeValid: boolean; scope: string }> => {
+): Promise<{ isChallengeValid: boolean; scope: string; actAs?: string }> => {
     // TODO: Ideally, this transformation isn't required and we could use DID directly.
     const profileId = getProfileIdFromDid(did);
     if (!profileId) return { isChallengeValid: false, scope: AUTH_GRANT_NO_ACCESS_SCOPE };
@@ -126,5 +126,6 @@ export const isAuthGrantChallengeValidForDID = async (
     return {
         isChallengeValid: result.records.length > 0,
         scope: authGrant?.scope || AUTH_GRANT_NO_ACCESS_SCOPE,
+        actAs: authGrant?.actAs,
     };
 };

package/src/accesslayer/consentflowcontract/relationships/create.ts

@@ -1,6 +1,7 @@
 import {
     ConsentFlowTerms as ConsentFlowTermsType,
     ConsentFlowTransaction,
+    ConsentFlowGuardianApproval,
     LCNNotificationTypeEnumValidator,
     LCNProfile,
     UnsignedVC,
@@ -76,11 +77,13 @@ export const consentToContract = async (
         terms: _terms,
         expiresAt,
         oneTime,
+        guardianApproval,
     }: {
         terms: ConsentFlowTermsType;
         expiresAt?: string;
         liveSyncing?: boolean;
         oneTime?: boolean;
+        guardianApproval?: ConsentFlowGuardianApproval;
     },
     domain: string
 ) => {
@@ -122,7 +125,7 @@ export const consentToContract = async (
     if (existing.length > 0) {
         return reconsentTerms(
             { terms: inflateObject(existing[0]!.terms), consenter, contract, contractOwner },
-            { terms, expiresAt, oneTime },
+            { terms, expiresAt, oneTime, guardianApproval },
             domain
         );
     }
@@ -137,7 +140,11 @@ export const consentToContract = async (
 
     const termsId = uuid();
 
-    const result = await new QueryBuilder(new BindParam({ params: flattenObject({ terms }) }))
+    const result = await new QueryBuilder(
+        new BindParam({
+            params: flattenObject({ terms, ...(guardianApproval ? { guardianApproval } : {}) }),
+        })
+    )
         .match({
             multiple: [
                 {
@@ -157,8 +164,8 @@ export const consentToContract = async (
                     properties: {
                         id: termsId,
                         status: oneTime ? 'stale' : 'live',
-                        createdAt: new Date().toISOString(),
-                        updatedAt: new Date().toISOString(),
+                        createdAt: transaction.date,
+                        updatedAt: transaction.date,
                         ...(expiresAt ? { expiresAt } : {}),
                         ...(oneTime ? { oneTime } : {}),
                     },
@@ -259,7 +266,10 @@ export const consentToContract = async (
                         boostCredential,
                         contractOwnerSigningAuthority,
                         domain,
-                        false
+                        true,
+                        undefined,
+                        true,
+                        [getDidWeb(domain, contractOwner.profileId)]
                     );
 
                     const boostTransaction = {