@learncard/network-brain-service 3.17.0 → 3.19.0

package/src/helpers/refresh-send-intent.helpers.ts

@@ -0,0 +1,273 @@
+import { createHash, randomUUID } from 'crypto';
+import { TRPCError } from '@trpc/server';
+import type { ManagedCredentialRefreshReceipt, SendBoostResponse } from '@learncard/types';
+import { canonicalizeCredentialJson } from '@learncard/helpers';
+
+import { neogma } from '@instance';
+
+import { getInitialRefreshRoot, getManagedCredentialUri } from './credential-refresh.helpers';
+
+/** A preparation not touched for this long is considered abandoned and may be taken over. */
+export const REFRESH_SEND_INTENT_STALE_MS = 5 * 60_000;
+
+export type RefreshSendIntentState = 'preparing' | 'prepared' | 'delivered';
+
+/**
+ * Whole-call idempotency record for a managed refresh send (LC-2198 follow-up).
+ * Metadata only: never stores credential claims, subject bodies, plaintext VCs or JWEs.
+ */
+export type RefreshSendIntent = {
+    intentKey: string;
+    issuerProfileId: string;
+    requestDigest: string;
+    state: RefreshSendIntentState;
+    claimToken: string;
+    boostUri?: string;
+    credentialId?: string;
+    refreshId?: string;
+    holderDid?: string;
+    pendingReceipt?: ManagedCredentialRefreshReceipt;
+    pendingActivityId?: string;
+    result?: SendBoostResponse;
+    updatedAt: string;
+};
+
+export type ClaimRefreshSendIntentResult =
+    | { kind: 'owned'; intent: RefreshSendIntent }
+    | { kind: 'prepared'; intent: RefreshSendIntent }
+    | { kind: 'delivered'; intent: RefreshSendIntent };
+
+const getIntentKey = (issuerProfileId: string, idempotencyKey: string): string =>
+    `${issuerProfileId}:${idempotencyKey}`;
+
+/** Digest of everything that defines a prepare request; a reused key must match it. */
+export const computeRefreshSendRequestDigest = (request: {
+    recipientProfileId: string;
+    holderDid: string;
+    templateUri?: string;
+    template?: unknown;
+    contractUri?: string;
+    templateData?: Record<string, unknown>;
+    integrationId?: string;
+    credentialId?: string;
+}): string =>
+    createHash('sha256')
+        .update(
+            canonicalizeCredentialJson({
+                recipientProfileId: request.recipientProfileId,
+                holderDid: request.holderDid,
+                templateUri: request.templateUri ?? null,
+                template: request.template ?? null,
+                contractUri: request.contractUri ?? null,
+                templateData: request.templateData ?? {},
+                integrationId: request.integrationId ?? null,
+                credentialId: request.credentialId ?? null,
+            })
+        )
+        .digest('base64url');
+
+const parseIntent = (props: Record<string, unknown>): RefreshSendIntent => ({
+    intentKey: props.intentKey as string,
+    issuerProfileId: props.issuerProfileId as string,
+    requestDigest: props.requestDigest as string,
+    state: props.state as RefreshSendIntentState,
+    claimToken: props.claimToken as string,
+    boostUri: (props.boostUri as string | undefined) ?? undefined,
+    credentialId: (props.credentialId as string | undefined) ?? undefined,
+    refreshId: (props.refreshId as string | undefined) ?? undefined,
+    holderDid: (props.holderDid as string | undefined) ?? undefined,
+    pendingReceipt: props.pendingReceipt
+        ? (JSON.parse(props.pendingReceipt as string) as ManagedCredentialRefreshReceipt)
+        : undefined,
+    pendingActivityId: (props.pendingActivityId as string | undefined) ?? undefined,
+    result: props.result ? (JSON.parse(props.result as string) as SendBoostResponse) : undefined,
+    updatedAt: props.updatedAt as string,
+});
+
+export const getRefreshSendIntent = async (
+    issuerProfileId: string,
+    idempotencyKey: string
+): Promise<RefreshSendIntent | null> => {
+    const result = await neogma.queryRunner.run(
+        'MATCH (i:RefreshSendIntent {intentKey: $intentKey}) RETURN i',
+        { intentKey: getIntentKey(issuerProfileId, idempotencyKey) }
+    );
+    const node = result.records[0]?.get('i');
+
+    return node ? parseIntent(node.properties) : null;
+};
+
+/**
+ * Creates or claims the intent for (issuer, idempotencyKey). Concurrency-safe through
+ * the `refresh_send_intent_key_unique` constraint. Throws CONFLICT when the key was used
+ * for a different request, or when another live request is still preparing it.
+ */
+export const claimRefreshSendIntent = async (params: {
+    issuerProfileId: string;
+    idempotencyKey: string;
+    requestDigest: string;
+}): Promise<ClaimRefreshSendIntentResult> => {
+    const { issuerProfileId, idempotencyKey, requestDigest } = params;
+    const claimToken = randomUUID();
+    const now = new Date();
+
+    const result = await neogma.queryRunner.run(
+        `MERGE (i:RefreshSendIntent {intentKey: $intentKey})
+         ON CREATE SET i.issuerProfileId = $issuerProfileId,
+                       i.requestDigest = $requestDigest,
+                       i.state = 'preparing',
+                       i.claimToken = $claimToken,
+                       i.createdAt = $now,
+                       i.updatedAt = $now
+         SET i.updatedAt = i.updatedAt
+         WITH i
+         CALL {
+             WITH i
+             WITH i WHERE i.state = 'preparing'
+                      AND i.claimToken <> $claimToken
+                      AND i.requestDigest = $requestDigest
+                      AND i.updatedAt < $staleBefore
+             SET i.claimToken = $claimToken, i.updatedAt = $now
+         }
+         RETURN i`,
+        {
+            intentKey: getIntentKey(issuerProfileId, idempotencyKey),
+            issuerProfileId,
+            requestDigest,
+            claimToken,
+            now: now.toISOString(),
+            staleBefore: new Date(now.getTime() - REFRESH_SEND_INTENT_STALE_MS).toISOString(),
+        }
+    );
+    const intent = parseIntent(result.records[0]!.get('i').properties);
+
+    if (intent.requestDigest !== requestDigest) {
+        throw new TRPCError({
+            code: 'CONFLICT',
+            message: 'This idempotencyKey was already used for a different send request.',
+        });
+    }
+
+    if (intent.state === 'delivered') return { kind: 'delivered', intent };
+    if (intent.state === 'prepared') return { kind: 'prepared', intent };
+    if (intent.claimToken === claimToken) return { kind: 'owned', intent };
+
+    throw new TRPCError({
+        code: 'CONFLICT',
+        message: 'A send with this idempotencyKey is still being prepared. Retry shortly.',
+    });
+};
+
+const lostIntentClaim = (): TRPCError =>
+    new TRPCError({
+        code: 'CONFLICT',
+        message:
+            'This send preparation was taken over or completed. Retry with the same idempotencyKey.',
+    });
+
+/**
+ * Records progress on an intent owned by `claimToken` (boost first, then allocation).
+ * The self-dependent SET takes the node write lock before checking ownership, so
+ * a concurrent takeover cannot pass a stale check and overwrite the new owner.
+ */
+export const recordRefreshSendIntent = async (
+    intent: RefreshSendIntent,
+    fields: Partial<
+        Pick<RefreshSendIntent, 'boostUri' | 'credentialId' | 'refreshId' | 'holderDid'>
+    > & { state?: 'prepared' }
+): Promise<RefreshSendIntent> => {
+    const result = await neogma.queryRunner.run(
+        `MATCH (i:RefreshSendIntent {intentKey: $intentKey})
+         SET i.updatedAt = i.updatedAt
+         WITH i WHERE i.claimToken = $claimToken AND i.state = 'preparing'
+         SET i += $fields, i.updatedAt = $now
+         RETURN i`,
+        {
+            intentKey: intent.intentKey,
+            claimToken: intent.claimToken,
+            fields: Object.fromEntries(
+                Object.entries(fields).filter(([, value]) => value !== undefined)
+            ),
+            now: new Date().toISOString(),
+        }
+    );
+
+    if (!result.records.length) throw lostIntentClaim();
+    return parseIntent(result.records[0]!.get('i').properties);
+};
+
+/** Stores the metadata-only receipt (and activity) right before delivery is attempted. */
+export const recordRefreshSendIntentPending = async (
+    intent: RefreshSendIntent,
+    pendingReceipt: ManagedCredentialRefreshReceipt,
+    pendingActivityId?: string
+): Promise<void> => {
+    const updated = await neogma.queryRunner.run(
+        `MATCH (i:RefreshSendIntent {intentKey: $intentKey})
+         SET i.updatedAt = i.updatedAt
+         WITH i WHERE i.claimToken = $claimToken AND i.state = 'prepared'
+         SET i.pendingReceipt = $pendingReceipt,
+             i.pendingActivityId = coalesce($pendingActivityId, i.pendingActivityId),
+             i.updatedAt = $now
+         RETURN i`,
+        {
+            intentKey: intent.intentKey,
+            claimToken: intent.claimToken,
+            pendingReceipt: JSON.stringify(pendingReceipt),
+            pendingActivityId: pendingActivityId ?? null,
+            now: new Date().toISOString(),
+        }
+    );
+    if (!updated.records.length) throw lostIntentClaim();
+};
+
+export const markRefreshSendIntentDelivered = async (
+    intent: RefreshSendIntent,
+    result: SendBoostResponse
+): Promise<void> => {
+    const updated = await neogma.queryRunner.run(
+        `MATCH (i:RefreshSendIntent {intentKey: $intentKey})
+         SET i.updatedAt = i.updatedAt
+         WITH i WHERE i.claimToken = $claimToken
+                      AND (i.state = 'prepared' OR (i.state = 'delivered' AND i.result = $result))
+         SET i.state = 'delivered', i.result = $result, i.updatedAt = $now
+         RETURN i`,
+        {
+            intentKey: intent.intentKey,
+            claimToken: intent.claimToken,
+            // The atomic replay comparison must ignore object property insertion order.
+            result: canonicalizeCredentialJson(result),
+            now: new Date().toISOString(),
+        }
+    );
+    if (!updated.records.length) throw lostIntentClaim();
+};
+
+/**
+ * When an intent's refresh is already bound (delivery succeeded but the result was never
+ * recorded), rebuild the result from the pending receipt and mark it delivered. Returns
+ * null when nothing is bound yet.
+ */
+export const reconcileBoundRefreshSendIntent = async (
+    intent: RefreshSendIntent,
+    domain: string
+): Promise<SendBoostResponse | null> => {
+    if (intent.result) return intent.result;
+    if (!intent.refreshId || !intent.boostUri || !intent.pendingReceipt) return null;
+
+    const root = await getInitialRefreshRoot(intent.refreshId);
+
+    if (!root) return null;
+
+    const result: SendBoostResponse = {
+        type: 'boost',
+        uri: intent.boostUri,
+        credentialUri: getManagedCredentialUri(root.rootId, domain),
+        activityId: intent.pendingActivityId ?? '',
+        refresh: intent.pendingReceipt,
+    };
+
+    await markRefreshSendIntentDelivered(intent, result);
+
+    return result;
+};

package/src/helpers/shim.ts

@@ -5,6 +5,7 @@ import {
     type Context as AWSContext,
 } from 'aws-lambda';
 import { TRPCError } from '@trpc/server';
+import { withInboxBatchBodyLimit } from './inbox-batch-http.helpers';
 import { type IncomingMessage, type ServerResponse } from 'http';
 
 import { OpenApiRouter } from 'trpc-to-openapi';
@@ -183,36 +184,36 @@ export const createOpenApiAwsLambdaHandler = <TRouter extends OpenApiRouter>(
         maxBodySize: undefined, // AWS Lambda handles body size limits
     });
 
-    return async (
-        event: AWSAPIGatewayEvent,
-        _context: AWSContext
-    ): Promise<APIGatewayProxyResult> => {
-        try {
-            const req = createRequestFromEvent(event);
-            const { res, promise } = createResponseHandler();
-
-            // Execute the handler
-            await openApiHttpHandler(req, res);
-
-            return await promise;
-        } catch (cause) {
-            // Handle any uncaught errors
-            const error = cause instanceof Error ? cause : new Error('Unknown error');
-            const statusCode =
-                error instanceof TRPCError ? (error.code === 'NOT_FOUND' ? 404 : 500) : 500;
-
-            return {
-                statusCode,
-                headers: {
-                    'Content-Type': 'application/json',
-                },
-                body: JSON.stringify({
-                    error: {
-                        message: error.message || 'Internal server error',
-                        code: error instanceof TRPCError ? error.code : 'INTERNAL_SERVER_ERROR',
+    return withInboxBatchBodyLimit(
+        async (event: AWSAPIGatewayEvent, _context: AWSContext): Promise<APIGatewayProxyResult> => {
+            try {
+                const req = createRequestFromEvent(event);
+                const { res, promise } = createResponseHandler();
+
+                // Execute the handler
+                await openApiHttpHandler(req, res);
+
+                return await promise;
+            } catch (cause) {
+                // Handle any uncaught errors
+                const error = cause instanceof Error ? cause : new Error('Unknown error');
+                const statusCode =
+                    error instanceof TRPCError ? (error.code === 'NOT_FOUND' ? 404 : 500) : 500;
+
+                return {
+                    statusCode,
+                    headers: {
+                        'Content-Type': 'application/json',
                     },
-                }),
-            } satisfies APIGatewayProxyResult;
-        }
-    };
+                    body: JSON.stringify({
+                        error: {
+                            message: error.message || 'Internal server error',
+                            code: error instanceof TRPCError ? error.code : 'INTERNAL_SERVER_ERROR',
+                        },
+                    }),
+                } satisfies APIGatewayProxyResult;
+            }
+        },
+        'openapi'
+    );
 };

package/src/helpers/signingAuthority.helpers.test.ts

@@ -0,0 +1,198 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import type { JWE, UnsignedVC } from '@learncard/types';
+import type { CredentialIssuer } from '../types/issuer';
+import type { SigningAuthorityForUserType } from '../types/profile';
+
+const mocks = vi.hoisted(() => ({
+    fetch: vi.fn(),
+    append: vi.fn(async credential => credential),
+    auth: vi.fn(async () => 'jwt'),
+    environment: { NODE_ENV: 'production' },
+}));
+vi.mock('@environment', () => ({ environment: mocks.environment }));
+vi.mock('@helpers/did.helpers', () => ({
+    getDidWeb: (domain: string, profileId: string) => `did:web:${domain}:users:${profileId}`,
+}));
+vi.mock('undici', () => ({ Agent: class {}, fetch: mocks.fetch }));
+vi.mock('@helpers/learnCard.helpers', () => ({
+    getDidWebLearnCard: async () => ({
+        id: { did: () => 'did:example:brain' },
+        invoke: { getDidAuthVp: mocks.auth },
+    }),
+    getLearnCard: vi.fn(),
+}));
+vi.mock('./status-list.helpers', () => ({ appendBitstringStatusListEntries: mocks.append }));
+vi.mock('@tracing', () => ({
+    trace: async (_kind: string, _name: string, action: () => unknown) => action(),
+    traceCrypto: async (_name: string, action: () => unknown) => action(),
+    traceHttp: async (_name: string, action: () => unknown) => action(),
+}));
+
+import { issueCredentialWithSigningAuthority } from './signingAuthority.helpers';
+
+const issuer = { type: 'profile', profile: { profileId: 'org' } } as unknown as CredentialIssuer;
+const sa = {
+    signingAuthority: { endpoint: 'https://sa.example' },
+    relationship: { name: 'sa', did: 'did:example:sa' },
+} as unknown as SigningAuthorityForUserType;
+const credential = {
+    '@context': ['https://www.w3.org/2018/credentials/v1'],
+    type: ['VerifiableCredential'],
+    issuer: 'did:example:sa',
+    issuanceDate: '2026-01-01T00:00:00Z',
+    credentialSubject: { id: 'did:example:student' },
+} as UnsignedVC;
+const jwe: JWE = {
+    protected: 'header',
+    iv: 'iv',
+    ciphertext: 'ciphertext',
+    tag: 'tag',
+    recipients: [],
+};
+
+describe('SA encryption boundary', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+    });
+
+    it.each([
+        { credentialSubject: {} },
+        { credentialSubject: [] },
+        { credentialSubject: [{ id: 'did:example:student' }, {}] },
+    ])(
+        'rejects missing subject IDs before allocating status or authenticating (%j)',
+        async ({ credentialSubject }) => {
+            await expect(
+                issueCredentialWithSigningAuthority(
+                    issuer,
+                    { ...credential, credentialSubject },
+                    sa,
+                    'network.example'
+                )
+            ).rejects.toMatchObject({ kind: 'validation_error', retryable: false });
+            expect(mocks.append).not.toHaveBeenCalled();
+            expect(mocks.auth).not.toHaveBeenCalled();
+            expect(mocks.fetch).not.toHaveBeenCalled();
+        }
+    );
+
+    it('includes every subject and the delegated contract owner without changing SA ownership', async () => {
+        mocks.fetch.mockResolvedValue({ ok: true, status: 200, json: async () => jwe });
+        await issueCredentialWithSigningAuthority(
+            issuer,
+            {
+                ...credential,
+                credentialSubject: [
+                    { id: 'did:example:student' },
+                    { id: 'did:example:second-student' },
+                    { id: 'did:example:student' },
+                ],
+            },
+            sa,
+            'network.example',
+            true,
+            undefined,
+            true,
+            ['did:example:contract-owner', 'did:web:network.example:users:org']
+        );
+        const body = JSON.parse(mocks.fetch.mock.calls[0]![1].body);
+        expect(body.signingAuthority.ownerDid).toBe('did:web:network.example:users:org');
+        expect(body.encryption.recipients).toEqual([
+            'did:example:student',
+            'did:example:second-student',
+            'did:web:network.example:users:org',
+            'did:example:contract-owner',
+        ]);
+    });
+
+    it.each([undefined, 'did:example:app-owner'])(
+        'encrypts only for the subject and owner (%s)',
+        async override => {
+            mocks.fetch.mockResolvedValue({ ok: true, status: 200, json: async () => jwe });
+            await issueCredentialWithSigningAuthority(
+                issuer,
+                credential,
+                sa,
+                'network.example',
+                true,
+                override
+            );
+            const body = JSON.parse(mocks.fetch.mock.calls[0]![1].body);
+            expect(body.encryption.recipients).toEqual([
+                'did:example:student',
+                override ?? 'did:web:network.example:users:org',
+            ]);
+        }
+    );
+
+    it('allows subject-less plaintext inbox issuance without encryption recipients', async () => {
+        mocks.fetch.mockResolvedValue({
+            ok: true,
+            status: 200,
+            json: async () => ({
+                ...credential,
+                proof: {
+                    type: 'Ed25519Signature2020',
+                    created: '2026-01-01T00:00:00Z',
+                    proofPurpose: 'assertionMethod',
+                    verificationMethod: 'did:example:sa#key',
+                },
+            }),
+        });
+        await issueCredentialWithSigningAuthority(
+            issuer,
+            { ...credential, credentialSubject: {} },
+            sa,
+            'network.example',
+            false
+        );
+        expect(JSON.parse(mocks.fetch.mock.calls[0]![1].body).encryption).toBeUndefined();
+    });
+
+    it('does not retry permanent recipient errors', async () => {
+        mocks.fetch.mockResolvedValue({
+            ok: false,
+            status: 400,
+            statusText: 'Bad Request',
+            text: async () => 'Recipient has no usable key',
+        });
+        await expect(
+            issueCredentialWithSigningAuthority(issuer, credential, sa, 'network.example')
+        ).rejects.toMatchObject({ status: 400, retryable: false, kind: 'http_4xx' });
+        expect(mocks.fetch).toHaveBeenCalledTimes(1);
+    });
+
+    it('keeps retry status metadata bound to the serialized request body', async () => {
+        const status = {
+            type: 'BitstringStatusListEntry' as const,
+            statusPurpose: 'revocation' as const,
+            statusListIndex: '42',
+            statusListCredential: 'https://network.example/status/1',
+        };
+        const unsigned = { ...credential, credentialStatus: status };
+        mocks.fetch
+            .mockImplementationOnce(async () => {
+                status.statusListIndex = '99';
+                return {
+                    ok: false,
+                    status: 503,
+                    statusText: 'Unavailable',
+                    text: async () => 'retry',
+                };
+            })
+            .mockResolvedValueOnce({ ok: true, status: 200, json: async () => jwe });
+        const issued = await issueCredentialWithSigningAuthority(
+            issuer,
+            unsigned,
+            sa,
+            'network.example'
+        );
+        expect(mocks.append).toHaveBeenCalledTimes(1);
+        expect(mocks.fetch).toHaveBeenCalledTimes(2);
+        const bodies = mocks.fetch.mock.calls.map(call => JSON.parse(call[1].body));
+        expect(bodies[0].credential).toEqual(bodies[1].credential);
+        expect(issued.statusEntries).toEqual([bodies[1].credential.credentialStatus]);
+        expect(issued.statusEntries[0]?.statusListIndex).toBe('42');
+        expect(JSON.parse(JSON.stringify(issued)).credential).toEqual(jwe);
+    });
+});

package/src/helpers/signingAuthority.helpers.ts

@@ -11,6 +11,8 @@ import { trace, traceCrypto, traceHttp } from '@tracing';
 import { PerfTracker } from '@helpers/perf';
 import { benchContextStorage } from '@helpers/bench-context.helpers';
 import { appendBitstringStatusListEntries } from './status-list.helpers';
+import { getBitstringStatusListEntries } from '@learncard/helpers';
+import type { IssuedCredential } from '../types/credential';
 
 const IS_TEST_ENVIRONMENT = environment.NODE_ENV === 'test';
 
@@ -127,17 +129,35 @@ export async function issueCredentialWithSigningAuthority(
     // credential. Allocating fresh Bitstring status entries per version would leak
     // writes and replace the descriptor the issuer supplied, so refresh publication
     // opts out. Defaults to true so every existing caller is preserved.
-    appendCredentialStatus = true
-): Promise<VC | JWE> {
+    appendCredentialStatus = true,
+    // Additional authorized readers (e.g. a contract owner delegating issuance).
+    additionalEncryptionRecipients: string[] = []
+): Promise<IssuedCredential> {
     const issuerEndpoint = `${signingAuthorityForUser.signingAuthority.endpoint}/credentials/issue`;
     const saName = signingAuthorityForUser.relationship.name;
     const saDid = signingAuthorityForUser.relationship.did;
     const ownerProfile = getIssuerOwnerProfile(issuer);
     const ownerDid =
         ownerDidOverride ?? getDidWeb(domain ?? 'network.learncard.com', ownerProfile.profileId);
+    const subjects = Array.isArray(credential.credentialSubject)
+        ? credential.credentialSubject
+        : [credential.credentialSubject];
+    const subjectIds = subjects.map(subject => subject?.id);
+    if (encrypt && (!subjectIds.length || subjectIds.some(id => !id))) {
+        throw new SaIssueError({
+            message: 'Encrypted credential issuance requires a DID for every subject',
+            status: 400,
+            kind: 'validation_error',
+            retryable: false,
+        });
+    }
     const credentialToIssue = appendCredentialStatus
         ? await appendBitstringStatusListEntries(credential, ownerProfile.profileId, domain)
         : credential;
+    // Capture the exact unsigned body once. Retries reuse both this body and its
+    // status coordinates, even if the caller later mutates its input object.
+    const serializedCredential = JSON.stringify(credentialToIssue);
+    const statusEntries = getBitstringStatusListEntries(JSON.parse(serializedCredential));
 
     const logContext = {
         issuer: getIssuerProfileId(issuer),
@@ -148,7 +168,7 @@ export async function issueCredentialWithSigningAuthority(
         encrypt,
     };
 
-    return trace(
+    const issuedCredential = await trace(
         'signing-authority',
         'issueCredentialWithSigningAuthority',
         async () => {
@@ -156,7 +176,9 @@ export async function issueCredentialWithSigningAuthority(
 
             try {
                 if (IS_TEST_ENVIRONMENT) {
-                    return await _mockIssueCredentialWithSigningAuthority(credentialToIssue);
+                    return await _mockIssueCredentialWithSigningAuthority(
+                        JSON.parse(serializedCredential)
+                    );
                 }
 
                 console.log('[SA Helper] Initiating credential issuance', logContext);
@@ -166,8 +188,18 @@ export async function issueCredentialWithSigningAuthority(
                 );
                 perf.mark('initDid');
 
-                const brainDid = learnCard.id.did();
-                console.log('[SA Helper] Brain DID resolved:', brainDid);
+                // Brain authenticates the request but must not be able to decrypt the response.
+                const encryption = encrypt
+                    ? {
+                          recipients: [
+                              ...new Set([
+                                  ...subjectIds,
+                                  ownerDid,
+                                  ...additionalEncryptionRecipients,
+                              ]),
+                          ],
+                      }
+                    : undefined;
 
                 const didJwt = await traceCrypto('getDidAuthVp', () =>
                     learnCard.invoke.getDidAuthVp({ proofFormat: 'jwt' })
@@ -178,24 +210,14 @@ export async function issueCredentialWithSigningAuthority(
                     console.error('[SA Helper] Failed to generate DID Auth VP - got falsy value');
                 }
 
-                const subjectId = Array.isArray(credentialToIssue?.credentialSubject)
-                    ? credentialToIssue?.credentialSubject[0]?.id
-                    : credentialToIssue?.credentialSubject?.id;
-
-                const encryption = encrypt
-                    ? {
-                          recipients: [brainDid, ...(subjectId ? [subjectId] : [])],
-                      }
-                    : undefined;
-
                 console.log('[SA Helper] Request details:', {
-                    subjectId,
+                    subjectIds,
                     encryptionRecipients: encryption?.recipients,
                     credentialType: credentialToIssue?.type,
                 });
 
                 const requestBody = JSON.stringify({
-                    credential: credentialToIssue,
+                    credential: JSON.parse(serializedCredential),
                     signingAuthority: {
                         ownerDid,
                         name: saName,
@@ -402,4 +424,5 @@ export async function issueCredentialWithSigningAuthority(
             saEndpoint: signingAuthorityForUser.signingAuthority.endpoint,
         }
     );
+    return { kind: 'issued-credential', credential: issuedCredential, statusEntries };
 }